Description
As part of its due diligence efforts, the M&A team has determined that the following events contributed substantially to the bankruptcy of Island Banking services.
1. Company officers and managers were able to conduct criminal activities using company IT assets without detection.
2. The company did not have a disaster recovery / business continuity plan in place. It could not restart operations due to the loss of servers and workstations (seized by law enforcement agents).
3. Storage media for servers and workstations had not been backed up to an off premises location leaving the company with no way to recover from the law enforcement seizure of storage media as evidence.
The root cause for each event listed above was determined to be: ineffective and/or missing IT security controls.
You have been asked to perform a gap analysis to assist in the identification and selection of IT security controls which could be implemented to remediate the situation ("close the gaps"). The CCISO has requested that you use the NIST Cybersecurity Framework and the NIST Security and Privacy Controls Catalog (NIST SP 800-53) as your source for IT security controls.
Choose 3 to 5 families or categories of controls ("framework functions") which should be implemented to remediate the above deficiencies (at least one family, e.g. AU Audit and Accountability, or category, e.g. Recovery Planning, for each event). Describe how the selected controls will prevent or deter such events in the future ("close the gaps").
Format your response as a business memorandum. For each control family or category, you should provide the following information (see Domain 2 Section 1.1.2 in CCISO):
- What it is
- What it does
- How the control performs its objective
You should have at least 5 strong paragraphs in your memo. Include citations and references (3 or more) to support your written work.
Post your memo in the body of a response to this thread. After you have done so, post two critiques and two or more follow-up or reply postings. Remember that your goal in writing critiques is to help your peer improve the content of his or her briefing paper. Writing critiques also helps you to develop your managerial skills (i.e. providing written feedback).
Explanation & Answer
Here you go buddy.Have a lovely day.👌
Running head: INFORMATION TECHNOLOGY SECURITY CONTROLS
Information Technology Security Controls
Student’s Name
Institutional Affiliation
1
INFORMATION TECHNOLOGY SECURITY CONTROLS
2
Information Technology Security Controls
Many organizations are faced with risks associated with information technology (IT).
These organizations have been struggling to find effective and efficient ways to counter these
risks which impact their operations. Island Banking services were hit to bankruptcy because
of ineffective IT security controls. The organization needs to understand the risks associated
with their security systems for them to get proper security controls to help eradicate these
risks (Austin et al., 2018). Therefore, carrying out a risk assessment of this organization
would be vital in addressing these risks. Lack of proper risk assessment would lead to attacks
such as the one Island Banking services encountered. The best sources of security controls
are the NIST Cybersecurity Framework and NIST Security and Privacy Controls Catalog
(NIST SP 800-53)
The NIST Cybersecurity Framework addresses the methods and procedures used in
risk management analysis in the system development process. The NIST Cybersecurity
Framework raises issues concerning security and factors affecting the development,
operation, design, and implementation of an information technology system (Scofield, 2016).
The framework organizes controls into families to provide control for an organization. Each
family controls a specific security control that is related to the overall security of that family.
Security controls included are policy, oversight, supervision, and automated mechanisms of
the information system. The contro...
