...Week 2: Administrative Controls SE578 – Prof. Joseph Constantini By David Truong (D00571438) 1/18/2013 Table of Contents How do Administrative Controls demonstrate “due care?” 3 How does the absence of Administrative Controls impact corporate liability? 3 How do Administrative Controls influence the choice of Technical and Physical Controls 4 How would the absence of Administrative Controls affects prigects in the IT department 4 Summary 5 Reference 6 How do Administrative Controls demonstrate "due care?" Administrative Controls are guidelines that is set up by management in order to meet the standard that shows that how he company has taken precaution to prevent malicious intent as well as prevention against malicious intent. The controls that are implemented must show a degree in which the process is common and assist in the fortifying the company’s ability to prove its willingness to take action on correcting weaknesses within the company. This idea is also known as “due care.” They must include controls that contribute to individual accountability, ability to audit, and separation of duties. Administrative Controls can be identified with two specific category: detective administrative controls and preventative administrative controls. Ultimately, the purpose of Administrative Controls is to show that the company has taken the necessary precaution, the “due care,” to protect the confidentiality, integrity and availability...
Words: 896 - Pages: 4
...A. Memo of Case Social engineering is a method of gaining access to information by deception performed against human capital. System penetrators and ‘crackers’ know that people, and their desire to be helpful, or their ability to emote, are the weakest links in any program designed to protect information systems. Attackers can trick or persuade their way into systems in any number of ways via remote and physical means, and convince users to reveal information of interest that can cause harm to an organization. A typical social engineering attack can be segmented into physical and psychological stages. The physical segment of the social engineering operation could include phone calls, or returned phone calls from employees back to the attacker (an example of reverse social engineering) that volunteer information, ‘dumpster diving’ for company specific information that can be used to simulate a rapport or relationship with the company if questioned by an employee or security, emails with surreptitious links requesting unique information such as PIN’s or user names, or physical proximity and entry by impersonating an authorized person. The psychological stage of a social engineering attack takes place after the physical foot printing of the organization by using the bona fides that were learned while gathering physical intelligence to manufacture relationships with persons or the company, or by asserting false authority by impersonating persons or departments within the company...
Words: 1868 - Pages: 8
...Categories › Uncategorized Answers.com > Wiki Answers > Categories > Uncategorized > What is the relationship between risks threats and vulnerabilities as it pertains to information system ... it 255 lab 2 solution - StudentOfFortune.com www.studentoffortune.com/question/2289555/it-255-lab-2-solution What is the relationship between risks, threats, and vulnerabilities as it pertains to information systems ... vulnerability, exploits, and the risk ... Understanding risk, threat, and vulnerability | TechRepublic www.techrepublic.com/blog/...risk-threat-and-vulnerability/1897 The three security terms “risk”, “threat”, and “vulnerability” will be defined and differentiated here: Risk. SANS Institute InfoSec Reading Room - SANS Information, … www.sans.org/.../introduction-information-system-risk-management_1204 · PDF file 4.2.3 Relating Threats to Vulnerabilities ... Once again, NIST SP 800-30 provides an excellent de finition of vulnerability as it pertains to information systems. Difference Between Threat & Vulnerability | eHow.com www.ehow.com › … › Operating Systems › Other Operating Systems A vulnerability is a weakness or flaw found in software and operating systems that threats try to exploit. Threats are malicious files or programs that attack an ... Securing Windows 2000 Server - Resources and Tools for IT ... technet.microsoft.com/en-us/library/cc751212.aspx Nov 17, 2004 · A threat is any potential...
Words: 527 - Pages: 3
...Information Security White Paper UMUC In business, an information security is a set of policies to protect the companies and small businesses infrastructure, physical and information technology assets, and to ensure that all information technology users within the domain of the companies and small businesses comply with the rules and guidelines related to the security of the information stored digitally at any network within the boundaries of authority. In short, it can protect data from the outside and even inside threat. The data and information, which the companies and small businesses have, are arguably the most important assets. They should ensure the data confidentiality, integrity, availability, non-repudiation, authentication, and authorization. Most small businesses and companies must have information security to ensure their business and information assets. Information security protects data and controls how it should be distributed within or without the businesses boundaries. This means that information should be encrypted and may have restrictions placed on its distribution to the third party. Information security should protect the data from the outside threats such as: Threats |Confidentiality |Integrity |Availability | |Denial of Service Attack |Low |Medium |High | |Power Supply Failure |Low |Low |High | |Malicious Code Infection |High |High |High | |Theft and Fraud |High |Medium |High | |Website Intrusion |High |High |High | |Unauthorized...
Words: 697 - Pages: 3
...Company Overview Quality Web Design (QWD) is a company that specializes in Websites and Web Design content for any type of business. Their mission is to help other businesses increase their revenue by providing them with top quality websites for their customers. In addition, they own over 250,000 of proprietary images, and graphical designs. These designs are customized for every industry and demographic. Their business process is quite simple. They have a server at the Company Headquarters, where they store all of their proprietary data (including images, scripts, templates, etc). They utilize a Microsoft Visual Studio Team Foundation Service (TFS) server to manage their content and the progress of the project. “Team Foundation is a set of tools and technologies that enable a team to collaborate and coordinate their efforts on building a product or completing a project. Team Foundation enhances team communication, tracks work status, supports team roles, enacts the team process, and integrates team tools.” (Microsoft.com (2011) Team Foundation Overview) In addition to the Team Foundation, they also utilize Visual Studio to code, and build the websites. These resources are accesses through different methods. Those methods include WAN connection, VPN connection through a remote office, and through the corporate office via LAN. They also have other services such as Outlook Web Access for E-mail that is accessed via the methods mentioned above. They have also created...
Words: 927 - Pages: 4
...Iris Recognition In the computer world, they say it is important to keep your eyes on the future, and in the research that follows, we're going to do just that. I am planning on exploring the ins and outs of iris recognition biometrics. Whether we like it or not, biometrics are here to stay and are becoming more and more popular as each year passes. Although the automated method of iris recognition has only existed in patent since 1994, an ophthalmologist, by the name of Frank Burch, first proposed the idea of using ones iris patterns as a method to recognize someone in 1936. It's hard to imagine that this type of biometrics recognition began almost 80 years ago. (FBI) Iris recognition is being used worldwide and is growing in popularity at an astonishing rate. Twenty-nine Canadian airports are using iris recognition for their employees and at Amsterdam's Schiphol Airport, they have fast-track lines at passport control that use iris scanning to identify flight crews and frequent travelers. You may think that airports and banks are the only type of companies that have these types of biometric security, but iris recognition is being used in more basic applications. Such as, a sugar beet factory in Wisconsin uses iris scanning to keep track of time and attendance of their employees because its more accurate than a card swipe ad less intrusive as other types of biometrics. (Iris Recognition Systems for Access Control and Identity Management Gain Popularity) We may look at iris scanning...
Words: 636 - Pages: 3
...Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Conducting a Penetration Test on an Organization This document is decided to give readers an outlook on how a penetration test can be successfully done on an organization. A methodology has been drawn out in this document to allow readers to be acquainted with the process that penetration testers go through to conduct a penetration test. Copyright SANS Institute Author Retains Full Rights AD Conducting a Penetration Test on an Organization TABLE OF CONTENTS PAGE Abstract 2 Bibliography ut ho Conclusion rr Limitation of Penetration Testing eta ins The Process and Methodology Planning and Preparation Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Information Gathering and Analysis Vulnerability Detection Penetration Attempt Analysis and Reporting Cleaning Up fu ll r igh ts. What is a Penetration Test? 2 3 3 4 6 7 9 9 10 10 11 12 14 Appendix A: Netcraft (www.netcraft.com) results on www.sans.org Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Chan Tuck Wai (twchan001) © SA Full name: Chan Tuck Wai GIAC userID: twchan001 Course: Security Essentials Version: First (Original Submission) Conference Location: Malaysia NS In sti DETAILS tu te 20 Appendix...
Words: 5729 - Pages: 23
...Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Biometric Scanning Technologies: Finger, Facial and Retinal Scanning This paper discusses several Biometric scan technologies: finger-scan, facialscan and retinal-scan. We discuss the recent history of Biometrics and how it has been influenced by such pseudo-sciences as Phrenology, the study of human skull characteristics and Anthropometry, the study of human body measurement. We discuss how finger-scan technology was influenced by French and British police advancements in the nineteenth century and still remain the most widely used Biometric technology today. Facial-scan technology is ... AD Copyright SANS Institute Author Retains Full Rights fu ll r igh ts Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 © SA NS In sti tu te 20 03 ,A ut ho rr eta ins Edmund Spinella SANS GSEC Original Submission San Francisco, CA Dec 2002 28 May 2003 Biometric Scanning Technologies: Finger, Facial and Retinal Scanning Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 © SANS Institute 2003, As part of the Information Security Reading Room. Author retains full rights. Abstract © SA NS In sti tu te 20 03 ,A ut ho rr eta ...
Words: 5748 - Pages: 23
...Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Anti-Hacking: The Protection of Computers While the term Anti-Hacking may have different meanings to different people, one thing is certain. By definition, it means , "the opposite of hacking." If hacking is defined as an attack on a computer system, then Anti-Hacking is the protection of that system. The three aspects discussed in this paper: Education of the Security Adminis trator, Securing the Environment, and How to Fight Back are just one combined definition of how to protect a system. Copyright SANS Institute Author Retains Full Rights AD © SANS Institute 2003, Author retains full rights Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 © SANS Institute 2003, As part of the Information Security Reading Room. Author retains full rights. Anti-Hacking: The Protection of Computers Chadd Schlotter In the Computer Security industry, there are many solutions available to help combat cyber crime. Firewalls and Intrusion Detection systems are in place across the Internet to help protect more networks than ever before. Teams at software corporations work diligently on creating patches for known vulnerabilities, yet everyday the number of computers that are compromised increases...
Words: 4983 - Pages: 20
...Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Conducting a Penetration Test on an Organization This document is decided to give readers an outlook on how a penetration test can be successfully done on an organization. A methodology has been drawn out in this document to allow readers to be acquainted with the process that penetration testers go through to conduct a penetration test. AD Copyright SANS Institute Author Retains Full Rights Conducting a Penetration Test on an Organization TABLE OF CONTENTS PAGE 2 What is a Penetration Test? 2 fu ll r igh ts. Abstract eta ins The Process and Methodology Planning and Preparation Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Information Gathering and Analysis Vulnerability Detection Penetration Attempt Analysis and Reporting Cleaning Up rr Limitation of Penetration Testing ut ho Conclusion 10 10 Appendix A: Netcraft (www.netcraft.com) results on www.sans.org 12 Appendix B: Penetration Testing Tools 14 tu te 20 ,A 11 02 Bibliography 3 3 4 6 7 9 9 sti DETAILS © SA NS In Full name: Chan Tuck Wai GIAC userID: twchan001 Course: Security Essentials Version: First (Original Submission) Conference Location: Malaysia Key fingerprint...
Words: 5638 - Pages: 23
...Comparing SOHO Hardware Firewalls Routers As more and more individuals start their own small home businesses and technology is becoming a major part of these businesses, it is just as important that they are able to secure their network from attacks the same as enterprises-level businesses. According to Whitman & Mattord (2011), one of the most effective methods of improving computer security in the Small Office/Home Office (SOHO) setting is a SOHO firewall, which serves as stateful firewalls that enable inside-to-outside and can be configured to allow limited TCP/IP port forwarding and/or screened subnet capabilities (p. 256). This paper will compare the Watchguard Firebox SOHO 6 and the Sonic Wall, which are both VPN router that offers similar specifications. This paper will compare these SOHO firewall products that function as packet-filtering firewalls that offer combine features, and provides SOHO users the strong protection from the use of Network Address translation (NAT) services. Watchguard Firebox SOHO 6 verses SonicWall Watchguard Firebox SOHO 6 is a firewall and VPN router for small business and branch offices that allows the sharing of a single broadband connection, and it is supported by all the leading operating systems. This product includes licenses for 10 users, with an upgrade option for 25 to 50 users. Small office owner often have very little experience managing their office hardware. Therefore, the Watchguard Firebox SOHO 6 is a good chose...
Words: 794 - Pages: 4
...Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. SSL Man-in-the-Middle Attacks TCP/IP protocols have long been subject to man-in-the-middle (MITM) attacks, but the advent of SSL/TLS was supposed to mitigate that risk for web transactions by providing endpoint authentication and encryption. The advent of Dug Song's 'webmitm' in late 2000 demonstrated the feasibility of mounting an MITM attack on the protocol, but a properlyconfigured client SSL implementation would warn the user about problems with the server certificate. This paper examines the mechanics of the SSL protocol attack, then focuses o... Copyright SANS Institute Author Retains Full Rights AD SSL Man-in-the-Middle Attacks Peter Burkholder February 1, 2002 (v2.0) Abstract TCP/IP protocols have long been subject to man-in-the-middle (MITM) attacks, but the advent of SSL/TLS was supposed to mitigate that risk for web transactions by providing endpoint authentication and encryption. The advent of Dug Song's 'webmitm' in late 2000 demonstrated the feasibility of mounting an MITM attack on the protocol, but a properlyKey fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 configured client SSL implementation would warn the user about problems with the server certificate. This paper examines the mechanics of the SSL protocol attack, then focusses...
Words: 6154 - Pages: 25
...COMPLIANCE WHAT’S NEW? AN OVERVIEW 24 24 26 DOMAIN 7: SECURITY OPERATIONS WHAT’S NEW? AN OVERVIEW 28 28 29 DOMAIN 8: PHYSICAL & ENVIRONMENTAL SECURITY WHAT’S NEW? AN OVERVIEW 32 32 33 DOMAIN 9: SECURITY ARCHITECTURE & DESIGN WHAT’S NEW? AN OVERVIEW 36 36 38 DOMAIN 10: TELECOMMUNICATIONS & NETWORK SECURITY WHAT’S NEW? AN OVERVIEW 40 40 41 INFOSEC INSTITUTE’S CISSP BOOT CAMP COURSE OVERVIEW COURSE SCHEDULE 44 44 45 INTRODUCTION (ISC)²’s CISSP Exam covers ten domains which are: Access Control Application Development Security Business Continuity and Disaster Recovery Planning Cryptography Information Security Governance and Risk Management Legal regulations, investigations, and compliance Operations Security Physical and Environmental Security Security Architecture and Design Telecommunications and Network Security Over the course of the this eBook, we’ll take a look at each one of the domains; give you some insight into what (ISC)² is looking for in that area; give you some supplemental reading material; and by the time we’re done, you should have the foundation of the information you’ll need to pass the CISSP exam as well as to succeed in your security professional...
Words: 11687 - Pages: 47
...Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Case Study: Critical Controls that Could Have Prevented Target Breach In December 2013 over 40 million credit cards were stolen from nearly 2000 Target stores by accessing data on point of sale (POS) systems. This paper will explore known issues in the Target breach and consider some of the Critical Controls that could have been used to both prevent this breach and mitigate losses. AD Copyright SANS Institute Author Retains Full Rights Case Study: Critical Controls that Could Have Prevented Target Breach GIAC (GSEC) Gold Certification Author: Teri Radichel, teri@radicalsoftware.com Advisor: Stephen Northcutt Accepted: August 5th 2014 Abstract In December 2013 over 40 million credit cards were stolen from nearly 2000 Target stores by accessing data on point of sale (POS) systems. This paper will explore known issues in the Target breach and consider some of the Critical Controls that could have been used to both prevent this breach and mitigate losses. From what is known about the Target breach, there were multiple factors that led to data loss: vendors were subject to phishing attacks, network segregation was lacking, point of sale systems were vulnerable to memory scraping malware and detection strategies employed by Target failed. A possible...
Words: 8983 - Pages: 36
...Strayer University Continuity Planning Overview CIS-359: Disaster Recovery Management October 29, 2015 Introduction: This paper will briefly expound upon the lead position or manager’s role, of a healthcare company. It will provide a list of responsibilities a business continuity manager is expected to perform, how to build the framework for, and execute a business continuity plan, and also display a chart that pertains to giving a BCP presentation. Explain four high-level activities that aid in the initiation of a viable, business continuity plan. The role of an experienced business continuity manager in a healthcare business must identify and implement all of aspects of the business’, business continuity plan or BCP. To remain in accordance with the BCP, in preparation for disaster, from the start date, while it is in ongoing stages, and also afterward. Business continuity managers, work directly and strategically with the in-house BCM (Business Continuity Management) division, the business owner, and also the BCM’s, guidance and/or steering committee. They are expected to supervise, utilize paramount communication skills, monitoring the efficiency and progress of those team members and/or subordinates, who report directly to the, business continuity manager. In a healthcare environment, an efficient and thorough business continuity leader, structures accountability framework, by working close-knit with the business’ IT department, existing business...
Words: 1125 - Pages: 5
