Paper Example on Attack on Azumer Water

Introduction

The attack on Azumer water was due to lack of adequate information security measures. There are many vulnerabilities that can be identified when assessing the organization information management approach and measures. Azumer Water lacked a backup of the database which is the reason why after the attack the organization did not have any volunteer information. Azumer Water information management approach is poor and lacks an ideal of best practices in information security. Full-time employees in the organization are allowed access to the volunteer database which is a significant vulnerability that might have led to the loss of Azumer Water volunteer database. Unlike a windows system the choice of the organization to use open source and Linux program increases the vulnerability of Azumer Water servers. The open source allowed the users to be able download the source code easily and change it.

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Save 25%

Using Linux makes it difficult to find security applications that can be used to enhance security. In the organization, a vulnerability is identified on how all the employees are given the freedom to access the network using their personal devices which makes it easy for the employees to increase the data vulnerability to outside attackers. Maria failure to create a reactive or proactive approach to reduce the vulnerability of the organization data. Despite being aware of the vulnerability of the Azumer Water system Maria believes that an attack on the organization information is unlikely this is the reason for the lack of preparedness in the organization data protection approach. In Azumer water case, the passwords safeguarding key organization databases are not changed frequently and passwords can easily be changed in such a scenario. Lastly, upon learning that a hacktivist group is seeking the attack on Azumer Water, Maria ignorance on such a threat and failure to create an effective database security measure.

Compromised Data

The data in Azumer Water data confidentiality and availability is compromised due to the high number of employees who are allowed access to the volunteer data. Azumer Water allows all permanent employees to access the volunteer database from home and using desktop computers or personal computers at the office which is against the data confidentiality standards. Azumer Water poor data availability management policies are the primary threat to the integrity of the volunteer database. When employees are allowed to make copies of the volunteer data when they have to work at home further compromises the integrity and confidentiality of the data in the organization. Besides, in Azumer Water passwords are not regularly changed which it makes easy for unauthorized access to the data putting the confidentiality of the data in jeopardy. The integrity of the data management approach in Azumer Water is questionable because although the organization has an acceptable use and passwords maintenance, it has never been enforced. Azumer Water lacks data standards framework such as administrative responsibility where data can easily be accessed and copied by full-time employees which compromise the data confidentiality and integrity of the system. The duplication of the data by the permanent employees is a major integrity issue in Azumer Water which compromises the data confidentiality. ISO: 27002 standard requires organizations to have suitable data controls depending on the risk that the data is exposed, but Azumer Water does not have any data control approaches which compromise its database integrity and data confidentiality (Henttinen, 2018). The standard also requires organizations to have control objectives, and each objective should be accompanied by a control which is not the case for Azumer Water.

Regulatory Compliance

The state and the federal governments create data protection laws. Whereas the federal government regulates specific important data such as health the states have provided laws that regulate how data is collected, stored and accessed (Hasty et al., 2013). In the case of Azumer Water, the organization is non-compliant on many fronts such as the failure to have a comprehensive data security plans and to encrypt personal data on transmission. As such, the organization does not have any written procedures on data access which compromises the organization database confidentiality. Azumer Water is non-compliant regarding protecting the social security numbers of the volunteers against public disclosure by allowing all the employees who work full time to access and even make duplicate copies of the volunteer data to work from home (Hasty et al., 2013). Besides, the organization does not have a policy to securely destroy the volunteer's personal information when it is no longer of use to the organization (Kure et al., 2018).

Immediate Steps to Mitigate Incident Impact

Assembling a Taskforce

The first action towards responding to a security breach in an organization is avoiding to panic and creating a task force. The response should be clear and pre-determined with response control in place (DeVoe & Rahman, 2015). Having the right team is very critical in any security breach incident. In the case of a breach, the chief information officer should lead the incident response.

Containment

After constituting a team, the organization should embark on a containment activity which assesses the cause of the breach and installing security patches (Barrett, 2018). During the containment stage, it is important to change the passwords for all the user accounts to reduce further compromise on Azumer Water database. Besides, Azumer Water after the occurrence of the incidence should disable the network which could be harboring the people responsible for the breach. After the threat is contained the organization should embark on data recovery to recover the database.

Importance of Incident Response Plan

An incidence response plan is essential because it establishes a crisis communication plan and helps in assigning different teams with responsibilities. The key to a successful response plan is to ensure that all the key partners and specialists are brought on board to increase the success of the incidence response (DeVoe & Rahman, 2015). Today, cyber-crimes have increased and creating an incident response plan helps an organization to handle cyber threats, minimize their impact and strengthen the system defenses to avoid future incidents. An organization with an incident response plan in place can easily communicate to stakeholders who can help promote trust. Azumer Water lacked an incident response plan which increased panic amongst the volunteers and also led to the defrauding of some volunteers because there was no communication plan established beforehand for such cases.

Processes to Increase Information Assurance Levels

Adoption of NIST Cybersecurity Network

Azumer Water should adopt a more secure and predetermined security framework to restore information safety assurance. NIST framework is based on standards, guidelines and best practices that can help the organization to manage future cybersecurity risk. The framework can work in any organizational scenario because it is flexible, cost-effective, and prioritized. The framework is created on the premise of the ability of the organization to identify threats and protect the information system as well as detection, response and ability to recover from any cyber-attack (Barrett, 2018). Therefore, Azumer Water should adopt the NIST cyber-security framework to increase the organization preparedness.

Compliance with Standards

Increased organization compliance to standards such as ISO: 27002 which requires an organization to create threat controls can significantly increase information assurance amongst the stakeholders (Alcazar Vargas & Fenz, 2012). The lack of standards shows an organization poor preparedness which reduces trust and confidence in the organization security systems.

Technical Solutions to Counter the Remaining Effects of the Attack and Prevent Future Attacks

Advanced Communication

Communication is essential in alleviating the impact of a cyber-attack. Azumer Water lack of a communication plan could significantly increase the number of people who are defrauded (DeVoe & Rahman, 2015). Therefore, adopting an ambitious communication plan can help in the future to warn stakeholders of any cyber-attack which will reduce panic and the extent of the damage.

Creating Progressive Threat Identification Tools

Progressive threat identification is an advanced detection and protection technology that provides comprehensive protection against cyber-threats. The technology functions by transferring critical data in the event of an attack before the attackers can access it. Besides, the threat identification system can use decoys and web-based deception solutions that can further protect data in case of attacks (Barrett, 2018).

Organizational Structure for IT and Security Management

Currently, Azumer Water organization structure is not defined which allows access to information by all full-time employees which is not a safe approach for the organization data security. The organization should create an information management unit that should be in charge of the organization database and data management. The new unit should be dedicated towards data management and managing the accessibility of the organization database to eradicate possible internal threats. The new information technology unit should be headed by the chief information officer who will be reporting directly to the organization chief executive officer. Such an information technology organization structure would increase accountability by a considerable margin (Kure et al., 2018).

Risk Management Approach

Improving Network Security through Proven Password Strategy

Azumer Water should change its password protection approach by creating a more effective authorization approach that requires a combination of entry controls for authorization. Currently, the organization does not have any password protection strategy which increases the organization database and network vulnerability (Kure et al., 2018).

Reducing Database Access

The number of people given access to the database should be reduced to buffer the internal security of the organization database. The few the number of people with access to the database the more significant the protection from internal cyber threats (Kure et al., 2018).

Cloud Backup of the Database

Cloud backup is a right approach through which Azumer Water can promote data security and recovery in case of any future incidences because the world of technology keeps on changing which leads to new threats (Kure et al., 2018).

References

Alcazar Vargas, F., & Fenz, S. (2012). Mapping ISO 27002 into security ontology (Bachelor's thesis, Universitat Politecnica de Catalunya).

Barrett, M. P. (2018). Framework for Improving Critical Infrastructure Cybersecurity Version 1.1 (No. NIST Cybersecurity Framework).

DeVoe, C., & Rahman, S. (2015). Incident Response Plan for a Small to Medium Sized Hospital. arXiv preprint arXiv:1512.00054.

Hasty, R., Nagel, T. W., & Subjally, M. (2013). Data Protection Law in the USA. Advocates for International Development.

Henttinen, H. (2018). Improvement of Information Security Management System in Media X Corporation.

Kure, H., Islam, S., & Razzaque, M. (2018). An Integrated Cyber Security Risk Management Approach for a Cyber-Physical System. Applied Sciences, 8(6), 898.