Security risk assessment of Hilcorp Energy Company's IT infrastructure

Information Technology

Hilcorp Energy Company is a medium sized organization specializing in the exploration of oil and natural gas. The company headquarter is located in Houston in the United States. However, the company has other operating locations in Gulf Coast region, the Rockies and Gulf of Mexico. The company Vision is "to be premier private energy company in the United States" while the company vision is to "efficiently develop energy that would otherwise be lost while providing an enjoyable and challenging work environment where long-term personal wealth can be created for all." (Hilcorp Energy, 2011 P1). Established in 1989, the company employs latest technology to extract oil and gas at Wyoming's Powder River Basin and Gulf of Mexico.

The objective of this report is to provide practical security assessment on the IT infrastructures and practices of Hilcorp Energy Company.

To enhance the ethical consideration, the researcher seeks for the permission from the management of the Hilcorp Energy Company before conducting the analysis on the IT infrastructure and practice of the company.

Ethical Consideration

To enhance the ethical consideration, the researcher seeks permission from the management of the Hilcorp Energy to evaluate the current IT infrastructure and practices of the company. To seek the permission from the management, the researcher wrote a formal letter to the Information Technology Director, Jim Noot, explaining the major objective for conducting research on their organization, and the benefits their organization will derive from the findings of the analysis. Having wait for almost a week for the response and received no reply, the researcher telephoned the IT director asking for the status of his letter. During the 30 minutes telephone conversation, and the researcher assures the director that the researcher only wants to perform external security consulting on the company IT infrastructure and practice and the findings of the assessment will be kept confidential. Having convinced the director the motive behind the assessment, the director finally accepts the researcher request to assess the IT infrastructures and practices of Hilcorp Energy Company.

Method of Data Collection

The researcher employs qualitative approach to collect data. The major objective for using qualitative approach for data collection is to go in-dept into the phenomenon. As being argued by Trochim and Donnelly (2007), qualitative method of data collection is advantageous because the researcher will be able to go in-dept into the phenomenon. A major instrument that qualitative approach uses for data collection is in-dept interview. A shortcoming of qualitative approach for data collection is that it is time consuming. The researcher selects in-dept interview for data collection, and with the permission of the IT director, the researcher is allowed to conduct 30-minute interview with the IT manager. From the interview discussion, the researcher is able to conduct security risk assessment on the IT infrastructures and practices of the company.

Security Risks Assessment

Security risk assessment is important to enhance the greater understanding on the potential danger the company is facing if the company IT infrastructures have been compromised. To conduct the security assessment, it is important to identify IT assets, and its important to the organization.

IT Context and Assets

IT assets include all elements of company software and hardware. IT security is concerned with the protection of the organization IT assets from internal and external threats. Typically, the threats are the potential abuse on the company IT assets. Apart from categorizing the physical hardware and software as assets, the IT assets also include all the information stored in the data warehouse, which could enhance organizational decision-making. Typically, the company uses the hardware infrastructures to enhance organizational networking and communication for the organizational efficiency. The company hardware, software and the company data warehouse are the key company IT assets. These IT assets are categorized as high risks for the company because a damage to the company IT assets could make business process of an organizational to go standstill.

Teymouri & Ashoori (2011) argue that IT infrastructures are considered as the strategic assets of most organizations, and they are important factors that lead to the business success. Organizational IT assets may worth several thousands of dollars or several millions of dollars, and if adequate measures are not implemented to protect the company IT assets, an organization may face danger of losing huge amount. Typically, by losing the company IT assets, a company public image may be at significant risks which may make an organization to lose some of its major customers. Moreover, if a company IT assets are compromised, the confidence the stakeholders have on the organization will diminish. Thus, an organization needs to employ maximum-security measures to protect the company assets. (Teymouri, & Ashoori 2011).

Identification of IT Threats

Identification of risks that could harm the company IT assets is very critical. The threat identification will enhance greater understanding of the organization on the impact of the threat, and the adequate measure needed to prevent the threat on the organizational IT infrastructures. Some of the risks that could damage the company IT assets are as follows:

Intruders: The sophisticated hackers are termed as intruders who could enter the company database and steal vital information that worth thousands or millions of dollars from the company database. Depending on the type of information, the hackers may use this information for monetary purpose. For example, the hackers may turn this type of information onto the hand of the competitors.

Natural Disaster: Disaster such as fire, flood, earthquake, and tornado are another sort of risks on organization IT assets. These type of risks may damage organizational assets that worth thousands or millions dollars within few hours.

Disgruntled Employees: This is another type of internal risk and if not properly managed, it may cause an organization an un-estimated amount of money. A disgruntled employ may turn company vital information on the hand of the competitors or may deliberately damage the company IT assets. (United States General Accounting Office 1999).

Analysis of these risks is very critical to enhance greater understanding the method to manage them.

Development a Risk Treatment Plan

To obtain required return on investment (ROI), the risks need to be managed effectively. The additional type of risks that organization needs to be addressed is as follows:

Network Security: Organization network is very vital for effective business communication. An unauthorized individual could intercept data transmitted through computer network. Thus, there is a need to develop appropriate security plan to enhance network security. The following procedures should be followed to enhance network security:

Proper documentation of the design and implementation of the network.

Firewall configuration to deter unauthorized access to the network.

Installation of antivirus software on all systems and servers.

Prevention of authorized access to the company data and network.

Always update the virus signature.

Encryption and secure connection.

Software security and security for the operating system

Use of access control and authentication

Use of Intrusion Detection System (IDS).

Use of Intrusion Prevention System (IPS).

Network routing control.

Network connection control.

Password management such as regular change of password.

Use of authentication, automatic terminal identification

Terminal logon procedure.

Physical Security: Physical security refers to the procedures of securing the company physical assets such as building, working areas, documents, systems and devices. All these items need be secured properly. Damage to any of these items could lead to damage of IT assets. The procedures to provide key security measures for company facilities are as follow:

Provision of 24-hour security with the trained security guard.

Use of physical entry control such as:

- Identification mechanisms such swipe card and identification card.

- Access authorization.

- Access restriction to be implemented on a daily basis.

- An entry and exit tracking system.

- Restricted access to data centre and server rooms

- Close 24-hour monitoring by a circuit television at critical locations such as network room, and data center.

- Restricted movement of media such as flash drives, compact disks etc.

-Paper control through authorization and physical inspection at gate passes.

-Use of fire detector system and fire suppression system

-Storing backup media that contain critical information at remote offline location.

Based on the identification of the risks on the IT assets and the methods for the treatment of these risks, the report discusses whether the Hilcorp Energy Company is actually having the appropriate policies and procedures for the treatment of these risks.

Results of the Risks Analysis

Based on the risk assessment conducted on Hilcorp Energy Company, the report uses the following criteria to assess the organizational IT security.

User Authentication and Access Controls

User authentication is the process of identifying a user's identity before being allowed to gain access to the computer system. Analysis of the method that Hilcorp Energy Company employs for the authentication practice is the use of the password-based authentication where a user is asked to input his or her password during login to gain access to the computer network. The process is that a user is asked to enter his or her password each time they want to get access to the network system. While this process is effective within the organization because the process only allows the authorized users to gain access to the computer network, however password-based network is not effective in the computer network. A sophisticated hacker could intercept the password remotely. There are situation where hackers uses the Trojan horse or worm to infect the user computer in order to steal a user password. In addition, password sent across the network could be eavesdropped and be used by an eavesdropper to impersonate the user. Moreover, password-based authentication is inconvenient because the users are asked to enter their passwords each time they want to get access.

The company access control policy is effective because it defines the operations or the action that a legitimate user could execute. The company uses access control system to prevent users to implement the activities that could lead to a breach of security. The company policy and procedures on access controls is that the company uses a reference monitor to mediate user's attempt into the system. Each time a legitimate user attempts to get access to the system, the reference monitor consults the authorization database to determine whether a user could be authorized to perform the operation.

PC / Workstation Security

The workstation is an "electronic computing device, including laptop, tablet PC, desktop computer, PDA, or any other device that performs similar functions, as well as the electronic media stored in its immediate environment such as local hard drives, CDROMs, floppy drives, zip-drives that are directly connected to the device"(University of California, 2007 P1).

Security of the PC/workstation is very important to address the risks that might have occurred at the workstation. Risk assessment of Hilcorp Energy Company reveals that the company employs different procedures to enhance the security of PC/workstation. The company allows workers to use personal computers (PC). At the site, workers could move from one place to the other, thus, the use of PC is allowed. Typically, the PC of each worker contains vital organizational information, and if such PC gets onto the hand of an authorized user, the company information might be at risks. Thus, the company implements some security measures to enhance security of the PC/Workstation.

First, there are trained security guards at the company location to ensure that an unauthorized person is not allowed at the company location. In addition, the company uses 24-hour monitoring circuit television to monitor the activities going on at the location.

Moreover, the company implement physical inspection at the gate pass. Since the users could make use of PC to work, the company employs access control to control the nature of work a user could perform while using a PC.

Moreover, the company implements a virus detection system by using virus detection software. In addition, the company stores all the backup offline at a remote location. Part of the company security policy is that the company also prohibits the installation or download of personal software in the company PC.

The company also install antivirus software on all the company PC. The authentication of a user is required before a user is allowed into the system. The company also uses encryption procedure to protect company data from the authorized access. While the company employs all these security measures for the company PC/Workstation, there are still some shortcomings identified with the company security measures.

While the company employs encryption to protect the company data from an authorized user, the company does not implement "cryptography for PC/workstation security." (Harn, Lin, & Xu 1994). Although, encryption is very effective for the security of PC/workstation, however, encryption could only remain effective if the private key used for decryption is not compromised. In the case of the Hilcorp Energy, many people use the same private key for decryption. With this system, the private key could be easily compromised. The use of cryptographic methods could employ to address the shortcoming identified in the encryption method. (SecureRF, 2010).

Network Perimeter Security

The company uses Wide Area Network (WAN) to connect the headquarter with the other stations. Analysis of the security of the network perimeter reveals that the company implements firewall and intrusion detection system (IDS) as the security procedures for the network system. Typically, firewall is effective because it blocks unauthorized traffic. In addition, the firewall enables the fast packet inspection and is able to filter authorized traffic. The only shortcoming for using firewall as only security procedure is that firewall cannot detect high level-level attacks. In addition, the firewall cannot block the malicious traffic that passes through the open ports or traffic that appears legitimate. Moreover, firewall could not block the traffic that passes through encrypted tunnel.

The company also uses the intrusion detection system (IDS) as another method to enhance network security. While IDS is effective to detect unauthorized access to the network, however, the IDS cannot prevent the unauthorized access to the network.

Based on the shortcoming identified on the security devises of the company, the report suggests the effective security procedures that the company could employ for IT security.

Recommendations

The paper recommends that the company should use public key cryptographic technique to enhanced security of the computer system. With public key cryptography, only the message sender and the receiver will share the public key to encrypt and decrypt the text. The use of public key cryptography will ensure that the private key used for the decryption of the text is not compromised. (Kumar, Jindal, Gupta, et al. 2011).

Moreover, the company should use the intrusion prevention system (IPS) in combination of IDS. The IPS is effective to prevent unauthorized access of malicious traffic into the company network. The company should also implement application layer filtering to scan the content of the email to ensure that the emails do not contain illegitimate data. The company should also use application layer filtering to detect, inspect and validate the traffic that passes through port and protocol.

Additionally, the company should implement proactive antivirus system to protect the computer system from the virus attack. The company should also use ISA Server 2004 to enhance IDS capabilities. Another recommendation for network protection is that the company should use firewall with multiple-layer filtering. The company should also employ high-level security policy to ensure that all employees adhere to the company security procedure. (Stephen, Lenny, Scott 2003).The company should implement 3-day workshop for all employee to enhance their greater understanding on the company IT assets and the method to implement adequate security measures on the company assets.

Conclusion

The report provides practical security assessment on the method Hilcorp Energy Company employs to implement security practice and procedures on the IT assets. The report uses in-dept interview for data collection. From the data collected, the report reveals that the company management has a greater understanding on the importance of providing security measures on the company IT assets. The company understands that IT contributes to the strategic advantages of the organization. Thus, the company employs different strategies to enhance security of the company assets. While the company takes practical measures to implement adequate security devices for the company assets, the report identifies some loopholes in the company security practice and procedures. To enhance the security measures on the company assets, the report suggests that the company should implement more security measures such as the use of public key cryptography technique, IPS, and the use of multi-layer firewall to increase the company security practice and procedures.