Your All-in-One AI-Powered Toolkit for Academic Success.

+13062052269

info@desklib.com

Available 24*7 on WhatsApp / Email

Company

Tools

Support

IT Risk Management for Internet of Things (IoT) Applications in Gigantic Corporation

Verified

Added on 2024/07/01

AI Summary

This report analyzes the potential threats and vulnerabilities associated with implementing Internet of Things (IoT) applications in Gigantic Corporation. It identifies key risks, such as data theft, system failures, and cyberattacks, and provides recommendations for mitigating these risks. The report utilizes various risk assessment techniques, including interviews, brainstorming, and SWOT analysis, to identify vulnerabilities and threats. It also employs tools like probability and impact matrices to evaluate the severity of risks. The report concludes with a set of actionable recommendations for Gigantic Corporation to enhance its IT infrastructure security and protect its valuable data.

Contribute Materials

Your contribution can guide someone’s learning journey. Share your documents today.

Assessment Item: 3
SUBJECT: ITC-596 IT RISK MANAGEMENT –
INTERNET OF THINGS
1

Secure Best Marks with AI Grader

Need help grading? Try our AI Grader for instant feedback on your assignments.

💎 Get Pro

Executive Summary
This report has been prepared and presented to the management of Gigantic Corporation
regarding the findings and vulnerabilities identified by the “IT Risk Assessment Lead Consultant
– Internet of Things”. The report has been prepared for enabling the management to take vital
decisions regarding technical risks associated while using IoT-based applications in its
operations. The report contains the major IT-related issues that have been identified by
conducting vulnerabilities and threats assessment and the recommendations have been provided
accordingly. These findings will help the management to develop appropriate IT policies and
procedures which enable to protect the vital information; both personal information of the
employees as well as corporate data.
In order to arrive at appropriate conclusions, the methods such as conducting interviews, Delphi
technique, and brainstorming were used for analysing the possible threats of using the current
policies that are employed for managing and controlling the data while using IoT-based
applications. The views and opinion provided by the experts provided an insight regarding the
vulnerabilities of the current IT infrastructure developed by Gigantic Corporation and the extent
of the risk associated while using the Internet of Things in various operations.
The tools and techniques such as probability and impact matrix, risk data quality assessment and
quantitative risk analysis were used for determining the immediate threats that have to be
mitigated by the organisation. These tools and techniques also enabled to ascertain the threats
and threat agents and the ways in which the loop-holes can be identified and mitigated.
The vulnerabilities and threats have been identified and presented separately along with
illustrating the ratings of these risks which have been classified as high, medium, and low. The
report concentrates on providing the solutions for mitigating high and medium risks as these
risks have the potential of hampering the smooth flow of operations. The high and medium risks
have to be immediately resolved for preventing the instances of threats such as data theft and
data breach. The recommendations have been provided based on the issues identified and the
best possible ways in which these risks can be mitigated effectively.
The report provides the following recommendations based on the findings and which should be
implemented by the management for protecting the organisation from facing serious
consequences, which include:
 Using the latest firewall and malware protection software in all IoT-based applications
and server.
 Using a firewall in the network which is used for communicating with the customers and
vendors.
 Upgrading the applications and software periodically.
 Developing and implementing the standard guidelines for using the internet and the
procedure that has to be followed while using software and application.
 Developing standard procedures that have to be implemented while dealing with threats.
 Strict adherence to the password policies and the sharing of information.
 Providing the access to the application and software based on the job role of the user.
 Using administrator credentials in all the computers and devices and restricting the user
from using external storage devices such as pen drives.
 Restricting the movement of personnel to certain locations such as server rooms.
 Using strong passwords for all the applications and software that are being used.
 Maintaining a log of users and the type of software and applications they use for better
control.
2

 Creating unique Ids and passwords with strong login credentials for using software and
applications.
 Installing CCTV cameras at appropriate locations for monitoring the activities performed
by the users and preventing intrusions in the restricted locations.
 Separating the personal information of the employees and staff with that of corporate
information.
 Taking a regular back-up of the data in a cloud set-up.
 Providing training to the employees and staff regarding the ways in which the
applications and software are to be used.
 Communicating the possible threats of using the internet to the employees and staff and
the risk associated with accessing websites other than the recommended sites.
 Conducting third-party audits regularly.
 Periodic assessment of vulnerabilities and threats for ascertaining the effectiveness of
implementing preventive measures.
 Using firewall/filters at the server for detecting malwares/ransomware and for identifying
risky websites.
The report also provides a detailed explanation regarding the possible consequences that may
have to be faced if proper control mechanisms are not implemented. Due to the increasing use of
the Internet of Things, the company is too much dependent on the applications and software, it is
necessary to understand the risks associated with using these applications. These details will help
the management to modify the current procedures that are being followed and the measures that
can be taken for enhancing the safety and security of the data. The results of the assessment
provide a clear understanding as to the importance of identifying threat agents and the ways in
which the vulnerabilities can be exploited by the threat agents for accessing the information.
The merits of this project are as given below:
 By using firewall and anti-malware, the possible cyber attacks can be prevented thereby
safeguarding the vital information of the company.
 Using strong login credentials ensures that the issues related to data theft and data breach
can be eliminated.
 Upgrading the applications and software regularly helps the company from possible
malware attacks as the latest versions of the applications are assumed to be safe.
 Formulating appropriate guidelines will help the management to implement appropriate
control measures enhancing the existing security of the IT infrastructure.
 Communicating the possible risks associated with using the applications and software
enables to implement the policies effectively.
 The overall improvement in the IT infrastructure and enhanced security helps to build
trust and confidence among the stakeholders and customers thereby ensuring continuous
growth and development of the organisation.
The report concludes that the results of the risk analysis have been prepared by using appropriate
methods and techniques which enhances its accuracy. By implementing the measures stated in
the report, the organisation will be able to achieve the desired level of effectiveness while using
the Internet of Things in its operations.
3

Table of Contents
Executive Summary.....................................................................................................................................1
Introduction.................................................................................................................................................4
Risk Management Overview....................................................................................................................... 5
Techniques used:.........................................................................................................................................6
Risk Assessment and Analysis:................................................................................................................... 7
Identification of the vulnerabilities.......................................................................................................... 8
Threats................................................................................................................................................... 10
Evaluation of the risks...............................................................................................................................11
Assessment Findings................................................................................................................................. 13
Risk Treatment and Response...................................................................................................................14
Findings based Recommendations.............................................................................................................14
Conclusion................................................................................................................................................. 17
References.................................................................................................................................................18
4

Paraphrase This Document

Need a fresh take? Get an instant paraphrase of this document with our AI Paraphraser

💎 Try AI Paraphraser

Introduction
This report has been prepared for providing a detailed analysis of implementing the applications
and software in Gigantic Corporation based on the concept of the Internet of Things. With the
increased usage of web-based interfaces, the various issues related to the security of the data as
well as the server is being faced by the company. The report has been prepared by conducting a
detailed vulnerability and threat analysis by using appropriate methods and techniques and the
possible consequences of these threats have also been explained in detail. The report also
provides the solution for resolving the issues and the ways in which the threats can be mitigated
have also been explained. Suitable recommendations have also been provided which can be used
by the management for safeguarding the vital information of the employees and customers.
Aim
The purpose of the report is to analyse the possible threats that can be faced by Gigantic
Corporation while using applications and software based on the concept of the Internet of
Things. The threats and vulnerabilities are identified and the impact of these risks has also been
explained which can be utilised by the management while developing a risk mitigation plan.
Assessment Scope
The scope of the risk assessment contains the factors and elements associated with the internet of
things. The report explains the important factors; both internal and external, that has to be
considered while formulating policies and procedures for mitigating the issues related to the
Interne of Things. The safety and security of the data and the server has been given importance
as the organisation deals with a huge volume of data which is vital for the growth and
development of the organisation.
It is important to monitor and control the activities of the users since the company relies on the
various applications and software that are used for performing activities. The report provides
clear guidelines that have to be followed for preventing the instances of data theft and
unauthorised use of data. The importance of providing strong login credentials has also been
explained.
The recommendations that are provided in the last part of the report explain the possible ways of
resolving the issues related to access controls and safety and security of the information. The
findings-based recommendations enable the management to take appropriate measures for
implementing appropriate control measures which help to overcome the threats faced by
Gigantic Corporation.
5

Risk Management Overview
The risk management is a process which involves identifying and managing the various risks
involved which may result in negatively impacting the operations of Gigantic Corporation. There
are various risks involved while developing a system based on the Internet of Things in which
the different functions of the organisation are connected through the Internet. The risks that are
involved while developing the system based on Internet of Things are system failures, instances
of data loss and data breach, natural disasters, and cyber attacks. These risks have to be mitigated
so that the organisation can overcome these issues and enhance the operational efficiencies and
protect the company from resulting losses (Biener, et. al., 2015).
It is very well established that it is important to protect the information as the competitors are
always looking for a way to extract confidential information for gaining an upper hand in the
market. Hence, it is essential that the key risks are identified so that a comprehensive plan can be
developed for protecting the server and the systems. The key factors have to be identified which
can be used for preventing any mishaps and the best possible ways of enhancing the cyber
security throughout the organisation.
The risk management process that has to be followed by Gigantic Corporation can be divided
into three steps:
Risk Assessment and Analysis: In this stage, the firm’s exposure to the potential risks and
uncertainties in the business and the resulting losses that may occur due to these risks. For
analysing the true nature of the risks, the company has to ascertain the market condition and the
objectives that are defined while developing the system based on the Internet of Things. This can
be explained by citing an example wherein the finance and sales functions are interconnected so
that the sales figures can be projected based on the actual sales target achieved by the team. In
this scenario, the potential risks that can be faced by Gigantic Corporation are; system failures in
finance, connectivity issues, data breach and data theft, and cyber attacks. Hence, the company
should identify the potential threats by assessing the risks involved in particular departments and
functions (Van Grembergen & De Haes).
Risk Evaluation: In this stage, the criteria are defined based on which the risks can be assessed
and the factors that have to be considered while evaluating the risks.
Risk Treatment and Response: The techniques and procedures are enlisted in this stage which
helps to mitigate the issues identified in the risk assessment stage.
Developing monitoring controls: It is essential for monitoring the systems and vulnerable
factors continuously so that the threats can be prevented and appropriate actions can be taken
quickly for mitigating the threats at the initial stage itself.
6

Figure 1: Risk Management Process
Source: (LucidChart, 2017)
Techniques used:
The techniques that are used for analysing the risk parameters are:
Documentation reviews:
The documents that are maintained by the organisations related to the assets, details of the
previous projects, and the results of the previous projects implemented are examined.
Interview: The interviews were conducted by preparing suitable questionnaires for ascertaining
the type of risks that are usually faced by the management. The participants were divided into
separate groups namely; employees, experts, and top-level executives.
Delphi Technique: In this technique, a list of questions was sent to the experts and stakeholders
for getting the responses on various topics and the results are sent back to them for arriving at a
common consensus.
Brainstorming: The brainstorming sessions were organised with the group of experts and top-
level executives for identifying the risks associated with the project.
SWOT Analysis: This is a management tool which can be used by the management for
ascertaining the strengths, and weaknesses of the firm and the opportunities that can be utilised
for overcoming the weaknesses.
The SWOT analysis of Gigantic Corporation for using the Internet of Things in various
operations is given below:
Strengths Weaknesses
 Presence of well-established IT
infrastructure.
 Using outdated applications and
software
7

Secure Best Marks with AI Grader

Need help grading? Try our AI Grader for instant feedback on your assignments.

💎 Get Pro

 Experienced staff for using the
applications and software.
 Good reputation of the company for
using web-based applications.
 Enhanced production capacities
 Preparation of accurate management
reports for decision making
 Exposure to risk related to data theft
and data breach.
 Prone to fire accidents
 Lack of emergency guidelines for
handling unexpected events.
 Back-up issues
Opportunities Threats
 Using latest updates and patches for all
the applications and software
 Implementing appropriate user control
measures.
 Using fire safety measures
 Preparing a detailed document for
mitigating the unexpected events.
 Taking back-up in a cloud set-up
 Hackers/outsiders stealing important
information related to the operations.
 Insiders/employees disclosing the
details to outsiders.
 Man-in-the middle attacks
 Fire damages
From the above analysis, the strengths and weaknesses can be ascertained and the steps that can
be taken by Gigantic Corporation for mitigating the threats that have been identified. The
weaknesses and threats can be mitigated by using the opportunities that have been identified in
the above analysis. Hence, SWOT analysis has been conducted for analysing the risks involved
while developing the system based on Internet of Things in Gigantic Corporation. This analysis
will help in making important decisions related to the use of preventive measures that can be
used for developing a comprehensive and effective IT infrastructure.
Tools and Techniques: Various tools and techniques were used for ascertaining the probability
of risks associated with the project such as probability and impact matrix, risk data quality
assessment along with performing quantitative risk analysis.
These tools and techniques enable to understand the extent of the actual risks involved while
performing various activities and the extent to which the available data is reliable. Also, these
tools enable to identify those risks which require immediate attention.
Risk Assessment and Analysis:
The first step in the process involves understanding the risk appetite of Gigantic Corporation that
is, the risk that can be tolerated by the firm for conducting the business operations. As the
company is a large firm, the resources are available to absorb a few risks. The level of risks
involved depends on the goals and objectives of the organisation and the priorities of the
business towards performing various operations. The assets of the companies are also defined for
developing the counter-measures such as funds, operational data, previous records, and technical
know-how.
The company has to categorise the Internet of Things (IoT) as;
 IoT which can be controlled, and
8

 IoT which cannot be controlled
IoT which can be controlled are the computers and other devices which are used by the
employees within and outside of the company. These devices can be tracked and hence, the risks
associated with these devices and applications are limited. The users of these devices can be
identified easily, therefore, the instance of data breach and any other threats can be easily
identified.
IoT which cannot be controlled is those where the systems of the firm are connected through
an external networks such as communication between the customers and the company. Here, the
interacting phase cannot be controlled as the customers use a different type of devices and
connections. These external agents are a serious threat as the malicious content can enter the
server thereby involves a high amount of risk.
Figure 2: Stages in Risk Assessment
Source: (Reij & Schothorst, 2012)
Identification of the vulnerabilities
Vulnerabilities are the weaknesses in the IT infrastructure which makes the threats possible. In
other words, the potential threats can only enter if the IT system has some loopholes within it.
The threats identify these loopholes for damaging the data or stealing a particular system
resulting in huge losses to the organisation as well as damaging the reputation of a firm (Sándor,
et. al., 2017).
As discussed in the above, both controlled and uncontrolled IoT has to be analysed for
identifying the possible threats including future threats. The IT technicians should differentiate
the threats as per the interface that is being used by the users while accessing the information.
The employees and staff usually use the LAN for performing the tasks and the customers use
some external connections for communication (Wang, et. al., 2014). The following table
identifies the vulnerabilities that can hamper the normal functioning of Gigantic Corporation:
Table 1: Vulnerabilities
Description Exposure
[Metrics
from 1 to
5, where
Severity
[Metrics
from 1 to 5,
where 1
Vulnerability
Assessment
Value
Remarks
9

1
indicates
low risk]
indicates
low risk]
Lack of back-up 4 4 4 An appropriate system of back-up is
not developed wherein; the important
data is saved in a different location,
most commonly in an external
storage device or cloud interface.
This impacts the entire organisation
in case of data breach and data theft.
System Usability
issues
4 4 4 Currently, the employees can access
any computer for performing tasks.
Hence, it is highly possible that the
instances of data theft are increased.
Use of external
networks
4 4 4 At present, the customers
communicate by using the external
network and hence, the risk of data
breach and cyber attacks is higher.
Lack of control
measures
4 4 4 A systematic approach is required for
preventing the threats from entering
the server. For instance, the admin
access is provided to more number of
users which may result in the
instances of data theft.
Lack of
awareness
among the users
3 2 2 The users are not aware of the threats
involved regarding data while using
the applications and software.
Inadequate
training for the
new users
3 2 2 The current procedures that are being
followed are aimed at providing
training that is limited to providing
information regarding using the
applications and software. However,
the procedure that can be followed
for minimising the threats is not
provided.
Use of an
outdated firewall
4 4 4 This is a high-risk scenario as the
malicious content may enter the
server resulting in data loss.
10

Paraphrase This Document

Need a fresh take? Get an instant paraphrase of this document with our AI Paraphraser

💎 Try AI Paraphraser

The above-mentioned vulnerabilities have been identified for developing a comprehensive
system which can be used for developing a system for mitigating the issues. A detailed
explanation regarding the vulnerabilities has also been explained which is helpful for
ascertaining the solutions that can be used while implementing control mechanisms.
Threats
Threats are the negative event that results in undesired outcome such as data loss or incurring
financial losses. These threats are initiated by Threat Actors who breach the security apparatus
because of drawbacks in the IT management system (Chatzimichailidou, et. al., 2015). The
threats that can potentially damage the company’s data are competitors trying to steal vital
information from Gigantic Corporation. The threats that can cause damage to the company have
been provided in the following table:
Table 2: Threat and Threat Agents
Threats Threat Agent Impact Remarks
Spoofing of
credentials
Employees High The unauthorised access to the
confidential information is
possible as the user can easily
access the device.
Man-in-the-
middle
attacks
Outsiders/Hackers High These are aimed at collecting
specific information about the
company and usually, a false
identity is created for entering
the company’s server.
Ransomware Hackers High The hackers send spurious
emails for obtaining financial
information such as credit card
details of the employees,
passwords, and others.
Blocking Hackers Medium A network can be blocked by
identifying vulnerabilities of
exchange protocols.
Data
likability
Companies Medium The huge volume of data that is
stored and processed enables to
identify the user as the stored
data can be interlinked.
Profiling Companies Medium Collecting and storing the
information may lead to creating
the employees’ profile such as
credit card numbers, email
addresses, etc.
11

Fire
Accidents
Outsiders/Staff High Fire accidents result in damaging
the cables affecting the
communication channel.
The above threats have the potential of damaging the reputation of the firm resulting in facing
long-term consequences. The increased usage of the Internet of Things applications results in
storing important details of the employees and staff and the threat agents exploit the
vulnerabilities for creating damages. The threats and threat agents both require sufficient time
and space for entering the system and there are various methods in which the vulnerabilities are
exploited such as man-in-the-middle attacks.
Evaluation of the risks
These are the chances of facing a negative event which is to be avoided along with its probability
and impact, which can be denoted as:
Risk = probability X impact\
Figure 3: Security Controls For Enterprise “Internet Of Things”
Source: (Unatek, 2016)
The risks that can be faced by Gigantic Corporation are:
Disruptions and denial-of-service attacks:
It is essential to develop a system which ensures continuous availability of the IoT-based devices
for avoiding operational failures and interruptions. However, denial-of-service attacks are aimed
at interrupting the flow of the communication channel resulting in system failures which may
12

lead to losses for the organisation. In many cases, the firm may not be able to operate vital
equipment or applications which are used for performing day-to-day operations. For instance, the
finance department may not be able to provide a sales projection report accurately which are
used for making appropriate decisions related to marketing and promotion. The management
may not be able to take a decisive decision and the organisation loses the opportunity of earning
more revenues (Abomhara, & Køien, 2015).
Privacy issues related to the stored data:
Although various precautions are taken by the company, the system is still vulnerable to an
attack as the hackers use sophisticated technology for entering the system. The creation of a huge
database can be used by the hackers to steal important information resulting in the instances of
data theft and data loss. Another important risk that is being faced is the personal information of
the customers are stored such as credit card details, email address, physical address, etc. These
types of information are stolen for committing frauds and the customers may lose their money
(Kolias, et. al., 2016).
Signalling capacity:
The use of the internet across the organisation is also a challenge as the signals start to distort
with the increase in the number of users. This results in slowing down the operations and can
affect the operational efficiencies. The connectivity issues result in the lowered capacity
utilisation of the IoT-based applications resulting in incurring losses. In order to avoid these, the
firm may have to additionally plan for the activities that can be stopped and this is again a
tedious task as each IoT-based application has its own importance. With the increasing use of
these devices, the company has to look for the ways in which the signal disruptions can be
avoided and in some cases, the additional funds may have to be allocated.
Power consumption:
This is one of the major risks that can be faced with the increasing use of IoT-based devices
results in increased power usage. This again results in creating additional funds which increase
the burden on the profits earned by the company (Elkhodr, et. al., 2016).
Impact of the risks
The impact of the above-mentioned threats has been illustrated in the following table:
Impact Remarks
Business operations The threats and risks affect the normal functioning of
the business resulting in incurring huge losses.
Efficiency The disruptions in the network result in minimising
the operational efficiencies resulting in increased
cost of production.
Financial losses The important financial information may be stolen
and the organisation may incur financial losses for
retrieving the stolen data.
13

Secure Best Marks with AI Grader

Need help grading? Try our AI Grader for instant feedback on your assignments.

💎 Get Pro

Losing goodwill and
reputation
The instances of data breach and data theft affect the
customers’ confidence in the firm and hence, the
reputation of the firm may be lost.
Unwanted legal expenses The customers and the stakeholders may prefer
moving to courts as their information may be stolen
and hence, the company may have to create
additional funds for incurring legal expenses.
Additional expenses for
upgrading IT infrastructure
The company may be forced to develop an expensive
IT infrastructure for securing the data.
Assessment Findings
The assessment findings are provided for understanding the various components which are
vulnerable which makes it possible for the threat agent to enter the system:
Software Components:
 The high amount of risk in the database server (Personal details of the employees and
customers are stored here)
 IoT-based applications
 Internal and external networks - used for communicating within and outside the
organisation (Ho, et. al., 2016)
 Other software used by the departments for performing day-to-day activities.
Physical Locations:
 Server room
 Finance and admin departments
 Database server
 Reception/Help Desk
Vulnerability Statement:
As per the findings, the vulnerabilities in the Software used by the organisation are:
 Access controls and admin privileges
 Authentication methods followed (Ho, et. al., 2016)
 Unscientific ways of managing user credentials
 Maintaining and upgrading the software periodically
The configuration weaknesses are:
 Lack of proper planning
 Insufficient procedure and policy implementation
 Audit and accountability maintenance
 Managing user credentials
 Issues related to authentication
14

Risk Treatment and Response
The management should plan and implement the control measures in order to prevent the
uncertainties that can inflict serious damage on Gigantic Corporation. The above risks have to be
mitigated so that the vital information stored in the server can be saved from possible cyber
attacks and other threats. Following are the measures that can be taken for mitigating the risks:
 A risk management framework should be drafted and the steps that have to be taken for
resolving the threats have to be clearly mentioned in the risk mitigation framework. This
document should also provide the roles and responsibilities of the staff while dealing with
the crisis.
 The management should conduct vulnerability analysis periodically (preferably
quarterly).
 Developing contingency plans for mitigating the risks along with drafting alternative
plans in case of system failures (Elkhodr, et. al., 2016).
 Upgrading the servers and IoT-based applications regularly (preferably monthly)
 Taking and storing regular back-up in order to save vital data.
 Using complex login credentials
 Two-step authentication while using IoT-based devices and while connecting to the
server
 Communicating the measures that have to be taken by the users while using the software
and application
 Providing the information to the users regarding the possible risks associated while
browsing various internet sites (Weber, 2015).
 Preparation of a back-up plan in case of system failure and drafting policies for the same.
 The company can also consider taking cyber insurance for minimising the losses due to
natural disasters and fire mishaps.
 The management should prepare policies and guidelines related to the cyber security and
communicating the same to the employees.
 The physical movement to critical locations such as database server should be restricted
and only a limited number of employees should be authorised to modify the data.
 It is also advisable to keep logs and registers for preventing unauthorised usage of data
and eliminating the risk related to data theft and data breach.
Findings based Recommendations
The following steps have to be taken by Gigantic Corporation for mitigating the risks and threats
that have been identified:
Table 4: Recommendations for the identified risks
Description Impact
on
business
Recommendations
15

Lack of back-up High Taking regular back-up of the database and other
vital information and storing the same in a cloud set-
up. This reduces the risk related to data loss as the
information can be retrieved as and when required.
System Usability
issues
High Proper user control and authorisation methods have
to be implemented and a record of the users has to
be maintained for resolving this issue (Jing, et. al.,
2014).
Use of external
networks
High Using a network firewall helps to control the traffic
and running IPS-scans enables active monitoring
and prevent threats from entering the server.
Lack of
procedures and
policies for
controlling and
monitoring
High Standard procedures have to be developed based on
the usability of the system in different departments.
The privacy policy has to be developed and
communicated to the employees and staff.
Lack of
awareness
among the users
Medium The employees and staff have to be made aware of
the risk associated while accessing the internet. A
list of trusted sites has to be circulated so that only
those sites are accessed which are safe for mitigating
the issue of cyber attacks (Kung, et. al., 2017)
Inadequate
training for the
new users
Medium Proper training should be provided to the users as
the issue of data theft can only be resolved if the
users follow the guidelines.
Use of an
outdated firewall
High The firewall and anti-virus software has to be
updated regularly in order to prevent malicious
attacks.
Spoofing High An adequate amount of filters and firewalls have to
be used for checking spurious emails and messages.
Spoofing of
credentials and
man-in-the
middle attacks
High These issues can be mitigated by implementing and
monitoring user controls and by using strong and
complex passwords. The users should provide
different passwords in case if they use multiple
software and applications.
16

Paraphrase This Document

Need a fresh take? Get an instant paraphrase of this document with our AI Paraphraser

💎 Try AI Paraphraser

Ransomware High Using the latest malware protection is the best way
to prevent the hackers from stealing vital
information.
Data likability
and Profiling
Medium This issue can be resolved by storing the data in
cloud set-up and using strong login credentials for
accessing the data.
Fire Accidents High The fire mishaps can be mitigated by developing a
disaster management plan and delegating the
responsibilities to specific employees for the same.
The vulnerabilities can be further mitigated by:
Organisational Processes and Procedures: The policies and procedures for accessing the
internet as well as monitoring the activities of the users have to be developed. The use of CCTV
cameras at appropriate locations enables to monitor the activities such as using external drives
and unauthorised access to the data. The most important aspect is the movement of staff and
employees should be restricted to specific locations such as server rooms. The physical
movement has to be stopped in order to avoid the issues related to spoofing of credentials and
unauthorised access.
Conducting Third-Party Audits: There should be a provision for conducting third-party audits
in order to verify the actual implementation of the standard procedures related to IT usage in the
organisation (Lee & Lee, 2015).
Segregation of the data: The data have to be categorised and stored separately. For instance, the
personal information of the staff and employees have to be separated from corporate data. This
will ensure that the data is properly managed and adequate control measures can be implemented
while accessing the information (Singh, et. al., 2016).
Using Administrator credentials: The admin credentials should be used in all the computers
and other devices so that user cannot make any changes in these devices. The use of external
drives such as pen drives can be blocked for safeguarding the device from data theft and data
breach. The admin credentials should also be used for accessing the data stored in the cloud set-
up.
Providing training to the employees: The privacy training should be provided to all employees
and staff as per their respective job roles. This is essential as the control mechanisms remain
inadequate if the policies and procedures are not properly followed by the users.
Enabling Application firewall: The IoT-based applications have to be safeguarded by using an
appropriate firewall for each application for protecting against “cross-site scripting” and “SQL
17

injection attacks”. The firewall detects malicious HTTP requests and blocks these requests
thereby preventing possible malware and ransomware attacks.
Conclusion
From this report it can be concluded that although developing a system based on the Internet of
Things enables to resolves the operational issues, it also increases the chances of instances
related to data loss. Hence, in order to overcome the issues, the company has to formulate plans
for preventing the potential risks and ensuring safety and security of the data. The
recommendations provided in the report can be used as a guide for devising measures for
mitigating these issues. Since the report has been prepared after conducting a thorough
investigation, the results obtained in the vulnerability and threat analysis can be relied and steps
can be taken accordingly.
18

References
 LucidChart, 2017. 5 Steps to Any Effective Risk Management Process, [Online]
LucidChart, Available at: https://www.lucidchart.com/blog/risk-management-process,
[Accessed: 11 Sep 2018]
 Biener, C., Eling, M., & Wirfs, J. H. (2015). Insurability of cyber risk: An empirical
analysis. The Geneva Papers on Risk and Insurance-Issues and Practice, 40(1), 131-158.
 Van Grembergen, W., & De Haes, S. (2018). Introduction to the Minitrack on IT
Governance and its Mechanisms.
 Reij, M.W., & Schothorst, M., 2012. Critical Notes On Microbiological Risk Assessment
Of Food, [Online] Brazilian Journal of Microbiology, Available at:
http://www.scielo.br/scielo.php?script=sci_arttext&pid=S1517-83822000000100002,
[Accessed: 12 September 2018]
 Sándor, H., Haller, P., Genge, B., & Kátai, Z. (2017, July). Optimally scheduled
interventions in the presence of vulnerabilities for modern cyber-physical systems. In
Industrial Informatics (INDIN), 2017 IEEE 15th International Conference on (pp. 115-
120). IEEE.
 Wang, L., Jajodia, S., Singhal, A., Cheng, P., & Noel, S. (2014). k-zero day safety: A
network security metric for measuring the risk of unknown vulnerabilities. IEEE
Transactions on Dependable and Secure Computing, 11(1), 30-44.
 Chatzimichailidou, M. M., Stanton, N. A., & Dokas, I. M. (2015). The concept of risk
situation awareness provision: towards a new approach for assessing the DSA about the
threats and vulnerabilities of complex socio-technical systems. Safety science, 79, 126-
138.
 Abomhara, M., & Køien, G. M. (2015). Cyber security and the internet of things:
vulnerabilities, threats, intruders and attacks. Journal of Cyber Security, 4(1), 65-88.
 Kolias, C., Stavrou, A., Voas, J., Bojanova, I., & Kuhn, R. (2016). Learning internet-of-
things security" hands-on". IEEE Security & Privacy, 14(1), 37-46.
 Elkhodr, M., Shahrestani, S., & Cheung, H. (2016). The Internet of Things: new
interoperability, management and security challenges. arXiv preprint arXiv:1604.04824.
19

Secure Best Marks with AI Grader

Need help grading? Try our AI Grader for instant feedback on your assignments.

💎 Get Pro

 Unatek, Inc., (2016). Security Controls For Enterprise “Internet Of Things”, [Online]
Unatek, Inc, Available at: http://www.unatek.com/blog/security-controls-enterprise-
internet-things, [Accessed: 12 September 2018]
 Ho, G., Leung, D., Mishra, P., Hosseini, A., Song, D., & Wagner, D. (2016, May). Smart
locks: Lessons for securing commodity internet of things devices. In Proceedings of the
11th ACM on Asia conference on computer and communications security (pp. 461-472).
ACM.
 Elkhodr, M., Shahrestani, S., & Cheung, H. (2016). The Internet of Things: new
interoperability, management and security challenges. arXiv preprint arXiv:1604.04824.
 Weber, R. H. (2015). Internet of things: Privacy issues revisited. Computer Law &
Security Review, 31(5), 618-627.
 Singh, J., Pasquier, T., Bacon, J., Ko, H., & Eyers, D. (2016). Twenty security
considerations for cloud-supported Internet of Things. IEEE Internet of Things Journal,
3(3), 269-284.
 Lee, I., & Lee, K. (2015). The Internet of Things (IoT): Applications, investments, and
challenges for enterprises. Business Horizons, 58(4), 431-440.
 Jing, Q., Vasilakos, A. V., Wan, J., Lu, J., & Qiu, D. (2014). Security of the Internet of
Things: perspectives and challenges. Wireless Networks, 20(8), 2481-2501.
 Kung, A., Kargl, F., Suppan, S., Cuellar, J., Pöhls, H. C., Kapovits, A., ... & Martin, Y. S.
(2017). A Privacy Engineering Framework for the Internet of Things. In Data Protection
and Privacy:(In) visibilities and Infrastructures (pp. 163-202). Springer, Cham.
20

1 out of 20

+13062052269

info@desklib.com

IT Risk Management for Internet of Things (IoT) Applications in Gigantic Corporation

Contribute Materials

Secure Best Marks with AI Grader

Paraphrase This Document

Secure Best Marks with AI Grader

Paraphrase This Document

Secure Best Marks with AI Grader

Paraphrase This Document

Secure Best Marks with AI Grader

Related Documents

Gigantic Corporation: Risk Assessment - Internet of Things (IoT)

IT Risk Assessment of the Internet of Things (IoT) for Gigantic Corporation

Internet of Things Security and Privacy

IoT Security: Issues, Challenges & Open Problems

Internet of Things: Security and Privacy

IT Security: Enterprise Technical Infrastructure Security Plan and Risk Assessment for Uber