IT risk assessment and vulnerabilities at Global Finance, Inc.

GLOBAL FINANCE, INC. (GFI)

IT RISK ASSESSMENT PAPER

When it comes to the risk assessment of Global Finance, Inc. there were identified vulnerabilities that were occurring in the locations of Technical Security, Management, and Operational. Vulnerabilities at the company are looked at as being weaknesses that could possibly be oppressed by a group of threats or just threats in general. Basically, all of these vulnerabilities are able to be alleviated by safeguards that are recommended. These safeguards are security features and certain controls that, when included or added in the information technology environment, alleviate the risk that is connected with the operation to what are the manageable levels. However, a complete conversation of the vulnerabilities and suggested safeguards are discovered in this report. If the safeguards suggested in this risk assessment are not applied, the outcome could be alteration or damage of data, disclosure of sensitive information, or denial of service to the users who are requiring the information on a recurrent foundation.

Risk Assessment Purpose

The goal of this risk assessment is to assess the competence of the Global Finance, Inc. network and security. This risk assessment will give a structured qualitative assessment of the environment that is considered to be an operational environment. The assessment jobs are to be able to addresses sensitivity, threats, risks, vulnerabilities and also the safeguards. The assessment approves cost-effective safeguards to alleviate threats and associated practical weaknesses.

Risk Assessment Scope

The option of this risk assessment measured the system's utilization of controls and resources (planned or implemented) to get rid of and/or handle vulnerabilities usable by threats external and internal to the Global Finance, Inc. system. This Risk Assessment Report will be able to evaluate the privacy (defense from unauthorized expose of system and statistics information), honesty (defense from inappropriate modification of material), and availability which means losing access to the system. Recommended security safeguards will permit management to make decisions in regards to security-connected creativities.

Safeguards and controls

Security is usually defined as the freedom from danger or as the ailment of safety. Computer security, precisely, is the protection of data in a system that against illegal disclosure, alteration, protection or destruction and of the computer system itself against use that is considered to be unauthorized, modification, or refutation of service. For the reason that certain computer security controls prevent productivity, security is naturally a negotiation which security practitioners, system users, and system work in order to attain an acceptable balance among productivity and security. Controls for providing information security can be technical, physical, or organizational.

Physical security is the utilization of locks, badges, security guards, alarms, and similar procedures to control access to computers, related equipment (including utilities), and the processing facility itself. In addition, measures are required for protecting computers, related equipment, and their contents from espionage, theft, and destruction or damage by accident, fire, or natural disaster (earthquakes and floods).

Technical security includes the utilization of safeguards combined into computer operations or applications software, hardware, communications software, and hardware and devices that are related. Technical switches are sometimes recognized as the logical controls. Personnel or administrative, or, security contains management constraints, operational measures, accountability measures, and supplemental administrative controls recognized to offer a suitable level of protection for calculating resources. Furthermore, administrative controls consist of procedures recognized to safeguard that all personnel who have access to computing resources have the necessary authorizations and appropriate security authorizations.

By means of utilizing all three controls it will bring layers of protection, which will in the end, increase security and then making the whole entire process much easier to control. For instance, to make access security better to the data center, rather than using the swap cards that has events of stolen and lost. Company can utilize pass code as technical control, and then be able to come up with a policy and process as what is considered to administrative control.

The lack of security in any one of these components is going to have some kind of negative impact on the computer environment. If there not policy in place, then there can be no good or organized management direction on how to keep the business protected, which also means their people, operation and its information. If there are no procedures and actions with related values, application of policy will be founded on an individual's understanding of policy -- which is expected to vary from individual to individual. If there is no physical security, then administrative and logical controls can be effortlessly avoided without being exposed. The absence of environmental controls can bring down the enterprise and then cause more destruction than a mischievous agent. If there is personnel security that is insufficient, the probability of insider threat increases dramatically and the influence may not be noticed for an important period of time.

The business report developments for the past few years must face with improve system that is tackling more remote users. Upgrade of hardware and application will resolve the delay users complain about and will aid the corporation to keep their evolution in the future. An Employee is considered to be an asset for the company, and improving their qualification will improve the corporation performance and will end the end support their growth. Outsource could possibly solve some money issues, but it might not necessarily take care of everything.

One major security control Global Finance, Inc. is missing is the administrative control policies. The company has to come up with some policies that are necessary to back their operation in order to get their mission in way that is considered to be proper. Management must find a way to force their rules by doing two things. The first would be to bring security awareness training which is considered to be a preventive measure that will aid users to recognize the profits of security practices. If workers are not able to understand the need for the controls being forced, they may sooner or later avoid them and in that way weaken the security program or render it unproductive. Technical training can aid so that they will not run into all of the common security issues such as omissions and errors in addition to making sure that they understand how to make suitable backup files and notice control viruses. Also, technical training just in case there is an emergency and fire drills for operations personnel that can make sure that proper action will be done to stop such events from moving into disasters. Second, a law that explains violations for workers who are not ignoring or following organizational policies.

At the same time, Global Finance lacks a disaster and recovery procedure which is a document that shows all of these procedures for emergency response, and protracted backup operations. It also needs what is called recovery, and this is necessary just in case a computer installation experiences some kind of a partial or total loss of physical facilities (or of admission to such facilities) or computing resources. The most important goal of this plan, used in combination with the contingency plans, is to make available sensible assurance that a computing installation can recover from disasters, continue to process critical applications in a mode that is degraded, and return to a normal mode of operation inside a time key that is reasonable. An important part of disaster recovery planning is to make available for processing at an alternative site throughout the time that the original facility is unobtainable.

Emergency and contingency plans instituted some kind of recovery procedures that speak to specific threats. These strategies aid in stopping minor incidents from being able to escalate into some disasters that could be far worse. For instance, an eventuality plan might deliver a set of procedures that describes the condition and response necessary in order to return a computing competence to nominal operation. An emergency plan is much needed because it might be a specific process for shutting down equipment in the occurrence of a fire or for leaving a facility in the occasion of an earthquake.

Redundancy is the replication of critical mechanisms or functions of a system with the purpose of increasing dependability of the system. The corporation does not need to shut down their system just in case there is hacking and stop their business for these kinds of incidents. Global Finance will need to know the importance of having regular backups of their data they see as important, but to what extent does data need to be backed up in order for it to be safe? It is very possible that someone or even a worker could possibly break into the system and then steal the backups that they could have been using for hundreds of gigabytes of photo files, home videos, and documents of past computers. In some cases certain software information can be stolen, and if Global Finance has the originals on their laptop or a redundant offsite backup, they could very well would have lose all of their data. Global Finance situation is not uncommon, and it's a perfect example of an often understated standard that all of the employees at the company should be able to understand: Global Finance needs redundant backups.

It's pretty simple for Global Finance: They will need to back up their data frequently. When they have set up that back up schedule, Global Finance should figure out a way to back up their data again. After they have got a couple current backups of their files, they should consider backing up their backups off-site. Also, it seems meaningless to contemplate of backing up backups, nonetheless if anything occurs -- failed drives, theft, fire, flood, etc. -- those backups could possibly be lost forever, and if a company has ever lost an important amount of data on account of a hard drive failure then they will know that backups are worth their weight in gold.

Certainly, there is a point of diminishing return when it comes to how much redundancy is needed at Global Finance -- it's not worth the company time/effort/cost to back up their backups ad infinitum -- so the following are some of the best practices that will help Global Finance in the information technology industry:

Schedule and plan regular backups in order to keep Global Finance archives up-to-date. If the company's laptop's hard drive dies, having backups from a long time ago probably will not help the organization as much as backups from last night.

Global Finance needs to make sure the company's data exists on three different mediums. It might seem needless, but if the company's already being intentional about backing up the organization information, they need to take it one step further to duplicate those backups at least one more time.

Something might happen to the company's easy onsite backups, so it is significant to consider off-site backups also. There are a lot of companies offering secure online backups for home users, and those are largely easy to use.

Global Finance needs to check their backups regularly. Having a backup is hopeless if it is not configured to back up the precise data and running on the schedule that is correct.

RAID is not considered to be a backup solution. Yes, RAID can match data across hard drives, nevertheless that do not mean the data is being "backed up" ... If the RAID array does not appear to work, all of the hard drives (and all of the data) in the array will crash with it.

Conclusion

The Risk Assessment at Global Finance identifies the present level of risk for the application and provides for the company risk mitigation recommendations for management review. The Risk Assessment at the organization serves as the main access control function for many critical applications and the loss of system availability, confidentiality, and/or reliability that could have an incapacitating impact on the organization's assignment. The sensitivity level of the system and of the data stored within, handled by, or communicated by the system reflects the worth of the system to the organization. Applying the recommended safeguards will decrease the general risk exposure associated with the general vulnerabilities talked about above.