Reference no: EM133213940

Case Study Company:

Company: SnowBe

SnowBe is a lifestyle brand for those who love the beach and snow. The owners started the company with a laid-back culture. Their customers instantly connected with their brand taking them to $100 million in sales in three years. After being so successful, the management team decided to take the company public.

Technical Information:

1. The majority of their sales are processed online through their website, housed on the AWS platform.
   1. All credit cards are accepted and stored on the company's website database.
   2. All customer information and purchase history are stored on the website indefinitely.
2. They have multiple storefronts in the U.S. and Europe, which accept checks, cash, or credit cards. The credit card transactions are processed using bank-provided credit card terminals in each store.
3. There are twenty desktops and thirty laptops in the main office in Los Angeles.
   1. The desktops are used to run the business and customer support.
   2. The thirty laptops are used for sales (retail and wholesale). The laptops use a VPN to log into the office to access company applications.
4. There are six servers (on-premise and AWS) for access management, storage, customer relations management, order management, accounting, and vendor applications.
5. As a result of SnowBe's laid-back culture, they neglected to implement technical controls and processes. As a result, they recently hired a technical consultant to get their neglected system and processes under control. The consultant started with implementing controls using the NIST 800-53 r5 framework.
   
   Additional Information:
   The technical consultant was impressed to find a well-run company with no reported technical issues or breaches despite SnowBe's laid-back culture. Although, there had been a few attempts that did not cause any harm or alerts to worry anyone. The technical consultant analyzed the risk of the company using the NIST Risk Management Framework. Here are some initial steps he suggested:
   
   - The need to update the firmware of all network devices.
   - The need to update the patches for all PCs and Windows servers to ensure they are using the latest Windows version.
   - The need to update their Anti-Virus and backup software.
   - The need to implement more processes into the access management system since most employees had access to almost all of the data on each server.
   - The need to lock the servers in a secured area of the office.
   - The need to update the company's WordPress shopping cart.
   - The need to implement the required PCI compliance items.
   - Login audit records need to be saved, and records older than 3 months should be archived to a cloud storage facility.
   - Mobile devices need to be reviewed and approved to have access to the company data. 

Instructions:

NOTES:

• Please answer each question or section of a question separately.  
• Elaborate on your answers to demonstrate your depth of knowledge for this week's topics.
• SnowBe update: SnowBe wants to streamline its business operations a little better. In addition, the CEO of the company is getting nervous about all the recent supply chain news.  He wants to create his own software to help with streamlining, but he doesn't have anyone with enough development experience.  There is one person who has the experience to be the project manager, her name is Karen.  They are looking at bringing in initially a team of three to work on software development solutions.  

Deliverables: 

1. SnowBe does not have a development process, and Karen is leaning towards using the Secure Software Development Framework (SSDF) or the Microsoft Software Development Life Cycle (MSDL).  Both frameworks are listed in the resources section below.
   
   You will be Karen for this situation. 
   
   Review both frameworks and the practices of each and document the following:
   1. Determine and describe which framework will work best for SnowBe, and why.
   2. Provide the steps you have taken to decide on the desired framework.  You will want to show your thought process that went into this decision. You will want to address some of the following items: programming practices from the framework, development processes, and methodologies that lead to secure software for SnowBe.
   3. For the framework that was not selected, document why it was not selected over the other.
2. Document the roles and responsibilities of Karen and her three new developers. Each developer should have different roles and responsibilities. 
3. Decide and describe the programming methodology you feel would work best for the new SnowBe development team.  You will want to list the methodology or a hybrid and list the why and why not of your decision.
4. Go over the importance of secure software pertaining to the two development frameworks, practices, and methodologies.