Network and Information Security: Security Assessment Report and Business Continuity Plan for AMC Pvt. Ltd.

Running head: NETWORK AND INFORMATION SECURITY
Network and Information Security: Security Assessment
Report and Business Continuity Plan for AMC Pvt. Ltd.
Name of the Student
Name of the University
Author’s Note

1
NETWORK AND INFORMATION SECURITY
Executive Summary
The report is prepared for an AMC Pvt. Ltd. for the evaluation of the current security policy and
the activity of the organization for maintaining business continuity. The risk associated with the
development of the network framework for the organization is analyzed for the preparation of
the report. The octave methodology is applied for the analysis of the risk and establishment of a
risk measurement criteria. A profile is created listing the assets of AMC Pvt. Ltd. and the
information asset container should be identified for identification of the areas of concern. The
threat is also analyzed based on the scenario for the identification and the analysis of the risk.
On successful identification of the risk a risk mitigation approach is applied for reducing the risk
associated with the development of the information security network. The security measures
that should be applied for the development of the network solution are given in the report. The
critical assets of AMC Pvt. Ltd. that is needed to be safeguarded for the reducing the risk of
security breach is also listed in the report. The vulnerability of the assets and the threats are
identified for securing the organizational resources from unauthorized access and choose a
network model and configure the devices according to the needs of the organization. For the
development of the network solution a project plan should be created including the list of
hardware required and scheduling the task for preparation of the network solution. A business
continuity plan is prepared for the creation of a backup solution for handling emergency
condition. A backup server can be deployed for backing up the data and securing the client
data.

2
NETWORK AND INFORMATION SECURITY
Table of Contents
1. Security Assessment report...........................................................................................3
1.1. Building asset based threat profiles........................................................................3
1.2. Identification of the infrastructure vulnerability........................................................5
1.3. Development of security strategy and risk mitigation plans....................................6
1.4. Prioritized list of issues............................................................................................7
2. Business Continuity Plan...............................................................................................9
2.1. Introduction..............................................................................................................9
2.2. Description of the Continuity Plan...........................................................................9
2.3. Security Policy.......................................................................................................12
References.......................................................................................................................14

3
NETWORK AND INFORMATION SECURITY
1. Security Assessment report
The security assessment report is prepared following the octave methodology and the
different criteria for the analysis of the risk is applied for the development of the risk mitigation
plan. The octave methodology is applied because it is the best suited risk analysis method for
AMC Pvt. Ltd. having more than 300 employees working in the organization. For the
identification of the risk the following three phases are used.
1.1. Building asset based threat profiles
Process 1: Determination of critical assets and how they are currently protected
The assets can be identified according to the information assets, software assets,
physical assets and services.
The information assets can be of different form such as the customer information,
accounts information, employee information, etc. The database server contains all the
organizational information of AMC Pvt. Ltd. and its confidentiality and the integrity is maintained
for maintaining the availability of data (21). The data files needs to be updated at a real time and
detailed instruction must be provided for the performing different activities on the network. The
old information in the database needs to be archived for saving space and maintain backup of
the data.
The software assets are divided into two types such as application and system software.
The application software is used for the implementation of the business rules and use of third
party application software must be avoided because it can cause a flaw in the system and the
intruder can get the access of the network by entering through an open port (4). The system
software is such as DBMS, office productivity packages must be updated regularly with security
patches.