Risk Assessment and Security Controls - Assignment Example

Risk Assessment and Security ControlsThe business with its system located in an unsecured room has two vulnerabilities. First is the physical vulnerability and it would be safe to assume that the business owner did not take precautionary measure to protect his network and system from malicious intrusion. To protect the network and system, the business owner must institute the following security measures1. Physical security – put in physical security such as lock and key security because the system is in unlocked room within the main building of the business.

In addition, level of access must be scrutinized with only authorized personnel having physical access to the server.2. Control the use of administrative privileges – in addition to physical security, assignment, access and use of the system must be controlled, identified and tracked. 3. Inventory of authorized and unauthorized devices – manage devices that would be given access and effectively prevent unmanaged and unauthorized devices from gaining access.4. Incident response management – management oversight, plans, defined roles to quickly discover an attack and effectively containing the damage and remove the attackers presence, and restore the integrity of the network and system (www.sans.org, nd)5.

Boundary defense – detect/rprevent/correct flow of data transfer in the network by establishing different trust levels.6. Application software security – all acquired software must be managed to prevent, detect and correct security weakness (www.sans.org c, nd)7. Malware defense – control the spread of malicious code at multiple points. This would include rapid update of malware defense, data gathering and corrective action (www.sans.org b, nd).8. Data protection – must have tools that will prevent data exfiltration to preserve the integrity of critical data.9. Data recovery capability – system must properly back up critical data and must have capability to recover it in the event of attack and/or loss.10. Continuous vulnerability assessment and remediation - - continuous evaluation of new information to identify vulnerabilities that would minimize if not totally eliminate opportunities for attackers.

References Critical Security Control: 6. (n.d.). SANS Institute -. Retrieved April 6, 2014, from http://www.sans.org/critical-security-controls/control/6Critical Security Control: 13. (n.d.). SANS Institute -. Retrieved April 6, 2014, from http://www.sans.org/critical-security-controls/control/13Critical Security Control: 18. (n.d.). SANS Institute -. Retrieved April 6, 2014, from http://www.sans.org/critical-security-controls/control/18