A Detailed Report on Information System Security at Google Company

This report provides a detailed analysis of information system security at Google Company, addressing various threats and mitigation strategies. It begins by examining the working mechanism of ransomware, highlighting tools like Kaspersky Anti-Ransomware Tool, AVG’s Ransomware Decryption Tools, and Trend Micro for tackling such attacks. The report then discusses threats against Google Company's network routers and switches, including Denial-of-Service (DoS/DDoS) attacks, social engineering, and malware. It further explores measures to ensure the availability and reliability of Google Company's web services, such as protecting server memory space, implementing Automated Deployment Services (ADS), and utilizing Windows Management Instrumentation (WMI). The report also addresses ensuring confidentiality and integrity for Google Company staff emails through S/MIME, and web server security threats like DoS/DDoS attacks, web application attacks, and DNS infrastructure vulnerabilities. Improvements to email server availability, the impact of employees on information security, and the use of data logs for monitoring and analyzing Google Company servers are also discussed, along with network devices for controlling security threats, including intrusion detection and prevention tools, anti-malware, and next-generation firewalls.

Running Head: INFORMATION SYSTEM SECURITY 1
INFORMATION SYSTEM SECURITY
Student Name
Institution Affiliation
Facilitator
Course
Date

INFORMATION SYSTEM SECURITY 2
Table of Contents
1.0 Introduction................................................................................................................................4
2.0 The Working Mechanism of Ransomware (Google Company case)........................................4
2.1 Three Tools used to Tackle Ransomware Attack in Google Company.................................5
2.1.1 Kaspersky Anti-Ransomware Tool.................................................................................5
2.1.2 AVG’s Ransomware Decryption Tools..........................................................................5
2.1.3Trend Micro......................................................................................................................6
3.1 Denial-of-Service (DoS/DDoS) Attacks................................................................................6
3.2 Social Engineering.................................................................................................................7
3.3 Malwares................................................................................................................................7
4.0 Ensuring Availability and Reliability of Google Company Web Services...............................8
4.1 Protection of its server memory space...................................................................................8
4.2 Automated Deployment Services (ADS)...............................................................................9
4.3 Windows Management Instrumentation (WMI.....................................................................9
4.4 Troubleshooting features........................................................................................................9
5.0 Ensuring Confidentiality and Integrity for Google Company Staff Emails..............................9
6.0 Webserver Security Threats in Google Company...................................................................10
6.1 Denial-of-Service (DoS/DDoS) Attacks..............................................................................10
6.2 Web application attacks.......................................................................................................11
6.3 DNS infrastructure...............................................................................................................11

INFORMATION SYSTEM SECURITY 3
6.4 SSL-induced blind spots......................................................................................................12
7.0 Improving the Availability of Email Server in Google Company...........................................12
7.1 Scaling the Email Server at its Construction Phase.............................................................12
7.2 Implementing Risk Mitigation.............................................................................................13
8.0 Impacts of Employees on Google Company Information Security.........................................13
8.1 Risk Management to Reduce Employee Risks on Google Company Information Security14
8.1.1 Educating the employees...............................................................................................14
8.1.2 Making Cyber Security a Responsibility of Everyone in the Organization..................14
8.1.3 Teaching Effective Password Management to Employees...........................................14
9.0 Data Logs in Monitoring and Analyzing Google Company Servers.......................................15
10.0 Network Devices to Control Security Threats in Google Company.....................................15
10.1 Intrusion Detection and Prevention Tools.........................................................................15
10.2 Anti-malwares....................................................................................................................16
10.3 Mobile device management tools......................................................................................16
10.4 Network access control tools.............................................................................................16
10.5 Next-generation firewalls...................................................................................................16
11.0 Conclusion.............................................................................................................................16

INFORMATION SYSTEM SECURITY 4
1.0 Introduction
With the current trends in technology, organizations have found themselves in the
receiving ends of the risks which have emerged as a result of these trends. These risks are
specifically due to many threats and risks associated with information systems. As a matter
of fact, cases of security breaches have been increasing year in year out. This is an indication
that any organization is at risk of information security breach in this era. It is therefore
importance for all the organizations to be aware of some of the potential risks to their
information security and ways to mitigate such threats or reduce their impacts if they happen
to hit the organization. In this paper, activities related to security audits, BCP planning,
Controls, risk analysis and control, and appropriate tools as well as techniques of containing
organization information tools have been discussed with Google Company as the case study.
Among the above list, ransomware, a common network information system malware
is the first in line to be discussed.
2.0 The Working Mechanism of Ransomware (Google Company case)
In its basic definition, Ransomware has been defined as malicious software threatens a
computer operation once inside the computer by preventing the access to personal data in the
computer. Under such situations, the attacker can freely demand for a ransom from the person who
has been affected in order to bring things back to normal and which is not always truthful (Andrei,
CEBERE & ACHIM, 2018). Based on the chosen organization, Google Company, Ransomware can
gain access to a personal computer in various ways and the common one is through Phishing spam, an
attachment that can appear to the victim as an email and masquerading as a trustworthy file. They
trick the owner to download them but once downloaded and opened, they then take over full control

INFORMATION SYSTEM SECURITY 5
of the victim’s computer and deny him access especially if built with social engineering tools that trick
the owner into giving full administrative access.
Once these malwares take over the victim’s computer, they encrypt all the user files and which
cannot be decrypted easily without a mathematical key which is only known by the attacker (Al-rimy,
Maarof & Shaid, 2018). This is the moment when the user is send a message being explained that the
files can only be decrypted under certain attacker conditions like paying some amount of money or
things of the sort. In some of the previous attacks witnessed, the attackers claimed to be law
enforcement agencies shutting down the user’s computer because of violations such as pirated
softwares and demanded for fines to restore the computers. Such tricks scare the victims from
reporting the incidences to relevant authorities (Andronio, Zanero & Maggi, 2015).
2.1 Three Tools used to Tackle Ransomware Attack in Google Company
2.1.1 Kaspersky Anti-Ransomware Tool
Kaspersky Anti-Ransomware Tool is a well-known tool when it comes to malware and
anti-virus protection. It was designed with SMB’s mind and leverages System Watcher and
Kaspersky Security network technologies in identification of ransomware behavior patterns
when protecting windows based devices at the endpoints. The Kaspersky Security Network
collects all the information from the voluntary users to keep the tool up to date with latest threats
while System Watcher technology scans all the crucial system events hence preventing malicious
attacks (Baykara & Sekin, 2018).
2.1.2 AVG’s Ransomware Decryption Tools

INFORMATION SYSTEM SECURITY 6
AVG Ransomware Decryption software has many tools which are designed to counter
specific ransomware threats. Such tools ensure that all files are scrutinized before being opened
in the computer and in case a malware is detected, it is discarded immediately to prevent its
consequences. These tools however work effectively when the software is maintained up to date.
The tools utilized by this software include Crypt888, Apocalypse, Legion, TeslaCrypt,
BadBlockSZ, FLocker and Bart
2.1.3Trend Micro
Unlike the case of Kaspersky Anti-Ransomware Tool which puts more emphasis on
protection of a computer against malware attacks, this tool works at the extreme end when the
computer has already been affected through its special features which enable it decrypt files
which are already attacked by the ransomware (Chandrashekhar, Gupta & Shivaraj, 2015).
3.0 Threats against Google Company Network Routers and Switches
Threats against network routers and switches are many including the distributed denial
of service attacks (DDoS), denial of service attacks (DoS), social engineering and malware.
These are just but a few and an indication that there are many threats towards these network
devices and a call for different protection approaches if a network must be secure. Solutions to
these threats are designed to cover multiple attacks but can never cover all the threats. Therefore,
a network needs a multilayered security approach to achieve maximum security objective.
3.1 Denial-of-Service (DoS/DDoS) Attacks
DoS and DDoS works on a principle of making routers and switches so busy to an extent
that they cannot play their roles in a network. To understand this principle, it is considered that
any networked device has a standard capacity of devices it can serve when connected and which

INFORMATION SYSTEM SECURITY 7
highly depend on device factors like processors, memory size, networking buffers, NIC
processor and the network connection speed (Esan, 2015). When router or switch abilities to
work are hindered or in other words prevented, a successful DoS is said to have taken place. This
is achieved by sending very large amounts of traffic at the network router or switch to trigger
these devices to fill their buffers or enter error condition status. This can be achieved through
configuring a single third party network device to focus its full networked capacity towards
another less capacity device. Considering my case study Google, since it supports large number
of networked capacity, an attack from single device won’t be able to put any dent in its capacity
and therefore distributed denial of service attacks comes into play. In this attack, the attacker
utilizes a group of exploited devices also known as botnet instead of using a single device to
send traffic to perform an attack on network devices. Since the path to get to the attacker is
indirect, it makes it harder to trace the executor of these attacks (He, Dong, Ota, Fan & Wang,
2016).
3.2 Social Engineering
This has been one of the popular and most obvious methods of attack to network devices
for years. It utilizes social methods to extract sensitive information which can hardly be given
directly. A good example is the phishing which can be send to network administrators to lure
them into disclosing network control credentials like password and access controls to the routers
and switches. The attackers can therefore compromise the network routers and switches using
these credentials given by the administrator.
3.3 Malwares
Malwares are short forms for malicious softwares. In the current technology trend, they
include Trojans, viruses, adware, worms, spam and rootkits. Although they differ in the way they

INFORMATION SYSTEM SECURITY 8
operate, they have a common goal of exploiting network devices like routers and switches to
compromise their operations. For instance, viruses are programmed to attach itself on specific
executing code which after being run executes and reproduces itself by spreading to completely
interfere with the normal functioning of a network device. On the other hand, worms works by
taking advantage of the network operating systems of these devices and are programmed to turn
network devices into bots for later attacks.
4.0 Ensuring Availability and Reliability of Google Company Web Services
System manufactures have set it clear that systems are hardly perfectly reliable and can
rarely anticipate all failure modes. Windows Server 2012 has been with some features to ensure
reliability and availability of web services. However, these features are not adequate for full
functioning of the server. Google Company has implemented some measures to ensure reliability
and availability of its web services (Hwang, Hsu & Lee, 2015).
4.1 Protection of its server memory space
The organization works very hard to prevent any external violations to its server memory
space. It has also adopted the .NET Framework which imposes constraints on potential rogue
processes which can interfere with proper functioning of the server. Also, it has implemented
mechanisms of ensuring proactive validation to detect correct behavior of processes
(Jin,Tomoishi, Matsuura & Kitaguchi, 2018).

INFORMATION SYSTEM SECURITY 9
4.2 Automated Deployment Services (ADS).
This company has implemented both automated and remote software and patch
distribution upgrades hence minimizing their server downtimes and reducing the risks of human
errors during maintenance processes.
4.3 Windows Management Instrumentation (WMI)
This service allows over 10,000 system user access through different ways such as
scripting, application and command lines as well as fine monitoring, controlling and reporting of
any malfunctioning of the server whenever it is detected.
4.4 Troubleshooting features
These features ensure quick troubleshooting and restoration of the servers to their normal
conditions quickly as possible to avoid incidences of non-response or slow responses when
accessing the servers. They include system recovery, logging, built-in performance monitoring,
and tracing capabilities (Voit & Verma, 2018).
5.0 Ensuring Confidentiality and Integrity for Google Company Staff Emails
Despite of the fact that message security features in Microsoft Exchange Server have
been there right from the first version of the product, only the customers with specialized
security skills and security experts have used the features. However, due to the increased support
for S/MIME (Secure/Multipurpose Internet Mail Extensions) in the current Message Exchange
Servers and the high demand for regulatory compliances, the need to comprehend these
principles has risen (Knorr & Aspinall, 2015).

INFORMATION SYSTEM SECURITY 10
To achieve email confidentiality and integrity most messaging platforms have adopted
S/MIME. For instance, the Messaging and Security Feature Pack for Windows Mobile 5.0 has
begun to support S/MIME certificates on current smart phones. Also, most Microsoft Exchange
Server Service Packs are offering support for S/MIME in the Microsoft Outlook Web Access.
Before S/MIME, the most common email protocol under use by the administrators to transfer
messages was the Simple Mail Transfer Protocol and which inherently proved to be less secure.
However, with the current S/MIME certificates, e-mail options are now provided under
greater security compared to SMTP protocol. This has enabled widespread and secure e-mail
connectivity. S/MIME achieves its security objectives through two approaches digital signatures
and message encryption (Kharraz, Robertson & Kirda, 2018). These two approaches are not
mutually exclusive services because each addresses its own specific security issue. On the side of
Digital signatures, it addresses both authentication and repudiation issues while message
encryption deals with confidentiality issues. For that matter, for integrity and confidentiality of
email messages to be achieved, both digital signatures and message encryptions have been used
by the Google Company.
6.0 Webserver Security Threats in Google Company
6.1 Denial-of-Service (DoS/DDoS) Attacks
DoS and DDoS works on a principle of making servers so busy to an extent that they
cannot play their roles in a network. To understand this principle, it is considered that any server
has a standard capacity of devices it can serve when connected and which highly depend on
device factors like processors, memory size, its buffers, its NIC processor and its processor
speed. When server abilities to work are hindered or in other words prevented, a successful DoS

INFORMATION SYSTEM SECURITY 11
is said to have taken place (Maurya, Kumar, Agrawal & Khan, 2018). This is achieved by
sending very large amounts of traffic at the server to trigger its buffers to fill or enter error
condition status. This can be achieved through configuring single third party devices to focus its
full capacity towards another less capacity server. Considering my case study Google, since it
supports large number of servers, an attack from single device won’t be able to put any dent in
its capacity and therefore distributed denial of service attacks comes into play. In this attack, the
attacker utilizes a group of exploited devices also known as botnet instead of using a single
device to send traffic to perform an attack on the server. Since the path to get to the attacker is
indirect, it makes it harder to trace the executor of these attacks (Wong & Kerkez, 2016).
6.2 Web application attacks
These include the attacks like SQL injections, cross-site request forgery (CSRF) and
cross-site scripting (XSS) which are launched by Cyber criminals to break into servers and
access data for different purposes.
6.3 DNS infrastructure
DNS servers have increasingly become targets for attackers because when DNS servers
are taken offline, the attackers keep thousands of millions of Internet users from gaining access
to the Internet. So, if an ISP’s DNS server is incapacitated by the attacker, ISP’s subscribers are
prevented from resolving their domain names, sending emails, visiting websites and using other
important Internet services (Mathew & Varia, 2014).

INFORMATION SYSTEM SECURITY 12
6.4 SSL-induced blind spots
With the increased number of applications supporting SSL, 40 percent of applications are
currently using SSL technology or change ports. SSL encryption has proved to be an enormous
loophole that can be utilized by malicious people to exploit webservers. This is because of the
inability of firewalls and intrusion prevention tools to keep pace with the growing SSL
encryption demands. For instance, the SSL key transitions from 1024 bits - to 2048-bits has
burdened many security devices because 2048-bits certificate require almost 7 times more
processing power to be able to decrypt SSL certificate encryptions (Ozzie et al, 2015).
7.0 Improving the Availability of Email Server in Google Company
Scalable applications with high availability are not easy to find because application
problems usually crop up in some unexpected ways to cause the applications stop working
appropriately as they were designed. Application availability problems arise from the least
expected areas. For that matter, it becomes very hard to anticipate where the problems may
originate. There are different approaches which can be used by an organization to improve email
server availability. Here are the two most common (Polyakov et al, 2014)
7.1 Scaling the Email Server at its Construction Phase
As indicated above, scalable applications with high availability are not easy to find
because application problems usually crop up in some unexpected ways to cause the applications
stop working appropriately as they were designed to, an email server that supports a certain
amount of traffic today might experience significantly more traffic in future and that may lead to