Security Incident Analysis
To be proactive, organizations need to have structures, processes, and plans in place to counter and respond to potential attacks and to deal with the consequences of successful attacks. A suitable security management plan and well-defined security goals that support the overall goals of the organization can ensure a reasonable level of business continuity, even in the case of security incidents.
In any organization, the individuals on the IT staff must work together to support the security goals of the organization. These individuals play significant roles in detecting and preventing security incidents before they occur. In the case of successful attacks, security management professionals are tasked with acting quickly to mitigate the attack’s effects.
In this assessment, you will refer to the attached “Case Study” document, which contains details regarding a security incident at a small non-governmental organization (NGO). In part I of this task, you will analyze the security incident and provide specific examples and details from the case study to support your risk assessment. In part II, you will create a plan to effectively address the aftermath of the incident and manage the NGO’s ongoing security risks.
Requirements
Part I: Incident Analysis and Response
A. Determine why the attack on Azumer Water’s infrastructure was successful, including two specific vulnerabilities that allowed the attack to occur. Provide details from the case study to support your claims.
B. Explain how Azumer Water’s operations and data have been compromised in the following areas:
• confidentiality, integrity, and availability
• PII (personally identifiable information) Security Incident Analysis
For two of the claims, support your analysis using an industry-standard framework such as NIST or ISO 27002.
C. Identify a federal regulation this NGO violated, providing a specific example from the case study as evidence of Azumer Water’s noncompliance.
D. Recommend two immediate steps to mitigate the impact of the incident, using specific examples from the case study to justify how these steps would mitigate the impact.
E. Explain how having an incident response plan in place will benefit Azumer Water, using details from the case study to support your explanation.
Part II: Risk Assessment and Management
F. Discuss two processes to increase information assurance levels within the organization and bring Azumer Water into compliance with the violated federal regulation identified in part C.
G. Recommend two technical solutions to counter the remaining effects of the attack in the case study and to prevent future attacks.
H. Recommend an organizational structure for IT and security management, including a logical delineation of roles and adequate coverage of responsibilities, to support the efficient discovery and mitigation of future incidents.
I. Identify two risks from the Azumer Water case study and address each of the following components for both risks:
Note: Refer to the “Risk Determination Template” for support with identifying and categorizing risks.
• threat event (risk management tier, threat event from the case study)
• threat source (type of threat source, threat source from the case study)
• threat source characteristics (capability rating, intent rating, targeting rating)
• relevance Security Incident Analysis
• likelihood of attack initiation
• vulnerabilities and predisposing conditions
• severity rating and pervasiveness rating
• likelihood initiated attack succeeds
• overall likelihood
• level of impact (type of impact, potential impact to the organization from the case study, impact rating)
• risk rating
• Discuss your risk management approach based on these risk categorizations
J. Acknowledge sources, using in-text citations and references, for content that is quoted, paraphrased, or summarized.
K. Demonstrate professional communication in the content and presentation of your submission.
Reference List
National Institute of Standards and Technology. (2012). Guide for Conducting Risk Assessments (NIST SP 800-30 Rev. 1). https://doi.org/10.6028/NIST.SP.800-30r1
Supporting documents also attached
-
Why was the attack on Azumer Water successful and what vulnerabilities allowed it?,
-
How were confidentiality integrity availability and PII compromised?,
-
What federal regulation was violated, and how?,
-
What immediate steps can mitigate the impact?,
-
What technical solutions can prevent future attacks?
