IT 380 Module Two Case Study Analysis Guidelines and Rubric Overview: This case study will help you analyze a cybersecurity scenario and identify which tenets were violated. Each skill in this paper i

IT 380 Module Two Case Study Analysis Guidelines and Rubric Overview: This case study will help you analyze a cybersecurity scenario and identify which tenets were violated. Each skill in this paper i 1

Company Training Manual

Prepared by:

[Student first and last name]

MANUAL OVERVIEW 4

SECTION 1: Introduction: Welcome to CyberLeet 5

1.1 Introduction 5

1.2 Your Role at CyberLeet 6

1.3 Purpose of This Manual 6

SECTION 2: Core Tenets of Cybersecurity 7

2.1 Confidentiality 7

2.2 Integrity 7

2.3 Availability 8

SECTION 3: Cybersecurity Policies 9

3.1 Password Policies 9

3.2 Acceptable Use Policies 9

3.3 User Training Policies 10

3.4 Basic User Policies 10

SECTION 4: Threat Mitigation Scenarios 11

4.1 Theft 11

4.2 Malware 11

4.3 Your Choice 12

SECTION 5: References 13

MANUAL OVERVIEW

You are the training manager at CyberLeet Technologies, a midsized firm that provides cybersecurity services to other businesses. CyberLeet’s core customer base is sole proprietorships and other mom-and-pop shops that are too small to have their own IT departments and budgets. Generally speaking, your clients have a reasonably high risk tolerance, and put a premium on the functionality of their IT systems over stringent security measures. However, you also have clients that must protect highly sensitive information in order to continue operating successfully. For example, CyberLeet supports a few small public-accounting firms that need to maintain important tax-related information, as well as several day-care businesses that must keep children’s health records private while allowing necessary access for certain caregivers. In the past year, CyberLeet has experienced rapid growth, which means you can no longer personally provide one-on-one training to every new information security analyst as they are hired. Therefore, you have decided to create a training manual that will explain to the current and future cohorts of new hires the essential principles and practices that they must understand in order to be successful in their role as information security analysts at CyberLeet.

Manual Layout

There are four sections in the manual, which cover all the components of a new employee training manual. As the training manager, you must complete each section using information you learned in this course. Refer to the background information on CyberLeet and apply the appropriate information that best matches based on the size of the company, the value of cybersecurity, and its core tenets. Apply best practices of cybersecurity principles for addressing the common threat scenarios of a sole proprietary business. The main sections of the manual you are responsible for completing are the following:

Introduction
Core tenets of cybersecurity
Developing cybersecurity policies
Threat mitigation scenarios

In Section One, describe the organization. Provide a short history of the company, define the way it operates, and describe its place within the industry and the community it serves. Follow the prompts to complete each section. All prompts should be deleted prior to submitting this section.

SECTION 1: Introduction: Welcome to CyberLeet

1.1 Introduction

Prompt: Explain the value of CyberLeet Technologies as a provider of cybersecurity services to its client businesses. Why is there demand for information security in a business environment? How do cybersecurity issues impact business resources, including finances, people, and time?

1.2 Your Role at CyberLeet

Prompt: Describe the overall role of the new hire as an information security analyst. What are the main functions of the job? What should be their ultimate goal once they are assigned to clients?

1.3 Purpose of This Manual

Prompt: Explain the purpose for this manual. Why is it important that information security analysts apply the principles and practices outlined in this manual? What is at stake if they do not appropriately apply their training and provide high-quality services to the client businesses?

A widely applicable security model is the CIA triad, standing for confidentiality, integrity, and availability. There are three key principles that should be guaranteed in any kind of secure system. In Section Two, describe the significance of each area as directed in each designated area. Follow the prompts to complete each section. All prompts should be deleted prior to submitting this section.

SECTION 2: Core Tenets of Cybersecurity

2.1 Confidentiality

Prompt: Explain the significance of confidentiality as a core tenet of cybersecurity. Be sure to define the term and use specific details and examples to illustrate its meaning in a business context.

2.2 Integrity

Prompt: Explain the significance of integrity as a core tenet of cybersecurity. Be sure to define the term and use specific details and examples to illustrate its meaning in a business context.

2.3 Availability

Prompt: Explain the significance of availability as a core tenet of cybersecurity. Be sure to define the term and use specific details and examples to illustrate its meaning in a business context.

Creating effective cybersecurity policies will make visible changes to how the organization operates. Rely on the information presented in this course to develop the necessary standards and frameworks of effective cybersecurity policies. Follow the prompts to complete each section. All prompts should be deleted prior to submitting this section.

SECTION 3: Cybersecurity Policies

3.1 Password Policies

Prompt: What principles should the information security analyst apply in order to develop appropriate password policies for their clients? Make sure you address confidentiality, integrity, and availability of information, as well as each of the following aspects:

Password length and composition of the password (e.g., uppercase, numbers, special characters)
Time period between resets and ability to reuse a prior password
Differentiated policies for different types of users (e.g., administrator vs. regular user)

3.2 Acceptable Use Policies

Prompt: What principles should the information security analyst apply in order to develop appropriate acceptable use policies for the client? Make sure you address confidentiality, integrity, and availability of information, as well as each of the following questions:

What should users generally be allowed to do with their computing and network resources? When and why would each example be allowable?
What should users generally be prohibited from doing with their computing and network resources? When and why would each example require prohibition?
When and why should users be aware of acceptable use policies and how can organizations keep track of these policies?

3.3 User Training Policies

Prompt: What principles should the information security analyst apply in order to develop appropriate user training policies for the client? Make sure you address confidentiality, integrity, and availability of information, as well as each of the following:

How to determine who would be trained
How to determine how often trainings would occur
How to determine whether certain staff receive additional training or whether they should be held to higher standards

3.4 Basic User Policies

Prompt: What principles should the information security analyst apply in order to develop appropriate basic user policies for the client? Make sure you address confidentiality, integrity, and availability of information, as well as each of the following questions:

When and why should users have to display some type of identification while in the workplace?
What types of physical access (with or without ID) to company areas is acceptable? Why?
When and why should employees with identification be allowed access to all areas of the company?
When and why should employees be allowed to take work home or bring guests into the workplace?

A threat-intelligence service provides analyzed, actionable threat information to help organizations defend against known or emerging threats before systems may be compromised. In this section, you will create three mitigation scenarios. The first two mitigation topics have been chosen; however, the third one is your choice. Follow the prompts to complete each section. All prompts should be deleted prior to submitting this section.

SECTION 4: Threat Mitigation Scenarios

4.1 Theft

Prompt: In the last month, two break-ins have occurred at a client’s office, which resulted in the theft of employee laptops during both incidents. The first incident occurred in the evening when the thieves broke through a ground-floor window. The second incident occurred during the day when the thieves walked right into the business area and removed two laptops. What physical and technical controls would be helpful to address the issue and prevent this type of vulnerability in the future? Compare and contrast the different methods that could be used to mitigate the given threat.

4.2 Malware

Prompt: Recently, one of your client’s staff has been inundated with phishing emails that are targeted at individuals and related to current business opportunities for the company. These messages are linked to malware and sent by known threat actors. What physical and technical controls would be helpful to address the issue and prevent this type of vulnerability in the future? Compare and contrast the different methods that could be used to mitigate the given threat.

4.3 Your Choice

Prompt: Create your own illustrative scenario of a common threat that an information security analyst may face. Explain what physical and technical controls would be helpful to address your chosen issue and prevent that type of vulnerability in the future, and compare and contrast the different methods that could be used to mitigate the given threat.

SECTION 5: References

Prompt: If applicable, list all references used in the creation of this document here. References must be in APA format.