security recommendation for this attached document
Project Name
Group 2
University of Maryland Global Campus
ITEC 610 9041 Information Technology Foundations (2245)
Professor Tanis Stewart
June 24, 2024
1.
Setting and Situation
The Bureau of Research and Intelligence (BRI) is entrusted with the crucial responsibility of giving American diplomats intelligence from various sources, while strictly adhering to U.S. foreign policy and maintaining the utmost confidentiality. As advancements in technology emerge, new security and threats are presented.
BRI has encountered several significant breaches and challenges, which are as follows:
1. Network Compromise: State-sponsored hackers targeted BRI’s network, successfully gaining unauthorized access to sensitive intelligence data.
2. Misuse of Personal Email: The bureau chief utilized personal email for official purposes, thereby jeopardizing the exposure of sensitive information to potential risks.
3. HR System Breach: A flaw in the HR system allowed authorized individuals to access employees’ personal information. Unfortunately, the cause of this breach remains undetermined and unresolved.
4. Stolen Laptop: A teleworker’s laptop, containing classified information, was stolen and remains unrecovered, posing a significant security concern.
5. Contractor Leak: A contractor leaked classified documents, thereby exposing confidential communication between diplomats and the President, which is highly sensitive.
6. Malware Infection: Computers within various foreign embassies fell victim to malware infections, resulting in security risks and causing public embarrassment for the affected parties.
As a result of these reports, the U.S. Accountability Office conducted a thorough examination of BRI’s information security, and several vulnerabilities were identified:
Identification and Authentication Controls
It was discovered that the passwords in use were short and did not have an expiration date, making them the sole means of authentication. This posed a significant risk as it increased the likelihood of unauthorized access to sensitive data.
Authorization Controls
The access privileges granted to users were excessive, and the management of databases was poorly executed, with all operations being carried out under single accounts. This lack of proper oversight and control created an environment where potential breaches could occur undetected.
Data Security
It was observed that data-at-rest was not encrypted, leaving sensitive information vulnerable to unauthorized access. This lack of encryption meant that even unclassified databases could potentially be exploited to derive sensitive information.
System Security
The utilization of outdated WEP standards posed a significant risk. This allowed personal devices to connect to the network, potentially compromising the security of the entire system.
Additionally, it was found that BRI lacked comprehensive plans for incident recovery. This absence of a clear strategy, coupled with infested security controls and inconsistent patching, left the organization susceptible to prolonged disruptions and potential data breaches.
Physical Security
Unauthorized personnel gained access to secure areas, and former employees retained access privileges even after leaving the organization. This lack of proper access management and control further increased the risk of unauthorized access and potential data breaches.
End User Security
It was noted that security training provided to employees was minimal, and the use of social media was allowed in restricted areas. Additionally, public cloud services were utilized for data storage, which introduced additional security concerns. Furthermore, there were no ongoing background checks or policies in place for handling classified information, leaving the organization vulnerable to insider threats.
2.
Risk Assessment Methodology
There have been some high-profile security incidents at the Bureau of Research and Intelligence. Therefore, a comprehensive risk assessment had to be conducted. The methodology followed by the IT security consultant team in this regard conforms to what has been laid down by the National Institute of Standards and Technology. It represents a structured way of identifying, evaluating, and prioritizing risks to enhance the overall security posture at BRI.
The risk assessment methodology was based on NIST’s “Guide for Conducting Risk Assessments” (Special Publication 800-30). This framework provided a structured process to assess and manage risks, thus ensuring that all factors within BRI’s information technology environment were adequately reviewed. The methodology started with the setup phase, which included the definition of the purpose, scope, assumptions, and assessment constraints. The key objective of the exercise was to identify security risks that could have been used to compromise the functions and properties of BRI. The scope of risk assessment was quite extensive as it covered all IT systems and processes within BRI. Nevertheless, areas primarily attacked in the past, according to recent incidents, were the significant targets, while constraints included limited time and access.
Various critical activities were at the center of the risk assessment process. First, there was the identification of threats. Sources had to be identified that could act as a weakness to the vulnerabilities existing within BRI’s IT environment. This would entail nation-state actors, insider threats, and external hackers. So, sources of those threats had to be pointed out to better understand the different avenues through which BRI’s security could be jeopardized.
The group then went on to target the vulnerabilities within the IT infrastructure of BRI. Among them were weak password policies, overprivileged users, no data-at-rest encryption, and outdated security protocols that enhanced unauthorized access and exposed the threat of breaches. Analysis of these weaknesses helped the team identify where BRI’s security defenses were most vulnerable. The team then analyzed the possible impact that could have been the case upon the exploitation of these vulnerabilities and threats identified. This includes impacts such as data breaches, loss of sensitive information, and operational disruptions in BRI activities. Knowledge of the extent to which such impacts are necessary for risk prioritization.
The next step was the likelihood assessment of each identified threat that would potentially exploit a vulnerability. The assessment considers the historical data, aggregates threat vectors from intelligence, and assesses the current security posture in BRI. The joining of these two independent assessments, impact and likelihood assessments, gave a comprehensive overview of the possible Stygian threats against the IT setup deployed in BRI. As such, the team could review and prioritize those risks that needed immediate attention.
Subsequently, the assessment results were documented and detailed reports were prepared that gave directions and recommendations for all identified risks and their possible impacts and mitigation strategies. This report is to be presented to relevant parties so that they are informed of these security risks and how much effort each one needs to put in to handle them effectively.
The risk assessment methodology underpinned several essential reference materials and resources. The chief resource was the NIST publications, which presented a number of risk management principles and frameworks, ensuring the methodology’s conformance to industry standards. The SANS Reading Room provided a good volume covering white papers on different aspects of information technology security, which gave insight into the latest security trends and best practices. Publications and alerts from the United States Computer Emergency Readiness Team were also quite enlightening about new and emerging threats and vulnerabilities. Other sources, including CSO Magazine, Information Security Magazine, and Homeland Security News Wire, were tapped for updates and other information to keep the risk assessment framework current and relevant.
3. Risk Assessment Plan
4. Risk Assessment Findings
5. Security Recommendations Reports
6. Conclusion
Reference:
Stewart, T. (2024, June). ITEC 610 PROJECT DESCRIPTIONS: IT Security Risk Assessment. Reading.
