WGU AUM1 Task 2 Report: ISMS Plan for Healthy Body Wellness Center

This report outlines an Information Security Management System (ISMS) plan developed for the Healthy Body Wellness Center, focusing on the scope of the ISMS, and an evaluation of a previously conducted risk assessment. The report details the development of business objectives, security principles based on FIPS and NIST guidelines, and the justification for including specific information systems such as databases and servers within the ISMS scope. It also covers the IT infrastructure that must be included and describes data flow within the network. Furthermore, the report recommends additional steps for addressing identified risks, including the generation of a Disaster Recovery Plan (DRP), a password policy, and a remote access policy, with justifications based on risk assessment evaluations. The report emphasizes the importance of these policies for maintaining the confidentiality, availability, and integrity of the organization's information systems and data.

Running head: TASK 2
TASK 2
Name of the Student
Name of the University
Author’s Note:

1TASK 2
Table of Contents
1. Scope for the development of ISMS planning.........................................................................3
I. Description of the development of business objective that is developed in the business
case study.....................................................................................................................................3
II. Security principles of guidance depending upon the case study.......................................3
a) FIPS...............................................................................................................................3
b) NIST..............................................................................................................................3
III. Justification of the system of information that should be included within the scope.......4
 What the procedure is.......................................................................................................4
 How the process would be applied to the case scenario...................................................4
 The need or implementation need of the process in the ISMS scope...............................4
IV. Justification to the information system that is needed to be included within research scope
5
 Information System that is needed to be included................................................................5
 Duties of the information system..........................................................................................5
 Purpose of including the system in the scope of the ISMS plan..........................................6
a) Database:.......................................................................................................................6
b) Servers:..........................................................................................................................6
Justification of the infrastructure of IT which must be included into the scope..........................6
Data flow description...............................................................................................................7

2TASK 2
B. Recommendation of additional steps for addressing the risks that are identified in this
particular case study, which must be taken by the organisation for implementing the plan of
ISMS................................................................................................................................................8
1. Discussion on the entailed of the recommended step which is based on the evaluation
based on the risk assessment which is conducted........................................................................8
i. Generation of the DRP......................................................................................................8
ii. Generation of a policy of password...............................................................................8
iii. Development of a policy of remote access....................................................................9
2. Each of the recommended steps are justified which is based on the evaluation of the risk
assessment that us conducted.......................................................................................................9
i. Creation of DRP................................................................................................................9
ii. Generation of a policy of password.............................................................................10
iii. Generation of a policy of remote access.....................................................................10

3TASK 2
1. Scope for the development of ISMS planning
This part of the paper defines about the potential for the development of ISMS plan in
support of this case study.
I. Description of the development of business objective that is deve
II. Loped in the business case study
As mentioned in the executive summary of the case study this report analysis about the
related security issues of technical, operational and management with the object for the
promotion of improvements in usefulness and quality of the medical grants by the evaluation,
information sharing, and the research that is federally supported.
III. Security principles of guidance depending upon the case study
The security principles for the guidance depend upon the qualitative evaluation without
assigning any numerical values (Laudon & Laudon, 2016). This case study was done taking in
counter the FIPS and NIST guidelines; these standards are accepted and known internationally
and for a management of information security.
a) FIPS
Processing standard of federal information (FIPS) Publication (PUB) 65: The
FIPS PUB standard defines the guidelines for risk analysis of automated data processing.
b) NIST
National Institute of Technology and Standards (NIST) Especially Published 800-
30: The NIST standard defines the management guide of risk for IT systems.

4TASK 2
The importance of risk in this scope was analysed by taking all the collected data
related to risk and threats, resource and assets, vulnerabilities, current control and the
likelihood of exploitation of vulnerabilities with respect to the impact and potential
threats. Those also assures the integrity and unique authorization of the information.
IV. Justification of the system of information that should be included within the
scope
This part of the paper will define the business process of the organisation that is
needed to be summed up within the research scope and will achieve the findings (1) What
is the process, (2) How I would be able to implement the procedure in the case scenario
(3) What is the need of the process to get included within the ISMS scope.
 What the procedure is: This part defines the process that is needed to be added with the
scope. The process, which is to be added in the ISMS scope are “Definition of system’s
boundary”, “information gathering” and “conduction of risk assessment”.
 How the process would be applied to the case scenario: The above mentioned process
must be implemented in ISMS scope as those are difficult to the assurance of
information. The plan of ISMS will be implemented in every mentioned case using some
methods (Peltier, 2016). In the implementation of the method there would be a phase of
planning which based on the current state analysis and the exposure of the related risk.
Some parts has been already conducted at the initial phase of risk assessment. On the next
step, the necessary steps planning are documented. After that to ensure the changes and
modification only as expected is ensured by monitoring. The phase of act stands for
ensuring the changes of previous baseline for the development to a new state.

5TASK 2
 The need or implementation need of the process in the ISMS scope: The above
mentioned process must be implemented in ISMS scope as those are difficult to the
assurance of information. The plan of ISMS will be implemented in every mentioned
case using some methods. In the case of change management, it should get included as
there must be a process of proper auditing for modifications being made in the aim to
achieve the ability of responding to a happening. The designing of secure software, must
be added in the research scope of ISMS, as the organization would be prone to risk and
vulnerabilities if there is a development of insecure software. Monitoring is also an
important factor and must be included in the scope in the aim of observing security
modifications and events, and also their quick detection (Candra, Briliyant & Tamba,
2017). New user accounts and devices are provisioned of granting huge permission,
which must be secured by a reliable security system and in this aim provisioning is
included within the case.
V. Justification to the information system that is needed to be included
within research scope
This part of the paper stands for justification of information system that must get
included in the ISMS scope. It would aim to cover about the information system that is
needed to be included, the duties of those information system, and the need for the
inclusion of the system in the ISMS scope
 Information System that is needed to be included: The system of information that
is needed to be included in ISMS planning are the servers and the databases.

6TASK 2
 Duties of the information system: Database is used to avail the comfort of tracking
records related to each and every transaction and in the case of servers it serves user in
the case of application running, accounting and authorization (AAA) within the system of
information.
 Purpose of including the system in the scope of the ISMS plan: This section
defines the purpose and importance of implementing the information system in the
planning process of ISMS.
a) Database:
Data base should get included in the planning process of ISMS as they defines a point of
singularity where organization could be extremely harmed by a breach (Humphreya, 2016). In
the aim of controlling proper security and take potential steps for prevention database from the
breaches issues, it is included within the scope. The policies of security that is put for supporting
the working model should have the property of ensuring confidentiality, availability and integrity
of the database information.
b) Servers:
Servers that acts like the infrastructures critical parts, should be included in the planning
process of ISMS and the server, which includes any breach has a noticeable effect in the
organization’s security. The servers serve in multiple purpose including the property to act like a
directory (Generally those servers that carries user account’s information). The system of
information must be included within the ISMS scope in the aim to give esurience of availability,
confidentiality and integrity related to the server by putting a proper control of the security.

7TASK 2
Justification of the infrastructure of IT which must be included into the scope
IT Infrastructure must be included into the scope that includes the infrastructure of
networking, includes the routers, firewalls and also switches. The appliances of security
monitoring includes into scope of ISMS which include the network of IDS/IPS devices, firewalls
of different applications, proxy servers of HTTP and also the email filters. It must be included,
the core of the networking equipment and also the appliances of security monitoring into the
scope of ISMS for ensuring the confidentiality, availability and also the integrity is accounted for
the infrastructure (Zhardemov et al., 2019). In case of assuring the confidentiality in case of
specific segments of network, the policy of firewall should be included into the scope of the
ISMS. During the data integrity, the protocols of the network is used including various
checksums which is included into the scope of ISMS, and also in case of availability of a
particular infrastructure where the ISMS includes network redundancy for the flow of the
network in case of a failure of hardware.
Data flow description
In the infrastructure of the IT the data will flow which is based on a specific source and a
destination for any traffic of network. The network must be segmented, thus will be able to pass
from one of the segment to the firewall between the access which must be granted. For the
outbound communication including the network and also the internet where various approved
channels are to be used. As example, Web proxy is the one and only method for the
communication of the HTTPS besides the email server which is corporate is one and only
method for sending the emails. Basically, the outbound ports must be blocked, except of the
authorised channels. The perimeter firewall will be passed by the inbound traffic and also it is
based on IP address and the port will also be passed into various devices of networking

8TASK 2
monitoring. The IDS/IPS is the module that will monitor almost all the inbound traffic and also
all the other appliances help in monitoring the application data includes an example, email filter
which can monitor all the inbound emails and the firewall of the web application will be able to
monitor the web requests that are inbounded. In respect to the destination, any of the thing that is
not filtered is sent towards the servers.
B. Recommendation of additional steps for addressing the risks that are
identified in this particular case study, which must be taken by the
organisation for implementing the plan of ISMS
This is the section which will recommend more steps for addressing the risks that re
identified in this particular case study which the organisation must implement the plan of ISMS
which may include (1) the making of the plan of disaster recovery (DRP), (2) the making of the
policy of password, and (3) the generation of a policy of remote access.
1. Discussion on the entailed of the recommended step which is based on the
evaluation based on the risk assessment which is conducted.
In this section it will be discussed about the recommended step which is based on the risk
assessment which is conducted.
i. Generation of the DRP
The generation of DRP is essential for acting quickly and also resolves an incident of
security during the crisis. It is indicated by risk assessment is “a DRP is not developed and not
also documented in case of SHGTS”. (Davis). It can be assumed that for any disaster which is
natural or anything by threat actor, the system may degrade, where the proper DRP must be
present (Fujii et al., 2018). The generation of DRP analyse the systems and also determines the

9TASK 2
way in which the systems will impact due to the crisis. Thus the new generated DRP will surely
look for the threats and the natural disasters that are of common types.
ii. Generation of a policy of password
The generation of a policy of password is important for ensuring any information system’s
confidentiality. In case of weak passwords the account may have to compromise and even if the
password is expired it may cause various types of attack on the passwords which includes the
attack of brute force for being successful. The assessment of risk also determines about the
passwords of JINX server which is not needed to change for almost ninety eight days also no
limit is there for the attempts of invalid access which usually occurs for a particular user. This is
the new policy of password which include the complexity of password, expiration of password,
and also the account lockouts.
iii. Development of a policy of remote access
A specific policy of remote access is to be implemented which ensures the information
system’s confidentiality. The analyse of risk determines about the access of remote registry
which is not restricted for the administrators This defines all the remote users will be able to
access all the registry in case of different hosts present in the network that leads towards the
leakage of information. This is the policy which must be implemented for ensuring the way
remote access will be able to be granted. The access of remote is granted for the users of
administrator or also through the authorised channels which include VPN concentrators or the
Citrix.

10TASK 2
2. Each of the recommended steps are justified which is based on the evaluation
of the risk assessment that us conducted
This is the section that justifies all the steps that are recommended which is based on the
evaluation done by the risk assessment.
i. Creation of DRP
The generation of DRP is an important step which ensures about the security in the
organisation also it is justified with the risk amount that is prevented. In case of DRP lack, when
the systems gets down, it will take several days which will also cause the revenue loss. With a
particular setup of DRP the organisation will be able to recover during the time of crisis.
ii. Generation of a policy of password
The generation of a policy of password is always justified for protecting all the vital
information systems and all its confidentialities. As the systems can be accessed by the users
with a password and as there is lack of password policy, it also exposes with password attack in
the organisation which include the attack of brute force (Park et al., 2016). A policy must be
implemented for controlling the passwords and also for preventing the attacks that occurs on the
critical accounts of various users.
iii. Generation of a policy of remote access
The generation of a policy of remote access is justified due to the risk deduction. As there is
less policy of remote access, no security control is present for preventing the user and do not
allow them to access the remote systems (Kumar et al., 2017). This cause in the leakage of the
information and lateral movement in adversary from a system to the system. The policy of

11TASK 2
remote access is to be implemented for ensuring that weather the controls of security are placed
for preventing any if such attacks.

12TASK 2
Reference:
Candra, J. W., Briliyant, O. C., & Tamba, S. R. (2017, October). ISMS planning based on
ISO/IEC 27001: 2013 using analytical hierarchy process at gap analysis phase (case
study: XYZ institute). In 2017 11th International Conference on Telecommunication
Systems Services and Applications (TSSA) (pp. 1-6). IEEE.
Fujii, T., Toi, T., Tanaka, T., Togawa, K., Kitaoka, T., Nishino, K., ... & Motomura, M. (2018,
June). New Generation Dynamically Reconfigurable Processor Technology for
Accelerating Embedded AI Applications. In 2018 IEEE Symposium on VLSI Circuits (pp.
41-42). IEEE.
Humphreys, E. (2016). Implementing the ISO/IEC 27001: 2013 ISMS Standard. Artech House.
Kumar, A., Sah, B., Singh, A. R., Deng, Y., He, X., Kumar, P., & Bansal, R. C. (2017). A review
of multi criteria decision making (MCDM) towards sustainable renewable energy
development. Renewable and Sustainable Energy Reviews, 69, 596-609.
Laudon, K. C., & Laudon, J. P. (2016). Management information system. Pearson Education
India.
Park, K., Lee, J. S., Han, J. Y., Lee, K. H., Kim, J. H., Cho, E. K., ... & Kim, D. W. (2016).
1300: Efficacy and safety of BI 1482694 (HM61713), an EGFR mutant-specific
inhibitor, in T790M-positive NSCLC at the recommended phase II dose. Journal of
Thoracic Oncology, 11(4), S113.

13TASK 2
Peltier, T. R. (2016). Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications.
Zhardemov, B., Kanatbayev, T., Abzaliyeva, T., Koilybayev, B., & Nazarbekova, Z. (2019).
Justification of location of LNG infrastructure for dual-fuel locomotives on the railway
network in Kazakhstan. Procedia Computer Science, 149, 548-558.