Risk assessment and business continuity planning for GFI Group, Inc.

Risk Assessment for GFI Group, Inc. (GFI)

RISK ASSESSMENT

Company Network, Interconnection, and Communication Environment

When it comes to the company network, GFI Group, Inc. (GFI) operates as a dealer brokerage company, which was discovered in the U.S. It is in network with over the counter (OTC) related securities and derivative products. The company mostly offers market data brokerage services, and analytics software merchandises to commercial and investment banks, insurance corporations, large businesses and hedge funds in places such as Asia Pacific, North America, and Europe. Furthermore, it offers brokerage services in four broad product classes which consist of credit, equity, financial and commodity. What is more, the company functions through a network of offices in New York, London, Cape Town, Paris, Sydney, Hong Kong, Seoul, Singapore, Tokyo, Englewood Calgary, and Sugar Land. GFI is headquartered in New York City, New York, the U.S.

T As far as Global Finance, Inc. (GFI) interconnection is concerned the world's top networks, carriers and ISPs have recognized strategic points of presence sites and centers all over the globe. Global Finance, Inc. (GFI) boasts the largest number of networks under one roof of any data center provider. With 9M+ ft 2 sq. ft. Of data center capacity across 31 strategic markets in the Americas, EMEA and Asia-Pacific. Global Finance, Inc. (GFI) Global Finance, Inc. (GFI) directly interconnect with every major worldwide network and to satisfy the peering, transit and traffic exchange obligations.

The communication environment has declined over the years at the GFI Group, Inc. (GFI).It is clear that the Business continuity for disaster recovery is considered to be a high priority for GFI and its subsidiaries, as well as GFI Securities, LLC. Our objective is to guarantee our continued ability to serve their clients and to protect their possessions and the individuals and possessions of their company. At the moment, the communication has been a failure due to the fact that its network security has not been able to keep up with the company growth. Their Business Continuity Program (the "program") has been developed to provide reasonable assurance of business communication in the event that there are disruptions of normal operations at the firm's critical services which at the moment are taking place.

Access and permission to authorized users of the system

Physical security will involve the company securing its assets by devices for instance alarm system for off hour utilization, and identification cards for workers. A process will need to be should in place to make sure that guests are correctly identified before getting any kind of assess to the facility. Users will not be able to take computer home except they are protected by the encryption software. Also downloading proprietary data onto CD, floppies, thumb/flash/memory drives and other portable media will need to be rejected unless such dealings are pre-approved and appropriate security actions are then taken.

Any enterprise will have to pay special consideration to computer security. Computer security is considered to be a field that is bothered with the control of risks connected to the utilization of the computer. A main focus will need to be on the external threats to the computing environment. In enterprise with branches cross country, it is important to allow information from "trusted" external sources, and disallow intrusion from non-trusted or anonymous sources. In a secure system, those that are the official users of that system are still able to do what they are supposed to do. Strong verification approaches can be used to safeguard that communication end-points of who they say they are, for instance, passwords should have no less than 8 complex character and must be changed every 130 or so days. Furthermore, ability and admission control list methods can be used to make sure privilege separation and mandatory access control are in order.

Mandatory access control is something that will be utilized in order to make that privileged entry is removed when rights are rescinded. Passwords are considered to be one of the most usually used approaches of authenticating user authority. Chain of trust practices can be utilized to endeavor to make sure that all software inserted has been certified as true by the system's designers. Merely official users will need to be able to set up software on the system.

Firewalls are software and/or hardware mechanisms that protect computers from those that are considered to be intruders. However, the firewall will not permit anything to enter come into the computing environment without the accurate markings. Every kind of the networks requires a firewall in order to keep out files and people that are dangerous to the system. In a production arrangement, an application that offers no way to cover already known security errors do not need to be used until the fix is made obtainable. Publicly recognized flaws are the main entry utilized by worms to routinely break into a system and then extend to other systems that are in connection with it. Secunia.com is an enterprise that looks over vulnerabilities in over 13,000 merchandises (Patton, 2003). Secunia's site is something that needs to be put to use as a search instrument for unpatched recognized defects in products that are popular. Software that is Anti-virus quarantines or deletes viruses on your computer, in principle shielding a person against viruses. However, this software once it gets on the computer will of course need to be updated from time to time, as there are new viruses made every day. There are a few things that are vital section of any software that is antivirus, one will need to look for a good discovery rate, compatibility with the companies system, easy to use, and must have the capability to make it update (Crump, 2009). Intrusion-detection systems are able to scan a network for individuals that are on the network but then again who should not be there or are doing things that they should not be doing, for instance trying out a lot of passwords to gain admission to the network.

Cryptographic Methods

In the future, as GFI Group, Inc. (GFI) expands, cryptographic methods can be utilized in order to defend information that is in transit among systems, decreasing the probability that data replaced among systems can be modified or intercepted. Computer security is considered to be an area of computer science that is concerned with the control of risks connected to the use of a computer. There are two dissimilar methods to security when it comes down to the computing. One puts the emphases mostly on external threats, and usually treats the computer system itself as a system that is trustworthy (Crump, 2009). In a secure system, the official users of that system are still capable of doing whatever they need to do.

GFI Group, Inc. (GFI) can use secure crypto processors in order to influence physical security methods into shielding the security of the computer system. Cryptographic methods are something that does include transforming statistics, scrambling it so it turns out to be illegible during transmission. The envisioned receiver can unscramble the message, nevertheless eavesdroppers will not be able to do this. Encryption is utilized in order to protect your message so that others will not be able to use it. This can be done in numerous ways by swapping the characters around, substituting characters with others, and even eliminating characters from the communication. These have to be utilized in combination in order to make the encryption secure enough that is to say, adequately hard to crack. Public key encryption is an advanced and practical way of doing encryption (Suter, 2006). It permits for example anyone to transcribe a message for a list of receivers, and simply those receivers will be able to declaim that message.

Auditing

Continuous auditing of GFI Group, Inc. (GFI) for risk assessment will need to become part of the guiding principle for a complete risk management. A third party will need to be engaged to achieve a detailed audit of the corporation, this is vital since auditing standard is instructed both by Reporting (ISACA) and Information Systems Auditing (Crump, 2009). Agreement with Sarbanes-Oxley Act of 2005 has guided to more difficult groups of controls. Also, ISACA has mentioned that when assessing an establishment's IT controls essential by the U.S. Sarbanes-Oxley Act of 2002, the resulting area have to be assessed:

Emphasis on scoping and support in executing an IT risk assessment for Sarbanes-Oxley

Understandings into people and cultural management concerns to highpoint the human issues that need to be measured when meeting the terms with Sarbanes-Oxley

Direction on application controls introduced to assist businesses in addressing and identifying numerous kinds of application controls and giving a business case for utilizing application controls

Changes to the willingness road map to abridge the procedure

In conclusion, risk managements and also the risk assessment are considered to be areas to be cautiously documented. GFI Group, Inc. (GFI) Management and Assessment project team has to lead a comprehensive survey of every one of the areas of the establishment's industry and make plans to militate against the risks in order to make sure in regards to the business continuity. GFI Group, Inc. (GFI) needs to understand that a policy will have to be expressed and documented with buy-ins from every part of the levels of the corporation on the steps to take to evade and mitigate all of the risks. GFI Group, Inc. (GFI) will need to get involved in making sure that the necessary training and testing of all employees involved in risk management will have to also be implemented in order to make sure that there is a successful result in case of disaster.

References:

Crump, K.S. (2009). Quantitative risk assessment since the red book: Where have we come and where should we be going? Human and Ecological Risk Assessment, 9(5), 1105-1112.

Patton, D.E. (2003). The risk assessment paradigm as a blueprint for environmental research. Human and Ecological Risk Assessment,, 9(5), 1337-1348.

Suter, G.W. (2006). Ecological risk assessment and ecological epidemiology for contaminated sites. Human and Ecological Risk Assessment, 22(9), 31-38.