Data Security Report: Addressing Critical Vulnerabilities

Desklib provides solved assignments and past papers to help students succeed.

Contents
Introduction......................................................................................................................................2
Issues encountered...........................................................................................................................3
Summary........................................................................................................................................10
Glossary.........................................................................................................................................11
References......................................................................................................................................12
Figure 1: Kaspersky Anti-Virus features.........................................................................................5
Figure 2: Windows 10 pro features.................................................................................................6
Figure 3: Cloud features..................................................................................................................7
Figure 4: Components of LAN........................................................................................................8
Figure 5: YesWare features.............................................................................................................9

Introduction
The assessment is about identifying the security issues in the case study which is provided
already. The issues that are provided needs closer scrutiny and more issues need to be identified
from the provided ones. The issues that are identified and need to be resolved may contain only
one solution through which multiple issues can be resolved or one single solution may minimize
the effect on other problems that are encountered. Out of the eighteen identified issue, the report
contains the top five issues that need to be discussed in detail and a proper solution is provided in
this particular report. The issues may be severe or average but a proper solution is needed in both
the case so this report has the solution of the top five major issues and its solution in the
documentation form. At last, a conclusion is given that conclude all the points covered in the
report that is being created.

Issues encountered
Issues Reasons
Absence of the latest Windows. A lot of new updated windows have been
introduced in the market but the organization is
not updated with it.
Absence of Security Software in laptops. None of the laptop present in the organization
contains any security software and that could
harm the confidential data of the organization.
Absence of the anti-viruses. This issue would definitely harm the data if
any of the viruses attack the system.
Accessing the Internet through ADSL via D-
Link DSL-2740B wireless router.
A number of other internet connections are
being used nowadays, that would provide the
best internet speed.
Absence of the IDS or the IPS Absence of this creates issue such as no alert as
well as reports at a particular time are
provided.
Using the QNap TS-412 NAS for the backup
purposes.
This is not the latest version and it could harm
the data if the backup is not done properly and
can also get lost.
Getting a lot of spam messages. This could bring up a lot of viruses along with
it.
Using the Windows 2000 Server. This issue is created as using this server a lot of
faults are being noticed.
Paying for the Ransomware infection. This issue is created and because of it, the
organization has lost a number of funds.
Each of the emails as well as the accounts can
be easily accessed.
This is another issue that is addressed in the
company and can cause different problems.
Absence of policies related to the authenticity
of employees
There is a lack of authentication security that is
highly vulnerable and can easily exploit the
authenticity of employees.
Absence of data confidentiality As the employee transfer files using email, the
file is not safe and easily vulnerable.

Stored data is unsafe The data that is stored is not safe and secure,
there is a lack of confidentiality
Lack of skilled employees The employees present are not much
knowledgeable.
Lack of policies that keep the employees
accountable.
The lack of policies that holds them to keep
work in a proper manner
Lack of policies related to access As everyone has access to everything, this can
result in vulnerability to sensitive information
of the organization.
Unaware employees Employees remain unaware of the problems
and threats that can occur so this can result in
causing some major problems
Absence of backup policy The absence of backup policy risks the data
and sensitive information of the organization
The top five issues that are discussed here are listed as below and its various parameters that
include the consequence of the issue, its alternative and the cost of using that alternative is
discussed (Bharadwaj, et al., (2018, November)).
(i) Absence of anti-viruses:
The Antivirus is important for the systems because it helps in providing the guard to the systems
that save the system from getting slower and providing more efficiency. Previously, the company
used McAfee software and now the company switched to other software (Wang et al., (2015)).
There are some consequences that can be faced if the absence of anti-virus is there or the poor
software of antivirus is there:
Consequences:
 Systems will work slowly, therefore, consumption of more time.
 Sensitive information can be leaked or stolen.
 Can transfer from another system also through the network and can result in heavy
destruction.
 System boot problems.
Alternative:
The alternative that is adopted by the company in order to improve the quality of the system is
the Kaspersky Anti-Virus. This has many features that will provide a great advantage to the
systems and help to overcome all the consequences that the other antivirus is giving. So the
different features of this antivirus are: Password management, Monitoring network, provide data
protection as well as provide backups to the data and information of the organization.
Cost:

The cost of using this antivirus software will be $39.95 per year for one particular system (2019).
Figure 1: Kaspersky Anti-Virus features
(ii) Absence of the latest Windows:
Currently, the company is using windows 10 which are efficient but not as much as the windows
10 which are updated (Tsai et al., (2010, August)). So the company is now switching to Windows
10 updated versions as it provides more features that are useful for this company and help in
earning more profits (Andersson & Szewczyk (2011)). There are various consequences that the
company needs to face if it uses the obsolete version of windows.
Consequences:
 Can easily come under the threat of the viruses that can lead to major destruction.
 There is a risk of Wanna cry threat on the windows that can affect the system badly.
 As the system is connected with the network and many online connections are there so
obsolete windows can lead to encounter to the risks related to the internet of things.
 Third party risks can also be encountered (Galal et al., (2016)).
Alternative:
The alternative that is adopted by the company in order to replace the obsolete Windows 10 is
the windows 10 updated version. These windows have more features like virtual desktops,
universal applications, the virtual assistant named as Cortana and a very effective web browser
named as Microsoft edge.
Cost:

The cost of installing the windows 10 in one system depends on the version which the company
adopts. The cost of windows 10 home is $119 and the windows 10 pro costs $199 (Statt, 2019).
Figure 2: Windows 10 Pro features
(iii) Stored data is unsafe:
The organization is currently using the QNap TS-412 NAS to backup workstation data which is
not efficient and need some replacement so that the efficiency can be increased (Tawalbeh et al.,
(2015, October)). This can be done by replacing the current software from the cloud that contains
unlimited storage as well as security to the data and information of the organization (Kenawell et
al., (2016)).
Consequences:
 The data of the employees as well as customers is jeopardized.
 Leakage of sensitive information related to the company.
 The DDoS attack can lead to heavy destruction.
 Stealing information lead to heavy loss of money and profits.
 Planning and benefits are on risks.
 Confidentiality and authentication are compromised (Seok et al.,(2016)).
Alternative:
The alternative of the QNap in order to store the data as well as backups in the cloud as it
provides unlimited space and storage. This method of storing the backup and huge amount of
data is effective as cloud provide easy maintenance, unlimited storage, and large network access,
economical, secure and self-service. All these features make this method more optimized and
effective (Janakova, M. (2018)).

Cost:
The cost of adopting this technology is from $100 per system in one month to $200 per desktop
and another cost of implementation, migration and the storage is also added ("How Much Does
Cloud Computing Cost?", 2019).
Figure 3: Cloud features
(iv) Internet Access Issue-
The company uses the ADSL for accessing the Internet via D-Link DSL-2740B wireless router.
This is the wireless router that is being used in order to provide access to the internet to the
employees of the organization. The issue that is being encountered by using this router is less
speed. The speed is the major issue being found here (Fraley & Cannady (2016, October)).
Consequences
 The slow speed of the Internet causes delays in the work.
 The employees working in the organization suffers because it restricts them from
searching the useful content whenever needed for any of the projects.
 The communication gap among the employees of the same and the different organization
will get affected (Puthal et al., (2015, January)).
 Most of the work in this department is purely based on the software to runs on the
internet.
Alternative
The alternative that could be used in place of it is the LAN connectivity. Connectivity of LAN
provides or offers better internet speed and that could clear almost each and every issue. LAN
helps in providing the stable and consistent internet speed to all the employees and it would help
in making the growth in the company (Simon & Anderson (2015)).
Cost:

The cost of installing the LAN Connection for 100 users annually is approximately $23,500 (Bob
O'Hara, 2019).
Figure 4: Components of LAN
(v) Accessing other employees data Issue
The organization contains their official emails. But each of the employees can access the
information and emails of the other employees as well. This issue creates a problem for the
employees who want to keep the data confidential. Such issues have to be resolved by the
perspective of the organization's work.
Consequences
 The employees can’t keep their data safe and secure.
 The employees face problems to keeping their personal information safe (Cai, et al.,
(2017)).
 The email id of the employees can easily be miss-used (Szewczyk, (2013)).
Alternative
YesWare is the software that could be used for tracking the emails of the individuals. This
software could really help the employee to keep their safe and secure from the access of the
different people. They can easily keep their data secure and safe and can keep it confidential.
This software can easily track the access of the different people on one’s email and notifies them
immediately (Zhao, M. (2017)).
Cost
This would cost $3000 for each user per annum (2019).

Figure 5: YesWare features

Summary
The conclusion of the above report is that all the encountered issues need to be rectifying by
replacing the obsolete methods, tools, and techniques of different components of the
organization. The company uses already some tools that are hampering the profits and benefits of
the company. So the replacements of these techniques are provided in this report. Also, the
features of the provided alternative are given along with the cost of installments of the
technology is given in the form of diagrams.

Glossary
Glossary
IPS/IDS Intrusion Prevention System and Intrusion
detection system which manages the traffic and
alarms the staff.
Server Server software on a central computer which helps
in providing services.
Client The computer system of a user. Make a request for
resources to the server.
YesWare The tool used to resolve the problem of accessing
other employee data issue.
LAN Local Area Network that provides a wide range of
internet.
Windows 10 pro An updated version of the windows 10 with
multiple and enhanced features.
QNap Software for data storage that the company already
using.

References
1. Bharadwaj, D. R., Bhattacharya, A., & Chakkaravarthy, M. (2018, November). Cloud Threat
Defense–A Threat Protection and Security Compliance Solution. In 2018 IEEE International
Conference on Cloud Computing in Emerging Markets (CCEM) (pp. 95-99). IEEE.
2. Fraley, J. B., & Cannady, J. (2016, October). Enhanced detection of advanced malicious
software. In 2016 IEEE 7th Annual Ubiquitous Computing, Electronics & Mobile Communication
Conference (UEMCON) (pp. 1-6). IEEE.
3. Janakova, M. (2018). Crm & social networks. Academy of Strategic Management Journal, 17(5),
1-15.
4. Zhao, M. (2017). Local Area Network (LAN)-Based Digital Signage Solution Using Raspberry
Pi. International Journal of People-Oriented Programming (IJPOP), 6(2), 20-32.
5. Kenawell, B., Phelan, B., Sherbondy, K. D., & Narayanan, R. (2016). QNAP 1263U Network
Attached Storage (NAS)/Storage Area Network (SAN) Device Users Guide (No. ARL-TN-0804).
Army Research Laboratory Adelphi United States.
6. Puthal, D., Sahoo, B. P. S., Mishra, S., & Swain, S. (2015, January). Cloud computing features,
issues, and challenges: a big picture. In 2015 International Conference on Computational
Intelligence and Networks (pp. 116-123). IEEE.
7. Tawalbeh, L. A., Alassaf, N., Bakheder, W., & Tawalbeh, A. (2015, October). Resilience mobile
cloud computing: features, applications and challenges. In 2015 Fifth International Conference on
e-Learning (econf) (pp. 280-284). IEEE.
8. Cai, H., Xu, B., Jiang, L., & Vasilakos, A. V. (2017). IoT-based big data storage systems in cloud
computing: Perspectives and challenges. IEEE Internet of Things Journal, 4(1), 75-87.
9. Simon, L., & Anderson, R. (2015). Security analysis of consumer-grade anti-theft solutions
provided by android mobile anti-virus apps. In 4th Mobile Security Technologies Workshop
(MoST).
10. Galal, H. S., Mahdy, Y. B., & Atiea, M. A. (2016). Behavior-based features model for malware
detection. Journal of Computer Virology and Hacking Techniques, 12(2), 59-67.
11. Seok, J., Choi, M., Kim, J., & Park, J. (2016). A Comparative Study on Performance of Open
Source IDS/IPS Snort and Suricata. Journal of the Korea Society of Digital Industry and
Information Management, 12(1), 89-95.
12. Tsai, C. L., Lin, U. C., Chang, A. Y., & Chen, C. J. (2010, August). Information security issue of
enterprises adopting the application of cloud computing. In The 6th International Conference on
Networked Computing and Advanced Information Management (pp. 645-649). IEEE.
13. Szewczyk, P. (2013). Usability and security support offered through ADSL router user manuals.
14. Andersson, K., & Szewczyk, P. (2011). Insecurity by obscurity continues: are ADSL router
manuals putting end-users at risk.
15. Wang, B., Zheng, Y., Lou, W., & Hou, Y. T. (2015). DDoS attack protection in the era of cloud
computing and software-defined networking. Computer Networks, 81, 308-319.
16. Xiang, Y., Lin, Y., Lei, W. L., & Huang, S. J. (2004). Detecting DDOS attack based on network
self-similarity. IEE Proceedings-Communications, 151(3), 292-295.
17. Bhuyan, M. H., Bhattacharyya, D. K., & Kalita, J. K. (2015). An empirical evaluation of information
metrics for low-rate and high-rate DDoS attack detection. Pattern Recognition Letters, 51, 1-7.