Reference no: EM133956425
Assignment:
Scenario:
Hank Helicopter Supplies (HHS) is a moderately sized helicopter parts company that employs 200 people. While HHS will not be storing any classified information on its server, the client's procurement orders are considered sensitive but unclassified.
HHS sells its parts online, where HHS customers create accounts on the www.hhs.aero website and order the supplies they need. The traffic between each customer and HHS website is encrypted using SSL.
HHS management believes in "prevention first" strategy. Money allocated for security was spent on an expensive commercial firewall to protect the internal network. Most of the system deployed by HHS and its partners run windows 7.
HHS links to several smaller partners that supply parts. These partners contact through the internet via VPNs. HHS also supports several remote sales offices that rely on cable modems for connectivity. In addition to wired links, HHS supports wireless 802.11b connectivity. The
wireless access point is plugged directly into the enterprise-class switch on the internal network.
The afternoon of Tuesday, October 20, was not a pleasant one for HHS. The sales department issued its invoices via email that morning and expected to see the money start rolling in.
October's sales looked unusually good, and the staff expected hefty bonuses that month. But instead of money, HHS began collecting complaints. Angry customers reported seeing charges for expensive helicopters parts they didn't order. The odd orders were advance avionics, navigation, and weapon system computers.
HHS system administrators had already prepared to work through the weekend. Growing weary with the slow response times on the company's Apache HTTP 2.0 server, they had planned to take the system down for maintenance. They were ready to add a few more gigabytes of RAM and mount a third hard drive in the system. They did not relish the thought of looking for bugs in the MySQL database server, which also ran on the same platform as the Web server.
The company appointed Alex the Information Security Officer to investigate, who ended up with an initial analysis for the attack which has been later handed over to you before his leaving due to medical reasons.
His report concluded that most likely the attacker got access into the system using social engineering and user interaction to put in the malicious code or using local privileged user. The attacker managed to replace all the current web -apps including those in server/web applications, then installed a web app that included an XML parser which was stored in the web application library. Consequently, the server will apply the new parser to handle all (web.xml) and tld files of other web application.
After interviewing a number of employees, you have found the following:
Last year, a mild earthquake rattled the main campus and fortunately, no damage was reported to the structure or foundations. Earthquakes in this area occur approximately once every other year.
David, the sales manager, often leaves his workstation logged on so his assistant can enter data and reply to some emails on his behalf and access client records.
Each winter due to heavy rains, the river down the road comes dangerously close to overflowing and flooding the nearby neighbourhood, including the company.
Victoria, the receptionist takes advantage of the company's fast Internet connection by downloading music to her computer via torrent software.
A small fire occurred 3 years ago in the patient waiting area that triggered the water sprinkler system. The fire was extinguished, however water from the sprinkler system damaged furniture and computer equipment. Building records show 4 fires have occurred in the past 20 years.
There is a lack of information security training due to high employee turnover and employee orientation materials not being kept up to date. Employee manuals and orientation materials are updated once every three years.
TASKS
Write a report addressing the following tasks:
- Identify all relevant threats considering all sources of threats.
- Identify all relevant vulnerabilities. Determine what weaknesses exist due to a lack of a security control and document them.
- Determine the likelihood of risks. What is the impact of the risks if they occur? How will it affect confidentiality, integrity and availability of the client records if they occur?
- What is your recommendation plan and security countermeasures that should be taken?