Week 5 Case Study
Risk Management Policy
By Jovan Kirby
SEC 280
Professor T. Campbell
DeVry University

Risk management is the process of making and carrying out decisions that will minimize the adverse effect of accidental losses upon our company. The risk management process is vital to the personal health and safety of employees and the safety of the public. In financial terms, it is vital to our ability to pursue our goals, commence and operate programs, and to perform duties in an efficient and professional manner. We will implement a plan to cover credit card theft and as well as internal breach of personal company information. Some ways to protect against credit card information being compromised is this. We have implemented some ways such as firewalls, restricted policies, and proxy servers. We will go through each one and explain why and how they will make this company stronger and better. First firewalls using a firewall will help build a strong defense. A firewall is a software program or piece of hardware that helps screen out hackers, viruses, and worms that try to reach your computer over the Internet. For example, if a firewall is configured with a rule to block Telnet access, then the firewall will drop packets destined for TCP port number 23, the port where a Telnet server application would be listening. The role of a firewall is to prevent malicious traffic reaching the resources that it is protecting. Some security experts feel this is an outdated approach to keeping information and the resources it resides on safe. They argue that while firewalls still have a role to play, modern networks have so many entry points and different types of users that stronger access control and security at the host is a better technological approach to network security. Now another aspect for this company we believe that restricted policies. This security setting allows an administrator to define two properties for security-sensitive groups (or restricted groups). The two properties are Members and Member Of. The Members list defines exactly who belongs and who does not belong to the restricted group. Both inclusion on the list and exclusion from the list, are enforced. The Member Of list specifies groups in which the restricted group is included. Only inclusion in the Member Of list is enforced, not exclusion: If you remove a group from the Member Of list, the restricted group is allowed to remain a member of the removed group. Now by enforcing this policy we can now control who can go where and who can do what within the company. Next we will conform to proxy servers for the company. In computer networks, a proxy server is a server (a computer system or an application) that acts as an intermediary for requests from clients seeking resources from other servers. The proxy server may exist in the same machine as a firewall server or it may be on a separate server, which forwards requests through the firewall.

An advantage of a proxy server is that its cache can serve all users. If one or more Internet sites are frequently requested, these are likely to be in the proxy's cache, which will improve user response time. A proxy can also log its interactions, which can be helpful for troubleshooting. The main reasons for using a proxy are anonymity, security, speed and filtering. The client computer is invisible to the Web server; this protects it from malicious attacks and also keeps the client computer anonymous. We touched bases on how to protect the company to keep all information safe within, but how do we secure the attacks that come within. By taking such steps like VPNs, logging and administration, an a auditing system for the company. A virtual private network extends a private network across a public network, such as the Internet. It enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network, and thus benefit from the functionality, security and management policies of the private network. A VPN is created by establishing a virtual point-to-point connection through the use of dedicated connections, virtual tunneling protocols, or traffic encryption. Using this will minimize information getting out the company we can keep it contain. Logging and administration, logging is the process of reviewing and analyzing the log files that firewalls and intrusion-detection systems accumulate. Administrators scan the log files for intrusion attempts and respond by closing any vulnerable ports or computers that are the targets of those attempts.