Topic 2: Final Project Part 1 – Risk Assessment, Security Policies, and Secure Network Design

Your Role:

Design a comprehensive security system for a hypothetical company.

Company Background: Give a brief overview of the hypothetical company – its size, industry, key operations, type of data it handles, etc.

  1. Network and System Security: Design the company’s network architecture, taking into account the security controls like firewalls, IDS/IPS, VPNs. Use a network diagram for visual representation. Explain your choices.
  2. Application and Web Security: Assume some applications that the company uses. Analyze these applications for the OWASP top 10 vulnerabilities and suggest remediation actions.
  3. Cryptography: Explain how the company should use encryption, including secure communications (SSL/TLS), secure storage, and key management.
  4. Incident Response and Risk Management: Create a comprehensive incident response plan and risk assessment for the company. This should include steps to be taken during an incident, team roles, communication plan, and post-incident review.
  5. Cloud and Mobile Security: Identify potential risks in the company’s use of cloud services and mobile devices, and propose mitigation strategies. Discuss the secure configuration of these services.
  6. Security Policies and Standards: Develop a security policy that aligns with a chosen standard (like ISO 27001) and create an auditing procedure to ensure compliance.

Hypothetical Company for Project 1:

Company Name: Bookster

Industry: Online Retail (Books)

Company Size: Small to Medium Business (250 employees)

Operations: Bookster is a dynamic online retailer specialized in selling books. Their business operations are entirely online, with no physical retail outlets. They host a website where customers can browse their book collection, order books, and write reviews. They also have an e-reader app available for iOS and Android where users can purchase and read e-books.

Data Handled: Bookster handles a lot of sensitive data, including customer names, addresses, credit card information, and purchasing history. On the employee side, they store personally identifiable information (PII), payroll data, and HR records.

Cloud Services: Bookster leverages cloud services for many operations. Their entire book inventory database is hosted on a cloud server, their website is hosted on a cloud platform, and they use a cloud-based CRM for customer relations and marketing.

Mobile Presence: Bookster has a mobile application available on both Android and iOS platforms. Customers can use these apps to browse, purchase, and read books, as well as leave reviews.

Security Concerns: Given their online presence, Bookster faces a variety of security threats, including potential data breaches, DoS/DDoS attacks, phishing attempts, and vulnerabilities in their web and mobile applications. They are also concerned about protecting their customer and employee data and ensuring their services remain available and reliable.

Submission:

Upload the completed plan in doc or pdf format below.

Skip to content