Designing Secure Software Systems: A Collaborative Effort

The assignment content describes a team of IT professionals working in various roles such as Sr. IT Security Solutions Developer, Java Developer, Sr. Network Security Design Engineer, Sr. Cybersecurity Tester, Security Assessor/Tester, and Network Security Analyst. Their responsibilities include designing, implementing, testing, and maintaining secure software tools, networks, and systems. They are also responsible for conducting security audits, assessing risks, and developing security strategies to mitigate threats. The team is expected to work together to create a company-wide software security strategy, design and build proof of concept prototype solutions, and document the software development lifecycle.

Newark Memorial Hospital
Cybersecurity and Security Audit
Jean Zahore NMH Project Management Sponsor
Demetrius Jenkins NMH Project Manager
Albert Brinkley NMH Security Analyst
David Thompson AHA Sr. Cybersecurity Developer
Eartha Robinson AHA Sr. Application Security Developer
Eberardo Gonzalez AHA Sr. IT Security Solutions Developer
Daniel Meade AHA Sr. Java Developer - Back End / DB Security team
Albie Morkel AHA Sr. Network Security Design Engineer
Morne Smith AHA Sr. Cybersecurity Tester
Andrew Davies AHA Security Assessor/Tester
Marni Wandel AHA User
Neil Patel AHA Network Security Analyst
Kurt Wilson AHA Accountant

Project Sponsor Role – Jean Zahore
Senior member of the project board and often the chair who governs the project risk
 Key stakeholder of the project
 Helps with funding, scope clarification, and progress monitoring. Provides Influence to
others in order to benefit the project
 Leads the project through the engagement/selection process till it is formally authorized
and therefore plays a dominant role in the development of the initial scope and charter
 Issues beyond the control of the project manager, the sponsor serves as an escalation path
 Authorizes changes in scope, phase-end reviews, and go/no-go decisions when risks are
particularly high
 For internal projects, the project sponsor provides the statement of work based on business
needs, product, or service requirements
 In the early stages of the project life cycle, periodic review of the business case by the
sponsor helps to confirm that requirement of the project is still valid in current situation
 The Sponsor acceptance required during the close of project and it should be documented
as part of the project closure phase
Project Manager Role – Demetrius Jenkins
Has the overall responsibility for the successful initiation, planning, design, execution,
monitoring, controlling and closure of a project.
 Manage the Project!
 Identifying, monitoring, and responding to risk
 Accomplish the project objectives within the constraints of the project. He/she is
responsible for the outcome (success or failure) of the project
 Involved with the planning, controlling and monitoring and also managing and directing the
assigned project resources to best meet project objectives
 Controls and monitors “triple constraints”—project scope, time and cost (quality also)—in
managing competing project requirements
 Examines the organizational culture and determine whether project management is
recognized as a valid role with accountability and authority for managing the project.
 Collects metrics data (such as baseline, actual values for costs, schedule, work in progress,
and work completed) & reports on project progress and other project specific information
to stakeholders
 Meet with project stakeholders for delivering a project’s objectives within scope, schedule,
cost, and quality

Security Analyst Role – Albert Brinkley
Protects computer assets by establishing and enforcing system access controls; maintaining
disaster preparedness:
 Conduct internal and external security audits
 Assist in planning, implementing and upgrading security measures and controls
 Maintain data and monitor security access
 Perform vulnerability testing, risk analyses and security assessments
 Anticipate security alerts, incidents and disasters and reduce their likelihood
 Manage network, intrusion detection and prevention systems
 Analyze security breaches to determine their root cause
 Recommend and install appropriate tools and countermeasures
 Define, implement and maintain corporate security policies
Sr. Cybersecurity Developer – David Thompson
Works with development and network engineers to architect and implement the next
generation security systems and defense strategies for highly available services infrastructure.
 Researches methods to compromise systems and security to develop strategies and designs
to prevent intrusion
 Maintains security architectures with development and network engineers through
monitoring, provisioning and review of cyber security system operations
 Provides recommendation to management for security strategies to enforce policies and
protection of sensitive data and systems.
 Designs security infrastructure solutions to meet current and future application systems and
services

Sr. Application Security Developer – Eartha Robinson
 Develops security software and or integrate security into applications software during the
course of design and development.
 Oversee a team of developers in the creation of secure software tools
 Will lead the role in software design, implementation and testing
 Develop a company-wide software security strategy
 Facilitate meetings and workshops to define client processes and needs
 Create new software systems or forensic healthcare tools
 Design and build proof of concept prototype solutions
 Institute programming techniques that are free from logical design and technical
implementation flaws
 Gain a thorough knowledge of attack vectors that may be used to exploit software
 Leverage attack tools to test your work for software vulnerabilities
 Research/identify flaws and remedy development mistakes
 Document the software development lifecycle
Sr. IT Security Solutions Developer –
Eberardo Gonzalez
 Strategic advisor to design, implement and support solutions and processes that will enable
business growth and manage risks
 Lead role in building on foundations in Information Technology and Business to design,
implement and support risk management organizations, processes and systems to address
the growing challenges of cyber threats and other information technology risks
 SME for Static and Dynamic Application Security Penetration & Scanning Tools
 Provide guidance on designing and developing enterprise web/client-server/embedded
systems applications that follow the secure design principles required to meet the
information and cyber security threats
 Design system security architecture and develop detailed security designs.
Representing the security aspects from the product design to the release
Develop technical solutions and new security tools to help mitigate security vulnerabilities
and automate repeatable tasks.

Java Developer – Daniel Meade
Manage software projects based on the Java programming language. They often help create the
basic concept that directs software development. They then oversee programmers and
software testers to make sure projects progress according to schedule.
 Maintains existing security prototypes and scripts
 Ensure security designs are in compliance with specifications
 Design and conduct security test
 Designs and develops user interfaces to internet/intranet applications by setting
expectations and features priorities throughout development life cycle; determining design
methodologies and tool sets; completing programming using languages and software
products; designing and conducting tests
 Creates user information solutions by developing, implementing and maintaining Java based
components and interfaces
Sr. Network Security Design Engineer - Albie Morkel
Is responsible for the implementation, maintenance, integration of the corporate WAN/LAN
and server architecture. This individual will also be responsible for implementation and
administration of network security hardware and software, enforcing the network security
policy and complying with requirements of external security audits and recommendations.
 Develop, update, and report performance metrics and status on security compliance
 Designing, installing, deploying, maintaining and troubleshooting production or test
networks
 Ensure security principles are being upheld and no violations of Security Policy is taking
place
 Audit security systems deployment, management, and maintenance, including Firewalls,
VPNs, and infrastructure monitoring, reporting, and associated sensor systems
 Develop and maintain CSIRT policy, procedures, and protocols. Conduct computer security
incident analysis, computer forensics operations, evidence gathering and preservation,
incident containment, and incident recovery. Develop and maintain CSIRT reporting
guidelines and procedures and perform the following

Sr. Cybersecurity Tester - Morne Smith
Responsible for performing the process intended to reveal flaws in the security mechanisms of an
information system that protect data and maintain functionality as intended. Due to the logical
limitations of security testing, passing security testing is not an indication that no flaws exist or that the
system adequately satisfies the security requirements
 Responsible for setting up and using Virtual Machines (VM) for testing purposes
 Testing configuration management software and issue tracking software
 Test automation software to develop repeatable tests.
 SME in developing software and scripting to facilitate testing
 Research new threats, attack vectors, and risk.
 Report on security vulnerabilities via formal reports and weekly status updates.
 Verify the security findings from other members of the penetration testing team
Security Assessor/Tester - Andrew Davies
A person who has been certified by the PCI Security Standards Council to audit merchants for
Payment Card Industry Data Security Standard (PCI DSS) compliance:
 Provide the testing for IT Security requirements, technical security countermeasures, risk
managements processes, contingency planning, and secure data communications; Testing
will include network, system, application and NIST control testing from administrative and
technical perspectives
 Conduct full cycle Security Assessments & Authorizations (SA&A)
 Responsible for analyzing vulnerability scans and interpreting risks and employing manual
 checks to validate vulnerability data
Be able to assist DOI with understanding risk and providing risk mitigation
 Will create Security Assessments Plans, Reports, and POA&Ms

Network Security Analyst – Neil Patel
Install software, such as firewalls, to protect computer networks. Information security analysts
plan and carry out security measures to protect an organization's computer networks and
systems.
 Assist with the plan, execute and lead security audit across an organization
 Assist with the inspection and evaluation of financial and information systems, management
procedures and security controls
 Evaluate the efficiency, effectiveness and compliance of operation processes with corporate
security policies and related government regulations
 Interview personnel to establish security risks and complications
 Assist with executing and properly document the audit process on a variety of computing
environments and computer applications
 Assess the exposures resulting from ineffective or missing control practices
 Provide a written and verbal report of audit findings
 Work with project management team to ensure security recommendations comply with
company policy and procedures
 Assist with developing rigorous “best practice” recommendations to improve security on all
levels