OCTAVE-S on TradeSolution Inc.. Introduction Phase 1: Critical Assets and threats Phase 2: Critical IT Components Phase 3: Changes Required in current.

Slides:

Advertisements

Similar presentations

Web Security for Network and System Administrators1 Chapter 1 Introduction to Information Security.

Advertisements

Mobile Devices: Know the RISKS. Take the STEPS. PROTECT AND SECURE Health Information.

OCTAVESM Process 4 Create Threat Profiles

NERC Security Requirements – What Vendors Should Provide James W. Sample, CISSP, CISM Manager of Information Security California ISO.

Smart Grid - Cyber Security Small Rural Electric George Gamble Black & Veatch

Network and Server Basics. 6/1/20152 Learning Objectives After viewing this presentation, you will be able to: Understand the benefits of a client/server.

INTRANET SECURITY Catherine Alexis CMPT 585 Computer and Data Security Dr Stefan Robila.

1 Pertemuan 9 Network Security and E-Commerce Matakuliah: M0284/Teknologi & Infrastruktur E-Business Tahun: 2005 Versi: >

Security Architecture Dr. Gabriel. Security Database security: –degree to which data is fully protected from tampering or unauthorized acts –Full understanding.

Comptroller of the Currency Administrator of National Banks E- Security Risk Mitigation: A Supervisor’s Perspective Global Dialogue World Bank Group September.

Accessibility, Integrity, & Confidentiality: Security Challenges for E-Business Rodney J. Petersen University of Maryland & Educause/Internet2 Security.

Chapter 7 Database Auditing Models

Presented by Manager, MIS.  GRIDCo’s intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to GRIDCo’s.

1 BUSINESS CONTINUITY AND DISASTER RECOVERY PLANNING Reducing your Risk Profile MIDWEST DATA RECOVERY INC.

1 Managed Security. 2 Managed Security provides a comprehensive suite of security services to manage and protect your network assets –Managed Firewall.

Copyright 2010, The World Bank Group. All Rights Reserved. Agricultural Coding and Data Processing Section B 1.

Lesson 8-Information Security Process. Overview Introducing information security process. Conducting an assessment. Developing a policy. Implementing.

Network Security Policy Anna Nash MBA 737. Agenda Overview Goals Components Success Factors Common Barriers Importance Questions.

Information Systems Security Computer System Life Cycle Security.

11 SECURITY TEMPLATES AND PLANNING Chapter 7. Chapter 7: SECURITY TEMPLATES AND PLANNING2 OVERVIEW  Understand the uses of security templates  Explain.

© 2001 Carnegie Mellon University S8A-1 OCTAVE SM Process 8 Develop Protection Strategy Workshop A: Protection Strategy Development Software Engineering.

Security Architecture

Security Professional Services. Security Assessments Vulnerability Assessment IT Security Assessment Firewall Migration Custom Professional Security Services.

Environment for Information Security n Distributed computing n Decentralization of IS function n Outsourcing.

Module 14: Configuring Server Security Compliance

Kevin Casady Hanna Short BJ Rollinson.  Centralized and Structured collection of data stored in a computer system  An electronic filing system  Easy.

Chapter 6 of the Executive Guide manual Technology.

INFORMATION SECURITY & RISK MANAGEMENT SZABIST – Spring 2012.

April 14, A Watershed Date in HIPAA Privacy Compliance: Where Should You Be in HIPAA Security Compliance and How to Get There… John Parmigiani National.

KAPLAN SCHOOL OF INFORMATION SYSTEMS AND TECHNOLOGY Unit 4 IT 484 Networking Security Course Name – IT Networking Security 1203C Term Instructor.

Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 7 Database Auditing Models.

© 2001 by Carnegie Mellon University SS5 -1 OCTAVE SM Process 5 Background on Vulnerability Evaluations Software Engineering Institute Carnegie Mellon.

Ali Pabrai, CISSP, CSCS ecfirst, chairman & ceo Preparing for a HIPAA Security Audit.

CSE 4481 Computer Security Lab Mark Shtern. INTRODUCTION.

Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 1 Security Architecture.

Module 6: Designing Security for Network Hosts

Prepared by Dept. of Information Technology & Telecommunications, November 19, 2015 Application Security Business Risk and Data Protection Gregory Neuhaus.

CPS ® and CAP ® Examination Review OFFICE SYTEMS AND TECHNOLOGY, Fifth Edition By Schroeder and Graf ©2005 Pearson Education, Inc. Pearson Prentice Hall.

Risk Assessment Richard Newman. Six Phases of Security Process 1. Identify assets 2. Analyze risk of attack 3. Establish security policy 4. Implement.

Chapter 2 Securing Network Server and User Workstations.

Small Business Security Keith Slagle April 24, 2007.

Module 11: Designing Security for Network Perimeters.

Introduction to Information Security

Lesson 19-E-Commerce Security Needs. Overview Understand e-commerce services. Understand the importance of availability. Implement client-side security.

CSCE 548 Secure Software Development Security Operations.

Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 1 Security Architecture.

The Importance of Proper Controls. 5 Network Controls Developing a secure network means developing mechanisms that reduce or eliminate the threats.

Jeff Warnock COSC 352 Indiana University of Pennsylvania Spring 2010.

Welcome to the ICT Department Unit 3_5 Security Policies.

Network and Server Basics. Learning Objectives After viewing this presentation, you will be able to: Understand the benefits of a client/server network.

INSIDER THREATS BY: DENZEL GAY COSC 356. ROAD MAP What makes the insider threat important Types of Threats Logic bombs Ways to prevent.

S7-1 © 2001 Carnegie Mellon University OCTAVE SM Process 7 Conduct Risk Analysis Software Engineering Institute Carnegie Mellon University Pittsburgh,

Information Systems Security

CS457 Introduction to Information Security Systems

Blackboard Security System

Review of IT General Controls

Team 1 – Incident Response

BUILDING A PRIVACY AND SECURITY PROGRAM FOR YOUR NON-PROFIT

Information Security based on International Standard ISO 27001

Risk Assessment Richard Newman

IT Vocab IT = information technology Server Client or host

RECORDS AND INFORMATION

IS4680 Security Auditing for Compliance

How to Mitigate the Consequences What are the Countermeasures?

IS4680 Security Auditing for Compliance

Security week 1 Introductions Class website Syllabus review

PLANNING A SECURE BASELINE INSTALLATION

Agenda The current Windows XP and Windows XP Desktop situation

Presentation transcript:

OCTAVE-S on TradeSolution Inc.

Introduction Phase 1: Critical Assets and threats Phase 2: Critical IT Components Phase 3: Changes Required in current strategy

TradeSolutions Inc. TradeSolutions Inc. A mid sized company with an office in Sweden Specialized in providing trading solution and surveillance technology for marketplaces, banks. Develops, customize and maintain trading platform ‘TradePro’. Customers access TradePro using the client application to do trading

TradeSolutions Inc. TradeSolutions Inc. 200 local workstations with windows XP running File Server, Web Server, Database Server, MS Exchange 2007 mail server. Production server which hosts TradePro Centrally stored data is located at two different premises (sites 1 and 2) Every employee can access the file server, database server and web server from remote area using VPN

Impact Criteria Reputation: Customer loss >10% Finance: Annual financial loss > 5 Million SEK Productivity: Staff work hours increase > 20% Fine: > 2.5 Million SEK

Critical Assets Code Repository Production Server Mail Server Personal Computers TradePro team Phase1: Asset-Based Threat Profiles

Phase 2: Identify Infrastructure Vulnerabilities Critical IT component

Threats with Highest Impact Code Repository Disclosure of the code o Competitors, hackers (External) o Employees (Internal) High impact on reputation, finance and productivity Production server Interruption or destruction o Competitors, hackers (External) o Internal IT team (Internal) o system problem, power supply and natural disaster High impact on reputation and finance Phase 3: Develop Security Strategy and Plans

Personal Computers Interruption or destruction o Competitors, hackers (External) o System problems and power supply High impact on reputation and finance. Mail Server Disclosure of the messages o Hackers (External) o Developers and internal IT (Internal) High impact on reputation and finance TradePro Team Unavailability of the team due to illness, family problems, retirement, resignation and lay off High impact on productivity and finance Phase 3: Develop Security Strategy and Plans Threats with Highest Impact

Authentication and Authorization (Red) Introduce Role based authorization scheme as a formal mechanism to restrict unauthorized users to access critical assets. Employees should not be given administrative privileges. The security policy should include the proper procedures to review the access rights of any employee. Internal IT team must take care of these issues Phase 3: Develop Security Strategy and Plans Protection Strategy & Risk Mitigation Plans

System and Network management (Yellow) Formal mechanisms should be defined to enforce Security Policy Access to USB and CD ROMs should be limited Checking the systems to remove any unnecessary software. Implement an auditing mechanism to verify whether the security requirements are met. Introduce new network managing and monitoring tools to reduce the manual labor. Implement a secure system. Internal IT decides and tracks this part. Phase 3: Develop Security Strategy and Plans Protection Strategy & Risk Mitigation Plans

Security awareness and training (Yellow) For all employees Conduct awareness courses. Workshop for new secure system Trainers from inside the company Responsibility of senior management For Internal IT Professional Workshop for new purchased security tools to protect code repository, production server and secure mail server. Trainers from outside the company Responsibility of security manager Phase 3: Develop Security Strategy and Plans Protection Strategy & Risk Mitigation Plans

Next Step Adequate funding should be allocated. Senior and security management supervision is needed. Security courses should begin just after the deployment of new tools and implementation of authorization policies. Conduct OCTAVE-S six months after the completion of general security awareness courses for all employees.