IS Security and Risk Management

This document discusses the threats and vulnerabilities in network devices, such as SYNful Knock and DoS attacks. It also explains the use of security devices like Web Application Firewall (WAF) and Edge Transport Server. Additionally, it covers the importance of high availability solutions and risk management in Windows Server 2016.

Running head: IS SECURITY AND RISK MANAGEMENT
IS SECURITY AND RISK MANAGEMENT
Name of the Student
Name of the Organization
Author Note

1IS SECURITY AND RISK MANAGEMENT
Task 1
Answer to (1)
It has been well known that several devices of network are hugely vulnerable and can be
highly exposed. It has been noticed that there are two different kinds of threats which are being
faced against all the network routers or rather all the switches of First Focus. The two kinds of
threats are SYNful Knock and attacks of Denial of Service.
It has been observed that a particular attack named SYNful knock has been disclosed
recently. The SYNful Knock has been seen to be currently changing the operating systems image
of the router and this has been allowing several attackers for gaining a specific foothold on the
network of the victim. This kind of malware can be both updated as well as customized when
embedded (Johansson 2016). Whenever the malicious image which is uploaded is changed, it
then provides with a specific backdoor into the network of the victim. By utilising a packet of
TCP SYN which is crafted, a type of channel of communication has been established in between
the device which has been compromised, the server of control and the malicious command
(Swinkels et al. 2015). The huge impact of this specific infection to a particular network or rather
a device is very much severe and indicated most likely that there may be an extra backdoors or
rather several devices which are compromised upon the network. This particular foothold will be
giving any particular attacker with the capability of manoeuvring as well as infecting all other
hosts and accessing all the data which are sensitive.
Attacks of DoS are among those attacks which are the easiest to understand (Edge and
Wachter 2015). They are mainly seen to be working upon the particular principle of making
networking devices like routers very much busy that they are not capable of performing their

2IS SECURITY AND RISK MANAGEMENT
respective jobs. Networking devices like the routers or switches within First Focus are seen to
have been possessing with a certain capacity level that they are capable of using whenever
connected. A successful DoS attack is seen to have been happening whenever the ability of all
the routers or the switches to perform has been hindered or prevented. The simple attack of DoS
has been known to be performed by a single networked device belonging to the third party by
focusing all of the available capacity of the network onto some other device which is networked
possessing less capacity (Lipstone 2014). First Focus is seen to have a huge amount of capacity
which is networked a type of attack from a single device which is networked is not putting a dent
in that particular capacity. Due to all such attacks of DoS, instead of utilising own networking
device for sending traffic, the hacker or attacker is seen to have been taking control of the entire
group of all the networked devices like routers which are exploited which is mainly it mainly
utilises for performing the task. Such an attack is seen to be costing First Focus both huge money
as well as time whenever all the services become inaccessible.
Answer to (2)
There are mainly two kinds of network security devices which can be utilised for
controlling security as well as mitigating several threats related to all the web and the email
servers. A WAF or rather Web Application Firewall is particularly one which helps a lot in
protecting several applications of web by directly filtering as well as monitoring the traffic of
HTTP in between an application of web and the internet (Thomas et al. 2016). It is capable of
typically protecting several applications of web from several attacks like cross-site forgery,
inclusion of file and injection of SQL among several others. A particular Web Application
Firewall is mainly a 7 defense layer of protocol and it is not at all designed for defending against
several types of attacks. This particular method of the mitigation of attack is mainly a part of a

3IS SECURITY AND RISK MANAGEMENT
particular suite of tools which is capable of creating a defense mainly a holistic one against a
huge range of several vectors of attacks. With the help of the deployment of a particular WAF in
front of the application of web, a kind of shield is seen to have been placed in between the
internet and the application of web. While a particular proxy server is capable of protecting the
identity of the machine of the client by utilising a particular intermediary, a WAF is a kind of
reverse proxy which is mainly capable of protecting the server from any kind of exposure by
possessing several clients pass through the Web Application Firewall before the server is finally
reached.
On the other hand, Edge Transport Sever is a particular type of server for all the several
external mail which are both incoming as well as outgoing (Wang, Xu and Gu 2015). This
particular server is capable of working in a great manner for several companies with a specific
infrastructure of network which has been divided into an internet network which is totally
protected and also a perimeter or rather a zone which is demilitarized. This particular Edge
Transport Server is seen to be located within the particular zone which is mainly demilitarized
while the Mail box is seen to be situated within the particular network which is private. The Edge
Transport Sever is also capable of providing an extra or additional defense layer for any kind of
messages (Yabusaki and Matsubara 2014). With the help of such a way, the server of mail will
be highly experiencing very few attacks which are external. Actually Edge Transport Servers are
specifically designed for sitting on a network of perimeter for properly sanitizing the mail of
SMTP both in and out of the organization. Since the ISA Server 2006 is seen to be typically
utilised as a firewall belonging to the back end with some other firewall at the perimeter’s front
end, the particular server of ISA is seen to be sitting in between the Edge server and the Local
Area Network which is mainly internal. But the Edge Transport is totally optional during the

4IS SECURITY AND RISK MANAGEMENT
installation of the Exchange Server 2010 and 2016 but is seen to be totally missing from the
Exchange 2013 (Prasanthi 2016).
Answer to (3)
The organization is assumed to have been utilising Windows server 2016 for hosting the
website of the organization. It is very much essential for the organization to set up as well as
manage several solutions of high availability. The can ensure the availability of the service of
web utilising the Windows Server 2016 with the help of covering some of the processes like:
 Configuration of the load balancing of the network- Load balancing is mainly a procedure of
the distribution of traffic of network across several servers. This will be ensuring that not a
single server will be bearing huge amount of demand. With the help of spreading the work in
an even manner, balancing of load will be helping a lot in improving the responsiveness of
the application. It will also be helping a lot in incrementing the availability of several
applications as well as websites for several users.
 Configuration of the clustering of the failover- It is mainly a feature of the platform of
Windows Server for the improvement of an increased availability of several applications as
well as services. It is mainly a successor to the Microsoft Cluster Service and can be easily
administered with the help of Manager snap-in of the Failover Cluster.
 Management of the clusters- There must be some cluster managers which are by definition
back-end GUIs or rather all the user interfaces which are graphical which have the capability
of controlling several computers as well as servers into the actual cluster. They will be

5IS SECURITY AND RISK MANAGEMENT
working with all the agents of the management of cluster for managing as well as configuring
each and every specific node for doing all the tasks.
 Interaction with the Hyper-V – Interaction with the Hyper-V is considered to be very
essential as it is particularly a tool capable of connecting to a virtual machine for that any
user can be able to interact with the guest OS in the virtual machine (Yong, Dunbar and
Sultan 2013).
 Management of the cluster roles of failover- It is very much important to manage all the
cluster nodes of failure by directly adding all of them as several connections of server in the
Admin Center of Windows and Failover clusters can also be added for both viewing as well
as managing several resources of cluster, storage, nodes and also switches which are virtual
(Razzaq et al. 2014).
 Configuration of all the settings which are mainly role specific- Configuration of role based
settings are very much essential and the particular administration based upon role will be
combining a number of roles of security, scopes of security as well as several collections
which are assigned mainly for defining the scope of administration for each every user of the
administration (Meisel 2013).
 Configuration of the monitoring of virtual machine- It is very much essential to enable the
VM Monitoring as the service of VM monitoring will be evaluating whether each and every
VM within the cluster is running by properly checking for the heartbeats which are regular
from the procedure of VMW running within the guest.

6IS SECURITY AND RISK MANAGEMENT
Answer to (4)
Ensuring the security of information has been seen to have become one of highest
priorities within the organization. This is because an institutional compliance as well as
assurance of several regulations of PDP are one of the most important factors which mostly
affects the decision making process of the consumers (Baird et al. 2017). Hence, for complying
will all the regulations of the government, the organization has been seen to have invested a lot
in the Privacy Enhancing Technologies and use of such tools for securing the data. Although,
several technologies may be helping a lot to reduce several instances of breach of data, the
organization has been able to identify several mechanisms which are effective for managing all
the employees who are mostly seen to have access to the data of customers.
Some recommendations can be provided for reducing the risks of all the employees. First of
all, it has to be made sure that everyone within the organization have to manage risks and one
thing must be clearly shown to all the employees that the management of risks will be making
jobs very much safer (Ji et al. 2014). It can be highly recommended that all the employees must
be aware of the fact that risk management will be enabling for the success of the project. Risk
management helps a lot in the reduction of several events which are totally unexpected and it
will also be helping a lot in creating a number of benefits in finance of the organization as well.
It is to be remembered that both the horizontal as well as the vertical sharing of information are
considered to be very much important for the well-being of both the organization as well as the
employees. It will be helping a lot for understanding both the internal as well as the external
issues and this will be finally helping a lot for working together in an effective manner (Koved
and Luo 2016). Whenever several strategies as well as plans are presented, the senior
management of the organization must be able to predict with high accuracy. Instead of only

7IS SECURITY AND RISK MANAGEMENT
maintaining a particular kind of illusion that the future can be controlled, the senior management
must show both honesty as well as courage while updating all the main employees based upon
the latest forecasts. Proper communication about what actually constitutes any particular
behavior to be acceptable and what does not and also all the bandwidths of all the deviations
which are acceptable from all the objectives which are stated should be provided. The
organization will be able to benefit a lot from the establishment of a particular structured process
which has to be maintained properly for the management of all its protocols, instructions as well
as some other main policy. The senior management of the organization must emphasize that
objective like risk management, in turn, will be aimed at the creation as well as the preservation
of value for all the main stakeholders of the company.
Answer to (5)
Windows 2016 auditing tools will be helping a lot in both monitoring as well as
analyzing the web server as well as all the email server problems (Zhang et al. 2016). The free
edition of the Netwrix Auditor for the server of windows is capable of providing the visibility
into what is actually happening within the infrastructure of server based upon Windows. It is
capable of tracking any kinds of changes to the configuration of the server of windows. Netwrix
us capable of offering a number of IT tools like Netwrix Auditor, Password Manager, Account
Lockout Examiner and Service Monitor. Password manager is a kind of password management
system which is mainly self-serviced for several users mainly for troubleshooting all the lockouts
of account and resetting their passwords. On the other hand, disk space monitor is capable of
alerting regarding the availability of the space on the disk on several servers when it mostly falls
below a particular threshold. Service monitor is capable of tracking all kinds of automatic

8IS SECURITY AND RISK MANAGEMENT
services of startup on several servers as well as give alerts if they are seen to be stopped
unexpectedly and it may also happen that the server gets automatically started. Daily activity will
be summarizing each and every details sent by this monitoring tool about any kinds of changes
during the past 24hours involving both the before as well as the after values for each and every
modification. There is also the Best Practices Analyzer tool within the server of windows which
is seen to be available on each and every home page in the console of the Server Manager. It is
basically capable of scanning as well as analyzing all the main settings of the roles of the server
and also reports compliance of all of them as compared to all the standards of practices which are
the best. This will be helping a lot in identifying all the issues which are highly potential which
may be affecting both performance as well as security. Microsoft even provides with the Remote
Connectivity Analyzer which is capable of helping a lot in both testing as well as troubleshooting
the particular connectivity of the emails. It is mainly an online tool, a particular website where
addresses of server as well as all the credentials of login are sent as input for running several
tests of connectivity. Windows is also capable of providing with the Exchange Seer Deployment
Assistant which is actually a tool which mostly asks for several questions related to deployment
and after that generates a custom checklist based upon a step by step structure. It is capable of
mostly asking several questions about the recent configuration, desired environment for
deployment as well as all the desired functionalities. The Remote Desktop Manager is capable of
providing a single platform for an access which will be centralized for many kinds of remote
links as well as several remote services, along with the capability of saving all the credentials of
login as well as passwords. It can be very much helpful in saving time as well as any kind of
hassle in both the management and the utilization of all the several kinds of several methods of
remote access.

9IS SECURITY AND RISK MANAGEMENT

10IS SECURITY AND RISK MANAGEMENT
References
Baird, S., Carter, E., Galinkin, E., Marczewski, C. and Marshall, J., 2017. Attack on Critical
Infrastructure Leverages Template Injection. Talos Intelligence Blog. http://web. archive.
org/web/20170718181549/http://blog. talosintelligence. com/2017/07/template-injection.
html.
Zhang, H., Cheng, P., Shi, L. and Chen, J., 2016. Optimal DoS attack scheduling in wireless
networked control system. IEEE Transactions on Control Systems Technology, 24(3),
pp.843-852.
Wang, H., Xu, L. and Gu, G., 2015, June. Floodguard: A dos attack prevention extension in
software-defined networks. In 2015 45th Annual IEEE/IFIP International Conference on
Dependable Systems and Networks (pp. 239-250). IEEE.
Meisel, A., Riverbed Technology Inc, 2013. Distributed web application firewall. U.S. Patent
8,566,919.
Ji, P., Luo, L., Sreedhar, V.C., Yang, S.X. and Zhang, Y., International Business Machines Corp,
2014. Hierarchical rule development and binding for web application server firewall.
U.S. Patent 8,627,442.
Koved, L. and Luo, L., International Business Machines Corp, 2016. Interactive management of
web application firewall rules. U.S. Patent 9,473,457.
Razzaq, A., Latif, K., Ahmad, H.F., Hur, A., Anwar, Z. and Bloodsworth, P.C., 2014. Semantic
security against web application attacks. Information Sciences, 254, pp.19-38.

11IS SECURITY AND RISK MANAGEMENT
Yabusaki, H. and Matsubara, D., Hitachi Ltd, 2014. Transport control server, transport control
system, and backup path setting method. U.S. Patent 8,811,149.
Lipstone, L.R., L 3 Communications Corp, 2014. Content delivery network analytics
management via edge stage collectors. U.S. Patent 8,825,608.
Swinkels, G.L., Skalecki, D., Prakash, A. and Chhillar, M., Ciena Corp, 2015. Extending control
plane functions to the network edge in an optical transport network. U.S. Patent
9,118,421.
Thomas, E., van Deventer, M.O., Stockhammer, T., Begen, A.C., Champel, M.L. and Oyman,
O., 2016. Applications and deployments of server and network assisted DASH (SAND).
Edge, S.W. and Wachter, A.K., Qualcomm Inc, 2015. Registration of a terminal with a location
server for user plane location. U.S. Patent 9,094,784.
Yong, L., Dunbar, L. and Sultan, R., FutureWei Technologies Inc, 2013. Network availability
enhancement technique for packet transport networks. U.S. Patent 8,472,325.
Johansson, J.M., 2016. Windows server 2008 security resource kit.
Prasanthi, B.V., 2016. Cyber forensic tools: a review. International Journal of Engineering
Trends and Technology (IJETT), 41(5), pp.266-271.

12IS SECURITY AND RISK MANAGEMENT