Network Management Security: Vulnerability and Threat Assessment

This report provides a vulnerability and threat assessment for Superb Gift Company's network management security. It identifies key vulnerabilities and threats that can potentially harm the organization and provides recommendations to manage the risks.

Network Management Security 0
NETWORK MANAGEMENT SECURITY
By Name
Course
Instructor
Institution
Location
Date

Network Management Security 1
Table of Contents
2 Introduction..............................................................................................................................2
2.1 Objective...........................................................................................................................2
2.2 Scope.................................................................................................................................3
2.3 Limitation..........................................................................................................................3
3 IT systems characterization......................................................................................................3
3.1 Mail Catalogue System.....................................................................................................3
3.2 Website..............................................................................................................................4
3.3 Finance System.................................................................................................................4
3.4 Marketing system..............................................................................................................4
3.5 Logistics and Distribution.................................................................................................5
3.6 Payment System................................................................................................................5
4 VULNERABILITY ASSESSMENT.......................................................................................6
4.1 Vulnerability Identification...............................................................................................6
4.1.1 Website weaknesses...................................................................................................6
4.1.2 Payment vulnerabilities.............................................................................................7
4.1.3 Network Vulnerabilities.............................................................................................7
4.1.4 Vague Policies...........................................................................................................7
4.1.5 Lack of CIRT.............................................................................................................8
4.1.6 Legal vulnerabilities..................................................................................................8
4.1.7 Data Duplication........................................................................................................8
4.2 Assessment........................................................................................................................9
Website weaknesses.................................................................................................................9
5 Threat Assessment.................................................................................................................12
5.1 Threat Identification........................................................................................................12
5.1.1 Impersonification.....................................................................................................12
5.1.2 System Failures........................................................................................................12
5.1.3 Hackers....................................................................................................................13
5.1.4 DDOS......................................................................................................................13
5.1.5 Insider Jobs..............................................................................................................13
5.1.6 Natural Disaster.......................................................................................................13

Network Management Security 2
5.1.7 Malware...................................................................................................................14
5.1.8 Government Regulations.........................................................................................14
5.2 Threat Assessment..........................................................................................................14
6 Risk Assessment....................................................................................................................17
6.1 Risk Identification...........................................................................................................17
6.1.1 Customer risks.........................................................................................................17
6.1.2 Business failure risks...............................................................................................17
6.1.3 Human risks.............................................................................................................17
6.1.4 ICT Systems and Application..................................................................................18
6.1.5 Legal risks................................................................................................................18
6.1.6 Administrative risks.................................................................................................18
6.2 Risk Analysis..................................................................................................................19
6.3 Impact analysis................................................................................................................20
6.3.1 Human Risks............................................................................................................21
6.3.2 Systems and Applications........................................................................................21
6.3.3 ICT Infrastructure....................................................................................................21
6.3.4 Customer risks.........................................................................................................21
6.3.5 Stock and Inventory.................................................................................................22
6.4 Risk Associated with Law...............................................................................................22
7 overall risk determination......................................................................................................23
8 Control Analysis....................................................................................................................25
9 CONCLUSION......................................................................................................................27
10 Recommendations..................................................................................................................28

Network Management Security 3
1 INTRODUCTION
This risk assessment is conducted for the Superb Gift company in order to have a report on
the assessment of the various risks that can potentially harm the organization. A detailed
vulnerability report is included in the report to point put key weaknesses in the company that can
potentially harm the organization not only in terms of its reputation but also its ability to deliver
its services as prescribed in the service charter. Various threats and threat agents have also been
identified in the report to gauge their impact level when they exploit the vulnerabilities. To make
the recommendations, the vulnerabilities, threats were assessed to determine the risk they portray
to company’s assets and processes (Jones, 2010).
To better conduct the assessment, the ISO 27001 standard on information security
management systems was used as a baseline to identify risk through assessment of vulnerabilities
in the company that does not conform to the security management systems process and practices.
The objective of this reports is as explained below
1.1 OBJECTIVE
i. Identification of exposures within the company that makes the company have risks in
the Information security
ii. Identification of key vulnerabilities in the company
iii. Identification of threats and threat agents that can exploit vulnerabilities in the
company
iv. Provide key recommendation to the company to manage the risks

Network Management Security 4
1.2 SCOPE
The risk assessment shall only rely on the information about the Superb company as
prescribed in the case study give. The risk assessment is conducted using the ISO 27001
standard guidelines on information security management system detailing how to plan
processes that are meant to deploy and manage security systems to safeguard information
assets of the company.
1.3 LIMITATION
The risk assessment did not go into the nitty-gritty of an audit report and focus only on the
risk assessment based on the case study give and proposed recommendations to help
reduce the risk to manageable levels.
To begin the risk assessment, it is vital to identify the various IT systems. This is as shown
below

Network Management Security 5
2 IT SYSTEMS CHARACTERIZATION
To correctly identify risks, it is vital to identify the various systems and applications that are
critical for the functioning of Superb Gift. The first line of protection against unfavorable
uncertainties is to know yourself (Anie, 2011). This involves scrutinizing the key technology
assets to identify the vulnerabilities in them which shall make the design of control much
effective. The key system in the Superb Gifts is explained below,
2.1 MAIL CATALOGUE SYSTEM
The mail order system contains a catalog of the various Gifts that the company sells. Customers
can view the itemized lists of the gift to buy and make an order through the ordinary mail. Once
the mail is received after some time, the company sends acknowledgment note to the mailer on
the order status. The order is then dispatched to the mailer address together with an invoice for
demanding payments (Szóstek, 2011).
2.2 WEBSITE
The Superb Gifts own a website which again acts as a secondary place where customers can hunt
for the gifts they seek to purchase. The website has a digital catalog of the key gifts that the
company sells. Clients check in the gifts and make orders online for the goods they seek. Once a
potential buyer finds the good he/she seeks, the checkout process where they make payments
using PayPal and credit and or debit cards (Garrido, Sullivan and Gordon, 2010).
2.3 FINANCE SYSTEM
The finance system which is mainly used for accounting purposes such as accounting the
payments from the buyers of the Gifts. The employees also get their systems tied to the finance

Network Management Security 6
system since all the payroll information get accounted from it. This makes the system very key
for the company as it contains critical company and employees’ financial information such as
bank account details (McGuire et al., 2008).
2.4 MARKETING SYSTEM
The marketing system is used to send customized advertisement and coupons to potential
customers. The data is mined from the users who sign up on the website. The big data analysis
ensures there is a high success ratio for the targeted marketing strategies that the company use.
The physical marketing offices are located far away in Bristol hence employees always connect
remotely to the other colleagues in other branches.
With the buyout by the Chinese corporation, new systems will be integrated to ensure smooth
operations (Batchu, Mishra and Rege, 2014).
2.5 LOGISTICS AND DISTRIBUTION
The logistics and distribution of Superb Gift are hosted in the physical depot in South Wales
where the inventory and internal logistics is hosted to facilitate the process of goods transfer.
Once the order has been authenticated at the administration in Bristol, the dispatch order get
processed at the depot where information such as customer shipping address is entered into the
consignment form filled in three copies, once for the depot, the other for driver and the
remaining will be issued to the customer upon receipt of goods and validate they are what he/she
ordered and that the goods are in good shape without any physical damages (Whitman and
Mattord, 2013)

Network Management Security 7
2.6 PAYMENT SYSTEM
This represents the check-out systems that the company use to facilitate the transfer of money
from the buyer to the company. The company has adopted three payment methods which include
the use of PayPal online money transfer, the use of credit card and also have the option for the
use of credit card to make purchases. All the systems require a secure environment to ensure the
seamless transfer of money to clear the invoices. It is therefore critical for the company to ensure
customer confidential don’t get preyed by hackers, rogue employee or competitor seeking to
tarnish the name of the company (Laurila et al., 2012).

Network Management Security 8
3 VULNERABILITY ASSESSMENT
To critical put the risks identification procedure into perspective, the identification of various
vulnerabilities and threats that can potentially exploit the vulnerabilities is important to be
identified and documented. Best on the documentation case study, assessment focused on the
vulnerabilities identifications first (Shabtai et al., 2010).
3.1 VULNERABILITY IDENTIFICATION
Vulnerabilities represent weaknesses that may be present in a company processes and
procedures. They are key to be identified to ensure the company plan on how to set up controls
for the same and reduce the risks of them being exploited by threats agents. The key
vulnerability identified is explained below(Stonebraker et al., 2013)
3.1.1 Website weaknesses
The Suberb Gift process order via their website which represents a catalog of all the products
being sold by the company with their corresponding prices. The following vulnerabilities exist in
the Superb website,(Agbabian, 2008)
3.1.1.1 SQL Injections
The website has a weakness its configuration of form data processing hence can potentially fell a
victim of SQL injection attacks whereby a user can potentially run codes directly into the
database

Network Management Security 9
3.1.1.2 Cross-site scripting
XSS vulnerabilities are identified in the website configuration of Superb Gift as it can potentially
allow a user run backed scripts into the non-sanitized front-end forms and wreak havoc in the
company website and even drop a whole database.
3.1.2 Payment vulnerabilities
The payment methods adopted by Superb Gift increases the risk of user data being compromised
an. Cybercriminals can spoof user details and send a malicious email containing a verification
code to PayPal user's email. This tricks the user and when he/she click the link in the email,
increases the risk of the account being compromised. Such vulnerabilities can seriously affect the
performance of the company when exploited by sophisticated hackers(Puhakainen and Siponen,
2010).
3.1.3 Network Vulnerabilities
The Superb Gift is exposed to a lot of vulnerabilities in their network. By virtue of being an e-
commerce site, several vulnerabilities can be in existence in their internal networks which can be
disastrous when exploited (Ramgovind, Eloff and Smith, 2010a). The following represent such
vulnerabilities
3.1.3.1 Malware
Malicious software can be wandering around in the company network looking for victims to
deliver their payloads. This is attributed due to the fact that the company lacks a well-structured
procedure to patch their programs and systems hence leaving them very much vulnerable to
exploitation by threat agents (Murugesan, 2008).

Network Management Security 10
3.1.3.2 Denial of Service
The configuration in the company's server is so much vulnerable to attacks such as DDOS. The
servers are not propelling protected by a firewall to properly manage the traffic to and from the
network hence making it susceptible to DDOS attacks. This is a serious vulnerability that can
very much bring down the company’s server when exploited (Liu et al., 2013).
3.1.4 Vague Policies
The company has a defined policy for various processes and procedures. It is however noted that
the depth of the policy and their vagueness presents a weakness in the ability of the employees
and other stakeholders to fully comply with it as there are many assumptions presented in many
clauses. This makes violation to be easy as there are always arguments to make against the
policy. This vulnerability presents legal and ethical vulnerabilities for the company in its ability
to enforce its policies (Michaud and Michaud, 2008).
3.1.5 Lack of CIRT
The company has not set up computer incidence response teams whose responsibility should be
dealing with incidences that emancipate from cybersecurity threats which has been affecting the
company from time to time. Lack of properly functioning CIRT makes the company operations
very much vulnerable to cyber-attacks as no administrative and technical procedure is in place to
respond to them effectively and efficiently within the least time to minimize total downtime
(Silver et al., 2014).
3.1.6 Legal vulnerabilities
The much-hyped buyout of the company to the large Chinese multinational distribution company
who operates globally and now plan to expand their customer base to East Asia. This makes the

Network Management Security 11
merger to be legally vulnerable as several regulatory frameworks will hinder the expansion.
Every region of the world has set up irreducible minimums to companies and corporation
seeking to expand their customer base to such territories. The European Union, for example, has
defined and enforced the General data protection regulation(GDPR) which provides the
framework for companies operating in the European Union to follow. The extension to East
Asia, therefore, presents inconsistency with the GDPR as the East Asian is not a signatory to the
GDPR. This makes the consumer and customer data to be very likely to exposed to third parties
for profit (Laudon and Laudon, 2015).
3.1.7 Data Duplication
With the ongoing hyped about the Chinese buyout, it is inevitable that the employee data must be
migrated to the Chinese server to ensure smooth buyout. This presents a weakness as such
matters as data duplication might arise due to the bad configuration in the database. Such
employees can make the company risks losing its capital due to the payment of ghost worker
(Scarfone and Souppaya, 2009).
3.2 ASSESSMENT
The above-aforementioned vulnerabilities are analyzed and assessed to gauge their level and
impact it could have on the company when exploited. This is summarized in the matrix below,
Vulnerability Vulnerability Statement Level

Network Management Security 12
Website weaknesses The company website is
susceptible to XSS and SQL
Injections due to improper
configuration
High
Payment Methods The use of PayPal on non-
secured network and website
presents serious vulnerability
not only to the company but
also the customers whom data
risk being exposed
High
Network Vulnerabilities The company network is not
well protected using a next-
generation firewall that can
detect intrusions and stop
them in real-time. The
applications and systems in
the infrastructure are not
regularly updated and patched
posing serious risks to the
company
High
Incomprehensible polices The company ICT policies
are vague which makes them
easily overlooked by
Medium

Network Management Security 13
employees they can easily be
challenged in a court of law.
Missing CIRT The company has not set up a
CIRT to respond to
cybersecurity incidence in
real-time.
Medium
Data Duplication The buyout presents cases of
employee data duplication
due to unplanned and non-
procedural data transfer
Low
Legal The buyout presents the
company with legal issues
due to the crossing of
regional boundaries which
have their different ways of
dealing with laws and
regulation on data processing
posing future handles for the
company in achieving its
strategic objectives,
especially after the buyout.
Medium

Network Management Security 14
4 THREAT ASSESSMENT
Threats are the exploiters of the vulnerability hereinbefore mentioned. Their main aim is to
benefit from the vulnerable systems and processes in the company to breach the security of the
company's information assets and infrastructures. This threat poses serious risks to the
functioning of the company in terms of data security. To assess threats, it is vital to identify and
describe their action with the probability of the threat exploiting the vulnerabilities assessed
hereinbefore (Scarfone and Souppaya, 2009).
4.1 THREAT IDENTIFICATION
Due to the many known and unknown vulnerabilities that exist in the company, the following
threats and threat agents come into play in attempts to exploit the vulnerabilities and wreak
havoc on company's information assets and infrastructures (Kim, Lee and Hwang, 2012);
4.1.1 Impersonification
With the vulnerable website and the frequent attacks on the company's network, the threat of
impersonification is real as rogue hackers can access company's employee credential and
perform an operation on the network and applications that can have devastating effects on the
reputation of the company. The payment information is a target for such threats as such
information reveals a lot about the customer (Orthacker et al., 2011).
4.1.2 System Failures
The misconfigured application and website can be exploited by threats that seek to make critical
systems such as the payment system fail to process customers’ requests. This threat can occur
due to the lack of proper patch management and applications’ updates scheduled on time to
reduce the impact of such threats (West, 2008).

Network Management Security 15
4.1.3 Hackers
A hacker who may be paid by competitors or conduct hacking for a cause may run exploits on
the company's network due to the vulnerabilities that exist due to lack of next-generation firewall
to safeguard the internal company's network from such threats. The exploits deployed by hackers
can create backdoors and listen to every communication going within the company and send it to
the hacker who can use the information to attack the company in the future (Payne and Edwards,
2008).
4.1.4 DDOS
Threats from DDOS are critical as it can cripple the company information assets and bring
everything in a standstill. Such threats exist due to the lack of a properly functioning CIRT to
handle cybersecurity incidences in the company. It, not a matter of if a DDOS attack will be
launched, it is a matter of when hence lack of organization and coordination with properly
defined incidence response plans in place, the company risks losing bug due to much downtime
caused by the threat when it materializes (Barrera et al., 2010).
4.1.5 Insider Jobs
The weakest link in any information security chain are the human elements internal or external to
the company. Employees in particle present a bigger threat to information security for the
company. The employees can take advantage of the inadequate and vague ICT policies to launch
attacks on the company network and website and go unpunished as the existing legal frameworks
and policies remain vague on how to conduct actual prosecution of the subjects of the
cybercrime (Vacca, 2012).

Network Management Security 16
4.1.6 Natural Disaster
The company main depot in South Wales is exposed to threats from natural occurrences such a
fire, storms and floods which makes the assets and stock of the company risked being completely
destroyed when such threat materializes. This is further increased by the outdated physical
security set up by the company in terms of perimeter security and access control making such
incidence such as fire and floods difficult to mitigate or reduce their impacts if and when they
occur (Warkentin and Willison, 2009).
4.1.7 Malware
Malware poses a serious threat to the continuous running of company applications and
processes. The malware contains malicious codes that can spread in the company network from
the end device to end device, infecting every machine it comes across. Such threats can critically
affect the proper functioning of the company's applications and systems. Malware such as
rootkits are even more serious as they can potentially affect the host operating system and make
them do whatever code in the rootkit does thereby affect the integrity of the company’s processes
and procedures(Dahbur, Mohammad and Tarakji, 2011)
4.1.8 Government Regulations
. The expansion of operations by the Chinese multinational presents serious threats as the foreign
government can have their own regulations and laws that affect data processing. Such laws and
regulation might contradict with the European Union GDPR's. The bureaucratic bottlenecks
installed by foreign jurisdictions can, therefore, make the operation of the company in those
foreign countries seems impossible. The company has not set up policy and procedure to deal
with such legal hurdles hence exposing themselves more to the threat receiving bureaucratic red
tapes in the new jurisdiction of operations (Saripalli and Walters, 2010).

Network Management Security 17
4.2 THREAT ASSESSMENT
The identified threat must be assessed and given weighty so as to prioritize the controls to
safeguard against the exploitation of vulnerabilities by the threat agents. The threat was assessed
as shown in the table below
Threat source Threat statement Level
Human Human elements in form of
employees and hackers can
exploit the network and
website vulnerabilities to
reveal critical company and
employees data
High
Natural Threats posed by fire, floods,
and storms can adversely
affect the operation of key
information systems and
assets when they occur
High
Malware Malicious codes can be used
to target key information
systems to steal information
and compromise the integrity
of such a system
High
Government Regulation Foreign government policies Medium

Network Management Security 18
and regulation can threaten
the expansion goal of the
Chinese multinational after
the buyout due to the
difference in the regulation
that protects data in those
jurisdictions
Ghost employees Due to the transfer of Superb
Gift employee data to the
Chinese server, the
emergence of ghost
employees may arise due to
accidental and or deliberate
data duplications during the
changeover
Cyber-attacks threats Lack of policy and procedure
designed specifically for
handling incidences that
might arise due to cyber
threats are not in place
making the likelihood of such
attacks materializing. There
are no CIRT and policies
High

Network Management Security 19
surrounding cybercrimes in
the company

Network Management Security 20
5 RISK ASSESSMENT
With the vulnerabilities indented and the potential threats registered, the next phase is the
empirical assessments of the risks which are a factor of vulnerability, threats, and assets. To
conduct the assessment, it was vital to identify the key assets that were at risks based on the
vulnerabilities and threats identified above (Ramgovind, Eloff and Smith, 2010b).
5.1 RISK IDENTIFICATION
The identification process looked carefully on the vulnerability and threats to draw a relationship
between the vulnerabilities, threats, and assets. The following list contains the list of risks
associated with the Superb company and the Chinese multinational who eventually bought it.
5.1.1 Customer risks
The customers, who are key entities in the Superb business are at risk. Their data which are
private to them is under threats from the vulnerabilities that exist in the website and network of
the company. This makes their critical information such as bank details from being compromised
by the third party who may opt to steal their identity.
5.1.2 Business failure risks
The ongoing cyber threats risks putting the business in a halt as such threats continue to
metamorphoses into serious attacks such as DDOS, client and shareholder's trust level will
drastically reduce. This will greatly affect their share capital of the Gift market. The long-term
impact is a catastrophic business failure due to perennial loss of profits (Shearing and Johnston,
2013).

Network Management Security 21
5.1.3 Human risks
The Human element in the company vicinity continues being placed at risk due to the
unmitigated natural catastrophes such fire which can wreak havoc on not only the company's
property but also the employee's life. The continuous neglect by the company to put safety
precautions especially in their main depot at South Wales continuously put the employees at risk
of losing their lives.
5.1.4 ICT Systems and Application
The key systems and application which not only act as support service to the company but also a
key source of company revenue such as the payment systems are as a risk due to prevailing
vulnerabilities that exist in the application and systems. The systems and applications risked
being hacked and accessed by unauthorized entities who might opt to wreak havoc by stealing
employee and customer data, interfere with the integrity of the company processes that the
systems try to automate and eventually deny the application access to critical information and
computing resources (Dawes, 2008)
5.1.5 Legal risks
With the much-hyped buyout by the Chinese multinational, the company is placed in serious
legal battles as they try to conform to the regulations and laws of the foreign jurisdictions. There
is a high probability that the foreign government might not approve the chines multinational
from expanding to their territories due to strict data processing regulations in the foreign markets
which might affect the general operation of the multinational. This presents serious legal battles
for the company trying to seek approval from the foreign government. The end result of such
legal battles might lead to their denial of a license in such territories.

Network Management Security 22
5.1.6 Administrative risks
The Chinese buyout means the current employee data must be replicated into the Chinese
multinational server to provide a seamless transfer of the current employees to work under the
merger. This poses serious risks to the multinationals as matters such as ghost workers are bound
to surface due to duplication of employee data during the merger. Such workers will continue
drawing their salary and benefits from the company illegitimately making the company
potentially experience loses and decline in net worth (Hamlyn et al., 2008).
To put the risks into perspective, the following table shows the risk analysis putting into account
the probability of occurrence which shall dictate the level of controls that best suits the risks
(Khatri and Brown, 2010).
5.2 RISK ANALYSIS
The relationship between the assets, vulnerabilities, and threats was analyzed to ascertain the
probability of the risk happening. The table below shows the matrix used.
Asset Risk Likelihood Rating
Human assets Working condition in the South Wales
depot is susceptible to fire and other natural
catastrophes such as floods and storms.
Natural threats such as flood, storms, and
fire
Medium
System and
Application
The various critical system and website are
not patched and updated hence very much
vulnerable. Malware might install
High

Network Management Security 23
themselves onto the systems
ICT Infrastructure The ICT infrastructure is vulnerable due to
the misconfigured firewall which does not
filter traffic. DDOS threats are much likely
to be used to exploit this vulnerability and
make the system and infrastructure
completely unavailable
High
Customers The customer data are continually being
exposed to the cyber threats due to lack of
properly configured website and application
making exploitation much easy. This put the
customer data at risk of being stolen by
external hackers or even rogue employees
who may steal the data and auction it to
other companies in need of data mining
High
Stock and inventory The company stock and inventory is at risk
from being exploited during distribution and
can get lost due to compromised interval
logistics within the company. The natural
disaster also continually presents risks to
this important asset
Medium

Network Management Security 24
5.3 IMPACT ANALYSIS
The above risks pose a different impact on the business operation when a bad event occurs. The
impact analysis is key in determining the core control to prioritize for the various assets. The
impact was gauged by the level of asset vulnerability and threat level. The following describes
the impact the risks have on business operations (Paquette, Jaeger and Wilson, 2010)
5.3.1 Human Risks
Human capital is a basic factor of production hence very key to the success of the business.
When the Human get reduced by an event such as fire and storms, business performance will be
affected negatively due to the reduced labor force to support business functions. The impact is
therefore high (Hayden, 2010).
5.3.2 Systems and Applications
The systems and application owned by Superb Gifts are the engines for transformation the
business into a going concern. The systems provide automation of services which drastically
reduce the cost of production. The risks associated with the systems and application, therefore,
have a devastating impact when they get exploited by the threats mention hereinafter.
5.3.3 ICT Infrastructure
The ICT infrastructure act as the support base for the system and application. Network and
security infrastructure which are at risk in the company put the company in a very shaky
situation since when such risks materialize, it can bring the operations of the company into a
standstill. Risks from being hacked can have a serious impact such as long total downtime which
more specifically causes revenue reductions (Sheikhpour and Modiri, 2012).

Network Management Security 25
5.3.4 Customer risks
Customers are the final beneficiaries of the business hence should be treated with the utmost
good faith. Any operation that affects the trust level the customer has for the company should be,
mitigate with priority number one. With the growing competitor, the customer today has much
expectation and seen as the king in the cutthroat competition among ventures. The business,
therefore, will have a high impact when such risks relating to customer occurs (Disterer, 2013).
5.3.5 Stock and Inventory
The stock and other assets are crucial for the continuous operations of the business hence their
exploitation will result into serious risks for the company as a lot of net worth will be lost if risks
of fire and theft occur to the company’s inventory and stock (Calder and Watkins, 2008)
The table below summarises the impact analysis as described above
Risk Impact rating
Human assets High
System and Application High
ICT Infrastructure High
Customers High
Stock and inventory Medium
Administrative Medium

Network Management Security 26
5.4 RISK ASSOCIATED WITH LAW
The legal framework unique since it is an external environment which the business has limited
control over. The merger between the Chinese multinational and Superb Gifts presents serious
legal hurdles. First, the issue of data protection of consumer is critical and with the bad
reputation of the well-documented hacks of the Superb Gift in the past, many jurisdictions will
require strict regulation for the multinational to expand to their territory. Such legalities may be
particular negative affect the ability of the company to expand to new territories.
The post buys legal issues such as assets purchases and stock purchases might bring legal risks as
the owner must be properly transferred in the presence of an attorney to prevent future issues.
The impact on the business is relatively low compared to other risks which have a direct impact
on the ability of the business to make revenue and reduce costs altogether (Sheikhpour and
Modiri, 2012).

Network Management Security 27
6 OVERALL RISK DETERMINATION
The overall risk was determined by taking into account the formula
Risk= Threat*Cost
The above formula provides an empirical method to quantify the risk on assets based on the level
of both the vulnerability and the threats. This provides the company a more detailed approach to
highlighting the risks in the company with the bid to ensure the controls are more focused on the
critical assets of the company. The table below shows the overall risked as determined by this
assessment,
Threat Likelihood Impact Tota
l
Risk High(1.0
)
Medium(0.5
)
Low(0.1
)
Low(10
)
Medium(50
)
High(100
)
Human asset
risks
1.0 100 100
Systems and
application
1.0 100 100
ICT
Infrastructure
0.5 100 50
Customer 1.0 100 100
Stock and
inventory
0.1 50 5

Network Management Security 28
Administrativ
e
0.5 50 25
Legal 0.1 100 100
The above table is discussed as shown below
High Risk; Includes assets such as Human resource, system, and applications, Customers,
Medium Risk; Includes ICT infrastructure,
Low Risk; includes administrative risks and stock risks

Network Management Security 29
7 CONTROL ANALYSIS
The controls are a various mechanism that can be adopted to ensure the risks and the impact on
the business is reduced to acceptable levels which the business can safely operate within. Based
on risks aforementioned above, the following controls and control classification can be employed
to detect, prevent or correct risks.
Risks Control Control Classification
Human assets exposed to risk
such as natural disasters
Enhance the physical
perimeter security. Fire
extinguisher in place
Preventive
system and applications
hacking
Anti-malware and antivirus
programmed to set up and up
to date
Preventive
ICT infrastructure being
compromised by DDOS
Set up a next-generation
firewall to filter traffic in and
out of the company internal
networks
Preventive
Data duplications after the
merger
Conduct a forensic audit of
the company data and remove
duplicates
Detective
Legal hurdles after the Get recommendations from Preventive

Network Management Security 30
merger the legal team before signing
documents and making some
move
Website being hacked Reconfigure the website to
install the latest technologies
that are relatively foolproof
Corrective
Stock and inventory theft and
damages
Set up inventory management
systems to prevent stock and
inventory theft
Preventive
The above control only provides a framework for the company to choose in thwarting the risks.
.

Network Management Security 31
8 CONCLUSION
In conclusion, the assessment report was done to have a holistic view of the superb company in
with respects to the ISO 27001 standards which define standards for the information security
management system. The report has identified the vulnerabilities that exist in the company, the
threats that can exploit the said vulnerabilities and empirical calculation of the risks associated
with such threats. The report went further and detailed controls and controls classifications that
the company can employ in response to the threats. The next sections provide a subjective
recommendation for the company in an effort to deal with the threats.
The recommendation is specifically written for the board of directors to use in reaction to the
risks and provides a well-researched control mechanism and methods which when followed,
shall make the company become ISO 27001 certified and attract more potential clients in the
future

Network Management Security 32
9 RECOMMENDATIONS
The following itemized list are recommendation towards the analyzed risks
1. Buy and install FortiGate next-generation firewall to protect the company's
internal network from attacks such as hacking.
2. Set up public key infrastructure to encrypt all the company’s data to ensure
company’s data remain safe in an event a breach occurs.
3. Use SSL in the website to secure checkout process especially for a user who opt
to use PayPal checkout options.
4. Buy and install fire extinguisher around the company premise to safeguard it
from risks of fire which can destroy not only property but also human life.
5. Use open source Ubuntu server to ensure reliability and security of critical
systems which must always run for the business to continue in operation
6. Ensure the company performs a forensic audit of its systems and application
which should be done by reputable firms such as KMPG to ensure the data
duplication risks are dealt with once and for all.
7. Set up a strong legal team with a battery of attorney to advise the company on
the potential buyout legal requirement by both parties and set up an agreement
signed by both parties to reduce future legal risks

Network Management Security 33
REFERENCES
Agbabian, P.M., 2008. Security management system including feedback and control. Google
Patents.
Anie, S.O., 2011. The economic and social benefits of ICT policies in Nigeria.
Barrera, D., Kayacik, H.G., van Oorschot, P.C. and Somayaji, A., 2010. A methodology for
empirical analysis of permission-based security models and its application to android. In:
Proceedings of the 17th ACM conference on Computer and communications security. ACM,
pp.73–84.
Batchu, S.K., Mishra, A.K. and Rege, O.U., 2014. Selective management of mobile device data
in an enterprise environment. Google Patents.
Calder, A. and Watkins, S., 2008. IT governance: A manager’s guide to data security and ISO
27001/ISO 27002. Kogan Page Ltd.
Dahbur, K., Mohammad, B. and Tarakji, A.B., 2011. A survey of risks, threats and
vulnerabilities in cloud computing. In: Proceedings of the 2011 International conference on
intelligent semantic Web-services and applications. ACM, p.12.
Dawes, S.S., 2008. The evolution and continuing challenges of e‐governance. Public
Administration Review, 68, pp.S86–S102.
Disterer, G., 2013. ISO/IEC 27000, 27001 and 27002 for information security management.
Journal of Information Security, 4(02), p.92.
Garrido, M., Sullivan, J. and Gordon, A., 2010. Understanding the links between ICT skills
training and employability: an analytical framework. In: Proceedings of the 4th ACM/IEEE
International Conference on Information and Communication Technologies and Development.
ACM, p.15.
Hamlyn, A., Cheung, H., Mander, T., Wang, L., Yang, C. and Cheung, R., 2008. Computer
network security management and authentication of smart grids operations. In: Power and
Energy Society General Meeting-Conversion and Delivery of Electrical Energy in the 21st
Century, 2008 IEEE. IEEE, pp.1–7.

Network Management Security 34
Hayden, L., 2010. IT security metrics: A practical framework for measuring security &
protecting data. McGraw-Hill Education Group.
Jones, W., 2010. Keeping found things found: The study and practice of personal information
management. Morgan Kaufmann.
Khatri, V. and Brown, C.V., 2010. Designing data governance. Communications of the ACM,
53(1), pp.148–152.
Kim, B., Lee, Y. and Hwang, C.-H., 2012. Mobile phone. Google Patents.
Laudon, K.C. and Laudon, J.P., 2015. Management information systems. Prentice Hall.
Laurila, J.K., Gatica-Perez, D., Aad, I., Bornet, O., Do, T.-M.-T., Dousse, O., Eberle, J. and
Miettinen, M., 2012. The mobile data challenge: Big data for mobile computing research. In:
Pervasive Computing.
Liu, X., Zhang, Y., Wang, B. and Yan, J., 2013. Mona: Secure multi-owner data sharing for
dynamic groups in the cloud. ieee transactions on parallel and distributed systems, 24(6),
pp.1182–1191.
McGuire, A.L., Fisher, R., Cusenza, P., Hudson, K., Rothstein, M.A., McGraw, D., Matteson, S.,
Glaser, J. and Henley, D.E., 2008. Confidentiality, privacy, and security of genetic and genomic
test information in electronic health records: points to consider. Genetics in Medicine, 10(7),
p.495.
Michaud, R.O. and Michaud, R.O., 2008. Efficient asset management: a practical guide to stock
portfolio optimization and asset allocation. Oxford University Press.
Murugesan, S., 2008. Harnessing green IT: Principles and practices. IT professional, 10(1).
Orthacker, C., Teufl, P., Kraxberger, S., Lackner, G., Gissing, M., Marsalek, A., Leibetseder, J.
and Prevenhueber, O., 2011. Android security permissions–can we trust them? In: International
Conference on Security and Privacy in Mobile Information and Communication Systems.
Springer, pp.40–51.
Paquette, S., Jaeger, P.T. and Wilson, S.C., 2010. Identifying the security risks associated with
governmental use of cloud computing. Government information quarterly, 27(3), pp.245–253.
Payne, B.D. and Edwards, W.K., 2008. A brief introduction to usable security. IEEE Internet
Computing, 12(3).
Puhakainen, P. and Siponen, M., 2010. Improving employees’ compliance through information
systems security training: an action research study. Mis Quarterly, pp.757–778.
Ramgovind, S., Eloff, M.M. and Smith, E., 2010a. The management of security in cloud
computing. In: Information Security for South Africa (ISSA), 2010. IEEE, pp.1–7.

Network Management Security 35
Ramgovind, S., Eloff, M.M. and Smith, E., 2010b. The management of security in cloud
computing. In: Information Security for South Africa (ISSA), 2010. IEEE, pp.1–7.
Saripalli, P. and Walters, B., 2010. Quirc: A quantitative impact and risk assessment framework
for cloud security. In: Cloud Computing (CLOUD), 2010 IEEE 3rd International Conference on.
Ieee, pp.280–288.
Scarfone, K. and Souppaya, M., 2009. Guide to enterprise password management (draft). NIST
special publication, 800(118), pp.800–118.
Shabtai, A., Fledel, Y., Kanonov, U., Elovici, Y., Dolev, S. and Glezer, C., 2010. Google
android: A comprehensive security assessment. IEEE Security & Privacy, (2), pp.35–44.
Shearing, C.D. and Johnston, L., 2013. Governing security: Explorations of policing and justice.
Routledge.
Sheikhpour, R. and Modiri, N., 2012. An approach to map COBIT processes to ISO/IEC 27001
information security management controls. International Journal of Security and Its
Applications, 6(2), pp.13–28.
Silver, D., Jana, S., Boneh, D., Chen, E.Y. and Jackson, C., 2014. Password Managers: Attacks
and Defenses. In: USENIX Security Symposium. pp.449–464.
Stonebraker, M., Brown, P., Zhang, D. and Becla, J., 2013. SciDB: A database management
system for applications with complex analytics. Computing in Science & Engineering, 15(3),
pp.54–62.
Szóstek, A.M., 2011. ‘Dealing with My Emails’: Latent user needs in email management.
Computers in Human Behavior, 27(2), pp.723–729.
Vacca, J.R., 2012. Computer and information security handbook. Newnes.
Warkentin, M. and Willison, R., 2009. Behavioral and policy issues in information systems
security: the insider threat. European Journal of Information Systems, 18(2), pp.101–105.
West, R., 2008. The psychology of security. Communications of the ACM, 51(4), pp.34–40.
Whitman, M. and Mattord, H., 2013. Management of information security. Nelson Education.