Omega Research is a rapidly growing research and consulting firm.It hasa single main office located in Reston, VA, and three small branch offices located in San Diego, CA, Salem, OR, and Kansas City, MO. Omega is not currently involved in e-commerce or business-to-business relationships.

Two weeks ago, Omega experienced a significant loss of proprietary data (estimated value $550,000.00) that was stored electronically in an Oracle database in the main office in Reston. The data was unrecoverable and backups were not being routinely maintained, so no restoration was possible. Although he has no hard evidence, Omega’s CTO believes that the loss resulted from deliberate deletion of files by a systems administrator from the Kansas City office who had been let go several weeks prior to the loss. To add insult to injury, four days ago, Omega’s CEO received a phone call from one of the company’s largest clients informing her that Omega’s website had been defaced with pornographic content. Needless to say, the CTO has been taskedwith getting things under control.

You have been hired as a consultant to develop a comprehensive plan for improving the company’s security posture in order to prevent future compromise of Omega’s networks and networked resources in the form of a risk assessment. Your guidance and observations will eventually be used to develop a long-term procedural and policy solution for Omega Research. The CTO has stepped up to the plate and made the commitment to do whatever it takes to address these issues.

Baseline Architecture

Considerations

Networking and Systems Administration

1. Access to any site LAN automatically guarantees access to the entire WAN. This means that user accounts authenticated in the Salem office have immediate access to resources in San Diego, Kansas City, and Reston.
2. User accounts and access restrictions are independently managed by each office’s system engineer. There is not a common user policy – rules concerning how passwords are created and enforced, cycled, and aged; lockout; user account retention; and so on, are created and maintained per office.
3. There is no formal backup and disaster recovery policy at any site. Backups are decentralized.Off-site rotation only happens at the Reston office; no officer of the company or single IT person knows how to access each other’s tapes in the event of a catastrophe. Salem currently performs no tape backups.
4. The local system administrators found at the satellite offices take all direction from the central office andare not authorized to make boundary router changes. They do not have authority to change anything without central IT approval. They have no budget; they have no authority; they have full accountability for their LANs.
5. All machines run some form of antivirus software, although local IT staff infrequently maintain their definition files and rely on user intervention to perform file updates. No machine has spyware protection.
6. There is no dedicated program for training employees on avoiding threats such as phishing.
7. Firewall logs, host packet analysis, application logs, and event and error logs are generally ignored across the board.

Business Requirements

1. The organization is growing rapidly in spite of recent events.
2. Its strength is in developing business within the local market and providing on-site consulting services.
3. The research end of the business is the wellspring from which it drawsits competitive edge, but Omega is realizing that consolidating the research workforce adds synergy to its efforts and reduces unnecessary overhead.
4. Omega plans to continue down that road. As a result, local sites will expand their consulting workforce and research will continue to be consolidated at the Reston and San Diego facilities. As this trend continues to develop, access to the research data stored at the East and West Coast facilities becomes critical. Additionally, Omega cannot afford another loss of proprietary information like the one recently experienced, and management knows that it could have been much worse.

Known Environmental Risks

1. The San Diego office is located in a 20-year earthquake zone. Once every 20 years, it estimated that a 6.0-Richter scale earthquake or greater will strike the facility, likely causing damage to the facility/computer equipment; management assumes that losses to computer assets could be estimated at 20%. As a countermeasure, the company has purchased insurance with $18,000.00/year annual premiums that increase 5% every year.
2. The Reston office is located in a 500-year flood zone. Once every 500 years, it is estimated that a flood will strike the facility, likely causing damage to the facility/computer equipment; management assumes that losses to computer assets could be estimated at 40%. The company has opted to not purchase insurance. Annual premiums would run at approximately $25,000.
3. The Kansas City office suffers a significant tornado event once every five years. When the tornado hits, severe electrical disruption affects the equipment and the office suffers 10% losses on computer assets. The company pays $14,000 in annual insurance premiums.

Specific Component and Grading Rubrics

At a minimum, students are to create afive-to-seven-page (minimum 2,000 words) Word document compliant with APA guidelines.

1. Provide a written assessment of the current security posture of the organization. (10 points)
2. State in general terms where Omega has strengths and where it has weaknesses. (10 points)
3. Develop a listing of threats, prioritized by their relative likelihood and potential frequency of occurrence. (15 points)
4. Develop a listing of vulnerabilities in the current security posture of Omega Research. (15 points)
5. Prioritize the vulnerabilities based on the potential impact on Omega Research if the vulnerability is exploited (i.e., threat is realized). (20 points)
6. Identify potential threat agents. (20 points)
7. Identify appropriate policies that must be developed and published now to support your plan of action. Include the essence of these policies (a paragraph), not the detailed policy itself. (25 points)
8. Additional recommendations that you might have for Omega senior management to improve their competitive advantage or to provide additional security. (25 points)
9. Proper APA citations are used throughout the report. (10 Points)

Best Practices

The following arebest practices in preparing this paper.

• Cover Page:Include who you prepared the paper for, who prepared it, and the date.
• Table of Contents:List the main ideas and sections ofthe paper and the pageswhere they are located.Illustrations should be included separately.
• Introduction:Use a header on your paper. This will indicate that you are introducingthe paper.

The purpose of an introduction or opening is to

1. introduce the subject and why it is important;
2. preview the main ideas and the order in which they will be covered; and
3. establishthe tone of the document.

Include in the introduction a reason for the audience to read the paper. Also include an overview of what youwill cover and the importance of the material. (This should include or introduce the questions that you are asked to answer in each assignment.)

• Body ofthe Report:Use a header with the name ofthe project. An example is,”The Development of Hotel X: A World Class Resort.” Proceed to break out the main ideas: State the main ideas and the major pointsof each idea, and provide evidence. Show some type of division, such as separate, labeledsections; separate groups of paragraphs; or headers. Include the information that you found during your research and investigation.
• Summary and Conclusion:Summarizing is similar to paraphrasing, but presents the gist of the material in fewer words than the original. An effective summary identifies the main ideas and the major support points from the body ofthe report; minor details are left out. Summarize the benefits of the ideas and how they affect thesubject.
• References:Use the citation format specified in the Syllabus.

Additional hints on preparing the best possible project follow.

1. Apply a three-step processto writing: plan, write, and complete.
2. Prepare an outline oftheresearch paper before going forward.
3. Complete a first draft, and then go back to edit, evaluate, and make any changes required.
4. Use visual communication to further clarify and support the written part of thereport. Examplesinclude graphs, diagrams, photographs, flowcharts, maps, drawings, animation, video clips, pictograms, tables, and Gantt charts.