Reference no: EM133015808

Security Risks & Cost Analysis

Introduction

Information security professionals are expected to keep abreast of the new developments in information security threat landscapes by assessing the current cyber-threat environment for the development of an effective means of protecting against evolving, modern-day IT threats. The set task for this practical focuses on specific aspects of Web security with emphases on monitoring and assessing threats and selecting countermeasures against Web-borne threats as well as the resulting cost calculations. It is intended that the answers to these questions will give you a good understanding of how you can identify threats and the related tools and methods used to build more secure enterprise information systems.

TASKS 1: DEFINITION OF INFORMATION SECURITY

There are many information security definitions on the internet. Below are two such definitions sourced from the Internet:

1. Security refers to all the policies, procedures and technical tools used for safeguarding information systems from unauthorized access, alteration, theft and physical damage.

2. Security is keeping anyone from doing things you do not want them to do to, with, or from your computers or peripherals.

Analyse the above definitions of information security and discuss the shortcomings of these definitions.

TASK 2: CASE STUDY

Ali Baba, the online shoe, clothes, consumer electronics and other items such as kitchenware, bikes and golf clubs retailer, has 300 employees across Australia with head office in Melbourne. Ali Baba recorded $1 billion in sales for financial year 2012. It has an active customer base of 850,000 and more than 250,000 orders are now being completed each week. In addition to advertising online using keyword targeted ads, email marketing and direct mail marketing to provide special offers and promotions to existing customers is used. Customers can choose the product they want on a website and then order using on-line or by phone.

Figure 1 is an architectural overview of the Ali Baba e-commerce site. The e-commerce architecture consists of a client at the end-user side, and a 3-tier processing server side. Firewalls are strategically placed between various components of the system architecture to enable network perimeter security. The alibaba.com site acts as a portal to all of Ali Baba's products, including shoes, clothing Books, DVDs, kitchenware, bikes and golf clubs and electronics items. It also takes online payments using debit and credit cards.
» Client - The client system has a recent version of Internet Explorer and the .NET framework. The client interacts with the web server using simple HTML over HTTP or SOAP over HTTP. In the latter case, the client downloads and executes .NET assemblies within the browser. The client uses a smart card reader for authentication and encryption.
» Web server - The web server is responsible for formatting the processed information before returning it to the client, and for handling client requests by performing input validation and delegating them to the appropriate units within the business tier. Usually, the processed information is formatted using the markup languages HTML. The web server runs IIS and ASP.NET. The web server interacts with an application server in the business tier, using web services.
» Application server - The application server implements the actual business logic. In order to achieve its functionality, several services can be provided to the application server from the back-end systems. The application server runs IIS, ASP.NET, COM+, ADSI, Visual Basic etc. The web server and the application server can interact by using remote procedure calls, web services or a proprietary application server protocol.
» Back-end systems - A directory server, a database server and a remote application server are located within the back-end systems. These systems collectively provide some basic services such as a database system and an authentication and directory service. The database stores, among others, personal user information. This information can consist of personal buying habits, grocery purchases, as well as a history of browsing sessions. The database runs SQL Server. The application server uses SQL to interact with the database server. The directory server in a Microsoft environment is typically Active Directory.
Connection to a remote application server or wrapped legacy application is done via SOAP. Note that SOAP messages are XML based messages for exchanging structured and typed information.

TASKS 2.1: ASSETS, THREATS & VULNERABILITIES ANALYSIS

Based on the generic architecture for e-commerce presented in Figure 1, work on the following tasks.

a) Compile an inventory of all important assets within Ali Baba enterprise network. Use the following template for the inventory. In the table, criticality level indicates how essential/critical the asset is to Ali Baba's business (acceptable entry is critical, essential or non-essential) and security attributes indicate which of the basic components of IT security (i.e., confidentiality, integrity or availability) is most appropriate.
b) Identify and briefly discuss the most relevant threats to the Ali Baba enterprise network. Assume that the company network and the servers are secured according to best practices. Also assume that attacks will be directed to the server and not to the client machine. For each identified threat, give a short overview of how likely it is to be materialised.
c) Using an online search engine, identify two different recent real-life attacks that could be perpetrated against Ali Baba's assets. You must justify your choice and argue convincingly that it can be perpetrated against Ali Baba's systems. In answering this question, you can assume whatever you like provided that the assumption is realistic and applicable to the system environment described in Figure 1.

TASKS 2.2: DATA LOSS ANALYSIS

Task 2.2.1: Eiden, an employee in marketing division of Ali Baba, carries home his laptop containing 45000 clients' personally identifiable information (e.g., contact, billing and servicing record) after work. Suppose that Eiden's laptop is "stolen" out of the trunk of his car on a Friday night while he is having a beer with some friends. He does not notice that the laptop has been stolen until Monday morning when he reports to work.
(a) According to Ponemon Study, data breaches in 2010 cost companies an average of $214 per compromised record. Estimate data breach costs to Ali Baba assuming that the information in the laptop is not encrypted. Please record this result as you need it later.
(b) List and explain the actual key cost component breakdown for the data loss. Which of these components is the most significant financial consequence and why.
(c) List and explain possible direct and indirect impacts of the data lose on the clients of Ali Baba.

Task 2.2.2: In this task, you will analyse Ali Baba's cost of data security breach risk by using the Data Loss Cost Calculator (DLCC) located at https://www.tech- 404.com/calculator.html.

a) Enter the number of affected records (comma is not allowed) in a data breach or identity theft incident. What is the total cost to Ali Baba as reported by the DLCC tool? Please record this result as you need it later.
b) Click the "Graph" icon in the lower left to generate a pie chart of the results. (This will generate a pie chart that depicts average data loss expenses as a percentage of the total.) Note this data as you will need it later.
c) Click each pie chart slice to produce an alternate chart showing the distribution of costs (by percentage) for that category. Please write down the data somewhere as you will need it later.

Task 2.2.3: In this task, you will use the data breach risk calculator (DBRC) to estimate the likelihood and impact of a potential breach on Ali Baba. You will need to answer a few short questions to find out how a data breach could impact Ali Baba.
a) What is the total cost to Ali Baba as reported by the DBRC tool? Please record this result as you need it later.
b) Get the distribution of costs (by percentage) for each category.
c) How Ali Baba compares with other companies as reported by DBRC tool?

Task 2.2.4: Use the Microsoft Excel with the data you gathered from task 2-1 (Manual), task 2.3 (DLCC) and task 2.3 (DBRC) to plot a column graph. In the graph, the horizontal axis should have "Manual, DLCC and DBRC" which corresponds to the three tasks. The vertical axis (y-axis) should show the total cost for each as determined by the three tasks. Give the x-axis a title "Data loss calculation" and name the y-axis title "Total cost."
a) What is the discrepancy level in percentage between the three methods?
b) What conclusion and observation you can make from the graph about the discrepancy?
c) For the common category Get the distribution of costs (by percentage) for each category.
d) Which calculator would you prefer to use if you have to calculate a data loss cost and why?

TASK 3: CLASS DISCUSSION
Discuss your findings, conclusions and observations as well as what you have learnt as a result of this practical. Involve in the discussion by asking questions, providing different viewpoints, supporting ideas, etc.

Attachment:- Security Risks Cost Analysis.rar