Follow the attach instructions to complete this work.
You will start by writing a short paper as described in the discussion question. You will be using information from this week’s readings and from your own research to address the information needs expressed in the question.
1. Create an MS Word document containing your “short paper” (response) for the discussion topic. Use MS Word to spell check and grammar check your work! Then, submit this file . (For presentations, use Power Point format – .pptx)
Remediation – Ineffective / Missing Security Controls
As part of its due diligence efforts, the M&A team has determined that the following events contributed substantially to the bankruptcy of Island Banking services.
1. Company officers and managers were able to conduct criminal activities using company IT assets without detection.
2. The company did not have a disaster recovery / business continuity plan in place. It could not restart operations due to the loss of servers and workstations (seized by law enforcement agents).
3. Storage media for servers and workstations had not been backed up to an off premises location leaving the company with no way to recover from the law enforcement seizure of storage media as evidence.
The root cause for each event listed above was determined to be: ineffective and/or missing IT security controls.
You have been asked to perform a gap analysis to assist in the identification and selection of IT security controls which could be implemented to remediate the situation (“close the gaps”). The CCISO has requested that you use the NIST Cybersecurity Framework and the NIST Security and Privacy Controls Catalog (NIST SP 800-53) as your source for IT security controls.
Choose 3 to 5 families or categories of controls (“framework functions”) which should be implemented to remediate the above deficiencies (at least one family, e.g.
AU Audit and Accountability, or category, e.g.
Recovery Planning, for each event). Describe how the selected controls will prevent or deter such events in the future (“close the gaps”).
Format your response as a business memorandum. For each control family or category, you should provide the following information (see Domain 2 Section 1.1.2 in CCISO):
· What it is
· What it does
· How the control performs its objective
You should have at least 5 strong paragraphs in your memo. Include citations and references (3 or more) to support your written work
