CPIS 606 Assignment 4 (B): IT Asset Inventory, Router Audit, and CIA

This document presents a comprehensive solution to a CPIS 606 assignment focused on IT auditing, specifically addressing the creation of an IT asset inventory and the auditing of network devices, with a particular emphasis on routers. The assignment requires the identification and categorization of IT assets, including hardware, software, and telecommunication devices, alongside a classification schema based on the CIA triad (Confidentiality, Integrity, and Availability). The solution provides detailed asset inventories, classification tables, and examples of router auditing, including questions to assess security practices like disabling unused interfaces, securing DNS lookups, and disabling unnecessary services. The document also includes the author's notes, which provide insights into the importance of maintaining a current asset inventory for effective cybersecurity incident response and maintaining trust with partners and stakeholders. The solution also includes a complete schema for classification taking account CIA has been described in the table.

Running head: CYBER-SECURITY
CYBER-SECURITY
Name of the Student
Name of the University
Author Note:

1CYBER-SECURITY
Orga
nizati
on
Asset
Progra
ms
Hard
ware
Mod
el
Serial
numbe
r for
Device
s
Mod
el
of
devi
ces
Import
ance of
Device
s
Use
of
Devi
ce
Device
Catego
ry
Confid
entialit
y
Inte
grit
y
Avail
abilit
y
Telep
hone
Office
progra
m
(used
for
commu
nicatio
n)
Moto
rola
Fixed
Wirel
ess
Phon
e
SN
196296
FW
200
L
blac
k
Used
for
Comm
unicati
ng
within
the
depart
ment
Hum
an
Reso
urce
Depa
rtme
nt
Comm
unicati
on
device
Low Lo
w
Low
Fax Sendin
g Files
Panas
onic
Fax
Mach
ine
SN
104
KX-
FP7
01
Used
for
sendin
g
import
ant
files
from
one
place
to
another
Hum
an
resou
rce
Depa
rtme
nt
Comm
unicati
on
device
Low Lo
w
Low
Route
r
Wireles
s
networ
k
Device
TP-
Link
AC1
900
Arch
er A9
Smar
t
WiFi,
High
Spee
d
MU-
SN
1104
Arch
er
A9
It
provide
s
wireles
s
internet
connec
tion in
the
Office
for all
the
devices
Infor
matio
n
Tech
nolog
y
Depa
rtme
nt
Comm
unicati
on
device
High Hig
h
High

2CYBER-SECURITY
MIM
O
Printe
r
Printin
g
importa
nt
docum
ents
HP
Desk
Jet
SN :
7009
HP
2622
It
accepts
text
input
and
graphic
output
Hum
an
resou
rce
Depa
rtme
nt
Hardw
are
device
Low Lo
w
Low
Firew
all
IT
securit
y
Links
ys
Syste
ms
RV
110
W
Wirel
ess-N
VPN
Firew
all
B004Z
MXE6
6
RV1
10W
-A-
NA-
K9
It
prevent
s the
unauth
orized
to and
from
the
private
networ
k.
Infor
matio
n
Tech
nolog
y
Depa
rtme
nt
Softwa
re
device
Very
High
Ver
y
Hig
h
Very
High
Anti-
virus
Protecti
on to
comput
er
System
Kasp
ersky
Total
Secur
ity
2020
Lates
t
Versi
on
B073V
KKNN
9
Secu
rity
2020
The
main
use of
anti-
virus is
all
about
detecti
ng,
neutrali
zing
some
of the
malwar
e
softwar
e. It
does
not
only
identif
y or
destroy
system
virus
Infor
matio
n
Tech
nolog
y
Depa
rtme
nt
Softwa
re
High Hig
h
High

3CYBER-SECURITY
but
also
help in
fightin
g
various
kind of
threat
like
worms,
phishin
g
attack,
and
rootkits
.
Serve
r
Data
sharing
New
Super
micro
2U
Super
Serve
r
SYS
B00N
UGKG
I2
2028
GR-
TRT
It
provide
s
various
functio
n
named
as
service
s like
data
sharing
or
resourc
es
along
various
client
and
perfor
ming
comput
ation.
Infor
matio
n
Tech
nolog
y
Depa
rtme
nt
Hardw
are
High Hig
h
High
IT
auditi
ng
softw
are
Fraud
Detecti
on
Team
Mate
+
Audit
111814
7618
2.0 It
merely
include
s audits
analyti
cs,
regular
Infor
matio
n
Tech
nolog
y
Depa
Softwa
re
High Hig
h
High

4CYBER-SECURITY
monito
ring,
detecti
ng
fraud
and
collabo
rating
with
group.
rtme
nt
Complete schema for classification taking account CIA has been described in the table:
Each of the asset in the organization will be examined as per CIA. The above mechanism
will be followed. It is completely based on both transmitted data and data residing in it.
CIA Low Moderate High
Confidentiality Complete
unauthorized
disclosure which will
have limited effect
on the firm.
Unauthorized access
which will have
adverse serious effect
on the organization
Unauthorized
disclosure will have
severe effect on the
organization
Integrity Any kind of
modification will
have a limited
adverse effect on the
organization.
Modification will
have serious effect on
the firm.
Any kind of
modification will
have severe effect on
the company
Availability Unavailability will
result in effect on the
firm.
Unavailability will
result in some serious
effect on
organization.
Unavailability will
have some serious
effect on
organization.
Confidentiality Classification Level Minimum Control

5CYBER-SECURITY
Low Official As per QGEA and agency
risk assessment
Medium Sensitive As per QGEA and agency
risk assessment
High Protected It is the duty of agency to
have controlled outline for
protecting information.
National Security Information (NSI) Not completely covered by
QGISF
Refer to federal PSPF
Seeking advice From QPS
Example of Router
The below example helps in auditing the router
SL No. Question Standard practices
1 Are the unused interfaces disabled? Any unused interface on the
router needs to be disable.
2 Is the DNS lookups for the when is turned
off?
The client service is merely
allowed at default even not
needed for most of the
routers.
3 Is Cisco discovery protocol completely
router disability
Cisco devices need to
disabled if not used by
application.

6CYBER-SECURITY
4 Is finger service completely disabled on
router
Unauthorized person need to
obtain information by making
use of suitable command.
5 Is Boostrap server disabled on router Bootp server service is
completely allowed by
default that provides other
router to boot this router. This
particular option needs to
disabled on router as it is
rarely used on today’s
network.
6 Is source routing is not enabled on router Sourcing router features will
help the individual packets in
order to specify routers.