Week 4 Assignment 2: Organizational Risk Appetite and Risk Assessment

Abstract
This report will touch on what is needed to prepare in case of untimely disaster and what should be done when the worse has happen and you need to recover. We will take a look at what the business impact analysis look like and the company risk assessment for our company and look for risk that can be handled and risk the most be avoided and try to come up with a plans and policies for how to handle all future risks and problems. ”Business Impact Analysis (BIA) determines the importance of the organization’s activities by assessing the impact over time, if they are interrupted, and establishes continuity and recovery objectives”. (Engemann & Henderson, 2012) When looking to make a Business Impact Analysis we need to talk a look at all the resources of our company and what they do for the company. Then we figure what each piece need in the event of a crisis and how long and how much money it will take to get back on line so let take a look at the most valuable piece of equipment and work our way to the most expandable piece of equipment. The first and most important is the 3 file servers which is the central storage and the managing of data files to the company. These servers house not only private information on the company but also customer information. This means if they are damage or found missing work is loss and vital customer data is either gone or in a worse case stolen. This is a prime reason to get the file servers up and running first and to make sure that damage assessment is done right away. The Piece of equipment that we need to look into is the 2008 Active Directory Domain Controllers (DC). This piece of hardware and software has two important functions in the company the first is that it responsible for again access to Windows domain resources and it stores account information while at the same time authenticates users and enforces security policy for a windows domain. When this is down we lose remote access to a great many services in the company and it can stop productivity of the company. If password are leak it can lead to loss data and fraud claims not to mention you system could be held for ransom if they lock you out. The email servers are a lynch pin to any company because they give us lines of communication through company infrastructure. CEO can send information down the chain all the way to the low level employee and because of this when the system crashes you can bring companies to a grinding stop. The email sever like the file server and Active directory domain should be checked like the other server contact information and personal information is stored and if lost lead the company open to thief and sabotage. If a disaster strike these should be the first system brought back on line so the company can begin to recover. Since we have covered the core piece of equipment for work inside the company let us take a look at the hardware and software for access to the company remotely and to get to the internet. The most dangerous and important piece to this hold plan is getting access to the world wide web depending on what service provider will determine what kind of service you can and what kind of protection comes with it. If you go with a top tier internet provider like Comcast, Time Warner and Verizon you can have the safety of knowing you have constant service and people who have a stable infrastructure. However we need to make sure that the internet is made safe before letting it flow into our system so this is why we have a Network intrusion Detection System (NIDS). The NIDS protects us from anything that has to do with the internet because it can intercept incoming packets and stop anything it deems to me of a malicious nature. This give the IT department time to trace and fix any attacks on the system. If you online system is ever down this need to be the first that comes up if you don’t have it you entire system becomes at risk from outside attacks. This is also one of the pieces of software and hardware that should be check daily to make sure it is running correctly. If the network intrusion detection system fails we must rely on the 2 firewall that the system has put into place. These are software and hardware that control incoming and outgoing traffic by analyzing data packing moving through our network. The down side to firewall is that they have been around for a while and most good hackers know how to get around them. However not having them in place is like not putting a lock on the house door it is just asking for trouble there are some good firewall software suites but the best defense is to have IT monitor them and to make sure that the latest software update have been added. This lead us into the office wireless setup which give us a FTP server which allows us to wireless retrieve files or store work remotely and a wireless access point which allows the 100 laptop/desktop to work from the office and at home. This is a great setup as long as everything stays secure WEP security has long since be made obsolete but people still use it when WPA security is vastly superior. We want to make sure that each of the computer has its own login goes though the in-house PKI environment so that you get rotating passwords and nothing can just force hack our system. Also with the VOIP telephone system we want to make sure that its hard-line connected and that we have enough lines to handle the volume of calls. Since we know what are asset are and what need to be protected we should perform risk assessment to make sure we are prepared encase there is any kind of problem. The first step in the risk assessment plan is to list out all of the hazards that might be incurred when a task process or job is finished. In our case the greatest risk is programmers not backing up their work and looking valuable time and money reprogramming. We then have to worry about work being stolen if we have people trying to hack our system we need to have something in place to make sure that not only is work protected but that we can reverse hack to find out who is trying to get into our system. Our next area of concern is making sure that we don’t have hardware failure. Lastly we need to plan out for unforeseen disasters if we have a earthquake or power outage we need to have steps in place to get back on line. Now that we know what the major risks are we should put them in order and plan out steps to come up with for if one of risks happens. The great risk is the failure to back up work we should have in place software that will auto save at least every ten minutes to that we never have to go back to far. Also employees should be trained and given company policy about saving their work to the fileservers or FTP servers if they are working from home. Our next biggest risk is from theft, hackers are a major concern and we need to have steps in place to protect against them. One important step is not to log into the office in a public place people will look over the shoulder or dumpster dive to get access to personal information to break into the system. All papers should be shredded and sent out to be properly handle so as not to give information. We should also remember to have our password keys on us and if someone fails to many time in a row to lock them out. The NIDS should be check on regular bases to make nothing got through. Hardware is always a concern and should have maintenance done to make sure it is in good working order. All repair persons should sign in and out and should have a security officer with them at all times. A report should also be made of any repairs so that we have a running long of everything that as fixed. In the event of a emergency such as a fire we should remember that employees most get to safety first. We then want to make sure that all work can be back up remotely so as not to lost everything. We should also plan to have the insurance company come in and assess what everything is worth encase items need to be replace. One of the risks we need to accept is a natural disaster since there is very little we can do if one strikes we should work to recover have fast as possible. If we waste to much money trying to avoided it we will be forever sinking money into something that can’t be stop. One risk we need to stop is failure to back up our work to there is no reason that we shouldn’t items in place to handle auto back up and teaching our employees why this is important. Since most of our work comes from billable hours we need to have proof of productivity and we also need to make sure that all the file servers and FTP are always online. The risk that should be shared is handling thief in the company since we can’t see everything coming at us we need to enlist help from outside the company. There are some good IT companies out there that handle hacker preventions and I believe we would be well served in hiring one of them to protect our system. Since we already have a NIDS and firewalls adding a lost prevention team can cover any holes we might overlook or not think to check. The items we can control is privacy we can handle the shredding and making sure that no customer information is lost. We can buy our own shredders and we can also make sure they a delivered to be destroyed. “Risk can be defined as the combination of the probability of an event and its consequences”. (AIRMIC, 2002)In regards to our company anything that takes more than a 15% loss to profits will be too much of a risk. When you factor how much it going to cost to make the game and to advertise the product and pay back our investors we can’t lose more than 15% or we will not break even. Also if at anytime we lost more than 20% of our information to theft we also will have to pull out because we can no longer guarantee our product or our reputation. The steps we need to make sure we turn a profits and secure our data should be: We need to do product testing before and a feasibility study before we begin anything this will give us a idea what the market is looking for before we begin testing. Also we need to have general meeting with the programmers and management to come up with a budget to see how much we are going to need before we make a profit. If we are going to maintain project security we need to monitor employee log-on and make sure the NIDS is working. Also we need to make sure that our antivirus/malware is up to date to protect from virtual attack. We should also let employees know set policy about security so that they don’t unknowingly make any mistakes.

AIRMIC. (2002). A risk management standard. Retrieved from http://www.theirm.org/publications/documents/Risk_Management_Standard_030820.pdf
Hiles, A. (2002). Enterprise risk assessment and business impact analysis: Best practices. Rothstein Associates Inc.
Engemann, K. J., & Henderson, D. M. (2012). Business continuity and risk management: essentials of organizational resilience. Rothstein Associates, Inc.