Week 1 is attached. Assignment request is below. Assignment Content A Penetration Tester evaluates the security of an information infrastructure by intentionally, and safely, exploiting vulnerabiliti

CMGT/400 v7

Week 1 is attached. Assignment request is below. Assignment Content A Penetration Tester evaluates the security of an information infrastructure by intentionally, and safely, exploiting vulnerabiliti 1

Narek Saribekyan

7.13.2020

CMGT/400
Professor Ellen Gaston

Threats, Attacks, and Vulnerability Assessment Template

Equifax company

Equifax is a data score company; the company offers global data, technological and analytical services. The company offers services to creditors who want to know the financial history of the people seeking loans. Thus, the company analysis lenders data to allow the creditors to make the right decision. Equifax servers as a consumer advocate for providing financial literacy to both the consumers and leaders. The company's goal is to offer solutions to complex financial and social solutions to consumers across the globe (Berghel, 2017). The company helps individuals to gain financial independence by increasing financial knowledge that helps them to the capital from lenders. Further, the company provides financial information to college and university students on how to manage their finances.

In recent, Equifax has faced serious cyber breach that adversely affected its operation. The hacker gained access into Equifax Vulnerability called “Apache Struts CVE-2017-5638" and accessed millions of credit information, including personal identification number, social security number, credit status, and other crucial details. Upon the assessments, it was identified that the company had not done enough to secure its system (Lawler, 2017). in case, the goal is to conduct an in-depth threat, attack, and vulnerability assessment. The focus in this assessment will be on evaluating the company's information infrastructures, system, and resources; assess its security measures to countermeasure the attacks and threat analysis.

Assessment Scope

In this assessment, we focus on analyzing the security status of the Equifax company. The study's scope will be based on the company's information system, assessing critical information systems, infrastructure, and cyber-related assets . The assessment will offer an in-depth analysis of these elements.

In the cybersecurity assessment, asset refers to devices, system, data, and other components that support information-related activities. The asset that will be assessed in this case include data – clients' personal details, including social security number, personal identification number, and consumer credits. The other form of data includes the organization's details, including financial records such as financial transactions, the number of lenders who access the system (Thomas, n.d.). The assessment will also focus on the organization's information system asset, including computing devices that are used to store client information and run other operations in the organization. Other asset includes the cloud platform; this includes the computer, system, and information stored in the cloud platforms.

System Model

A diagram and descriptions of each asset included in the assessment scope.

Computing devices

Cloud platform

information systems

Information systems Information systems

Database

Existing Countermeasures

The countermeasures put in place in Equifax company can be classified into three main categories - system and data security, access control, securing the weakest links

System and data security

After the 2017 Equifax data breach, Equifax embarked in data security, the company not only focused on securing its system, but also its data. Thus, the company has implemented three data security measures – data encryption, Tokenization, and data identification.

Access control

The company has access control measures to critical data to prevent an internal breach. The Equifax has implemented a hierarchy of access to its information system to regulate information to people who only need it at a given time.

Securing the weakest link

Equifax has realized that the end-users have become the weakest link in the cybersecurity. The hackers have shifted their focus to accessing company information systems through aid from the end-users. Thus, Equifax has implemented training programs to its system end-users to ensure they are aware of possible security threats. The company has implemented two-factor authentication to ensure the information system is secure.

Threat Agents and Possible Attacks

Define 12 to 15 threat agents and possible attacks.

Though Equifax has implemented various security measures to ensure its system is free from the breach, this doesn't provide 100% security to the system. The information system is prone to a number of security threats; various threat agents enable this in the organizations.

Agent threats: employees conduct, weak systems

Possible attack: ransomware attacks, denial of access, email phishing, a man in the middle, drive-by attack, password attacks, SQL injection, Eavesdropping attack, malware, and cross-site scripting, botnets

Exploitable Vulnerabilities

Exploitable vulnerabilities.

Employees conduct weak passwords, bugs, OS command, Missing authorization, buffer overflow, and unsecured room for storing critical data.

Threat History/Business Impact

Threat History Events	Duration	Business Impact	Threat Resolution
Malware attack	Seven days	Loss of trust in the company Cost of litigation Compensation	Notifying the customers Compensating client whose data were breached Improving information system security

Risks and Contingencies Matrix

Risk	Probability	Priority	Owner	Countermeasures/Contingencies/Mitigation Approach
Internal malice	High	Most Urgent	All end-users	Training end-users, access control, and system monitoring
Phishing	Medium	More urgent	All end-users	Training end-users
Malware attack	Medium	More urgent	IT department	Security systems, system update, and system monitoring
Ransomware attack	Medium	Urgent	IT department	Training end-users, system update, system monitoring

References

Berghel, H. (2017). Equifax and the latest round of identity theft roulette. Computer, 50(12), 72-76.

Lawler, R. (2017). Equifax security breach leaks personal info of 143 million us consumers.

Thomas, J. E. A Case Study Analysis of the Equifax Data Breach.

CMGT 400 Grading Rubric Individual – Week 1 Threats, Attacks, and Vulnerability Assessment
	MEETS CRITERIA?
Introduction to Security and Risk Management	PTs	Grade	COMMENTS
Content (53 points)
Part A: Select an organization you wish to explore during the course. As you make your selection, keep in mind that you will explore the following roles in the organization: Cyber Security Threat Analyst, Penetration Tester, Cyber Security Engineer, Risk Management Analyst, and Software Engineer. You need sufficient knowledge of the organization you select to complete these security assignments. The organization must be of sufficient complexity to meet assignment requirements.			Organization and/or industry identified. The selected organization is of sufficient complexity to meet assignment requirements. Introduction shares insight into Equifax potential for application of key cybersecurity roles and skill requirements.
Part B:	50
Take on the role of a Cyber Security Threat Analyst for the organization you select. Use the Threats, Attacks, and Vulnerability Assessment Template to create a 3- to 4-page Assessment Document. Research and include the following: • Tangible assets: • Include an assessment scope. The scope must include virtualization, cloud, database, network, mobile, and information system. (10pt) • Asset descriptions: • Include a system model, A diagram and descriptions of each asset included in the assessment scope, and existing countermeasures already in place. (Microsoft® Visio® or Lucidchart®) (5pt) • Threat agents and possible attacks (5pt) • Exploitable vulnerabilities (5pt) • Threat history (5pt) • Evaluation of threats or impact of threats on the business (5pt) • A prioritized list of identified risks (5pt) • Countermeasures to reduce threat (5pt)		50	Major assets identified. System description provided. System model included. Clarified assessment scope. Countermeasures described adequately. Shared insight into threats and vulnerabilities section content. Threat history included. Shared risk and recommendations, Considered encryption. Remember formal risk assessment. Apply BCP/DR concepts –backups . Considered need for currency. Add change management. Applied security technologies. Has a reference section and used references in text.
	58 out of 58
Research
Assignment has research depth including at least two outside relevant peer reviewed references from course material and/or the library.			The assignment content demonstrated you did research. Include at least two professional references to meet research depth requirement. Use references in text.
Organization
Assignment is organized appropriately covering all required topics in a logical sequence and applies the Threats, Attack, and Vulnerability Assessment Template. Title, introduction, body, conclusion and references are included in required sequence.			Applied some of Threats, Attack, and Vulnerability Assessment Template, included title, reference section. Covered all requirements
Quality and APA:
Assignment projects professional, quality image, meets academic integrity requirements. Includes title page and reference section. References in APA format. No spelling errors - the paper has obviously been proofread. Title and reference slides/pages do not count toward the length requirement.			Met APA and projected a quality image. Started the assignment with a formatted title page and included your name. Has a reference section and used references in text.
TOTAL POINTS FOR RESEARCH, ORGANIZATION, QUALITY, AND APA REQUIREMENTS	12 out of 12
Assignment was late but it was the first week.
TOTAL POINTS	(70 out of 70 possible points) 04-28-19 rpg