Information Security Audit Plan for Gamble Bet Ltd Company

This article discusses an information security audit plan for Gamble Bet Ltd Company, which has experienced a security breach resulting in fraudulent purchases from credit card numbers of the company clients. The audit plan will review the security system of the organization to determine the source of fraud and outline measures to mitigate the situation and minimize the likelihood of further system fraud in the future. The article also discusses various types of attacks that could have resulted in the credit system fraud and the impact of these attacks on the organization.

Gamble Bet Ltd Company Case Study 1
PRINCIPLES OF INFORMATION SECURITY: GAMBLEBET LTD COMPANY
By: (NAME)
(COURSE TITLE)
(TUTOR NAME)
(COLLEGE NAME)
(DATE)

Gamble Bet Ltd Company Case Study 2
Executive summary
As an IT security consultant for HackStop, I will design a security audit work plan for
Gamble Bet Pty Ltd. The company IT security has been comprised. The credit fraud system was
raising alarm bells. The fraud originated from credit card numbers of the company clients. The
fraudulent purchases from the said credit card have risen to over of fifty thousand dollars. This
audit plan will review the security system of the organization so as to determine the source of
fraud. The report will also state what the organization can do to mitigate the raised security issue.
The report will also outline some of the measures the organization can do to minimize the
likelihood of further system fraud in the future.
This audit plan will have four major areas of focus. First, the report will outline what
could have engineered IT security lapses. Second, the report will perform a threat analysis where
the report will state what ought to be tested and investigated. Third, the report will outline the
dependencies, in here the report will state the critical success factors of getting the job done. The
key people who ought to be interviewed. The report will also state the support, as an IT security
consultant I would need from the organization. The report will also outline some of the critical
resources that would be needed for the job. Lastly, the report will outline what measures the
organization needs to implement to mitigate the situation. In here the report will outline security
controls so that web applications and web servers are not comprised again.
Background and problem analysis
Web applications and servers are popular targets for hackers and attackers. Gamble Bet need
to note that web servers are used in storing web applications. There is over 10 attacks which are
web-server based. Most organization employ the use of a firewall as one of the prevention
techniques but not so that effective. One of the most probable types of attacks that the

Gamble Bet Ltd Company Case Study 3
organization could have experienced is URL interpretation attack. This is the type of attack
widely known as URL poisoning where the attackers manipulate the organization URL. SQL
injection is another type of attack that could have resulted in credit system fraud. In here the
attackers use application code to access the organization database. It allows the attackers to read,
alter, delete, and create data stored at the back-end database. Cross-site scripting is another form
of attack which could have resulted to credit system fraud. In here the attacks inject a code to the
organization web application thus able to manipulate client-side scripts of the organization web
application. It also allows the attackers to execute scripts which are able to deface the web
application and hijack user sessions. Cross-site request forgery (CSRF) is another form attack
where the users are tricked into performing unintended actions. By doing so the attackers are
able to request the organization web application that a certain user is already authenticated
against their backs. In here the attacker is able to access functionality through the victims’
already authenticated browser. Targets of these types of attacks include gambling sites, online
banking, social media, and email addresses.
Web-based applications usually accept user input where queries are constructed which
ought to be based on dynamic inputs. If some of these inputs are not validated or not properly
sanitized then they will open a re-way for an attacker to launch attacks like SQL injection, and
directory traversal types of attacks. Parameter tampering is another form of attack where
parameters are changed between the server and the client. This, in turn, leads to SQL injections
types of attacks. If an attacker is able to modify the parameters it can lead to other forms of
attacks on the web server (Gupta, 2015).
From the case study, it is evident that the organization systems must be vulnerable to
directly traversal type of attack. This is a type of attack where a user is able to access a resource

Gamble Bet Ltd Company Case Study 4
beyond the organization web root directory. In here the attacker is able to access the organization
system files and even run operating system commands, and access the organization configuration
information.
LDAP injection type of attack where an attacker is able to exploit the organization web
application by constructing LDAP statements which are based on the user input. This results in
the execution of arbitrary commands like granting permissions to various unauthorized queries.
One can also modify credit numbers content. XML type on injection is another form of attack.
In here the attackers use usually inject XML document into a web-application. SSI injection type
of attack, the user injects data into web-application. A successful type of SSI injection allows a
hacker to inject code into the organization HTML pages and even able to perform remote code
execution (Halfond, 2016).
Local and remote file inclusion allows an attacker to include unauthorized files by
exploiting dynamic file inclusion. Fingerprint web-server based attacks are form exploited by a
hacker where there are able to get information about the organization servers by sending specific
commands and afterward analyzing the output. Server-side request forgery attack could have
been used by attacked to bypass the organization network controls. In here the hackers are able
to influence organization network connection which is made by the application server and able to
comprise the organization servers. This type of attack can result into the heart-bleed type of
weakness which results to from unsuitable user inputs and the validation of the user inputs are
missing thus able to tamper with the organization system without notice.
Security misconfiguration is another weakness which could have been utilized by the
attackers. From the scenario described, no documentation of any maintenance practice that was
carried out by the organization. This usually results in security misconfiguration as security

Gamble Bet Ltd Company Case Study 5
patches are released on the basis. Security misconfiguration gives attackers access to private
features and data and can result in an incomplete system comprise.
Threat analysis
The impact of these attacks can range beyond comprise of the credit card numbers
system. The attacks can also lead to web-application defacement. It can also lead to information
theft and loss of sensitive information. Some of these attacks can lead to serious modification of
the organization data which in turn can lead to the bad reputation of the organization. Due to
SQL code injection and injection-related attacks, it can lead to Denial of service attacks which
have very serious implications to the organization. This is a type of attack makes data or
information unavailable to the users of the system. Other types of attacks such as SQL injection,
can hinder the normal functioning of the organization web-application. Local and remote file
inclusion attack is specifically designed to crash the organization web-application and the web-
server. This means that without Gamble Bet Pty Ltd having the best security controls it will
eventually lead to the collapse of the entire organization system. This attacks can also lead to a
huge financial loss. Example, Verizon investigation report shows that the DoS attack led to 3.3
million US dollars. 2015 alone most of the banking institutions were faced with the type of
attack which originated SQL injection.
There various points that Gamble Bet need to note when handling this issue. To carry out
the process of audit, the organization need to first establish the security baseline policies.
Without having a well-laid standards and policies it would be very hard for the organization to
determine the level of risk. Security policy baseline will be used by the organization in
measuring the effectiveness of the implemented IT security controls. First, the organization
needs to review the security mechanism which is configured at the firewall point. By doing so

Gamble Bet Ltd Company Case Study 6
Gamble Bet will be able to evaluate some of the possible exposures to any unauthorized network
connections. Second, the IT team need to review logging and configuration procedures. By
carrying out this activity the organization will be in a position to know where to comprise
originated from. Third, the organization needs to do a very quick assessment which should not
take more than 10 hours. In here the organization needs to not to shut down their computers or
the organization network else important information may be lost, they just need to disconnect the
organization web-server from the network and perform penetration tests. After this Gambling bet
need to change or its user passwords. All the administrative passwords should be changed and
even request their clients to change their user passwords. With this, the organization is able to
isolate the system which have been compromised and revoke access privileges which could have
be gained by the attacker.
Phase two is establishing the where the attack could have originated. In here a system
which could have been affected ought to be investigated by performing a forensic audit. An
Attacker could have left malware on the organization system during the time they had access to
the web-server to carry out attacks in the near future. All the activity logs are identified and
documented. They should also be preserved for forensic analysis which ought to be done later.
These logs help in identifying where the attack originated from so as to block any future
attempts. The third phase is notifying those account holders that have been affected. The
organization should also notify the stakeholders. The better one can send out a notification, the
better. The organization can send mass emails to their clients or even call out automated calls to
warn their customers of carrying out any unauthorized activity or revealing their passwords to
anyone. Sending out notices is very important for protecting the organization’s reputation after
comprise. By doing so, demonstrates that the organization takes their customer’s data very

Gamble Bet Ltd Company Case Study 7
seriously. This also helps in reducing the backlash which inevitably follows a major data security
breach. The organization ought also to notify the authorities as soon as possible which can help
in the investigation.
Phase four is restoring the organization assets back to normalcy. This can be done first
wiping data which is stored in the web-servers and then re-installing backup systems. In carrying
out these activities the organization needs to depend on their disaster recovery plan and their
business continuity plan which they have set in place. When restoring the organization activities
it is important to be sure to first catalog those assets which have been comprised and what is
supposed to be on the organization network according to forensic report findings.
The last phase is preparing for the next attack or system comprising. It is important
Gamble Bet organization prepare the next type of attack. If the organization has been hit, then
there is a possibility that one will be attacked again by the same people. By Gamble Bet
organization studying the attacks methods implemented by the hackers, the organization is able
to identify some of the gaps which allowed the attack to take place. This will also help in
preventing future forms of attacks. The organization also need to study their DR/BC plan which
will help them in learning how to improve their plan for future use. The organization need to
improve on their overall cyber-security posture
Dependencies and critical success factors
The audit team needs to first secure support from the senior management. The support of
the senior management is very vital as it helps in gaining the resources required for the IT system
audit process. Also, before carrying out any audit process, the team need to establish what they
know about the company. This question can only be answered by Bob, the CEO. From the CEO
the audit team need to establish both internal and external stakeholders. The CEO is also the one

Gamble Bet Ltd Company Case Study 8
who can give the very recent press releases or any news relating to the company. The team also
need to establish the architecture structure of the organization and how information follows from
the CEO to the lowest level. It is important to make sure that the Organization CEO, Bob have a
clear understanding of the aims of the IT system audit plan and some of the benefits which are
expected from it. Second, the team needs to interview the banking manager. How did he realize
that the organization system was already comprised? When was the first time he interacted with
the system?
The audit team needs to prepare questionnaires, and interviews with the key staff. One of
the key staff who needs to interview is the organization IT personnel. One of the questions that
need to be answered by the IT personnel is how the organization keep up with the current IT
industry standards. What are some of the technical standards that Gamble Bet subscribe to? The
team need to have a look some of the standards through illustrations. Second, the IT personnel
need to show some of the strongest points that the organization have put in place to protect the
every IT resource used by both the employees and Gamble Bet clients. The team also need to
establish from the IT personnel the type of OS running on the web-server. IS it Linux, Ubuntu,
windows or any other OS? In addition, to the audit team need to establish if one finds a defect or
a bug in the web application, do the organization fix for themselves or do their contact banking
provider to fix or their IT service providers. Are they any documentation of any bug which have
ever been detected? All this information, the audit team need to find out and document.
From the IT personnel, the audit team needs to know measurements taken by the bank
and the Gamble Bet to protect where the web-application reside. The audit also needs to go
through the organization recovery policy document to examine if they are any security
weaknesses one can identify.

Gamble Bet Ltd Company Case Study 9
One of the tool required in their audit which ought to be provided by the company is 05
FTK manager. This is an audit tool which allows one to examine folders and files in the network
drives and local hard drives. Using this tool will help the audit team in creating SHA1 or what is
commonly known as MD5 hashes. The tool helps in identifying the clients’ accounts which have
been already comprised. The IT team also need to check if there any signs of unwanted browser
toolbars in the web-server and the redirected searches. Also, with frequent random popups in the
web-server gives a clear indication that the web-server has already been comprised (Jaeger, 2008).
Recommendation
One, of the activities that the organization need to do, is to install antivirus software in its
web-server. The organization also need to keep all its computer software patched. The anti-virus
installed by the organization needs to always be active and must be configured for an update on a
regular basis. The antivirus also needs to be configured to automatically scan downloaded and all
email attachments. The organization also need to regularly contact its IT service providers for
unrecognized activities on the organization system. In addition, to this, the organization need to
keep its operating system updated on daily basis. Second, the organization need to use very
strong passwords for every application and site they use. The system administrator need to
choose a password which have at least ten characters which included special characters and
upper/Lowercase. In addition, they need to use the password manager in all its websites. The
organization need to have a different password for each of its web-application. Clients should
also be encouraged to always change their password regularly. As indicated earlier some of the
attacks would have originated from social engineering attempts. In here one is able to obtain
unauthorized information thus able to assume identify of may be a client. To counter this, clients
are supposed to be advised in keeping their credentials private. The organization also need to

Gamble Bet Ltd Company Case Study 10
secure all its WiFi connections to avoid any unauthorized access of the organization network. To
prevent the organization system from SQL injections or any injection-related attacks the
organization need to always establish all the web-applications which are vulnerable. Since these
is the most common type of attack which could have resulted in comprise of the system, the first
step is not to trust anyone. Second, one should not use dynamic SQL in their web-applications.
This can be done by constructing queries with user input. The third step is updating firewall and
patch which hackers can exploit. Forth, the organization need to consider installing a web-
application firewall. This will help in filtering out malicious data. In addition, the web
application firewall will help in setting default rules and it usually make it easy to add new rules
where necessary (Gallegos, 2016).
Fifth, the organization need to always use appropriate privileges. One should not connect
the organization database using admin-level privileges unless compelled to do so. Using a
limited access account is far much better as it limits what an attacker can do. Sixth, it is always
important to keep the organization secrets secret. As it is possible that the organization web-
application could have been compromised, one should accordingly by hashing or encrypting
passwords and other organization confidential data which includes even the connection strings.
The organization should also not diverge more information than need as attackers can learn more
about database architecture from the displayed error messages. This means that the organization
should always display minimal information. In fact, the organization should use remoteonly to
display their verbose error messages on the organization native machine. Lastly, the organization
needs to continually monitor SQL statements from all their database-connected applications.
This, in turn, will help in identifying any rogue SQL weaknesses and SQL statements (Pawar,
2015)

Gamble Bet Ltd Company Case Study 11
Team members’ activities and their roles
To perform the above IT audit process, it needs dedicated individuals who are ready to
carry out the tasks and activities effectively. The following outlines the team member and the
activities they will carry out
IT team member Activities
IT Audit team leader This person is responsible for leading the IT audit lead team.
He is involved in co-coordinating of the team activities. He is
the head of the team and mandated in presenting an audit
security plan to the organization stakeholders. He also
mandated in resolving any conflict which may arise among the
team. They are also supposed to teach their team members on
how to interact with the organization stakeholders when
carrying out any form of an interview.
System analyst This person is responsible for evaluating procedures and
analyzing credit system related issues. He also mandated in
testing and designing standards and solutions.
Risk assessment officer This person is mandated in evaluating and examining the
operational procedures of the organization. He is also mandated
in establishing risk-related issues. There are also mandated in
monitor business indicators which could have been
compromised. In addition, there are required to develop a
contingency plan to deal with any emergency that may arise.

Gamble Bet Ltd Company Case Study 12
Security consultant This is a person responsible I drafting questionnaires to be
distributed to the various stakeholders. They are also supposed
to mitigation factors and analyze financial data
System administrator This person is mandated in producing reports related to
database integrity and the performance of the system. There are
responsible for performing system tests to determine the source
of attacks.

Gamble Bet Ltd Company Case Study 13
References
Gallegos, F., 2016. Audit and control of information system by Frederick Gallegos. 2nd ed.
Cincinnati: South-Western Pub.
Gupta, A. a. S. S., 2015. Information System Audit. A study for security and challenges in, 2(III),
pp. 45-67.
Halfond, W. V. J. a. O. A., 2016. A classification of SQL-injection attacks and countermeasure.
In Proceedings of the IEEE International Symposium on Secure Software Engineering, 1(II), pp.
13-15.
Jaeger, T., 2008. Operating system security by Trent Jaeger. 1st ed. Chicago: Morgan &
Claypool Publishers.
Pawar, 2015. SQL Injection Attacks. KHOJ: Journal of Indian Management Research and
Practices, 4(II), pp. 125-129.