Fluent Essays

Hi, Please find attached the assignment and the supporting doc.   Quick as possibleTitle of Your Assessment Your Name Central Washington University Date Throughout this template, replace any blue text with the text for your report. The blue text is instructions. When you submit your report, all blue text should be removed. Table of Contents Executive Summary 3 Overview of Assessment 3 Identified Risks and Common Risk Themes 3 Summary of Proposed Mitigation Activities 3 Risk Assessment Report 4 Overview of Risk Assessment 4 Risk Measurement Criteria 4 Scope of Assessment 4 Security Controls Assessed 4 Areas of Concern (or Risks) 5 Area of Concern (Replace this with an abbreviated version of the wording from Worksheet 10.) 5 Risk Heat Map 5 Risk Mitigation 5 Risks to Accept 5 Risks to Defer 6 Risks to Transfer 6 Risks to Mitigate 6 Reference List 7 Octave Allegro Worksheets 8 Octave Allegro Questionnaires 9 Executive Summary Overview of Assessment When the assessment took place, I interviewed the branch manager of department of information. During the interview, the information asset we assessed were employees account information. However, there was a limitation in the process of the assessment. The purpose of assessing employee’s account information was to see what are the chance that that account information would be compromised. Identified Risks and Common Risk Themes There was some area of concerns that I have discovered while the assessment was in progress. One of those concerns was a disgruntle employee may release employee account information. Other areas of that were also a concern was a hacker may gain access to employee account information. Other areas were how do they manage the employee accounts. Summary of Proposed Mitigation Activities The common thing to do when you are mitigating risk is first start with the basic assessment. A basic assessment can be something like evaluating the system setting that has been set by default such as a type of encryption, is the computer’s hard drive encryption enabled or disabled, internet security setting configured or not, etc. Those are the general things that would need to be examined before deciding which security controls to implement to the computer system. Risk Assessment Report Overview of Risk Assessment I used Octave Allegro methodology to help me to get a better understanding on what areas to assess and see what the potential impact on those areas are would be. For example, Aneel has provided me the information such as the percentage for worksheet 1 through 3 on the different level of each impact are. The usage of the Octave Allegro worksheet has provided me a better insight as to what kind of question I could as Aneel. Risk Measurement Criteria The following impact areas are what Aneel and I determined needed to be assessed such as reputation and individual confidence, financial, and safety. In each of these areas, Aneel and I have agreed that safety will ranked number 4 which mean that areas is the most important. Follow by individual confidence whiIntroducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process Richard A. Caralli James F. Stevens Lisa R. Young William R. Wilson May 2007 TECHNICAL REPORT CMU/SEI-2007-TR-012 ESC-TR-2007-012 CERT Program This report was prepared for the SEI Administrative Agent ESC/XPK 5 Eglin Street Hanscom AFB, MA 01731-2100 The ideas and findings in this report should not be construed as an official DoD position. It is published in the interest of scientific and technical information exchange. This work is sponsored by the U.S. Department of Defense. The Software Engineering Institute is a federally funded research and development center sponsored by the U.S. Department of Defense. This work is supported, in part, by ictQATAR, through a contract with Carnegie Mellon University. Copyright 2007 Carnegie Mellon University. NO WARRANTY THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN AS-IS BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder. Internal use. Permission to reproduce this document and to prepare derivative works from this document for inter- nal use is granted, provided the copyright and No Warranty statements are included with all reproductions and derivative works. External use. Requests for permission to reproduce this document or prepare derivative works of this document for external and commercial use should be addressed to the SEI Licensing Agent. This work was created in the performance of Federal Government Contract Number FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The Government of the United States has a royalty-free government-purpose license to use, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do so, for government purposes pursuant to the copyright license under the clause at 252.227-7013. For information about purchasing paper copies of SEI reports, please visit the publications portion of our Web site (http://www.sei.cmu.edu/publications/pubweb.html). http://www.sei.cmu.edu/publications/pubweb.html SOFTWARE ENGINEERING INSTITUTE | i Table of Contents Acknowledgements vii Abstract ix 1 Introduction 1 1.1 History of OCTAVE 1 1.2 Overview of Existing OCTAVE Methodologies 2 1.2.1 The OCTAVE Method 2 1.2.2 OCTAVE-S 3 1.2.3 OCTAVE Allegro 4 1.3 ScopThe  CIS  Critical  Security  Controls   for   Effective  Cyber  Defense   Version  6.0                      i   The  Center  for  Internet  Security     Critical  Security  Controls  for  Effective  Cyber  Defense   Version  6.0     October  15,  2015     This  work  is  licensed  under  a  Creative  Commons  Attribution-­‐Non  Commercial-­‐No  Derivatives  4.0   International  Public  License.  The  link  to  the  license  terms  can  be  found  at   https://creativecommons.org/licenses/by-­‐nc-­‐nd/4.0/legalcode     To  further  clarify  the  Creative  Commons  license  related  to  the  CIS  Critical  Security  Controls  content,  you  are   authorized  to  copy  and  redistribute  the  content  as  a  framework  for  use  by  you,  within  your  organization  and   outside  of  your  organization  for  non-­‐commercial  purposes  only,  provided  that  (i)  appropriate  credit  is  given   to  CIS,  and  (ii)  a  link  to  the  license  is  provided.      Additionally,  if  you  remix,  transform  or  build  upon  the  CIS   Critical  Security  Controls,  you  may  not  distribute  the  modified  materials.  Users  of  the  CIS  Critical  Security   Controls  framework  are  also  required  to  refer  to  https://www.cisecurity.org/critical-­‐controls.cfm  when   referring  to  the  CIS  Critical  Security  Controls  in  order  to  ensure  that  users  are  employing  the  most  up  to  date   guidance.    Commercial  use  of  the  CIS  Critical  Security  Controls  is  subject  to  the  prior  approval  of  The  Center   for  Internet  Security.          ii       The  CIS  Critical  Security  Controls  for  Effective  Cyber  Defense     Introduction   1   CSC  1:    Inventory  of  Authorized  and  Unauthorized  Devices   6   CSC  2:    Inventory  of  Authorized  and  Unauthorized  Software   9   CSC  3:    Secure  Configurations  for  Hardware  and  Software  on  Mobile  Devices,  Laptops,  Workstations,   and  Servers   12   CSC  4:    Continuous  Vulnerability  Assessment  and  Remediation   16   CSC  5:    Controlled  Use  of  Administrative  Privileges   20   CSC  6:    Maintenance,  Monitoring,  and  Analysis  of  Audit  Logs   23   CSC  7:    Email  and  Web  Browser  Protections   26   CSC  8:    Malware  Defenses   30   CSC  9:    Limitation  and  Control  of