You have just been hired as an Information Security Engineer for a video game development company. The organization network structure is identified in the below network diagram and specifically contains:
| 1) 2 – Firewalls | 5) 2 – Windows Server 2012 Active Directory Domain Controllers (DC) |
| 2) 1 – Web / FTP server | 6) 3 – File servers |
| 3) 1 – Microsoft Exchange Email server | 7) 1 – Wireless access point (WAP) |
| 4) 1 – Network Intrusion Detection System (NIDS) | 8) 100 – Desktop / Laptop computers |
| 9) VoIP telephone system |
The CIO has seen reports of malicious activity being on the rise and has become extremely concerned with the protection of the intellectual property and highly sensitive data maintained by your organization. As one of your first tasks with the organization, the CIO requested you identify and draft a report identifying potential malicious attacks, threats, and vulnerabilities specific to your organization. Further, the CIO would like you to briefly explain each item and the potential impact it could have on the organization.
Write a four to five (4-5) page paper in which you:
- Analyze three (3) specific potential malicious attacks and / or threats that could be carried out against the network and organization.
- Explain in detail the potential impact of the three (3) selected malicious attacks.
- Propose the security controls that you would consider implementing in order to protect against the selected potential malicious attacks.
- Analyze three (3) potential concerns for data loss and data theft that may exist in the documented network.
- Explicate the potential impact of the three (3) selected concerns for data loss and data theft.
- Propose the security controls that you would consider implementing in order to protect against the selected concerns for data loss and data theft.
- Use at least three (3) quality resources in this assignment (no more than 2-3 years old) from material outside the textbook. Note: Wikipedia and similar Websites do not qualify as quality resources.
Identifying Potential Malicious Attacks, Threats, and Vulnerabilities Specific to A Video Game Development Company
Using user accounts and privileges illegally, modifying data stored by the company, using the company data for financial gain or industrial espionage, and damaging the systems of the company by running corrupted code are some of the potential malicious attacks that may be carried out on the video development company. People with malicious intentions may perform activities that prevent authorized users from performing their activities. This would deplete the resources and bandwidth of the network, which would jeopardize the activities of the company.
Read also Network Security and Modern Day Computer Network Attacks
People with malicious intentions may initiate the attacks from different locations. Therefore, the network attacks can be classified into two different categories. These include external and internal network attacks. People with malicious intentions who attack the network externally may carry out the attacks with or without help from employees or contractors of the company. People who carry out the attacks may be experienced individuals or inexperienced attackers. They may also be a group of experienced attackers. Experienced attackers usually have defined plans and technological tools that enable them to carry out the attacks.
The technological tools can detects flaws in the security of the network and exploit them to the advantage of the attackers. Experienced attackers usually scan and gather information on the network they aspire the attack. They scrutinize the firewall logs of the network to determine security flaws that would allow them to access the network. Therefore, users should undertake a critical evaluation of the existing firewall logs to detect any external attack or threat of external attack. Installing an Intrusion Detection System would also help in identifying the threats to external attack that the system faces (Williams, 2013).
Read also Network Security Policy Example
Structured and unstructured attacks are the two major types of external threats. A malicious individual, group or organization may undertake the external attacks. Parties that pose structured external threats usually have premeditated thoughts on the damages or losses they intend to cause a network or organization. Some of the motives of structured external threats include greed, terrorism, or politics. Parties that engage in structured external attacks are usually highly skilled in the network design. They also know how to avoid the Intrusion Detection System and other security measures of the network. They also have hacking tools that enable them to intrude into a network. Their level of expertise enables them to develop new techniques by modifying the existing network hacking tools. In some instances an authorized user may provide the attacker with access into the system. Inexperienced attackers pose unstructured external threats to a network or organization. Inexperienced attackers are referred to as script kiddies. They do not have the necessary skilled to create threats on a network autonomously. They usually try to seek fame by striving to crash websites or other targets on the internet. Internal threats usually originate from within the organization. They originate from employees or contractors who are dissatisfied with the organization. They usually have some form of access to the network. An organization may prevent internal and external attacks using an Intrusion Detection System that is configured to detect both internal and external attacks (Kim & Solomon, 2013).
Read also Network Risk Management
Loss of productivity is one of the major impacts of malicious attack to a network. Less of productivity would have a direct impact on the financial performance of an organization. Therefore, it is vital for the management of an organization to acknowledge the potential financial costs of a malicious attack on its network. This would enable the managers make decisions on the amount of money they should invest to prevent the malicious attack. However, most organizations do not know how the measure the decline in productivity due to malicious attack. The management may use various tools to measure the decline in productivity or delays in processing orders from customers. Malicious attack would also lead to immediate economic impact on an organization. Some of the direct economic impact on an organization includes damage to the systems of the organization. Repair or replacement of the systems requires human intervention. In addition, malicious attack leads to leads to disruptions in the operations of an organization and delays in carrying out various transactions that are vital in the business. There are various short-term and long-term economic costs associated with malicious attack. Loss of business or contracts with other organizations is one of the major short-term economic costs of malicious attack. Tarnishing of the reputation of the organization is also one of the short-term economic costs of malicious attack. Decline in market valuation and decline in investor confidence are some of the long-term economic impacts of malicious attack (Witte et al., 2012).
The video game development company may implement three types of control to prevent its network from potential malicious attack. It may use physical controls, technical controls, and administrative or process controls. Physical control involves controlling physical access to the network. The company should ensure that it allows only authorized employees to have physical access to the network. Technology-based controls refers to the implementation of technological tools that would control the logical access to the sensitive data of the company. An organization may implement various technology-based tools. Intrusion Detection System (IDS) is one of the technology-based controls that the company may implement. Administrative and process controls refer to the implementation of policies and procedures that would guide users on the actions and restrictions that they should follow when handling sensitive company data. The above controls may be preventive, detective or corrective. Preventive controls reduce the likelihood of malicious attack on the system. They also reduce the likelihood of unintentional or intentional breach of sensitive company data. On the other hand, detective controls help in detecting and reporting attempted malicious attack on the system. They help in identifying suspicious activities whenever they occur. Finally, corrective controls help in responding to suspicious activity and terminating any of the activities. This helps in reducing the impact of the attacks (Kim & Solomon, 2013).
The operating systems, applications and technologies of the company face certain security threats that would result in data loss or theft. However, the company may implement various technical controls to reduce the potential risks and help in the recovery of vital information if there is a breach in the system. Currently, the major threat targets its employees. Employees are some of the most important assets of the company. However, it is very hard to ensure the security of the employees. The threats that the company is exposed to can be classified into three categories. These include browser attacks, watering-hole attacks, and phishing and social network attacks. Organizations are prone to browser attacks regardless of the type of platform they use to support the system. This is due to the fact that the browser is one of the common applications in all platforms. Emails or messages may contain links from malicious websites. The websites may be so similar to legitimate websites, which makes it difficult to distinguish them. People with malicious intentions may also include content in a certain page and lure users to the webpage. Users would then visit the page and download malware to the system. Downloading the malware makes the system become vulnerable to attacks. These types of attacks are referred to as watering hole attacks. In most instances, prefer convenience and simplicity instead of security, which may make usage of the system be complex. This makes the users become victims of phishing schemes. People with malicious intentions usually purport to send information from banks, popular social networks, or insurance companies to unsuspecting users. They then redirect the users to sites that require them to enter their details. This enables people with malicious intentions to access the user’s accounts since people usually use similar passwords for different accounts (Witte et al., 2012).
Read also Social Engineering Attacks
Loss or theft of data would lead to the tarnishing of the image of the company. Customers would not like to be associated with a company that comprises their data. Tarnishing of the reputation of the company would have short-term and long-term financial impacts on the company. Loss or theft of data may halt the smooth operations of the company. The company may lose sensitive data that is necessary in the development of new video games. Loss or theft of data may make the company lose its competitive edge if rivals access sensitive data on the company (Sambath & Zhu, 2012). Reengineering several factors of the topology of the system would help in improving the security measures of the system. Redesigning the firewall pair to ensure that there is more granular control of the network traffic that should reach the public is one of the measures that would help in preventing data loss and theft. Modifying the IDS and the addition of more device to monitor the internal network traffic would also help in preventing data loss and theft. Implementing encryption protocols with highly secure algorithms would also help in preventing data loss and data theft (Kim & Solomon, 2013).
You can order a unique paper on Identifying Potential Malicious Attacks, Threats, and Vulnerabilities at an affordable price.
Get Your Custom Paper From Professional Writers. 100% Plagiarism Free, No AI Generated Content and Good Grade Guarantee. We Have Experts In All Subjects.
Place Your Order Now