IT Security and Risk Management

This report discusses the importance of IT security and risk management in organizations. It analyzes the network security risks faced by Vodafone Australia and recommends ways to mitigate them. It also discusses the impact of employees on information security and provides risk management recommendations to reduce the risk of employees. The report also covers the Windows Server 2016 auditing tools and ways to analyze web server and email server problems using them.

Running head: IT SECURITY AND RISK MANAGEMENT
IT security and risk management
Name of the student:
Name of the university:
Author note:

1
IT SECURITY AND RISK MANAGEMENT
Table of Contents
Introduction:....................................................................................................................................2
Discussion:.......................................................................................................................................3
Threats against network router/ switches:...................................................................................3
Network security devices to mitigate threats related to web and email servers:.........................4
Availability of Web Services:......................................................................................................5
Impact of employee on information security:..............................................................................6
Risk management recommendation to reduce risk of employee:................................................7
Windows Server 2016 auditing tools:..........................................................................................8
Ways to analyze the web server and email server problems using the Windows Server auditing
tools:............................................................................................................................................8
Conclusion:......................................................................................................................................9
References:....................................................................................................................................11

2
IT SECURITY AND RISK MANAGEMENT
Introduction:
IT security and risk management are well-defined as the process of managing the hazard
related to information technology within organization while identifying and assessing the risks so
as to maintain confidentiality, integrity as well as availability of information assets within an
organization. With the advancement of technology and its several uses, the risks regarding the
use of information technologies are also taking up pace while increasing the number of malware
infection rates in network systems. Having a stable IT security plan helps in mitigating the
potential risks within an organization while enabling the secured and safe operation of
applications that gets implemented within the organization’s overall network (Fielder et al.
2016). Implementing a proper IT and risk management plan within organization helps in
protecting the important credentials and the data sets within organization while a safeguarding
the technological assets of the organization (Barafort, Mesquida and Mas 2017). This part of the
assessment is prepared so as to provide a detail report on the evidence system services of the
well-known society in Australia known as Vodafone Australia while reflecting on the major
types of network security risks that can lead to vulnerable situation within the organization.
Background: Vodafone Australia is one of the well-known telecommunications and Internet
service benefactor brand operating in Australia. The internet facility provider brand offers wide
range of broad band plans through their National Broadband Network (Rodrigues 2019).
Recently the organization is reported to have faced certain network related issues leading to
frequent network outages as well as service down time and hence this report is prepared so as to
analyze the issues while recommending suitable measures for the issues.

3
IT SECURITY AND RISK MANAGEMENT
Discussion:
Threats against network router/ switches:
Organizations mainly make use of local area networks along with wide area networks so
as to facilitate communication with a multiple number of mail servers as well as Web servers.
Hackers often take advantages of this type of network infrastructures to crawl inside the
organizations network system and hamper its credential information.
As the organization of Vodafone Australia makes use of cloud services so as to host the
enterprise applications of its customers via cloud-based platform, hence it becomes necessary
that the organizations network control is stable and secured enough. However, some
vulnerability does exist with the network devices that are used within the organization of
Vodafone Australia, which includes the following:
1. Vodafone Australia has been reported with often network outages due to router issues
leading to partial network outages in some parts of the world. The cause of the issue that
was pointed out by the organization due to such network outages includes a problem with
the ADSL router that is mainly used within the organization to provide its services
(Szewczyk and Macdonald 2017).
Here in lies the main vulnerability with the organization as it uses the ADSL router so as
to provide its services as these types of routers are often identified as the potential
devices to attack and compromise the vulnerabilities associated with the web interface of
organization. Several vulnerability risks exist with the use of ADSL routers as they get
classified into two categories one is the server-side attack and the other is the client-side
attack. The server-side attacks of the router aim at altering the actual information for

4
IT SECURITY AND RISK MANAGEMENT
example the root passwords while the client-side attacks target mostly the users who are
connected with the ADSL routers leading to interaction with malicious webs sites and
thus exposing the credential information of the company.
2. Another issue that is faced within the organization of Vodafone Australia, is with the
management of network traffic which often leads to lack in the flow of traffic while
initiating telecommunication within their network. This issue is mainly caused due to the
unexamined data packets that gets into the network without any inspection as a result of
which rises high vulnerability against privacy and security concerns within their offered
network services (Lopez-Martin et al.2017). Unexamined data packets are considered to
be trained inputs that when enters within a network can lead to several vulnerabilities like
destroying the information assets of the company or dynamically tracking the programs
that gets executed within the network. Hence proper vulnerability detection tests need to
be carried out for each of the data packets that enters within the network.
Network security devices to mitigate threats related to web and email servers:
Although the organization of Vodafone Australia aims at providing its consumers the best
mail and web services but still complaints have been received from different consumers about
frequent network traffic issues leading to blocking up of email and web servers. Email is one of
the most popular way to carry out businesses and attackers find ways to discover vulnerabilities
within this domain. Some of the vulnerabilities that still exist with the email and web server of
Vodafone Australia includes weak authentication procedures making use of weak passwords so
as to secure the data. Hence attackers take advantage of these kind of vulnerability to access the
information assets of the organization. Another risk that exist within the organization is the risk
with its web servers where the organization is responsible for the smooth functioning of web

5
IT SECURITY AND RISK MANAGEMENT
applications over the cloud-based platform. But as a result of frequent network outages, the web
servers are often vulnerable to risks like phishing scam, Security misconfiguration and many
more.
In order to mitigate these threats related to email and web servers, the suggested network security
devices that the organization of Vodafone Australia can implement within their network
includes-
1. Implementing SSL server port: The SSL server port is of the secured port for initiating
outgoing mails and involves selection of settings for implementing secured connection in
the mail program (Jawi and Ali 2016). For this the organization would require to change
the settings for only the mail server while changing the port listing from 25 to 465. This
type of server port also enables secured use of email server while reducing the risk of
phishing or DDoS kind of attacks that are more likely to take place in absence of this
settings.
2. Implementing web cache: Web cache helps in saving a lot of time while directly asking
for contents from the web server that resides far away from the client’s reach (Saravanan
et al. 2017). Hence if a web cache gets Implemented within the web server of the
organization, then it would make contents available while reducing the time and
overloading of the web servers.
Availability of Web Services:
In spite of some of the vulnerabilities that are present within the organization, some positive
views are also reflected within the organization as for example, the organization of Vodafone
Australia is known to use the Windows Server 2016 so as to provide its web services to its
consumers. The Windows Server 2016 is one of the Microsoft’s latest server operating system

6
IT SECURITY AND RISK MANAGEMENT
that helps in providing huge potential to big business organizations (Lee 2017). The Windows
Server 2016, provides a wide range of of advanced structures leading to its core basis. The
features include identity administration along with improved security measures so as to
safeguard the data safety and accessibility while maintain integrity of data from end to end
(Morimoto et al. 2017). The organization of Vodafone Australia can make the best use of the
windows server 2016 while enabling easy availability of web services which includes the
following:
1. Active Directory Certificate Services- delivers certification authority, certificate
enrollment policy services, network device enrollment services
2. Active Directory Domain Services- Provides active directory right management server
3. DHCP Server-
4. File and Storage Services- provides file server services, data deduplication, branch cache
for network files, file server resource executive
5. Hyper V Services
6. DNS Server
7. Remote Access- providing remote desktop connection broker, licensing of remote
desktop, routing, web application proxy.
8. Web Server IIS- provides web server, features related to common HTTP, Directory
browsing, custom logging, tracing, Security, basic authentication, application
development
9. Windows Server Essential Experience
10. Windows Server Update Services- providing WID connectivity, SQL Server connectivity

7
IT SECURITY AND RISK MANAGEMENT
Impact of employee on information security:
The significance of the members’ attitude towards data security within society mainly
depends on the technological elements and security attitudes and awareness towards the
behavioral aspect of the employees (Soomro, Shah and Ahmed 2016). The organization of
Vodafone Australia besides ensuring the confidentiality of information also promotes strong
internal culture between the employees while assessing the critical nature of the privacy risks
within the information assets of the organization. The organization of Vodafone Australia
expects its employees to be ware of the fact about controlling as well as protecting the
information of its customers but they often fail in doing so. Vodafone Australia promotes various
types security awareness risks throughout the business so as to deepen the security culture of the
entire organization (Varga, Cherry and D'Antoni 2016). The employees under the organization
are engaged with different global awareness program that helps them to understand the role that
needs to be played while protecting the customer information within the organization. In spite of
various awareness programs, the employees of the organization get impacted due to the
prevalence of certain security risks such as growing rate of cyber threats, cyber criminals and
hacktivist activities within the organizations information assets.
Risk management recommendation to reduce risk of employee:
In order to diminish the risk of the member as a result of the growing risk in security trends,
the following risk management plan is thus proposed based on the business scenario of the
organization:

8
IT SECURITY AND RISK MANAGEMENT
1. To arrange for Global Security Operation Centre so as to design an infrastructure to
detect the possible cyber-attacks that are likely to occur within the organization of
Vodafone Australia (Sharma, Dhote and Potey 2016).
2. Recognition of attacks that can successfully take place within the organization while
exploiting the present vulnerabilities within the organization. In this context a robust
business continuity model needs to be set up by the organization that should ensure its
effectivity as well as response to emergency situation during any type of data breach.
Creating crisis within the business operation of Vodafone Australia.
3. Implementing privacy management capability within the infrastructure of the company
while embedding privacy feature within the Machine to machine platform (Patra, Naveen
and Prabhakar 2016). This approach of the organization will help in identifying the
business requirements that are needed so as to regulate the privacy feature of the
information assets of the organization.
4. Besides all these, the organization should also take steps to implement awareness and
training programs for the employees including e-learning course for the employees so as
to decrease the risk of member due to data security threats within the organization.
Windows Server 2016 auditing tools:
Windows server 2016 provides unique feature of security auditing while enhancing the
threat detection within the data center of organizations. The different types of auditing tools that
are available within the Windows Server 2016 includes Security Account Manager, Security
Audit Logs, Boot Configuration Database, LSASS Security and improved logon information of
events.

9
IT SECURITY AND RISK MANAGEMENT
Ways to analyze the web server and email server problems using the Windows
Server auditing tools:
The organization of Vodafone Australia can make use of the mentioned auditing tools
that are available within the Windows Server 2016, so as to detect the net server and email server
problems that are detected within the company’s network while detecting the occurrence of
malicious activity within the datacenter.
While using the auditing tool of Security Account Manager, the organization can store
the user passwords within the database files. This will allow the company to protect the database
files against common attack while enabling the SAM access remotely to find the operators of the
local collection of admins on the server.
Using the windows server auditing tool such as security audit logs, will also help the
company of Vodafone Australia to raise alerts o suspicious activities occurring within their email
or web server (Eni 2016). The auditing tool of security audit logs provides various features such
as detailed tracking, management of audits and integrity of the audit systems.
Besides all the tools, the organization can also make use of the Boot Configuration
Database so as to enable track changes related to test signing, boot debugging, and disabling the
Win load debugging menu.
Conclusion:
Thus, from the report it can be concluded that with all the types of advanced malicious
attacks, it is necessary for organizations to establish a secured as well as safe network so as to
protect the information assets of the company. Threats to network security system can come in
various form that companies usually miss out leading to events like frequent network outages or

10
IT SECURITY AND RISK MANAGEMENT
issues regarding email or web server downtime. Hackers usually find ways to attack these types
of vulnerabilities within network security so as to spread malicious virus within the network
while compromising the assets of the organization. Hence it is essential for organizations to
make use of the latest windows server updates so as to safeguard their information with the latest
and advanced security features. Besides using updated web servers, it is also beneficial for
organizations to make use of the web server auditing tools that provides a wide range of security
tools to prevent the impact of malicious activity within the organizations network while helping
them to process with their services in a smooth manner.

11
IT SECURITY AND RISK MANAGEMENT
References:
Barafort, B., Mesquida, A.L. and Mas, A., 2017. Integrating risk management in IT settings from
ISO standards and management systems perspectives. Computer Standards & Interfaces, 54,
pp.176-185.
Eni, L.C., 2016. Considerations regarding the design of an online collaborative audit
system. Managerial Auditing Journal, 31(1), pp.64-86.
Fielder, A., Panaousis, E., Malacaria, P., Hankin, C. and Smeraldi, F., 2016. Decision support
approaches for cyber security investment. Decision Support Systems, 86, pp.13-23.
Jawi, S.M. and Ali, F.H.M., 2016, September. Rules and results for SSL/TLS nonintrusive proxy
based on JSON data. In 2016 6th International Conference on IT Convergence and Security
(ICITCS) (pp. 1-5). IEEE.
Lee, T., 2017. Windows Server 2016 Automation with PowerShell Cookbook. Packt Publishing
Ltd.
Lopez-Martin, M., Carro, B., Sanchez-Esguevillas, A. and Lloret, J., 2017. Network traffic
classifier with convolutional and recurrent neural networks for Internet of Things. IEEE
Access, 5, pp.18042-18050.
Morimoto, R., Shapiro, J., Yardeni, G., Droubi, O., Noel, M., Abbate, A. and Amaris, C.,
2017. Windows Server 2016 Unleashed (includes Content Update Program). Sams publishing.
Patra, S., Naveen, N.C. and Prabhakar, O., 2016, May. An automated approach for mitigating
server security issues. In 2016 IEEE International Conference on Recent Trends in Electronics,
Information & Communication Technology (RTEICT) (pp. 1075-1079). IEEE.

12
IT SECURITY AND RISK MANAGEMENT
Rodrigues, M., 2019. Vodafone group Plc-telecommunications (Doctoral dissertation).
Saravanan, P., Arunkumar, S., Subramaniyaswamy, V. and Logesh, R., 2017. Enhanced web
caching using bloom filter for local area networks. International Journal of Mechanical
Engineering and Technology, 8(8), pp.211-217.
Sharma, D.H., Dhote, C.A. and Potey, M.M., 2016. Identity and access management as security-
as-a-service from clouds. Procedia Computer Science, 79, pp.170-174.
Soomro, Z.A., Shah, M.H. and Ahmed, J., 2016. Information security management needs more
holistic approach: A literature review. International Journal of Information Management, 36(2),
pp.215-225.
Szewczyk, P. and Macdonald, R., 2017. Broadband router security: History, challenges and
future implications.
Tang, M. and Zhang, T., 2016. The impacts of organizational culture on information security
culture: a case study. Information Technology and Management, 17(2), pp.179-186.
Varga, S., Cherry, D. and D'Antoni, J., 2016. Introducing Microsoft SQL Server 2016: Mission-
Critical Applications, Deeper Insights, Hyperscale Cloud. Microsoft Press.