Free Risk Analysis and Cybercrime Prevention Strategy Essay Sample

The field of risk analysis has presumed increasing significance in the contemporary time given the concern both by private and public divisions in health, safety and environmental predicaments. In IT, a risk analysis report can be employed to bring into line technology-linked objectives with a company’s goals. A risk analysis report can either be qualitative or quantitative. In quantitative risk study, an attempt is made to statistically determine the probabilities of diverse hostile events and the possible extent of losses if a certain event occurs, whereas a qualitative risk analysis, often used, does not involve statistical likelihoods or forecasts of loss. Contrary, the qualitative technique entails describing the numerous threats, determining the degree of vulnerabilities and creating countermeasures in case an attack takes place.

Definition of Terms

Threats

A threat is an action of intimidation whereby a deed is suggested to elicit a negative reaction. It can also be defined as a communicated intention to cause loss or harm to another individual. Threat is specifically used in a ritualized form, mainly so as to prevent the avoidable acts which can result to damage or death of the persons. Cyber-attacks in terms of unauthorized access, malicious code, and network based attacks should be considered.

Hazards

A hazard is a condition that results to a certain degree of threat to health, life, environment or property. The majority of hazards are potential or dormant, with merely a theoretical harm or risk. Nevertheless, when a hazard turns out to be active, it can generate an emergency situation. Hazards only subsist when they are happening. Vulnerability and hazard interrelate to produce a risk.  Hazards in this scenario encompass high shock, extreme temperatures, power interruptions, vibration, susceptibility to RFI/EMI radiation, and wind. Structural hazards, data hazards, and control hazards should be well though-of whilst developing program code/ application software. If appropriate safeguards are not well put in place, breakdown of apparatus microwave frequencies may cause harm to equipments or staffs.

Vulnerabilities

In computer security, vulnerability can be defined as a weakness that enables an attacker to lessen the information assurance of a system. Vulnerability is the connection of three components: flaw or system weakness, access to the flaw by the attacker, and the ability of the attacker to exploit the vulnerability. In order to exploit the flaw, the attacker should have at least one pertinent method or instrument which can link to a system weakness. In this case, vulnerability can also be termed as the attack surface. In appropriate configuration of routers and firewalls, unavailability of patch management, poor access controls, and mishandled or weak encryption technologies necessitates to be well thought-out as vulnerabilities in this situation.

Risks

Risk is the possibility that an activity or action will cause harm to individuals, property or the environment, that is it will lead to undesirable outcome. The concept means that a choice having a sway on the result existed or subsists. Possible losses can also be termed as risks. It is apparent that almost all human actions carries a certain degree of risk, however, some are more risky compared to others. The four components to be addressed in this case with every risk will encompass technology, people, infrastructure, and process. Risk management and evaluation are the main factors considered in identifying risks linked with this system.

Assets

An asset can be defined as anything intangible or tangible which has the capacity of being controlled or owned to generate value which is deemed to have positive economic value. In this situation, assets will encompass the information being communicated and the physical equipments. The system would have such elements as Controlled Cryptographic Item (CCI) which will guarantee secret of the information sensitivity. Both secure and non-secure communications necessitates being appropriately encrypted and handled. Equipment maintenance staffs and operators are obligated to have DoD 8570 certifications and security clearances.

Methodology Used to Conduct the Risk Analysis

Qualitative risk analysis methodology will be used to conduct the risk analysis in this case study. There are various qualitative methods employed in risk analysis including hazard and operability study (HAZOP), preliminary risk analysis (PHA), and failure mode and effects analysis (FMEA/FMECA). In this study however, we will employ preliminary risk analysis methodology.

Preliminary Risk Analysis Methodology

Preliminary risk analysis, also referred to hazard analysis is a qualitative method that entails a methodical analysis of the incident categorization that can transform a probable hazard into an accident. Preliminary risks analysis method seeks to identify the undesirable hazards or events and then such events are separately analyzed. For every hazard or event, potential enhancements and precautionary actions are thereafter put in place. Preliminary risk analysis methodology offers a base for determining which groups of hazards are more risky thus should be given much attention and the types of risk analysis techniques most suitable. This methodology is very effective in that it can be employed in working environments to readily identify activities which lack safety measures. A consequence/frequency diagram can be used to rank the identified hazards according to risk. This allows measures to be prioritized with an aim of preventing accidents.

Steps to Risk Analysis

The four steps of the risk analysis process encompass threat assessment, vulnerability assessment, impact assessment, and risk mitigation. The main elements of the key analysis methodology include identification, control, elimination, and minimization of uncertain events.  

Risk assessment is the procedure of threat identification which encompasses human, natural, and environmental. The team should identify the potential threats and establish a ranking system which weighs and prioritizes the risks linked with the threat.

Vulnerability assessment encompasses the identification of vulnerabilities through the employment of such tools as penetration testing, vulnerability scanners, and audits o management and operational controls. However, vulnerabilities may also be weighed and prioritized in a similar manner as threat, on the basis of their risk and how they impact system operation. 

Impact assessment analyses the vulnerabilities and threats and assesses the effect these have on the system being evaluated. The linked effect on the system assist in defining the risk to the system and employing either qualitative or quantitative risk assessment offers insist on how such risks can be reduced.

Risk mitigation considers the three evaluation procedures and eventually attempts to mitigate the risks linked with each vulnerability or threat. The use of a qualitative risk assessment will allow these risks to be assigned high, low or medium values based on the discussed assessments. After the values have been assigned, the organization management can be provided with a report on the risks, hazards, and their effects on the system plus the weaknesses which requires to be reduced.  The alleviation procedure necessitates constant monitoring of the procedures and the generation of tracking systems which assist to monitor efficiency of the risk management process.

Evaluate the Top Five Risks in This Scenario Using the Qualitative Risk Analysis Approach

It is apparent that the five top risks that can be linked to the satellite communication system include the following:

Intrusion

This is the penetration to the system by cracking and/or hacking. Within the industry, hardening helps mitigate the threat. Evidently, intrusion detection systems (IDS), patch management, encryption, intrusion protection system as well as passwords are vital devices and processes that ought to be determined during the development. Moreover, a penetration testing should be done on the system to identify any vulnerability.

Meaconing

This is the rebroadcasting as well as interception of signals to interrupt communication in organizations. Apparently, signal Meaconing should be low under normal circumstances. However, the system should have in place inherent processes that will help address the threat and linked vulnerabilities. According to studies, deigning into the system power increases or channel hopping at the  testing or design stages helps to overcome the threats and linked vulnerabilities.

Loss of Control And/ Or the Physical Security of the Military Assets

This is usually is a real threat especially when the military equipment get into the wrong arms. This is due to the fact that the risk of the equipment rises tremendously. As a result of this the vulnerabilities and the threats increase due to the reason that the enemy knows the capabilities of the system.

Jamming

This is a technique that is used to prevent the radio frequency from getting to the desired destination. Evidently, the broadband radio frequency that is directed to the system can either cause the damage of the system or hinder communications. Such an attack can result to the denial of service of the system. In addition it can cut off the equipment from the external sources. This kind of risk can be addressed by ensuring that the equipment is designed appropriately as well as developing multipath links to overcome the damage. 

Interference

The interference as a result of noise or weather conditions results to difficulties in trying to send any intelligible message traffic. In order to overcome the threat, measures and strategies that will help identify the man-made as well as natural threats need to be put in place. Besides, the mitigative measures also need to be identified.

Assumption Made

The assumption made for the portable satellite system is that the system can be positioned to fixed locations which will offer physical security measures of protecting the system from damage, loss, or attack. Furthermore, the system is employed to communicate classified and top secret information for wartime emergencies. Key technologies offered by the National Security Agency (NSA) are necessary and moreover, the system has the capacity of making use of Type I AES encryption for information that is transmitted through the GIG. In addition the system should be approved or certified by Joint Interoperability Test Command (JITC), whilst Authority to Operate (ATO) and Authority to Connect (ATC) for the GIG is compulsory. The system should also make the use of Federal Information Processing Standards Publications (FIPS) 140-2 compliant encryption. Meaconing, Intrusion, Jamming, Interference, (MIJI) procedures are established and put in place in order to alleviate threats and in addition identify the roots of such threats.

Evaluate How Any Applicable Federal Legislation Will Help to Minimize Potential Risks and Help to Prevent and Detect Cybercrime Activities

In this case, various legislations are applicable which creates a framework for information security. The application of these processes will assist in reducing risks and mitigating vulnerabilities intrinsic in this system.

Department of Defense (DoD) Information Security and Accreditation Process (DITSCAP) Instruction 5200.40 offers Designated Approval Authority (DAA), accreditation and certification guidance, and a procedure which encompasses formal security test and assessment, and system documentation. Joint Interoperability Test Command (JITC) endorses systems and issue Authorization to Operate (ATO) for all DoD GIG compatible equipment. 

Federal Information Security Management Act (FISMA) (44 U.S.C. § 3541) necessitates every government agency to formulate and implement a program to offer security for the data systems which supports assets and operations of the agency. The National Institute of Standards and Technology (NIST) have the responsibility of developing methods, guidance and standards for commercial and federal agencies on Information Technology systems in order to meet the federal law formulated by Federal Information Security Management (FISMA).

The Department of Defense 8570.01-M Information Assurance Workforce Improvement Program offers categorization and guidance of certification and positions of the staffs who offer Information Assurance (IA). There are various levels of access and each level requires a particular extent of experience, training and certification in order to carry out specific tasks within the Department of Defense GIG network. The notion ‘Privilege Access’ categorizes the degree of control of a particular user that is network administrator, local user, or system administrator.

The National Institute of Standards and Technology (NIST) SP 800-30 Risk Management Guide for Information Technology Systems, offers a procedure of managing risk. The risk management guide offers a basis for the development of an efficient risk management program that consist both the practical guidance and definitions essential for evaluating and alleviating the identified risks within the Information Technology systems.

The National Institute of Standards and Technology SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems, Information Security, offers risk management process for Federal Information Technology systems, carrying out the activities of security controls selection and implementation, security categorization, security control evaluation, security control monitoring, and information system authorization.

Recommend Acceptable and Unacceptable Risk Standards That Are Consistent With Specified Federal Legislation Based On Best Practices for Securing and Preventing Cybercrime within the Organization in the Scenario

According to experts, risk analysis gives one an opportunity to prioritize his or her expenditure and efforts by taking into consideration the resources and where they will have a huge effect. It is apparent that the threats and vulnerabilities that cause minimal harm to the equipment are known as acceptable threats. For instance the tornadoes and hurricanes would be a good example especially in areas in the universe where the possibility of them occurring is very minimal. Minimal protection to the kinds of risks with very little impacts is acceptable. Industry standard in these cases may cost less and provide a reasonable amount of risk. On the other hand, unacceptable risk standards are those that allow for a huge impact. In addition, the protection offered to prevent the system from getting damaged is insufficient. In our case the information technology is a military target that will be used in a foreign hostile environment. Evidently, this will require the use of more processes to overcome the risks. Therefore since the industry is not in a position to address the risk and en sure maximum protection of the information technology system, it is recommended that additional safeguards, encryption, hardening as well as redundancies be deployed in order to meet the acceptable levels.

Develop a Cybercrime Prevention Strategy for the Contractor

The National Institute of Standards and Technology (NIST) have designed a comprehensive methodology for cybercrime prevention and information security. The methodology comprises of six steps that assist in developing a cybercrime prevention strategy that conform s to the federal law of the information security. In addition the strategy is able to protect the contractors involved from the unacceptable risks. Following the methodology steps ensures that the system developed is secure and that it is in line with the Department of Defense standards. Moreover the development costs are minimized, the information security enhanced and the risk factors linked to the project reduced.

The six steps included in the methodology include;

Categorize

This entails categorizing the categorizing the information system as well as the information developed for transmitting. Furthermore, safeguarding and storing the equipment as well as the information systems.

Select

Baseline security measures that abide by the requirements of the organizations common security should be selected and documented. The dynamic subsystems should comply with the security controls of the organization, the constraints and the assumptions. Of importance also is the identification and the documentation of the system dependencies as well as the sub system requirements.

Implement

The security controls need to be implemented and a description of how they are implemented given. It should be ensured that the compulsory configuration security is implemented and that they comply with the organizational and federal policies.

Assess

The security controls need to be assessed using the assessment processes to check whether the controls are implemented and that they are functioning as required. In addition ascertain whether the controls are configured in a right manner and that they are producing the as expected. In conclusion you should document a security assessment report.

Authorize

The information technology system operation should be authorized based on risks to the operation of the organization and other organizations, assets, individuals and the national interests. A plan of action should be developed with the measures to be used to address the weaknesses to be found. Besides, a security authorization package which comprises of the security assessment report, security plan, the plan of action and the measures to be undertaken should be developed. These are very vital documents for the accreditation and authorization process.

Monitor

The security controls of the ongoing processes should be monitored. This is done so as to assess the controls effectiveness, document the changes of the system, to carry out the impact analysis as well as report the status.  Conduct remediation actions based on monitoring activities and update security plan, security assessment reports and plan of action as needed. Monitoring should be carried at all stages from the design to the accreditation process.

Conclusion

Risk analysis involves three consisted elements: risk perception, risk assessment and risk management. There has also been appreciation that it is essential to incorporate both the public and private divisions in defining the nature of the danger and the development of policies and programs for managing such risks. Risk analysis can be delineated as the procedure of defining and investigating the risks to businesses, individuals, and government activities posed by possible human-caused or natural hostile events. Following the National Institute of Standards and Technology (NIST) will ensure that the costs are reduced by identifying, prioritizing as well as mitigating security risks.