Premium Essay

Vulnerability Management Plan

In:

Submitted By douglasm10
Words 6924
Pages 28
WESTERN GOVERNORS UNIVERSITY

Submittal Cover Sheet

[pic]

Date: 06/12/2012

Student Name: Michael Paul Douglas

Student ID Number: 150777

Student Degree Program: Bachelor of Science Information Technology Security

Student Email: douglasm@my.wgu.edu

Four Digit Assessment/Project Code: CAPW4

Mentor Name: Martin Palma

For Revisions Only Indicate Previous Grader:

Submissions received with an altered, incomplete or missing cover sheet will be returned for resubmission.

Submit to: Western Governors University Attn.: Assessment Delivery Department 4001 South 700 East, Suite 700 Salt Lake City, Utah 84107-2533

wgusubmittals@wgu.edu Capstone Project Cover Sheet

Capstone Project Title: Vulnerability Management Plan

Student Name: Mike Douglas

Degree Program: Bachelor of Science Information Technology Security

Mentor Name: Martin Palma

Signature Block

Student’s Signature

Mentor’s Signature

Table of Contents

Capstone Report Summary (Introduction) 1
Review of Other Work 3
Rationale and Systems Analysis 8
Goals and Objectives 13
Project Timeline 22
Project Development 24
References 28
Appendix 1: Competency Matrix 29
Appendix 2: CVSS GUIDE 32
Appendix 3: DICES IV vulnerability management plan 33

Capstone Report Summary (Introduction)

Digital Integrated Communications Electronic System version IV (DICES IV) is a critical piece of communications infrastructure relied on to ensure missile launch success. When a single mission’s price tag soars into the tens and sometimes hundreds of millions of dollars, management of hardware, software, and personnel risks and vulnerabilities must be included to mitigate events that

Similar Documents

Premium Essay

Risk Management Plan for Defense Logistics Information Service

...Risk Management Plan for Defense Logistics Information Service 1. PURPOSE This Risk Management Plan is an overall look at how Defense Logistics Information Service can protect it’s data. The implication of lost confidential government data is the primary cause for this plan, and will be treated with the utmost importance. 2. GUIDING PRINCIPLES This plan will be presented through a formal, written, written risk management, and security safety program. The Security Safety and Risk Management Program supports the DLIS philosophy that government safety and risk management is everyone’s responsibility. Teamwork and participation among management, providers, and staff are essential for an efficient and effective patient safety and risk management program. The program will be implemented through the coordination of multiple organizational functions and the activities of multiple departments. DLIS supports the establishment of such clauses and best practices. An in depth look at mistakes made and ways we can learn from them will be at the forefront of out investigation. Constructive feedback will play a large part as well. In a just culture, unsafe conditions and hazards are readily and proactively identified, mistakes are openly dicussed, and suggestions for systematic improvements are welcomed. Individuals are still held accountable for compliance with safety and risk management practives. As such, if evaluation and investigation of an error or even reveal reckless behavior...

Words: 829 - Pages: 4

Premium Essay

Communication Product

...RESULTS-BASED PUBLIC SECTOR MANAGEMENT A Rapid Assessment Guide PLAN EVALUATE BUDGET RESULTS MONITOR IMPLEMENT i RESULTS-BASED PUBLIC SECTOR MANAGEMENT A Rapid Assessment Guide © 2012 Asian Development Bank All rights reserved. Published in 2012. Printed in the Philippines ISBN 978-92-9092-838-6 (Print), 978-92-9092-839-3 (PDF) Publication Stock No. TIM124978 Cataloging-In-Publication Data Asian Development Bank    Results-based public sector management: A rapid assessment guide. Mandaluyong City, Philippines: Asian Development Bank, 2012. 1. Managing for development results   2. Results-based management    3. Public sector.   I. Asian Development Bank. The views expressed in this publication are those of the authors and do not necessarily reflect the views and policies of the Asian Development Bank (ADB), its Board of Governors, or the governments they represent. ADB does not guarantee the accuracy of the data included in this publication and accepts no responsibility for any consequence of their use. By making any designation of or reference to a particular territory or geographic area, or by using the term “country” in this document, ADB does not intend to make any judgments as to the legal or other status of any territory or area. ADB encourages printing or copying information exclusively for personal and noncommercial use with proper acknowledgment of ADB. Users are restricted from reselling, redistributing, or creating...

Words: 5265 - Pages: 22

Premium Essay

Business Paper

...Business and Commercial Awareness ------------------------------------------------- MODULE CODE: 6FBS1261MODULE LEADER: Mr. Neil GodfreyImplementation PlanMember: Jenna Julien                      ID NUMBER: 13028960Programme Delivered by:CTS College of Business and Computer Science Ltd.Submission Date: 07/01/2013Final Word Count:1302(Excluding, Table of Contents, Tables & References) | Table of Contents Section 1.0 1 OVERVIEW OF INVESTMENT AND IMPACT ON FINANCIAL DEPARTMENT: 1 Section 2.0 2 LINKAGES WITH OTHER DEPARTMENTS: 2 Section 3.0 3 MILESTONES AND TIME PLAN FOR FINANCIAL ACTIVITIES: 3 Section 4.0 4 RISK MANAGEMENT PLAN: 4 TABLE 1: Showing Risk Plan for Implementation Plan 5 TABLE 2: Showing Risk Assessment for Implementation Plan 5 Section 5.0 6 FINANCIAL OVERVIEW OF INVESTMENT: 6 COST-PLAN 6 TABLE 3: SHOWING DETAILED EXPENSE ACCOUNT 7 TABLE 4: SHOWING TOTAL PROJECTED YEARLY INCOME 8 TABLE 5: SHOWING PROJECTED COST-INCOME RATIO 8 TABLE 6: SHOWING TOTAL FORECASTED PROFITS 8 TABLE 7: SHOWING PROJECTED PROFIT-INCOME RATIO 9 TABLE 8: SHOWING PROJECTED BREAK-EVEN PERIOD FOR 9 Section 6.0 10 RESOURCE REQUIREMENTS BY THE FINANCE DEPARTMENT: 10 Section 7.0 11 KEY PERFORMANCE INDICATORS 11 Section 8.0 12 REFERENCES 12 Section 1.0 OVERVIEW OF INVESTMENT AND IMPACT ON FINANCIAL DEPARTMENT: The 3 star new build in Rio de Jainero, Brazil was chosen as the best investment idea by our syndicate...

Words: 2601 - Pages: 11

Premium Essay

Recognizing and Minimizing Tort and Regulatory Risk Plan

...Risk Plan Recognizing and Minimizing Tort and Regulatory Risk Plan LAW/531 September 29, 2010 Introduction Alumina, Inc. makes aluminum products and has revenues of over $4 Billion Dollars. The company is based in the United States (US) with operations in eight other countries around the world. The US accounts for 70% of Alumina’s market share. Alumina has business interests in automotive components and manufacture packaging materials, bauxite mining, and Alumina refining and smelting. The company falls under the jurisdiction of Region 6 of the Environmental Protection Agency (EPA) (University of Phoenix, 2010). Recognizing and Minimizing Tort and Regulatory Risk Plan Companies and organizations such as Alumina, Inc. have corporate governances that require them to operate their businesses under government rules, regulations and boundaries. The rules and regulations have been authorized and enacted by major legislation, which are enacted by Congress and enforceable by laws. Minimizing the risk of tort liability is the goal of every organization and company. Five years ago Alumina was in violation of environmental discharge norms in a routine EPA compliance evaluation inspection. The EPA ordered a cleaned up and Alumina complied right away. Now, the case of negligence starts. The government places a high level the importance on the preservation of the environment and enforces environmental regulations. Alumina has to come up with a risk management plan...

Words: 1581 - Pages: 7

Premium Essay

Improving Security Through Layed Security

...adequate protection of information or have been so restrictive that they have prevented companies from making the maximum use of information to innovate, collaborate, and achieve competitive advantages. The security approach that many organizations have been forced to take in the past have been a reactive approach rather than viewing information security as a business enabler they see it as a inhibitor, designed to prevent bad things from happening. The problem with this is that good efforts in one area can be quickly nullified by failures in another. To help with its security transformation, Global called upon the expertise of CIS, its own security division, CIS’s information risk management strategy brings together, within a global framework, all the components that an organization needs to plan and implement an end-to-end approach for protecting a business’s most critical information assets. Looking a compliance you have to understand that there are certain laws that apply to financial data. The question at hand is looking at reporting from a unsecure network. Bringing in a risk team will first a foremost put that to a stop, finance data should not be reported over unsecured networks, this can a violation of compliance law by letting information out be that either non encrypted or passing it along where it is vulnerable. Assuring the integrity and security of personal information held by banks, insurance...

Words: 1132 - Pages: 5

Premium Essay

Risk Management Plan

...Risk Management Plan YIELDMORE Version 1.0.1 Table of Contents Executive Summary...………………………………………………………..3 1.0 Introduction..……………………………………………………………..4 1.1 Purpose of the Risk Management Plan……………..…….....4 2.0 Risk Management Procedure……….…………………………………...4 2.1 Objectives……………………………………………………4 2.2 Scope………………………………………………………...4 2.3 Compliance Laws and Regulations…………….………………….…....5 2.3.1 PCI DSS Summary ………………………………..…....…5 2.3.2 Sarbanes Oxley Act Summary ………………………..…..6 2.4 Roles and Responsibilities……………………………………..….…..6 2.4.1 Threat Identification………………………………………..7 2.4.2 Methods for Risk Identification……………………...…….7 2.4.3 Vulnerability Identification...………………………...…….7 2.4.4 Pair Threats & Vulnerabilities……………………...………8 2.5 Risk Analysis………………………………………………….……......8 2.6 Risk Monitoring……………………………………………....………..9 2.6.1 Risk Management Plan Approval………………………….10 Executive Summary A risk is an event or condition that if a threat exploits vulnerability there could be a positive or negative effect on a business or project. Risk Management is the practice of identifying, assessing, controlling and mitigating risks. This document is a guideline in completing a Risk Management Plan. The Risk Management Plan describes the vulnerabilities and threat pairs that could be a potential risk, and outlines a plan to be performed, recorded, and monitored with control measures. The Risk Management Plan is important because it outlines...

Words: 1648 - Pages: 7

Premium Essay

Lab 2 Ist

...Lab 2 - Align Risks, Threats, and Vulnerabilities to COBIT PO9 Risk Mgmt. Controls Part 1 4. Discuss the primary goal of the COBIT v4.1 framework. Provide a basic description of cobit. * The purpose of Control Objectives for Information and related Technology (COBIT) is to provide management and business process owners with an information technology (IT) governance model that helps in delivering value from IT and understanding and managing the risks associated with IT. COBIT helps bridge the gaps amongst business requirements, control needs and technical issues. It is a control model to meet the needs of IT governance and ensure the integrity of information and information systems. 5. Explain the major objective of the Control area (COBIT 4.1 Controls Collaboration link on the left side of the COBIT website) * “The COBIT Controls area within ISACA's Knowledge Center promotes collaboration and sharing of information, solutions and experience among COBIT users.” 6. From the COBIT Domains and Control Objectives section, list each of the types of control objectives and briefly describe them based on the descriptions on the website. * Plan and Organize – “This domain covers strategy and tactics, and concerns the identification of the way IT can best contribute to the achievement of the business objectives. The realization of the strategic vision needs to be planned, communicated and managed for different perspectives. A proper organization as well as technological...

Words: 4162 - Pages: 17

Premium Essay

Risk Management

...for an IT Risk Management Plan Course Name and Number: _____________________________________________________ Student Name: ________________________________________________________________ Instructor Name: ______________________________________________________________ Lab Due Date: ________________________________________________________________ Overview In this lab, you defined the purpose of an IT risk management plan, you defined the scope for an IT risk management plan that encompasses the seven domains of a typical IT infrastructure, you related the risks, threats, and vulnerabilities to the plan, and you created an IT risk management plan outline that incorporates the five major parts of an IT risk management process. Lab Assessment Questions & Answers 1. What is the goal or objective of an IT risk management plan? 2. What are the five fundamental components of an IT risk management plan? 3. Define what risk planning is. 4. What is the first step in performing risk management? 5. What is the exercise called when you are trying to gauge how significant a risk is? 25 6. What practice helps address a risk? 7. What ongoing practice helps track risk in real time? 8. True or False: Once a company completes all risk management steps (identification, assessment, response, and monitoring), the task is done. 9. Given that an IT risk management plan can be large in scope, why is it a good idea to develop a risk management plan team? 10. In...

Words: 434 - Pages: 2

Premium Essay

Risk Assesment Plan

...RISK MANAGEMENT PLAN PURPOSE AND SCOPE The purpose of the Risk Management Plan is to establish an approach to monitoring, evaluating, and managing risks throughout the life of the project. A risk is an uncertain event or condition that has a negative or positive effect on the project’s objectives. The risk management plan will identify potential risk, assess individual risk and its impact on performance, cost, and schedule of the overall project and develop an action plan that handles individual risk. RISK PLAN OBJECTIVES The scope of this risk assessment assessed the system’s use of resources and controls (implemented or planned) to eliminate and/or manage vulnerabilities exploitable by threats internal and external to the Project. If exploited, these vulnerabilities could result in: • Unauthorized disclosure of data • Unauthorized modification to the system, its data, or both • Denial of service, access to data, or both to authorized users This Risk Assessment Report evaluates the confidentiality (protection from unauthorized disclosure of system and data information), integrity (protection from improper modification of information), and availability (loss of system access) of the system. Recommended security safeguards will allow management to make decisions about security-related initiatives. PROJECT RISKS This risk assessment methodology and approach was conducted using the guidelines in NIST SP 800-30, Risk Management Guide for Information Technology Systems...

Words: 1565 - Pages: 7

Premium Essay

Understanding Nist 800‐37  Fisma Requirements 

..................................................................................................... 3  I. The Role of NIST in FISMA Compliance ................................................................................. 3  II. NIST Risk Management Framework for FISMA ..................................................................... 4  III. Application Security and FISMA .......................................................................................... 5  IV. NIST SP 800‐37 and FISMA .................................................................................................. 6  V. How Veracode Can Help ...................................................................................................... 7  VI. NIST SP 800‐37 Tasks & Veracode Solutions ....................................................................... 8  VII. Summary and Conclusions ............................................................................................... 10  About Veracode .................................................................................................................... 11                                      © 2008 Veracode, Inc.  2        Overview  The Federal Information Security Management Act of 2002 ("FISMA", 44 U.S.C. §  3541, et seq.) is a United States federal law enacted in 2002 as Title III of the E‐ Government Act of 2002 (Pub.L. 107‐347, 116 Stat. 2899). The Act is meant to  bolster computer and network security within the Federal Government and ...

Words: 2451 - Pages: 10

Premium Essay

Is4550 Lab 9

...Risk-Threat-Vulnerability IT Security Policy Definition Unauthorized access from Public Internet Acceptable Us Policy User Destroys Data in application and deletes all files Asset Identification and Classification Policy Hacker penetrates you IT infrastructure and gains access to your internal network Vulnerability Assessment and Management Policy Intra-office employee romance gone bad Security Awareness Training Policy Fire destroys primary data center Threat Assessment and Management policy communication circuit outages Asset Protection Policy Workstation OS has a known software vulnerability Vulnerability Assessment and Management Policy Unauthorized access to organization owned Workstations Asset Management Policy Loss of production data Security Awareness Training Policy Denial of service attack on organization e-mail server Vulnerability Assessment and Management Policy Remote communications from home office Asset Protection Policy LAN server OS has a known software vulnerability Vulnerability Assessment and Management Policy User downloads an unknown e-mail attachment Security Awareness Training Policy Workstation browser has software vulnerability Vulnerability Assessment and Management Policy Service provider has a major network outage Asset Protection Policy Weak ingress/egress traffic filtering degrades performance Vulnerability Assessment and Management Policy User inserts CDs and USB hard drives with personal photos...

Words: 616 - Pages: 3

Premium Essay

How to Identify Threats & Vulnerabilities in an It Infrastructure

...Week 1 Laboratory How to Identify Threats & Vulnerabilities in an IT Infrastructure Learning Objectives and Outcomes Upon completing this lab, students will be able to: • Identify common risks, threats, and vulnerabilities found throughout the seven domains of a typical IT infrastructure. • Align risks, threats, and vulnerabilities to one of the seven domains of a typical IT infrastructure • Given a scenario, prioritize risks, threats, and vulnerabilities based on their risk impact to the organization • Prioritize the identified critical, major, and minor software vulnerabilities   Week 1 Lab: Assessment Worksheet Part A – List of Risks, Threats, and Vulnerabilities Commonly Found in an IT Infrastructure Overview One of the most important first steps to risk management and implementing a risk mitigation strategy is to identify known risks, threats, and vulnerabilities and organize them. The purpose of the seven domains of a typical IT infrastructure is to help organize the roles, responsibilities, and accountabilities for risk management and risk mitigation. This lab requires students to identify risks, threats, and vulnerabilities and map them to the domain that these impact from a risk management perspective. Lab Assessment Questions & Answers The following risks, threats, and vulnerabilities were found in a healthcare IT infrastructure servicing patients with life-threatening situations. Given the list, select which of the seven domains...

Words: 590 - Pages: 3

Premium Essay

Risk Management Plan

...(ISCM) is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. This publication specifically addresses assessment and analysis of security control effectiveness and of organizational security status in accordance with organizational risk tolerance. Security control effectiveness is measured by correctness of implementation and by how adequately the implemented controls meet organizational needs in accordance with current risk tolerance. Organizational security status is determined using metrics established by the organization to best convey the security posture of an organization’s information and information systems, along with organizational resilience given known threat information. This necessitates: • Maintaining situation awareness of all systems across the organization; • Maintaining an understanding of threats and threat activities; • Assessing all security controls; • Collecting, correlating, and analyzing security-related information; • Providing actionable communication of security status across all tiers of the organization; and • Active management of risk by organizational officials. Purpose: The purpose of this guideline is to assist organizations in the development of an ISCM strategy and the implementation of an ISCM program that provides awareness of threats and vulnerabilities, visibility into organizational assets, and the effectiveness of deployed...

Words: 4395 - Pages: 18

Premium Essay

Lab 2

...Assessment Worksheet Align Risk, Threats, & Vulnerabilities to COBIT P09 Risk Management Controls Student Name: _____________________________________________________________ 1. From the identified threats & vulnerabilities from Lab #1 – (List At Least 3 and No More than 5), High/Medium/Low Nessus Risk Factor Definitions for Vulnerabilities) a. b. c. d. e. 2. For the above identified threats and vulnerabilities, which of the following COBIT P09 Risk Management control objectives are affected? • PO9.1 IT Risk Management Framework • PO9.2 Establishment of Risk Context • PO9.3 Event Identification • PO9.4 Risk Assessment • PO9.5 Risk Response • PO9.6 Maintenance and Monitoring of a Risk Action Plan 3. From the identified threats & vulnerabilities from Lab #1 – (List At Least 3 and No More than 5), specify whether the threat or vulnerability impacts confidentiality – integrity – availability: Confidentiality Integrity Availability a. b. c. d. e. 4. For each of the threats and vulnerabilities from Lab #1 (List at Least 3 and No More than 5) that you have remediated, what must you assess as part of your overall COBIT P09 risk management approach for your IT infrastructure? 5. For each of the threats and vulnerabilities from Lab #1 – (List at Least 3 – No More than 5), assess the risk impact or risk factor that it has on your organization in the following areas: a. Threat or Vulnerability #1: o Information – o Applications – o...

Words: 469 - Pages: 2

Premium Essay

Lp4: Review Questions

...1. What is risk management? The process of identifying risk, as represented by vulnerabilities, to an organization’’s information assets and infrastructure, and taking steps to reduce this risk to an acceptable level. Why is the identification of risks, by listing assets and their vulnerabilities, so important to the risk management process? It is a starting point for the next step in the risk management process –– risk assessment. 2. According to Sun Tzu, what two key understandings must you achieve to be successful in battle? Know the enemy and know yourself. 3. Who is responsible for risk management in an organization? Each community of interest has a role to play in managing the risks that an organization encounters. Which community of interest usually takes the lead in information security risk management? information security community 4. In risk management strategies, why must periodic review be a part of the process? To verify the completeness and accuracy of the asset inventory, review and verify the threats to and vulnerabilities in the asset inventory, as well as the current controls and mitigation strategies. Must also review the cost effectiveness of each control and revisit decisions on deployment of controls. Managers at all levels must regularly verify the ongoing effectiveness of every control deployed. 5. Why do networking components need more examination from an information security perspective than from a systems development perspective? Networking...

Words: 817 - Pages: 4