Case Study

User Generated

uneqvx42852000

Writing

Description

This is the first case study for the course and it will be based upon the case study text: Public Sector Case Study - Edward Snowden - pg. 226

In reading the excerpt from the textbook on what happened and how Snowden was able to access the data that he did, write a mini-security policy following the security template in Chapter 7 (pg. 185). Highlight at least three policies that you feel were violated in this case and address the policies that need to be in place to prevent those violations from occurring in the future. Make sure to incluce enough detail that it could be amended to an existing policy and clear enough that any/all employees know what the new policy addresses.

Part 1:

Write 2-3 paragraphs at the beginning of your paper explaining the three issues you want to address and why. Follow APA guidelines for paper format and make sure to check spelling/grammar prior to submitting.

Part 2:

Write your mini-security policy following the template in textbook addressing the three issues you identified.

Unformatted Attachment Preview

Part 1 Public Sector Case Study In May 2013, Edward Snowden, a National Security Agency (NSA) contractor, met a journalist and leaked thousands of documents detailing how the U.S. conducts intelligence surveillance across the Internet. In June 2013, the U.S. Department of Justice charged Snowden with espionage. Not long afterward, Snowden left the United States and finally sought refuge in Russia. The Russian government denied any involvement in Snowden’s actions but did grant him asylum. While this story reads like a spy novel, it raises a number of information security policy questions. For this discussion is not important whether Snowden was a traitor, a spy, or a whistleblower. The issue here is the security policies and controls that allowed a part-time NSA contractor to gain unauthorized access to highly sensitive material. This is particularly important because in April 2014, the Department of Defense announced adoption of the NIST standards. Would the Snowden breach have been prevented if the NIST standards had been adopted earlier? Given the secret nature of the NSA, the full details of how this breach of sensitive data occurred may never come out. However, reports indicate that Snowden worked part time for an American consulting company that did work for the NSA in Hawaii. There he gained access to thousands of documents that detailed how the U.S. government works with telecommunication companies and other governments to capture and analyze traffic over the Internet. The details of the scope and nature of this global surveillance program were not publicly known and considered secret. It’s clear from the reporting that Snowden had excessive access; that is to say, he was granted access beyond the requirements of his job. Additionally, reports indicated that he used other people’s usernames and passwords. He obtained these IDs through social engineering. Finally, consider the way in which he accessed and captured the information. Some reports indicate he used inexpensive and widely available software to electronically crawl through the agency’s networks. There are also indications that he removed the information on a USB memory stick. FYI Social engineering refers to the use of human interactions to gain access. Typically it means using personal relationships to trick an individual into granting access to something you should not have. For example, you might ask to borrow someone’s keycard to use the restroom but instead use the keycard to access the data center. Or perhaps you might ask for someone’s ID and password to fix his or her computer, and then later use those credentials to access customer information. If he had used a Web crawler to automate the capturing of thousands of documents, Snowden would have been using software that is widely available over the Internet, and free of charge. Web crawler software simply starts browsing a Web page looking for links and then downloads related content. A Web page then links the Web crawler to another page and the process starts all over again. Thousands of Web pages are quickly scanned in a matter of minutes or hours, depending on the content. More sophisticated Web crawler software looks for specific documents to download. Snowden worked at the NSA for several months, accumulating thousands of documents and reportedly had access to 1.7 million documents in all. There were clear NIST framework violations. For purposes of this discussion, the focus is on the network and social engineering. NIST publications outline other standards that were violated, such as effective security management and oversight. The following four NIST framework network policies were clearly violated: • • • • Sharing of passwords Excessive access Penetration testing Monitoring It’s never a good idea to share passwords. This would be a clear violation of security policy, especially by anyone handling classified data. Additionally, the level of access must be considered a policy violation. Any security framework generally prohibits granting access not related to the individual’s job function. It’s clear from the volume of material involved in the Snowden affair, and its classified nature, that the access he was granted was excessive for the role he performed. The NIST framework outlines the guidance on penetration testing. Such testing would have clearly demonstrated the weaknesses of controls that allowed a Web crawler to scan and download thousands of documents. This type of testing and assessment would provide another opportunity to correct the network control deficiencies prior to a breach. The NIST framework outlines the requirements for effective network monitoring. These requirements require logs to be reviewed in a timely manner. Log reviews are a detective control and essential in identifying potential hackers. Keep in mind Snowden scanned the internal network for months while downloading vast amounts of data. Hackers tend to probe a network for weaknesses prior to a breach. Assume that some of those links the Web crawler attempted to access resulted in an access violation. These violations would have been an indicator of a potential breach in progress. This type of monitoring would have provided another opportunity to correct the network control deficiencies and identify Snowden as an internal hacker. Finally, consider the lack of controls that allowed Snowden to remove so many documents on a USB memory stick. This unusual activity could have been prevented, or, at a minimum, detected, given the volume of material extracted—especially given that many organizations have in place additional controls to monitor contractor activities. Some of the specifics of the Snowden breach may never be known. Nonetheless, a security policy framework must be a comprehensive way of looking at information risks and ensuring there are layers of controls to prevent data breaches. This case is typical of a breach occurring over many months, indicating the breakdown of multiple controls. It represents both a lack of effective security policies and lost opportunities to detect a breach over several months. Part 2 Sample Templates In this section, you will look at some suggested document formats for policies and standards. You can use these as is or create a template that best reflects your organization’s needs. Sample Policy Template The following outline of a policy document helps you organize the content for your program-level policy and framework policies: POLICY NAME AND IDENTIFYING INFORMATION 1. PURPOSE This document establishes a policy for … 2. BACKGROUND This document was developed because … 3. SCOPE This policy applies to the use of … TIP Never use individual (personal) names in a policy or standard. For Role and Responsibilities, use the name of the department, unit, or specific role that is accountable. Individuals join and leave the company. 4. OPERATIONAL POLICY 4.1. Section 1 4.2. Section 2 4.3. Section 3 4.4. Section 4 5. ROLES AND RESPONSIBILITIES The following entities have responsibilities related to the implementation of this policy: 6. APPLICABLE LAWS/GUIDANCE 7. EFFECTIVE DATES This policy becomes effective on the date that [xxx] Chief Information Officer (CIO) signs it and remains in effect until officially superseded or canceled by the CIO. 8. INFORMATION AND ASSISTANCE Contact the … for further information regarding this policy. 9. APPROVED [Director of Information Security Policies] Date of Issuance 10. ASSOCIATED RESOURCE
Purchase answer to see full attachment
User generated content is uploaded by users for the purposes of learning and should be used following Studypool's honor code & terms of service.

Explanation & Answer

Attached.

Running head: CASE STUDY

1

Case Study

Name

Institutional Affiliation

Part 1

Public Sector Case Study

As a systems administrator, Edward Snowden conducted contract work for the NSA
where he obtained documents containing classified information that he subsequently released to
the press. However, the acquisition of such documents raised concerns about the agency’s
network security. There are three policies that Snowden violated in his search through NSA
systems that will be addressed in the present analysis. First, Snowden obtained the information
using social engineering. He used his position to acquired elevated privileges and increased
access using his colleagues’ login credentials. He proceeded to defeat security controls that were
set in place to compartmentalize data and ensure access to data on the basis of need to know.
Second, the issue of password sharing comes ...


Anonymous
I was stuck on this subject and a friend recommended Studypool. I'm so glad I checked it out!

Studypool
4.7
Trustpilot
4.5
Sitejabber
4.4

Related Tags