Comprehensive Cybersecurity Analysis for ABC Technology

This report provides a comprehensive cybersecurity analysis for ABC Technology, an Australian hardware and software company. It examines vulnerabilities in their current practices, including the Bring Your Own Device (BYOD) policy, free Wi-Fi access for visitors, and cloud-based data storage. The report identifies potential security threats such as Denial of Service (DoS) attacks, social engineering, malware, unauthorized data access, and phishing. It details how these threats can impact ABC Technology's assets, including customer data and internal systems. The report concludes with specific recommendations for improving the company's security posture, emphasizing the importance of employee education, policy documentation, and data backup strategies. The goal is to educate the company and its employees about cybersecurity threats and mitigation techniques to protect their data and infrastructure from cyberattacks.

Windows User
[COMPANY NAME] [Company address]
PROFESSIONAL SKILLS IN
INFORMATION
COMMUNICATION

Executive summary:
Cyber-security, it is often referred to as the collection of policies, tools, security safeguards,
security concepts, risk management approaches, guidelines, training, actions, assurance,
technologies and best practices that are used by the organizations to protect their cyber-
environment and assets such as customer data, information, applications, physical resources,
tangible resources, services and telecommunication system. With the advancement of cyber-
crimes, it has become essential for the organizations that should evolve in the field of cyber
security and implement practices and policies that can provide complete prevention to them
against any kind of cyber-attack. ABC technology is a growing name in hardware and software
products and has multiple office in various areas where the employees connect through and
work on VPN. This document would investigate various vulnerabilities in the current practices
of the company such as use of BYOD technology, Free Wi-Fi access to the visitors, utilization of
cloud computing, and would analyze how these vulnerabilities can attract Cyber-criminals to
perform various attacks on the company’s assets. The document briefly describes the type and
nature of this attack and how they can harm ABC technology. At last the report presents some
recommendations to the company, such as importance of employee’s education,
documentation of the policies and backup of data, on the basis of investigation done on the
company’s security architecture. This document would serve the organization and the
employees to help them get a brief knowledge on the cyber security paradigm and what are the
basic requirements the company should follow to avoid this security threats.

Contents
Executive summary:....................................................................................................................................1
Introduction.................................................................................................................................................3
Cyber-security.............................................................................................................................................3
Identification and analysis of Vulnerabilities in the current architecture and practices in ABC system......4
Bring Your Own device (BYOD) policy......................................................................................................4
Free Wi-Fi for the guest/visitors..............................................................................................................4
Cloud-based computing and storage of data...........................................................................................4
Security threats to ABC Company................................................................................................................5
Denial of Service Attacks.........................................................................................................................5
Social engineering....................................................................................................................................5
Malware..................................................................................................................................................6
Unauthorized access to the data.............................................................................................................6
Phishing...................................................................................................................................................6
Conclusion...................................................................................................................................................7
Recommendation........................................................................................................................................7
References:..................................................................................................................................................8

Introduction
ABC technology is an Australia based company dealing in various types of hardware products
that comprises of both hardware and software. The company has number of offices around the
nation and two of them are located overseas. The company uses VPN to provide all the
computer related services which is maintained in the Canberra Office. The workers working
onsite are allowed for BYOD. All the company’s center provides free Wi-Fi access to their
guests/visitors that is limited with a password access. All the information of their 10000
customers and the products are stored at cloud side. The company has faced many attacks in
the past and are concerned that the information might be compromised by the malicious
hackers in the future and they might access all the customer and product information. ABC has
thus hired us as a security consultant of a famous security company. They require a cyber-
security repot which can educate the company and their employees about the current cyber-
security threats and mitigation techniques. The company want to know the vulnerability in their
own infrastructure so that they can take develop strong security system and policies to prevent
potential attacks on their data and infrastructure.
Cyber-security
As per industrial definition of Cyber-security, it is often referred to as the collection of policies,
tools, security safeguards, security concepts, risk management approaches, guidelines, training,
actions, assurance, technologies and best practices that are used by the organizations to
protect their cyber-environment and assets such as customer data, information, applications,
physical resources, tangible resources, services and telecommunication system (Garrett, 2017).
Cyber security is essential to ensure that the organizations properties and assets are
maintained secure against the relevant security risk factors arising in their environment. The
prominence of Cyber Security increases if a company has particular policies and practices that
make them prone to the threat of Cyber-crimes which can result in loss of their assets and data.
The importance of Cyber security for ABCT Company lies in the fact that the company has faced
many cyber-attacks in the past where the information of the customer has been compromised.
The company is afraid they might again face any sort of Cyber-attack, however the problem is
that the company and their employees are less aware of the current trends in the Cyber
security and what they can do to prevent those attacks (Global cyber security - information
technology, 2017).

Identification and analysis of Vulnerabilities in the current
architecture and practices in ABC system
Bring Your Own device (BYOD) policy
The company has BYOD policy in place. With the BYOD policy the employees are allowed to
perform their workplace tasks on their own device (PR Newswire, 2014). With BYOD policy in
place two scenarios is possible, for the first one, the employees can bring their personal devices
at workplace and perform their office task on them and secondly the company provide their
employees with the devices that are owned by the company however, they can still use them in
their personal areas. ABC Company implements the BYOD policy where the company provides
the employees with company-owned device. Thus the sensitive data of ABC is operated in
unsecure external environment and possible with the use of non-secure applications. In case
the employees lacks awareness of the threats that can arise in this non-secure environment the
risk of cyber-attacks would increase considerably. On the other hand careful handling of this
devices and the information stored within them would avoid the risk to the information and
applications of the Company. The employees should have sense of ownership and firm control
on the use and access of device to avoid security implications, for example downloading
malicious contents or sharing sensitive data of the company through insecure network can
enable the malicious hacker to steal the confidential and sensitive information of the company
and misuse them (Miedema, 2018).
Free Wi-Fi for the guest/visitors
ABCT provides the visitors and guests with free access to the Wi-Fi network within Company
premises. This is practice is gaining popularity in many industries today, particularly in the
hospitality industries where visitors are actually their customers and providing free Wi-Fi
attracts more and more customers. The practice however can open door for many cyber-
crimes. The guest are themselves potential misusers of the Wi-Fi network. They can use the
network to view inappropriate content for which the company can be held liable. There has
been many cases in the past when the visitors have downloaded pirated and unauthorized
contents using company’s free Wi-Fi service. Without proper controls in place the Wi-Fi can
provide attackers a simple back door to complete corporate network introducing all other
network security holes (Mitra, 2016). Uncontrolled and poorly managed Wi-Fi connection can
cause serious business problems for ABC. Though, the access provided by the company to the
guest is password limited it is not time limited that is the visitors can access the Wi-Fi whenever
they comes in contact and can log into the network automatically. This Wi-Fi is potential
vulnerability for the ABC technology towards significant security risks.
Cloud-based computing and storage of data
Cloud-based solutions are answer to every organizational requirement such as storage,
processing, handling multiple resources, accessing data from anywhere, real-time operations,
huge computation power and so on (Kouatli, 2014). ABC Company also stores the data of their
customers on the public cloud, which means that all the data related operations are overseen

at the cloud. The cloud computing paradigm provides companies with flexible storage and
processing tasks with low purchasing and maintenance overhead. However, the cloud based
solutions introduce many vulnerabilities in the security infrastructure. The data stored on the
cloud should be accessed through network connection. If the connection is unsecured it can be
intruded by the malicious attackers making the entire organization vulnerable to the cyber-
attack. Similarly insecure APIs and poor login credentials can result in breaking into the cloud
architecture by the malicious user which can ultimately make the customer data vulnerable
(Information security forum identifies top six security threats for 2014, 2013).
Security threats to ABC Company
In the above section we saw the major vulnerabilities to the company as a result of their current
practices. In this section we would discuss the possible threats to the information and assets of the
company. Below is the list of five major emerging threats that can do significant harm to the company.
Denial of Service Attacks
Denial of Service or DoS attacks are efforts done by the attackers in order to severely cut down
the services and website of the company. These attacks are carried out in order to keep the
legitimate users from using the services provided by the company. The extent of harm to the
company is recognized by the technique used by the attacker to carry out the attack. The
attackers can use various techniques to carry out DoS attack. Some of the known techniques
include, SYN/ACK Flood, Smurf, Ping floods and others. These techniques causes the server of
the organization to operate with limited bandwidth which ultimately freezes the entire system
(Sarojini, Vijayakumar, Selvamani, & Fernandez, 2015). There are various categories of the DoS
attacks as well, such as some of these attacks are carried out in attempt to consume the limited
resources of the company, some causes destruction of information associated with
configuration, Dos Bandwidth attacks where the attackers uses UDP or ICMP packets to
increase the traffic activity which backs off access to other network resources. ABC Company is
more likely to be hit by the DoS attacks due to the use of cloud based services. An attack carried
out on the network can take down the entire servers of the company. Moreover, the BYOD
policy would facilitate the DoS attack as there can be uncontrolled number of devices joined to
the ABC network.
Social engineering
In context with the BYOD and free Wi-Fi access to the employees and visitors of ABC social
engineering is another emerging threat. In an organization human resources are the weakest
security links, exploiting them the attackers can send malicious emails and messages to spread
malware. Similarly the employees of the ABC in absence of adequate security information can
download malicious content which can infect the whole ABC network (Kouatli, 2014). Since it is
difficult to monitor and control the activities performed by the employees and visitors on their
personal device and thus it can be more difficult for the company to acquire evidence in case of
attacks.

Malware
Malware as explained in the above section are the malicious software that are inserted into the
system by the attackers when they get access to the system. The malware can allow the
attackers to enter into the administrative zone in the system architecture where they can end
up doing malicious activities (Presswire, 2017). Malware are considered as a significant cyber
threat to the business particularly the one that works in the software and hardware
technologies. The attackers lures the employees to download the attachment that are received
with spam emails, thus the employees in absence of awareness downloads the software which
abuses the corporate system and results in malfunctioning. Additionally malware nowadays, are
well-equipped to steal confidential information of the companies. ABC thus requires to have
proper security policies in place to safeguard its information from being stolen or corrupted by
the Malware.
Unauthorized access to the data
Unauthorized access of data of the organization can result in data breach, manipulation and
removal of important data from the system database. This type of attacks are most of the time
carried out by an insider. For example a negligent employee may gain access to the privileged
information which he/she otherwise cannot legally access, and then perform operations on the
data. This type of malicious act is done by the employee who want to do harm to the company
or tries to gain something from the stolen information such as selling them to the competitors.
This type of insider attack is difficult to recognize as the employees have legal authority to use
the system and also they are the one who has knowledge on how the intrusion system can be
bypassed. This unauthorized access can also be gained by the employees at the cloud provider
side. Since the company does not have visibility of how its data is handled at the cloud end, the
employees at the cloud side can gain advantage from the situation and can access the data of
the company without their permission. Since ABC store their data on the cloud, there are
chances of the stored data be accessed by unauthorized users of which even the company
would not be able to detect.
Phishing
Phishing are the strategies used by the malicious users in order to gain details of the victims
such as their login credentials and in some cases banking details. Phishing is characterize as
criminal/illegal activity which applies deceptive practices to gain confidential data such as
username and password and other details of an individual or system. The attackers carrying out
phishing attack uses social engineering strategies for drawing users and get their profitable
information (Wazid, Zeadally & Das, 2019). Phishing attacks are further categorized into two
streams: Malware based phishing attack where malware is injected into the system through
email, another is Deceptive phishing where the attacker sends fake messages that looks as
received from legitimate sources, and the user provide the required information to the
attackers through the message

Conclusion
This report is designed to allow ABCT review its current organizational practices and understand
the threat landscape and engage in the basic security practices to mitigate a wide range of
cyber-threats. through this report we analyzed a range of practices that can be put into place to
secure against the cyber threats which includes, knowing what mitigation tools are used, how
data can be protected, how many devices are connected to the network and restricting number
of privileged users to minimum. It is important for ABCT to introduce security tools that
integrates various help-desk and maintenance product together with the security system.
Alongside it is also important to make the employees of the company familiar with the tools,
weapons and techniques that can be used to attack the security infrastructure of ABC. With the
use of cyber security knowledge presented in this report and integrating appropriate policies
particularly the one with BYOD and free Wi-Fi usage ABCT can easily prevent the cyber security
challenges or at least be prepared for them in advance.
Recommendation
First of all ABC technology would require to move on from traditional security practices to cyber
security management practices. Firewalls and antivirus are not enough to handle the state of
art cyber-attacks. Since the business are connected to employees, suppliers and customers
through internet the door to the company’s security infrastructure are always open for the
cyber-criminal. Alongside the implementation of the advance cyber-security practices, there are
some important points that ABC technology should follow, these are given below:
Document cyber security policy: In the area of cyber security particularly for the small
businesses like ABC it should be there first priority to document all the cyber security control so
that they can be reviewed at any point of time by every employee.
Educate employees: The cyber security is an ever changing and ever evolving paradigm, and
thus to grow up in this area and understand all its aspects well, the employees should be given
regular training on the Cyber security protocols.
Regularly back up all data: Regardless of all the precautions taken, there are still possibilities of
data breach. Thus it is an essential requirement that the company should back up all the data,
including word documents, databases, spreadsheets, human resource files, account
payable/receivable file and financial files. The ABCT should also make sure to back up all the
cloud that is stored on the cloud. Along these lines it is also important to ensure the backup are
functioning correctly.

References:
Bring-your-own-device (BYOD) initiatives stifled by companies' wider network security threats, says
iboss security: NexGen web security industry leader obviates malware, bandwidth concerns
posed by BYOD. (2013, Jul 30). PR Newswire Retrieved from
https://search.proquest.com/docview/1413618725?accountid=30552
Garrett, D. (2017, May 11). Concrete steps carriers can take to help insureds improve
cybersecurity. Carrier Management, Retrieved from
https://search.proquest.com/docview/2024497679?accountid=30552
Global cyber security - information technology. (2017, Feb 20). PR Newswire. Retrieved from
https://search.proquest.com/docview/1870057813?accountid=30552
Information security forum identifies top six security threats for 2014.
(2013). SecurityInfoWatch.Com, Retrieved from
https://search.proquest.com/docview/1469032754?accountid=30552
Kouatli, I. (2014). A comparative study of the evolution of vulnerabilities in IT systems and its relation to
the new concept of cloud computing. Journal of Management History, 20(4), 409-433. doi:
http://dx.doi.org/10.1108/JMH-02-2014-0018
Miedema, T. E. (2018). ENGAGING CONSUMERS IN CYBER SECURITY. Journal of Internet Law, 21(8), 3-
15. Retrieved from https://search.proquest.com/docview/2002988420?accountid=30552
Mitra, S. (2016). A quantitative investigation of the security factors affecting the use of IT systems in
public networks (Order No. 10148523). Available from Business Premium Collection.
(1830782598). Retrieved from https://search.proquest.com/docview/1830782598?
accountid=30552
Sarojini, G, Vijayakumar, A, Selvamani, K, & Fernandez, I. (2015). AN OVERVIEW: TRUST AND
REPUTATION IN CLOUD SERVICES. National Journal on Advances in Computing and
Management, 6(2) Retrieved from https://search.proquest.com/docview/1789513094?
accountid=30552
Wazid, M., Zeadally, S., & Das, A. K. (2019), Mobile banking: Evolution and threats: Malware threats and
security solutions. IEEE Consumer Electronics Magazine, 8, 56-60.
doi:http://dx.doi.org/10.1109/MCE.2018.2881291 Retrieved from
https://search.proquest.com/docview/2177329095?accountid=30552

Wick hill feature: Delivering secure wi-fi; tony evans from wick hill (part of the nuvias group) highlights
the risks of wi-fi and provides some advice for delivering a secure hotspot. (2017, Jan 04). M2
Presswire Retrieved from https://search.proquest.com/docview/1855028809?accountid=30552