EXERCISE

• Explain Data Protection Act. Find an article which violates Data Protection Act

Data Protection Act is a law designed to protect personal data that stored on the systems. 

• Explain Computer Misuse Act. Find an article which violates Computer  Misuse Act

The computer Misuse Act is designed to protect the computer users against the attackers that want to steal the user's information.

Article: https://www.standardmedia.co.ke/article/2001288449/why-regulation-on-cyberspace-is-long-overdue-in-kenya 

• Research a range of physical security technologies including bio-metrics, swipe cards, theft prevention (security guard) etc. (5)

1. Bio-metrics: devices measure unique characteristics of a person such as voice pattern or fingerprint patterns.
2. Swipe cars: it is a door entry systems complete with swipe card door locks is the most common access system used by businesses today.
3. Security guards: a person employed to protect a building against intruders or damage.
4. CCTV: is a TV system in which signals are not publicly distributed but are monitored, primarily for surveillance and security purposes.
5. Security Alarm: 

• Research different ways that physical security could be breached.

• What is ISO 31000 risk management?

It is a guidelines, provides principles, framework and a process for managing risk. It can be used by any organization regardless of its size, activity or sector. It can help organizations increase the likelihood of achieving objectives, improve the identification of opportunities and threats and effectively allocate and user resources for risk treatment.

Example of company that have ISO:

References:

ISO 31000 Risk management

Iso.org. (2018). ISO 31000 Risk management. [online] Available at: https://www.iso.org/iso-31000-risk-management.html [Accessed 26 Jul. 2018].

Network Security Infrastructure

EXERCISE

1. For each of the following:

• NAT 
• DMZ
• Firewalls

2. Provide the description.

3. Discuss its purpose.

4. Identify how to implement it.

5. Explain why organizations need to implement it.

ANSWER 

NAT

• Network Address Translation (NAT) is the process where a network device to assigns a public address to a computer inside a private network.

Purpose:

• To limit the number of public IP addresses an organization or company must use. for both economy and security purposes.

Implement:

• Able to keep track of the session composed of communication between the workstation and the firewall, and the firewall with the internet.

DMZ

• A physical or logical sub-network that separates an internal local area network (LAN) from other entrusted networks, usually the internet.

Purpose:

• It provides an additional layer of security to the LAN as it restricts the ability of hackers to directly access internal servers and data via the internet.

Implement:

• The external network is formed from the ISP to the firewall on the first network interface, the internal network is formed from the second network interface and the DMZ is formed from the third network interface. Different sets of firewall rules for traffic between the internet and the DMZ, the LAN and the DMZ, and the LAN and the internet tightly control which ports and types of traffic are allowed into the DMZ from the internet, limit connectivity to specific hosts in the internal network and prevent unrequested connections either to the internet or the internal LAN from the DMZ.

Firewalls

• It is a software or firmware that enforces a set of rules about what data packets will be allowed to enter or leave a network.

Purpose:

• Firewalls are incorporated into a wide variety of networked devices to filter traffic and lower the risk that malicious packets travelling over the public internet can impact the security of a private network. Firewalls may also be purchased as stand-alone software applications.

Implement:

• By using a host-based firewall, it installed on individual servers and monitors incoming and outgoing signals. A network-based firewall can be built into the cloud's infrastructure, or it can be a virtual firewall service.

Internet, T. and Translation, N.

Internet, T. and Translation, N. (2018). What is Network Address Translation (NAT)?. [online] WhatIsMyIPAddress.com. Available at: https://whatismyipaddress.com/nat [Accessed 10 May 2018].

What is DMZ (demilitarized zone)? - Definition from WhatIs.com

SearchSecurity. (2018). What is DMZ (demilitarized zone)? - Definition from WhatIs.com. [online] Available at: https://searchsecurity.techtarget.com/definition/DMZ [Accessed 10 May 2018].

What is firewall? - Definition from WhatIs.com

SearchSecurity. (2018). What is firewall? - Definition from WhatIs.com. [online] Available at: https://searchsecurity.techtarget.com/definition/firewall [Accessed 10 May 2018].

Security Audit

EXERCISE

1. Discuss the purpose of a security audit, how it is managed and how to action the outcomes.

•  It can be happen before the threats, the security have to be check first. It is security of an organization physical, financial and computer access that controls the procedures and systems to determine its level of vulnerability to attacks or intrusions from unauthorized access. 

How it is manage?

• It is managed by evaluating the scope of information security management organization and determine whether essential security functions are being addressed effectively.

How to action the outcomes?

•  We have to update our security systems to prevent from unauthorized access.

2. Explore the range of vulnerability tests to detect weakness in security systems.

• Software program to discover flaws - to tests the system by sending out remote threats in order to ensure the system is capable of holding against security threats.
• Improves the speed of re-mediating highest risk vulnerabilities.
• Using host based to identifies the issues in the system.
• Vulnerability scanning - potential targets for DOS attacks.
• Password cracking - used to test and detect weak passwords that should be changed.

3. Provide an outline problem scenario for testing and review possible outcomes.

Problem: Abuse of User Account Privileges

• Most attacks were carried out by insider. Whether t's because of honest mistakes (accidently sending info to the wrong email address or losing a work device), intentional leaks and misuse of account privileges, the people inside you business represent one of the biggest security problems you'll ever face because these threats come from trusted users and systems, they're also among the hardest to identify and stop. 

4. Produce an audit document showing the range of tests on IT systems and networks (e.g. LANs/WANs and wireless networks).

 

 

 

 

REFERENCES

What is security audit? definition and meaning

BusinessDictionary.com. (2018). What is security audit? definition and meaning. [online] Available at: http://www.businessdictionary.com/definition/security-audit.html [Accessed 8 May 2018].

 

Information Security Management Audit/Assurance Program

Isaca.org. (2018). Information Security Management Audit/Assurance Program. [online] Available at: https://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Information-Security-Management-Audit-Assurance-Program.aspx [Accessed 8 May 2018].

Bhatti. (2012). Audit Checklist for Information Systems. Slideshare.net. Retrieved 8 May 2018, from https://www.slideshare.net/ATBHATTI/audit-checklist-for-information-systems-14849697

Dosal, E.

Dosal, E. (2018). 5 Common Network Security Problems and Solutions. [online] Compuquip.com. Available at: https://www.compuquip.com/blog/5-common-network-security-problems-and-solutions [Accessed 10 May 2018].