Practical Applications in Cybersec Mgmt and Pol

Project 1 Case Study 1: Bank Solutions, Inc. Gap Analysis Submitted To: Prof. Richard A. White Submitted By: Project 1 Case Study 1: Gap Analysis CSIA 485 – Practical Applications in Cybersecurity Management Due Date: March 30, 2014 Introduction The information can be most important asset that the Bank Solutions, Inc. needs to be protected in order to ensure the information confidentiality, integrity, and availability. Insuring the company’s confidentiality, integrity, and availability is crucial to its operations. As the Bank Solutions, Inc. continues to grow potentially, it become a target for a leverage corporate buyout. It becomes an attractive situation to Douglas Smith, the Chief Information Officer for the Bank Solutions, Inc., and other members of executive management which are close to retirement. It leads to the Bank Solutions to have contracted an outside consultant to identify the operating and regulatory risk and the control measures to mitigate the risks. The Bank Solutions implementations of Risks Assessment provides crucial findings:  The Bank Solutions data center Disaster Recovery Business Continuity Plan was last created in 2007, and last updated in 2009. Furthermore, it was last tested in 2007.  The Disaster Recovery Business Continuity Plan distribution lists appears to be that not all key the participants have a copy of the plan.  There are no proper incremental and full backups plan.  The key participants on the critical plan have not been trained to use the Disaster Recovery Business Continuity Plan.  The Bank Solutions has no proper way in handling security incidents, including escalation points of contract and procedures for preserving the forensic qualities of logical evidence.  There are no specific privileged activities on production servers and selected administrative back office system. In this scenario, Gap Analysis is very useful for the beginning of a project creating and developing business model so that the organization can identify the tasks that they need to complete to deliver the project. Below diagram is the Gap Analysis Plan (Risk Assessment, Security Patches, and Propose timeline) for this Scenario: Threats, Risks, and Vulnerabilities Recommended IT Security Strategy Propose Timeline Out-of-date Disaster Recovery Business Continuity Plan Implement newer version of Disaster Recovery Continuity Plan that should cover what the business should do after disaster and how to continue doing business until recovery is accomplished (Kene, (n.d.)). Update all copies of Disaster Recovery Business Continuity Plan if every time something changes (Kene, (n.d.)). Out-of-date Disaster Recovery Business Continuity Plan facility testing activities Identify the contingency locations. Test the possible scenario. Don’t wait until the actual disaster strikes to figure out what to do next. Run the test (Kene, (n.d.)). Run the Disaster Recovery Business Continuity Plan again a few months later to test if DRBCP team forget something. Even though the team has a solid plan, they should test it annually to make sure (Kene, (n.d.)). Not all Disaster Recovery Business Continuity Plan key participants have a copy of the critical plan List all the personnel, and contacts and service companies that participants in Disaster Recovery Business Continuity Plan. Make sure not to miss someone. Furthermore, make plenty of copies to give to each of the key participants of Disaster Recovery Business Continuity Plan and keep several copies at an off-site location, and in safety deposit box (Kene, (n.d.)). Give the copy of Disaster Recovery Business Continuity Plan if it is a solid plan. Even though the team has a solid plan, they should test it annually to make sure (Kene, (n.d.)).

Courses in CSIA

Popular Documents from University of Maryland-University College

University of Maryland-University College