Case Study: Expanding Information and Network Security Business

This case study examines the potential for business expansion of a Melbourne-based software company specializing in information and network security. The report provides an overview of current market applications, including authentication (Kerberos), web security standards, and IP security applications. It explores the company's opportunities to expand within the information and communication technology sector, considering strategies such as off-shelf software customization and in-house product development. The analysis includes factors for success and potential failure, along with recommendations for strategic growth, market segmentation, and compliance with regulations. The study also addresses the importance of information security in today's evolving digital landscape, emphasizing the need for robust security measures to protect against cyber threats.

Running head: CASE STUDY
Assessment 3-report
Case Study
Name of the Student
Name of the University
Author Note

1
CASE STUDY
Executive Summary
The purpose of this report is to examine the possibilities for the expansion of the business. The
following report provides the discussion regarding the information and the security applications
that are there in the market at present and its uses. The report also focuses on the security and the
technological aspects of the advantages and the risks involved. The respective Company is a
small software organization that was established less than five years ago. The software
organization is based in Melbourne. The company deals with the development and the
customization of the applications that specialize in the information and the network security area.
The Company at present and compiling the recent scenario is exploring option to expand its
business opportunities in the next five years to its other branches within the information and the
communication technology.

2
CASE STUDY
Table of Contents
Introduction......................................................................................................................................3
Discussion........................................................................................................................................4
Information Security and Network Security................................................................................4
Information/Network Security Applications...............................................................................4
Authentication Applications (Kerberos)..................................................................................4
Web Security Standards...........................................................................................................5
IP Security Application............................................................................................................5
Expansion Opportunities of the Company...................................................................................6
To expand the business a few strategies have to be followed:................................................7
Off shelf software and in-house products....................................................................................7
Reasons for Success.....................................................................................................................8
Probable reasons for Failure........................................................................................................9
Conclusion.......................................................................................................................................9
Recommendations..........................................................................................................................10
References......................................................................................................................................12
Annotated Bibliography.................................................................................................................15

3
CASE STUDY
Introduction
The respective Company is a small software organization that was established less than
five years ago. The software organization is based in Melbourne. The company deals with the
development and the customization of the applications that specialize in the information and the
network security area. The major clients of the company are based in the major cities of
Australia, which range from small to medium sized organizations. This organization at present is
undertaking projects that are developing applications in-house or the customization of the off-
shell software. These are done with agreement with the large vendors. The business scope of the
organization at present is limited to the development of the applications. The Company at present
and compiling the recent scenario is exploring option to expand its business opportunities in the
next five years to its other branches within the information and the communication technology.
The Company also plans to expand its business to all parts of Australia and if possible overseas
also. The future options of this organization are to diversify the business to provide the ongoing
information and the network security services to the various businesses, which have a presence
on the online platform. This will require management of the online security of those
organizations, websites and the database of the clients. The report is an investigation of the
possibility of the expansion of the business. The following report provides the discussion
regarding the information and the security applications that are there in the market at present and
its uses. The report also focuses on the security and the technological aspects of the advantages
and the risks involved.

4
CASE STUDY
Discussion
Information Security and Network Security
The information security refers to the number of the strategies that are used to manage
the different processes, the tools and the policies, which are important for the prevention,
detection, documentation, and to counter the threats to the digital and the non-digital
information. It is also called as the ‘infosec’. Infosec has the responsibility to establish the
business process to protect the assets of information despite the information being in the mode of
formatting or transition or is at rest in the storage or being processed Panda, Abraham & Patra,
2012). The network security on the other hand refers to any action that is designed for the
protection of the usability and integrity of the network and the data. The network security is
effective and manages the access to the network. The duty of the network security is to target the
threats and stops them from spreading to the network of an individual. The network security is a
combination of the various layers of the defenses in the network. Each layer has its policies and
controls (Stallings & Tahiliani, 2014).
Information/Network Security Applications
Authentication Applications (Kerberos)
The Kerberos is an authentication protocol that is designed for the internet protocol and
the transmission control protocol. This service acts on the concerned network acts as trusted
intermediary. This application allows the clients to access to other different clients and services
on the respective network. This application keeps a database of the various clients and their
protected keys. The services require the authentication of the clients by registration of the
password keys with this application. There is the creation of the shared password session that is

5
CASE STUDY
provided to the client and the server for the encryption of the messages. For the purpose of the
encryption the Kerberos uses DES that is the data encryption standard. The customer or the client
has make a request for the ticket granting service from the application and then this application
sends the ticket to the respective client that has the encryption of the client password key. The
generation of the authenticators by the client is done by sharing the password keys. If the
credentials provided by the client are approved, then the server grants access to the service
(Mahajan & Sachdeva, 2013). There is a possibility to replace all the client Kerberos software
with a version, which records the passwords.
Web Security Standards
These use the SSL (Secure Socket Layer) protocol for providing a reliable and secure
service on the Transmission Control Protocol. The web security threats are located at the server
or the customer and include passive and active attacks. The passive attacks comprises of the
access to the network traffic between the browser and the server and accessing the restricted
information. The active attacks comprise of the impersonation as another user and alteration of
the messages and the information on a website. There are security parameters to define the
association between the browser and the server. There is provision of the confidentiality by using
the symmetric encryption and message integrity. The message integrity is determined by the
shared password key, which is used in the form of the ‘message authentication code’. During the
alert, there is through a simple warning and if the alert is fatal then there is termination of the
connection. The alert messages are sent using the codes (Kumar, Ashok & Subramanian, 2012).
IP Security Application
This application is an agenda of the open standards that ensure private and secure
communications over the internet protocol networks using the cryptographic protection services.

6
CASE STUDY
This security is a collection of protection services that are cryptography based. The
authentication and the privacy mechanisms of the protected internet protocol provide the basis
for the security strategy for the individuals (Park et al., 2012). There is protection of the pair of
hosts and security gateways. There is the provision of the authentication of the origin of the data,
encryption that ensures the data is not leaked and the data has not been changed on the way.
There is also detection of the things that are received more than once so help to protect against
the defiance of the service attacks. The implementation of this application enables the provision
of a strong security. This application is below the transport layer and is transparent in nature. The
implementation of this application in the end system does not affect the upper layer software and
the applications. This application also provides security to the individual users if required.
Expansion Opportunities of the Company
The Company at present and compiling the recent scenario is exploring option to expand
its business opportunities in the next five years to its other branches within the information and
the communication technology. The Company also plans to expand its business to all parts of
Australia and if possible overseas also (Franke & Brynielsson, 2014). The future options of this
organization are to diversify the business to provide the ongoing information and the network
security services to the various businesses, which have a presence on the online platform. This
will require management of the online security of those organizations, websites and the database
of the clients. The world is changing at a pace and there are risks to the information assets of the
businesses and the individuals. Online applications, cloud computing and the mobility are the
new technologies that are adopted as the value of the information is high and is a major
organizational asset. The incidents of the cyber attacks, cyber spying, ransomware, threats of the
insider are reported frequently. The immunity to these security breaches is low hence, the usage

7
CASE STUDY
of the applications that specialize in the information and the network security area is necessary.
Before the consideration for expansion of the business, there are some points to be kept in mind.
The managing of the new locations for the expansion is necessary (Barnaghi et al., 2012). There
has to be the managing of the energy and the resources between the new and the old locations. It
has to be kept in mind if the expanding entity will be a separate entity or subsidiary of the main
Company. The tax implications and the policies have to be kept in mind. A comprehensive
analysis of the financial investment is important. The information about the competitors and their
operations is necessary. The performance of the competitors also has to be tracked and analyzed.
To expand the business a few strategies have to be followed:
 A market segmentation analysis has to be done firstly. The SWOT analysis of the
Organization has to be performed before the expansion of the Company all over Australia
and overseas.
 There has to be a development of a strategy and a business plan.
 The setting of the reasonable goals to measure the progress and the cost benefits has to be
done by the management.
 The tactical project has to be planned with commitment of the dates.
 The government and the industry specific regulations have to be ensured and reviewed
with proper certifications.
Off shelf software and in-house products
The off-shelf software has a lower up-front cost that contains the features that is required.
The support can be added with the maintenance contract and the upgrades are provided at a
reduced cost. If the software is a software-as-a-service them there is o requirement of installation
of hardware or software (Barnaghi et al., 2012). The customization may be started with the

8
CASE STUDY
minimum necessary requirements and can be added on later. This can be also tailored according
to the needs and the processes of the organization. The desired changes can be made quickly.
However, there is high initial cost involved. Most of the changes and the features that will be
requested will have to be paid. The ramping up of the new developers may incur additional costs.
While the in-house software will be produced by the organization that may later be available for
the commercial use and be on the solitary judgment of the organization, which is developing.
The need to develop this software is when there is the non-availability of the software in the
market. Both the customization of the off shelf software and the development of the in-house
software has its pros and cons but the customization of the off-shelf software will enable the
Company in the opportunity to expand its business (Choo, 2014).
Reasons for Success
The ‘security adults’ helps to identify the security risks and the validation of the
protection devices. The security adults enable the laying of the groundwork for identification to
secure the infrastructure. These also provide the objective insight on the effectiveness of the
complete security program (Barnaghi et al., 2012). The ‘managing security’ helps to manage the
security flaws. There is the maintenance and administration along with the reliable monitoring
and evaluation of the events, which take place on a daily basis. The advancement in the security
management software has reduced the responsibilities of the security personnel. The ‘security
policy’ is another reason for the success of the organization. The company has an information
security policy and the company expects to conduct it themselves with the matters that affect the
security position of the business. Some policies are related to security and the other policies are
in terms of their impact to the security risks regarding to the non-IT employees. The security is
classified as the deep technology category and there is the use of the complex techniques that

9
CASE STUDY
includes the block chain. The fusion of the technical expertise with the domain expertise is a
powerful combination (Alrajeh, Khan & Shams, 2013).
Probable reasons for Failure
There may be common misconceptions arising in the organization. There has to be the
availability of the latest data-loss prevention tool with the organization. The fundamental issue
within the culture of the organization that may cause some risks to arise is a problem. The
applications of the traditional security strategies also tend to give rise to risks. These traditional
security methods do not provide the visibility f the different risks. There is security risk in the
culture and the enforcement area also. There are certain manners and activities, which correlate
to the likelihood of a breach-taking place (Vacca, 2012). There has to be the provision of the
necessary data that support the strategic decision-making, if these are not provided then risks will
arise which may lead to the failure. The choice overload may also be a reason for the failure of
the plan to expand the business (Barnaghi et al., 2012). The underinvestment for this plan for
expansion may lead to the failure of the expansion plan. There can be threats by the hackers and
of the cyber breaches. The organization has to be prepared for these threats and attacks. It will be
impossible to respond to each one of the reported attacks but the company has to be alert at every
moment.
Conclusion
Thereby the following report is an investigation of the possibility of the expansion of the
business. The following report gives the discussion regarding the information and the security
functions that are there in the market at hand and its uses. The report has provided with a focus
on the protection and the technical aspects of the advantages and the risks involved. The

10
CASE STUDY
respective Company is a small software organization that was established less than five years
ago. The software organization is based in Melbourne. The company deals with the expansion
and the customization of the applications that concentrate in the information and the network
security area. The Company at present and compiling the recent circumstances is exploring
option to increase its production opportunities in the next five years to its other branches within
the information and the communication technology. The events of the cyber attacks, cyber
spying, ransomware, threats of the insider are reported frequently. The immunity to these
protection breaches is low hence, the usage of the applications that focus in the information and
the network security area is necessary. Before the deliberation for expansion of the business,
there are some points to be kept in mind, which have been discussed in the report. The managing
of the new locations for the expansion is necessary. There has to be the managing of the energy
and the resources between the new and the old locations. The network security is effective and
manages the access to the network. The duty of the network security is to target the threats and
stops them from spreading to the network of an individual.
Recommendations
1. There should be the implementation of the network segmentation. This comprises of the
classifying and the categorizing of the information and technology assets, data and the
employees into definite groups. The placing of the resources in the different areas of the
network of the organization will not allow the exploitation of the entire system. If this is
not there in the system of the Company then the cyber threats will make the organization
vulnerable (Enck et al., 2014).
2. There should be usage of the secure remote access methods, which have the ability to
connect to the network in a remote manner. This enhances the convenience for the end

11
CASE STUDY
users. The encrypted data channel allows for sending and receiving data through the
public infrastructure. With the help of the Virtual Private Network, the users will have
remotely access to their resources.
3. There should be use of strong passwords only to keep the system and the information
secure. The use of different passwords for different accounts will enable better control.
The passwords should have eight characters approximately and the greater number of
characters will need the hackers to guess more. The installation of the new software
should have the ability to change all the passwords with permission of the user.