Cyber Security Issues and Solutions for Small Accounting Company JL

This report analyses the cyber security issues faced by small accounting company JL and suggests solutions to address them. It covers topics like ransomware, poor passwords, patch management, phishing, and authentication. The report recommends the use of encryption, backup, security software, spam filters, and access control to improve cyber security. It also compares the chosen solution with alternative solutions and provides a breakdown of the cost involved. The report concludes with recommendations for JL to improve their cyber security.

Computer security

1 | P a g e
Table of Contents
Introduction................................................................................................................................1
Cyber security issue that should be addressed immediately in JL.............................................1
Ways to address the issue...........................................................................................................2
Comparison of chosen solution better than alternative solution................................................4
Breakdown of the cost in addressing security issue...................................................................4
Recommendation........................................................................................................................5
Conclusion..................................................................................................................................6
References..................................................................................................................................7

2 | P a g e
Introduction
In this report cyber security of a small accounting company JL has been analysed. The
company started the journey with very few employees and slowly it had entered digital
market by offering online services to the customers. Online marketing has increased eth
chances of security breaches thus it is important to address the security issues by finding out
the solutions (Buczak & Guven, 2016). In this report the possible security threats that can hit
the system are found and the ways in which issue could be addressed is analysed. The
solutions to improve cyber security are compared with the other approaches so that best
outcome could be obtained. The current situation of the company in term of cyber security is
quiet weak as none of the laptops have any security software’s, poor security controls as the
passwords are not strong. The number of spam message received is very high, unaware about
the latest security threats as they even paid a huge amount at time of ransom ware attack
(Buczak & Guven, 2016). There are currently no policies or rules guiding employees on how
to best utilise resources and conform to ideal cyber security conscious behaviours. Thus, this
report will help in resolving all the concerns.
Cyber security issue that should be addressed immediately in JL Ransom ware- It is the bane for cyber security as it spreads the virus from one
customer by spreading the sensitive information over the network. It is one of the
fastest growing cyber threats as it prevents the users to access their personal files and
then demand the payment from the users to release their file (Gupta, Agrawal &
Yamaguchi, 2016). This issue was also faced by JL as their files were corrupted and
the access was denied to the valid users. Thus, hackers then asked JL to send some
crypto currency or payment through credit card to release their confidential data
(Gupta, Agrawal & Yamaguchi, 2016). Poor Passwords- In case of JL, every employee has the right to access the
information of other. As there is no strong authentication or security concerns. Thus,
due to poor passwords the information gets leaked over the network (Todev, 2015).
The business contains sensitive and confidential data thus passwords should be strong
so that only authenticated users are able to access the information (Rawat &
Bajracharya, 2015). The passwords should be strong so that hackers are not able not
break it.

3 | P a g e
 Patch management- In case of JL, there is no security software installed in the
system. Due to thus reasons networks are not secured and viruses enter the system
through the spam messages (Todev, 2015). The attacker’s attack the system due to
poor patches management as they allow vulnerabilities to enter the system and spread
through the network. This can be controlled by updating the system and protecting it
from all the vulnerabilities by installing anti-virus software. Phishing- It is one of the criminal processes that try to read the sensitive data like
username, password and some credit card details. It is a spam attack that is carried out
by emails (Ibrahim, Hamlyn-Harris & Grundy, 2016). If the link or message is
accessed by the victim then the sensitive information has the chance to get leaked. In
case of JL all the data is stored online thus it is important to secure the data (Ibrahim,
Hamlyn-Harris & Grundy, 2016). Authentication- Cyber security issue that should be addressed immediately is making
use that authentication is done correctly (Wells, Camelio, Williams & White, 2014).
Only valid users are given right to access the data. This could be done by designing an
access control list. It is an accounting firm thus every user should not have right to
make modifications so that data remains confidential (Wells, Camelio, Williams &
White, 2014).
Ways to address the issue
It is important to safeguard the system and this could be done by undertaking various steps.
 One of the most important security tools is cryptography that is used to hide the
meaning of information by keeping eth data confidential. It is needed in JL as it deals
with accounting data (Perakslis & Stanley, 2016). Cryptography encodes the data in
such a way that it is not in readable form. Even if the data is leaked it is not read by
the correct user (Perakslis & Stanley, 2016).
 Backing up the data is another way through which business is protected and the trust
of customers is maintained (Abomhara, 2015). The data should be backed regularly so
that in case of failure it could be recovered easily. Backing up the data is a cost
effective and easy approach (Tsai, Jiang, Alhabash,LaRose, Rifon & Cotten, 2016).
 The devices and software’s used in an organisation should be secured by installing
software’s so that they protect the system from malware and viruses. Such software’s
make sure that infection is not penetrated in the system (Tsai, Jiang,

4 | P a g e
Alhabash,LaRose, Rifon & Cotten, 2016). The updates in the software’s should be
done automatically so that security upgrades protect the internal as well as external
network (Shacklett, 2015).
 It is important to protect and monitor the information so that sensitive information is
not leaked (Geers, Kindlund, Moran, & Rachwald, 2014). It reduces the overall risk of
resource theft and tampering.
 As seen in case of JL passwords are not managed properly. It is important to manage
all the passwords and avoiding the invalid access to the network or data. This can be
improved by choosing strong passwords so that digital security is enhanced.
Passwords can protect the system from attacks.
 It is suggested that spam filters should be used so that amount of spam messages
could be reduced. As in case of JL, each employee receives on average 40 spam
messages each day (McGregor, Charters, Holliday & Roesner, 2015). Thus, applying
spam filter will help in reducing the chances of phishing attack and fraud emails.
 Every organisation should remain updated about the latest cyber security risks and
threats. It is necessary to stay informed about the latest scams and vulnerabilities so
that security risks could be understood (Alieyan, Kadhum, Anbar, Rehman & Alajmi,
2016).
 The hardware devices and the storage devices should be encrypted so that concerns
related to hardware theft could be reduced. The devices should be certified so that no
bugs in the system (Alieyan, Kadhum, Anbar, Rehman & Alajmi, 2016).
 JL don’t make use of any antiviruses software, thus it is suggested that organisation
should make use of antivirus software. They should be updated regularly so that
system is protected from all the threats and vulnerabilities. Antiviruses are installed in
the system as they block the bugs to enter in the system.
 Firewalls and other security software’s should be used so that security could be
maintained (Kaur & Kaur, 2015). It is also suggested that untrusted Wi-Fi and internet
connections should be avoided so that entry of hackers in eth system becomes
difficult.
 Data recovery software should be used so that data breaches don’t occur. Data could
be recovered so that system continues to work in every situation. The data should be
kept (Kaur & Kaur, 2015).

5 | P a g e
 Access control is an important part for maintaining security in an organisation. The
poor access control leave the data open and allow unauthorised user to access the
data.
 The standardize software should be used by ensuring that software’s cannot be
downloaded in the system without any approval. This is an access control list that is
used to assign right privileges among users. It enhances the overall performance.
 One of the most important way through which security can be maintained is training
the employees.
 A secure network is needed so that channels through which communication take place
is secure. Some of the networks that could be virtual private network it ensures that
channels through which communication is done are authenticated.
 Apart from all these, one of eth important tool that should be used is intrusion
prevention system. It is a way in which steps are taken to remove the bugs so that
unauthorised users are not permitted to hit the network.
Comparison of chosen solution better than alternative solution
The chosen technology is encryption and cryptography that secures the data from the hackers.
Even if the data is leaked, the hackers are not able to access the actual information. It is better
than some other means as it make sure that data remains confidential and it is not accessed by
nay unauthorised users (Knowles, Prince, Hutchison, Disso & Jones, 2015). If compared to
other technology, encryption is the best technology for data protection. It provides security to
data at time of data transfer. Apart from that, it maintains the integrity so that hackers are not
able to alter the data. It is difficult to alter the encrypted data, thus it can be said that
encrypted data means integrity. It also maintains the privacy of data as it protects all the
sensitive data of an individual (Ashfaq, Wang, Huang, Abbas & He, 2017). It is a powerful
technique that is used to limit the criminal activities. It is one of the correct solutions that are
used for transferring the data. Encryption technology helps in protecting stored data across all
devices even during transfer (Ashok, Wang, Brown & Govindarasu, 2015). Additional, it is
one of the best security solution measures as it offers authentication that helps in detecting
unauthorized users. It is an improved technology as it maintains the confidentiality, integrity
and availability in data (Ashfaq, Wang, Huang, Abbas & He, 2017).

6 | P a g e
Breakdown of the cost in addressing security issue
To address the security issue, it is suggested that access control list should be
designed by an organisation (Boopathi, Sreejith & Bithin, 2015). The cost for using access
control concept in an organisation requires 1200 dollar for installation and about 1200 dollar
per year for licence. The security software’s are also needed like antivirus and other
software’s that cost around 30-70 dollar. The cost needed for encryption by an organisation is
not fixed as it depends upon the type and amount of data (Knowles, Prince, Hutchison,
Disso & Jones, 2015). The cost factor includes various things like hosting fees for
infrastructure, storage, bandwidth, SSL and domain renewals, cost for software licenses, cost
for UI/UX updates, Preventative maintenance cost that includes periodic updates to plugins,
security patches and much more.

7 | P a g e
Recommendation
It is recommended that, the situation of JL can be improved by using security
software’s in the system. Apart from that as the communication is done via ADSL thus, it is
necessary that wireless routers are highly secure and they make use of firewalls so that
viruses do not penetrate in the system . The username and passwords should remain
confidential between the employees so that there are no chances of data breach. The spam
filters should be used so that issue of spam messages could be resolved. Apart from that,
cryptography technology and encryption should be used so that even if data is lost it is not
accessed by the hackers. Various policies or rules are designed guiding employees to best
utilise resources and make them aware about security conscious behaviours.

8 | P a g e
Conclusion
From the above discussion, the security concern off JL is understood by considering
their current situation. Cyber security is very important as essential data is stored online of an
organisation. This information stored on the network has high chances of getting leaked.
Thus, it is necessary to protect the information from unauthorized access so that data is
secure. Security attacks are rising in today’s era attackers try to read the sensitive documents
of various organisations this has led to development of unique security measures. It can be
concluded from this research that cyber security allows the business to increase their
efficiency by storing their information online.

9 | P a g e
References
Abomhara, M. (2015). Cyber security and the internet of things: vulnerabilities, threats,
intruders and attacks. Journal of Cyber Security and Mobility, 4(1), 65-88.
Boopathi, K., Sreejith, S., & Bithin, A. (2015). Learning cyber security through
gamification. Indian Journal of Science and Technology, 8(7), 642-649.
Buczak, A. L., & Guven, E. (2016). A survey of data mining and machine learning methods
for cyber security intrusion detection. IEEE Communications Surveys &
Tutorials, 18(2), 1153-1176.
Gupta, B., Agrawal, D. P., & Yamaguchi, S. (Eds.). (2016). Handbook of research on modern
cryptographic solutions for computer and cyber security. IGI Global.
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015). A survey of
cyber security management in industrial control systems. International journal of
critical infrastructure protection, 9, 52-80.
Perakslis, E. D., & Stanley, M. (2016). A cybersecurity primer for translational
research. Science translational medicine, 8(322), 322ps2-322ps2.
Tsai, H. Y. S., Jiang, M., Alhabash, S., LaRose, R., Rifon, N. J., & Cotten, S. R. (2016).
Understanding online safety behaviors: A protection motivation theory
perspective. Computers & Security, 59, 138-150.
Wells, L. J., Camelio, J. A., Williams, C. B., & White, J. (2014). Cyber-physical security
challenges in manufacturing systems. Manufacturing Letters, 2(2), 74-77.
Ibrahim, A. S., Hamlyn-Harris, J., & Grundy, J. (2016). Emerging security challenges of
cloud virtual infrastructure. arXiv preprint arXiv:1612.09059.
Ashfaq, R. A. R., Wang, X. Z., Huang, J. Z., Abbas, H., & He, Y. L. (2017). Fuzziness based
semi-supervised learning approach for intrusion detection system. Information
Sciences, 378, 484-497.

10 | P a g e
Shacklett. M. (2015). 10 ways to develop cybersecurity policies and best practice. Retrieved
from https://www.zdnet.com/article/10-ways-to-develop-cybersecurity-policies-and-
best-practices/.
Todev. N. (2015). Here’s How to Develop a Cybersecurity Recovery Plan. Retrieved from
https://www.onr.com/blog/heres-develop-cybersecurity-recovery-plan/.
Alieyan, K., Kadhum, M. M., Anbar, M., Rehman, S. U., & Alajmi, N. K. (2016, October).
An overview of DDoS attacks based on DNS. In Information and Communication
Technology Convergence (ICTC), 2016 International Conference on (pp. 276-280).
IEEE.
Geers, K., Kindlund, D., Moran, N., & Rachwald, R. (2014). World War C: Understanding
nation-state motives behind today’s advanced cyber attacks. FireEye, Milpitas, CA,
USA, Tech. Rep., Sep.
Kaur, R., & Kaur, R. (2015). AN OVERVIEW OF CLASSIFICATION OF DDOS
ATTACKS AND DEFENCE MECHANISMS FOR DDOS ATTACKS. Int J Adv
Engg Tech/Vol. VI/Issue II/April-June, 12, 14.
McGregor, S. E., Charters, P., Holliday, T., & Roesner, F. (2015, August). Investigating the
Computer Security Practices and Needs of Journalists. In USENIX Security
Symposium(pp. 399-414).
Rawat, D. B., & Bajracharya, C. (2015, April). Cyber security for smart grid systems: Status,
challenges and perspectives. In SoutheastCon 2015 (pp. 1-6). IEEE.
Ashok, A., Wang, P., Brown, M., & Govindarasu, M. (2015, July). Experimental evaluation
of cyber attacks on automatic generation control using a CPS security testbed.
In Power & Energy Society General Meeting, 2015 IEEE (pp. 1-5). IEEE.