Assessment of Security Threats in ABC Gym's IT System

Desklib provides solved assignments and past papers to help students succeed.

IT RISK MANAGEMENT
Assessment Item 3
Student Name:
Student ID:
Subject Code:

Executive summary:
The report includes identification of security and privacy threats associated with the Gym IT
system and described the different threats for it. It described the vulnerabilities and shows the
consequences of these privacy and data breaches threats. It presented the assessment of different
risks associated with the gym system. It presents the overall analysis in the context of ABC gym
and provides different protection and mitigation options for the risks. The different accessing
techniques, attack detection, and protection techniques, and attack prevention techniques. It
developed a protection mechanism for this gym that helps to keep its stored data secure and helps
in data protection. Further, it presents reviews of the proposed protection mechanisms and
recommends some options for improving the protection mechanisms.
The report first describes the Gym assets and identifies the threats for these assets. This will
provide help in risk management. Further, the consequences of these threats give effects that it
can cause. It describes the different attacks for the IT system of Gym. The developed security
mechanisms include providing security to physical and nonphysical threats of Gym. The security
mechanism includes authentication techniques, attack prevention, and encryption techniques.
Further, reviewing these techniques provide improvements that further enhance system security.
Thus it helps to understand the IT risk management and development of a system for managing
the IT risk. The report describes the risk management of the IT system in the context of a Gym
that gives a practical analysis of the management analysis and helps to understand how it can be
applied.

Contents
Executive summary:........................................................................................................................2
1. Introduction:.............................................................................................................................4
2. Risk assessment:.......................................................................................................................4
2.1 Gym Assets:...........................................................................................................................4
2.2 Threats:......................................................................................................................................5
2.3 Vulnerabilities:.......................................................................................................................6
2.4 Consequences:........................................................................................................................6
3. Risk mitigation options:...........................................................................................................7
4. Protection mechanisms:............................................................................................................8
5. Risk Analysis:.........................................................................................................................10
6. Reviews and improvements:..................................................................................................11
7. Conclusion:.............................................................................................................................12
8. References:.............................................................................................................................12

1. Introduction:
Development of Gym culture is helping to improve the fitness, and development of new
technology and its adaptation in the gym is further helping the gym member in improving their
experience with the fitness benefits. With the technological adaptation in the Gym, various IT
threats have raised with the physical security threats in the gym. These threats may affect the
Gym working and loss of data may result in privacy loss of the member with the security risks.
So, the report discussed the gym assets, identification of these various threats, vulnerabilities,
and consequences of these threats shows the protection techniques and developed a mechanism
for protecting the system from these threats. It provides different techniques that can help in
protecting the data and privacy of the system and can prevent various attacks. Further, the
developed mechanism is analyzed and evaluated. The analysis of the system is presented in the
report that gives further requirements for improvement that are recommended in the report. Thus,
it helps to understand the IT risk management system in context to a Gym and also helps to
understand the system development for managing IT risks at Gym.
2. Risk assessment:
For mitigating the Gym risk or managing the risk at ABC Gym risk management mechanism
followed first identifies the risks at the gym. Further, the risk assessment includes identification
of Gym assets, threat associated with these assets, vulnerabilities, consequences.
Figure 1 Gym risk management procedure

2.1 Gym Assets:
The first step of ABC gym risk assessment is the identification of gym assets. Identification of
these assets will help to identify the threats associated with these assets. The ABC gym has the
following types of assets:
Facilities: These are the assets of the gym for improving the customer experience at the gym by
providing them better location, layout, and facilities.
Equipment: This includes the tools for training, technologies, and devices installed in the Gym.
Staff: The trainers, managers, and workers working for the ABC gym are the gym staff and
assets of the gym.
Brands: the communication of gym reputation and mission to the members for turning it into a
brand (Hopkin, 2018).
Technological Equipment: The technological assets of ABC gym includes the equipment used
for member activities tracking and building the technological ecosystem. These also help in
evolving and learning from the collected data and making improvements in further processes.
2.2 Threats:
The section includes the associated technological threats with the gym assets and mainly focused
on the technological threats associated with the gym technological equipment. The ABC gym
has created an ecosystem environment for member activities checking and creating member data
of check INS and check out and gathering information about the members. So, this technological
equipment and data have the major threats of data breaching system failure and required to be
protected from these threats. So, the major threats associated with these devices and equipment
are as follows:
Physical Threats: These are the threats generally developed by physical impacts on the system
device. Physical threats associated with the gym and its IT systems are

 Internal Threats: These threats include fire accidents, power supply problems, humidity
in the Gym hardware, etc.
 External threats: Lightning, earthquakes, floods, etc. are the external threats for the gym
systems.
 Other: thefts, disruption, intentional errors, and accidents are other physical thefts.
Non-physical threats: these threats include external attacks, viruses, spyware, Trojans, worms,
key loggers, service denial attacks. Further, the description of threats is described here in detail:
 System failure: the failure of Gym IT system is the major threat associated with it. The
failure of the system may occur from different reasons these may internal reasons of the
system and external reasons.
Attack Threats: The external attacks are the major threats for this data. These attacks may
provide data access to illegal persons and may affect the working of the systems (Raguseo,
2018). The following attacks may affect the system working:
 DoS (Denial of service) attacks: These attacks include overwhelming the
resources of the system so the system will not respond to the request. These
attacks include TCP SYN flood attacks, Smurf attack, and teardrop attack, etc.
 MitM (man in the middle) Attacks: These attacks occur mainly in the
transmission of information when a hacker or middle man gets the information in
between the transmission from server to client. These attacks include session
hijacking IP spoofing.
 Phishing Attacks: These are fake emails that seem trusted but aim to influence
users or to gain personal information.
 Drive-by Attacks: These attacks are the general methods for malware spreading.
In these attacks, the hackers search insecure sites and plant PHP or HTTP coded
malicious script on pages and when visiting the sites the malware will be installed
(Rubin, & Ophoff, 2018).
 Password Attack: Password authentication is the generally used mechanism for
user authentication and obtaining the user password is a common approach for
attacks.

 Data losses: Loss of member data is major threats of the gym IT system. This may result
in privacy breaches of the members. The data losses may occur due to system failure,
data theft through unauthorized access and
 Unauthorized access: the access of the data through the gym member and providing
secure authentication to the gym member is required. In absence of secure accessing
system the devices and data can be accessed by an unauthorized person
(Sivasubramanian, & Apte, 2019).
2.3 Vulnerabilities:
The system vulnerabilities increase the chances of these attacks, unauthorized access, system
failure, and physical damage. For the ABC Gym the system Vulnerabilities are described here:
Old System: The Gym is using the same system for the last 6 to 7 years, which does not provide
the advanced security option and not support some advanced security programs and has the
threats of easy attacks.
System security: The advanced security systems are not installed in the system also the antivirus
and software for enhancing system security are required for the system. Also, accessing the
approach for the system not secure (Li, et al. 2018). In the absence of these security systems, the
system can be attacked easily.
Member awareness: The Gym members are not so aware of the security issues and their
consequences. So, not to be aware of the security of the system and Gym increases the threat of
unauthorized access and privacy breaches.
2.4 Consequences:
These attacks and failure threats of Gym system may have some worst consequences including
the data loss of customers, their safety and security threats and affecting the gym working, etc.
Further, these threats include:
 Affects the gym working or disrupt gym operations.
 Benefits to the gym competitor.
 Customer data breaches.

 Customer safety and security issues.
 Loss of whole data and sensitive information.
 Staff security issues.
 Illegal monitoring of Gym system that may cause security threats while working with
gym machinery.
 Gym security issues (Wu, et al. 2018).
3. Risk mitigation options:
Looking at the threats and consequences of these threats it is required to searching the risks
mitigation options and implementing it for the security and safety of gym members and proper
working of the gym. The following may be the risks mitigation member for the gym:
Physical Threat protection: The physical threat protection options include protecting the
system from fire, thefts and according to the threat generation these protection options also can
be divided into:
Protection from Internal physical threats: protecting options from internal physical security
threats include, using automatic fire detectors, not using water to put out the fire, using voltage
controllers, fire extinguishers, using air conditioner to control humidity (Radanliev, et al. 2018).
Protection from external physical threats: Protection options from external physical threats
include, using the lightning protection system, it can reduce the damage caused through
lightning, housing computer systems.
Other protection systems: locking doors and maintaining proper security can help in protecting
the other threats.
Non-physical risks mitigation:
 Secure Accessing: authorized access is a major reason for security threats and attacks
threats that result in privacy and data breaches. So, providing smart and secure access to the
Gym members will help in reducing these threats. Biometric recognition as fingerprint and
face recognition, card and voice recognition techniques for secure authentication can be

used for providing secure authentication to the data. So, the secure authentication system
can be provided to the gym members that will protect their data and help to maintain the
security of the gym IT system.
Figure 2: biometric recognition for smart access and secure authentication of members
(Source: smartlink.com, 2019)
 Encryption Techniques: these techniques mostly helpful in data transmission, but they
provide helps in storing the member data and accessing it. These are effective data
security techniques that are used by most of the organization in the current time and may
provide the security to the gym data (Toch, et al. 2018). Two types of these techniques are
asymmetric that called public-key encryption and symmetric encryption techniques.
 Proper direction and training to the members: With using these techniques and
providing secure access it is also required to providing the proper training to the Gym
member about the security of the devices and techniques they are using is required. Lack
of awareness will increase the threats of security with the devices and accessing
techniques they are using (Cobb, et al. 2018). So, providing proper training regarding the
accessing issues and devices handling will further mitigate this threat of data and privacy
breaches.

4. Protection mechanisms:
So, after identification of threats and analyzing the protection techniques that can be used for the
system security the security mechanism for the system is developed that includes the mitigating
options for the threat and provide a secure system to physical and non-physical threats of attacks.
Figure 3 protection mechanism
4.1 Threat identification: For the development of this system first it is required to identify all
threats associated with the data storage and transmission of the members. Identification of threats
will provide the idea that what is required to protect and what are the requirements for system
security.
4.2 Data security: The security of the member data is a big concern that is further described in
the developed mechanisms. For the data security, the system follows attack identification and

prevention approach and providing secure accessing to the member. The data security
mechanisms are further described in detai (Ford, et al. 2019)l.
4.2.1 Attack prevention: Attack classification and identification model is used to describe the
attack threats of the Gym IT system. Also, providing training regarding system security to the
member will help to keep the system safe. Further, for preventing the attack the encryption
techniques and network security it described:
4.2.1.1 Data Encryption: The encryption technique can prevent the data from breaches. The
encryption technique and algorithms as RSA, Blowfish, and Triple DES, etc. can help in
encrypting the data.
4.2.1.2 Network Security: Security of the network is important for preventing the network. The
gym network for this purpose should be secure. Although, the network and service provider
provides some security option but looking at the sensitivity of data and security threats other
network security options should be used.
4.2.2 Secure accessing: The biometric recognition technology is used for developing a smart
access system and providing security awareness to the member will further help to keep the
system secure.
4.2.2.1 Training and awareness: for the secure accessing of the system and system security,
proper training and making aware to the gym member is required. So, the developed mechanisms
follow the system. Further, the awareness and training to the member will help to use the devices
accurately that will eliminate further threats (Ford, et al. 2019).
4.2.2.2 Monitoring: Better monitoring of the system is required to further preventing the system
from failure and attacks. Through a better monitoring system, further problems in the system can
be identified as the requirements of security software and a new system. This will prevent the
system and provides better maintenance to the system.

5. Risk Analysis:
Further, the risk analysis of the system is presented in the below table which shows the threat,
vulnerabilities, assets, impacts, risks and recommends the improvement for the system and
shows the effectiveness of the system.
Table 1 Analysis of threat, vulnerabilities, and its impacts on assets and recommended
solutions and its effectiveness
S.
No.
Threat Vulnerability Assets Impacts Risks Recommendation
1 Physical
threats
Security
system,
negligence
Whole
System
System
damage
Data and
money losses
Improved security
system,
2 System
failure
System
security,
accessing,
awareness
Devices
system
System and
data losses
Potential loss
of money
and
information
Security network,
device
maintenance
3 DoS
(Denial
of
service)
attacks
Online client
data
Servers Services
access
denial
Information
losses
Attack prevention
methods
4 MitM
(man in
the
middle)
Attacks
Network
security and
protection
Network
or
servers
Security
and privacy
breaches
Privacy loss Attack and data
prevention
5 Phishing
Attacks
Awareness of
the members
Data,
System
or
network
Data and
privacy
breaches
Information
and privacy
losses
Better training and
increasing
awareness