ISOL 533 - Information Security and Risk Management Risk Management Plan
University of the Cumberlands
Executive Summary
<Review the Scenario on Page #2 of the publisher’s Project: Risk Management Plan. Summarize the information about the company provided in the scenario and place it into this section of the report. Remove these instructions and all other instructions below before submitting the document for grading.>
This Risk Management Plan covers the Risks, Threats and Weaknesses of the Health Network, Inc. (Health Network).Risks - Threats – Weaknesses within each domain
<Using the Threats listed on Page #3 of the publisher’s Project: Risk Management Plan and the 7 Domains diagram on Page #3 of this template, complete the table on Page #2 of this template (review your Lab #1 solution). Once you enter the Threats into the table, list one or more Weaknesses that might exist in a typical organization using research and your imagination) and then list the Risk to the company if the Threat exploits that Weakness. Then group these Risks-Threats-Weaknesses (R-T-W) by Domain and discuss them below in this section.>
User Domain: <list each User Domain R-T--W identified in the table>
Workstation Domain: <list each Workstation Domain R-T--W identified in the table>
LAN Domain: <list each User Domain R-T--W identified in the table>
WAN-to-LAN Domain: <list each Workstation Domain R-T--W identified in the table>
WAN Domain: <list each User Domain R-T--W identified in the table>
Remote Access Domain: <list each Workstation Domain R-T--W identified in the table>
System/Application Domain: <list each User Domain R-T--W identified in the table>Compliance Laws and Regulations
<List the laws and regulations that affect this industry.>
…
Your Organization
.
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
Enter details about the organization and it IT Infrastructure.
•
•
•
organization
division
organization's
organizational
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
organization .
organization
organization d
organization'
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
organization changes to the
systems, applications and organizational data can undermine the organization's
violations of federal or state mandates and laws can
lead to major . potential to impact the
organization
organization
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
organization
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
central respoitory accessible via the
orporate
ISOL 533 - InfoSecurity & Risk
Management Uni.
ISOL 533 - Information Security and Risk Management R.docx
1. ISOL 533 - Information Security and Risk Management
Risk Management Plan
University of the Cumberlands
Executive Summary
<Review the Scenario on Page #2 of the publisher’s Project:
Risk Management Plan. Summarize the information about the
company provided in the scenario and place it into this section
of the report. Remove these instructions and all other
instructions below before submitting the document for
grading.>
This Risk Management Plan covers the Risks, Threats and
Weaknesses of the Health Network, Inc. (Health Network).Risks
- Threats – Weaknesses within each domain
<Using the Threats listed on Page #3 of the publisher’s Project:
Risk Management Plan and the 7 Domains diagram on Page #3
of this template, complete the table on Page #2 of this template
(review your Lab #1 solution). Once you enter the Threats into
the table, list one or more Weaknesses that might exist in a
typical organization using research and your imagination) and
then list the Risk to the company if the Threat exploits that
Weakness. Then group these Risks-Threats-Weaknesses (R-T-
W) by Domain and discuss them below in this section.>
User Domain: <list each User Domain R-T--W identified in the
table>
Workstation Domain: <list each Workstation Domain R-T--W
identified in the table>
LAN Domain: <list each User Domain R-T--W identified in the
table>
WAN-to-LAN Domain: <list each Workstation Domain R-T--W
identified in the table>
WAN Domain: <list each User Domain R-T--W identified in the
table>
Remote Access Domain: <list each Workstation Domain R-T--W
identified in the table>
2. System/Application Domain: <list each User Domain R-T--W
identified in the table>Compliance Laws and Regulations
<List the laws and regulations that affect this industry.>
…
Your Organization
.
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
Enter details about the organization and it IT Infrastructure.
•
•
•
organization
3. division
organization's
organizational
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
organization .
organization
organization d
organization'
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
4. organization changes to the
systems, applications and organizational data can undermine the
organization's
violations of federal or state mandates and laws can
lead to major . potential to impact the
organization
organization
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
organization
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
5. central respoitory accessible via the
orporate
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
organization
organization
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
ISOL 533 - InfoSecurity & Risk
Management University of the Cumberlands
RegisterRisk Register#RiskImpact on ProjectCost
$LikelihoodImpact Mitigating ActionsContingencyRisk
OwnerDeadline101<Identify the risk>Brief description of risk
and impact on costs, schedule etc$Very
6. UnlikelyNegligible<Describe what is currently done on the
project to reduce the impact of the risk.><Describe the course
of action if the risk does materialize: alternate solution,
reduction in functionality etc.>Person
responsibleMM/DD/YY102<Identify the risk>Brief description
of risk and impact on costs, schedule
etc$UnlikelyMarginal<Describe what is currently done on the
project to reduce the impact of the risk.><Describe the course
of action if the risk does materialize: alternate solution,
reduction in functionality etc.>Person
responsibleMM/DD/YY103<Identify the risk>Brief description
of risk and impact on costs, schedule etc$Moderately
LikelySignificant<Describe what is currently done on the
project to reduce the impact of the risk.><Describe the course
of action if the risk does materialize: alternate solution,
reduction in functionality etc.>Person
responsibleMM/DD/YY104<Identify the risk>Brief description
of risk and impact on costs, schedule
etc$LikelyCritical<Describe what is currently done on the
project to reduce the impact of the risk.><Describe the course
of action if the risk does materialize: alternate solution,
reduction in functionality etc.>Person
responsibleMM/DD/YY105<Identify the risk>Brief description
of risk and impact on costs, schedule etc$Very
LikelyCrisis<Describe what is currently done on the project to
reduce the impact of the risk.><Describe the course of action if
the risk does materialize: alternate solution, reduction in
functionality etc.>Person responsibleMM/DD/YY106<Identify
the risk>Brief description of risk and impact on costs, schedule
etc$Very UnlikelyNegligible<Describe what is currently done
on the project to reduce the impact of the risk.><Describe the
course of action if the risk does materialize: alternate solution,
reduction in functionality etc.>Person
responsibleMM/DD/YY107<Identify the risk>Brief description
of risk and impact on costs, schedule
etc$UnlikelyMarginal<Describe what is currently done on the
7. project to reduce the impact of the risk.><Describe the course
of action if the risk does materialize: alternate solution,
reduction in functionality etc.>Person
responsibleMM/DD/YY108<Identify the risk>Brief description
of risk and impact on costs, schedule etc$Moderately
LikelySignificant<Describe what is currently done on the
project to reduce the impact of the risk.><Describe the course
of action if the risk does materialize: alternate solution,
reduction in functionality etc.>Person
responsibleMM/DD/YYBRisk Identifier—a descriptive name or
number. Use this for tracking across project
documentsCIdentify the risk and relevant triggers that may
cause the risk to be realizedDDiscuss the potential impact this
risk may have on costs and/or scheduleEIdentify the cost
associated with this riskFLikelihood is a measure of the
probability of the event occurring: Very Unlikely, Unlikely,
Moderately Likely, Likely, Very LikelyGImpact measures the
effect on scope, cost, and/or schedule -- Negligible, Marginal,
Significant, Critical, or Crisis.HRisk Level is the resultant of
Likelihood and Impact Low, Moderate, or High.ISpecify
planned mitigation strategies: Preventative (implement
immediately) OR Contingency (implement if/when risk
occurs)JIdentify who is responsible for undertaking each
mitigation action(s)KIdentify the status of the risk: Open,
Closed, New etc
1
2
3
4
5
6
A
B
C
D
8. #
Risk
Impact on Project
101
<Identify the risk>
Brief description of risk and impact on costs, schedule etc
102
<Identify the risk>
Brief description of risk and impact on costs, schedule etc
103
<Identify the risk>
Brief description of risk and impact on costs, schedule etc
Risk Register
Health Network, Inc.
HNetPay
Payment
Database
View Bill –
Make Secure
Payments
View Bill -
Make Secure
Payments
HNetConnect Directory
Database
Doctors
Update
Profile
Customers
Query
HNetExchange
Message Server
(Primary Revenue)
9. Hospitals
(Customer)
Send Secure
Messages
Clinics
(Customer)
Receive Secure
Messages
View Bill -
Make Secure
Payments
Credit Card Processing Organization
Update
Profile
View Bill -
Make Secure
Payments
Update
Profile
Corporate Offices
Minneapolis
Arlington
Portland
650 Laptops/Mobile Devices
Data Centers
*Minneapolis
*Arlington
*Portland
1000 Servers
Loss of company data due to hardware removed from production
systems
Loss of customers due to production outages
Internet threats due to accessibility via internet
Loss of company information due to lost/stolen laptops/mobile
11. Company. All rights reserved.
www.jblearning.com Page 1
Deliverables
As discussed in this course, risk management is an important
process for all organizations. This is particularly true in
information systems, which provides critical support for
organizational missions. The heart of risk management is a
formal
risk management plan. The project activities described in this
document allow you to fulfill the role of an employee
participating in the risk management process in a specific
business situation.
The project is structured as follows:
Project Part Deliverable
Project Part 1 Task 1: Risk Management Plan
Task 2: Risk Assessment Plan
Task 3: Risk Mitigation Plan
Project Part 2 Task 1: Business Impact Analysis (BIA) Plan
Task 2: Business Continuity Plan (BCP)
Task 3: Disaster Recovery Plan (DRP)
Task 4: Computer Incident Response Team (CIRT) Plan
12. Submission Requirements
All project submissions should follow this format:
-point, double-space
Scenario
You are an information technology (IT) intern working for
Health Network, Inc. (Health Network), a fictitious health
services organization headquartered in Minneapolis, Minnesota.
Health Network has over 600 employees throughout the
organization and generates $500 million USD in annual
revenue. The company has two additional locations in Portland,
Oregon and Arlington, Virginia, which support a mix of
corporate operations. Each corporate facility is located near a
co-
location data center, where production systems are located and
managed by third-party data center hosting vendors.
Company Products
Health Network has three main products: HNetExchange,
HNetPay, and HNetConnect.
HNetExchange is the primary source of revenue for the
company. The service handles secure electronic medical
14. three of the company’s products using HTTPS connections.
Doctors and potential patients are able to make payments
and update their profiles using Internet-accessible HTTPS Web
sites.
Information Technology Infrastructure Overview
Health Network operates in three production data centers that
provide high availability across the company’s products.
The data centers host about 1,000 production servers, and
Health Network maintains 650 corporate laptops and
company-issued mobile devices for its employees.
Threats Identified
Upon review of the current risk management plan, the following
threats were identified:
ata due to hardware being removed from
production systems
-
owned assets, such as mobile devices and laptops
various events, such as natural disasters, change
management, unstable software, and so on
the Internet
16. Project Part 1 Task 1: Risk Management Plan
For the first part of the assigned project, you must create an
initial draft of the final risk management plan. To do so, use
the template provided in class:
Evaluation Criteria and Rubrics
competencies covered in the course thus far?
management plan in the outline?
decision-making skills in identifying key components
and compliance laws and regulations?
id the student create a professional, well-developed draft
with proper grammar, spelling, and punctuation?
Project Part 1 Task 2: Risk Assessment Plan
After creating an initial draft of the risk management plan, the
second part of the assigned project requires you to create a
draft of the risk assessment (RA) plan. To do so, use the
template provided in class:
Evaluation Criteria and Rubrics
18. in the scenario for this project, as well as any new threats
that may have been discovered during the risk assessment. You
have been assigned to develop this new plan using the
template provided in class.
Evaluation Criteria and Rubrics
-quality risk mitigation plan
based on material provided in the course?
parts of the project to build out a risk mitigation plan?
-developed draft
with proper grammar, spelling, and punctuation?
Project Part 2 Task 1: Business Impact Analysis (BIA) Plan
This part of the project is a continuation of Project Part 1 in
which you prepared an RA plan and a risk mitigation plan for
Health Network. Senior management at the company has
decided to allocate funds for a business impact analysis (BIA).
Because of the importance of risk management to the
organization, senior management is committed to and supportive
of
performing a BIA. You have been assigned to develop the BIA
plan.
20. team has their full support, as well as permission to contact any
of them directly for participation or inclusion in your BCP
plan. You have been assigned to develop this new plan.
Winter storms on the East Coast have affected the ability of
Health Network employees to reach the Arlington offices in a
safe and timely manner. However, no BCP plan currently exists
to address corporate operations. The Arlington office is
the primary location for business units, such as Finance, Legal,
and Customer Support. Some of the corporate systems,
such as the payroll and accounting applications, are located
only in the corporate offices. Each corporate location is able
to access the other two, and remote virtual private network
(VPN) exist between each Production data center and the
corporate locations.
The corporate systems are not currently being backed up and
should be addressed in the new plan. The BCP should also
include some details regarding how the BCP will be tested.
You may refer to the following additional resources to help you
and your team develop a BCP, and you may use a BCP
template if found during your research.
23. with proper grammar, spelling, and punctuation?
Project Part 2 Task 4: Computer Incident Response Team
(CIRT) Plan
By now you should have developed an RA, a risk mitigation
plan, and a BIA, BCP, and DRP.
In this part of the project, you will create a CIRT plan for
Health Network. The company headquarters (HQ) handles all
incidents because the information security organization is
located in Minneapolis, so the plan will have its roots at HQ.
Make sure to incorporate your instructor’s feedback on earlier
submissions if applicable to the CIRT plan.
Evaluation Criteria and Rubrics
consider the inputs provided in their earlier
submissions?
-developed report
with proper grammar, spelling, and punctuation?