CMIT 321 Executive Proposal

Project Description

The purpose of project is to write an executive proposal for a
fictitious company called Advanced Research. The goal of the proposal is
to persuade the executive management team to approve purchase of
security testing software that can benefit the company’s corporate
network security by testing and identifying vulnerabilities before they
are exploited by hackers. The proposal must include a detailed
description of the software, its purpose and benefits

Suggested Approach

Research a security testing software tool that you practiced using in the EC-Council iLabs or from the textbook. Determine whether the tool would be beneficial in testing the security of a corporate network. Use the vendor’s website to collect necessary information about the tool to be able to explain its purpose and benefit. Include 3rd party endorsements and case studies about the tool.
Integrate the information from your own experience with the tool into
your proposal. This may include results from the iLab exercises or your
own test lab.

Company Description

Advanced Research Corporation

Advanced Research is a startup medical research and development
company. After five years of extraordinary success in the development of
innovative medical and pharmaceutical products, Advanced Research is on
its way to becoming a major player in the medical research and
development industry. However, due to its success, Advanced Research has
also become a major target of cybercriminals. Advanced Research has
been the victim of cybercriminal attempts to steal intellectual property
and sell it to Advanced Research’s competitors. It is suspected that
the corporate network has been infiltrated from unauthorized sources
more than once. In 2011, Advanced Research was falsely accused of
unethical research and development practices. The false allegations
resulted in the defacement of Advanced Research’s public website and
several Denial of Service attacks at different times over a 9 month
period that brought the corporate network to its knees. These attacks
had a major impact on Advanced Research’s ability to conduct business
and resulted in undesirable publicity for the company.

Regardless of its security problems,Advanced Research has continued
to grow as a company. Its research and development departments have
grown over the years, due to the expansion of the company, in proportion
to the increase in its business making up over 40% of the human
resources. Advanced Research’s innovative research and development
information is paramount to its continued success as a company.
Although, no known attacks have occurred in last 18 months, the security
of its network and intellectual property is still a major concern for
the company. Because Advanced Research is a still fairly young company,
management has been hesitant to budget for expensive security projects.
However, this point of view is beginning to change. Particularly,
because one of Advanced Research’s competitors, a major player in the
medical research and development industry for over 40 years, experienced
a loss of hundreds of millions of dollars in research data that was
stolen from its corporate network by cyberthieves.

Background and your role

You are the IT Manager hired in 2012 to manage the physical and
operational security of Advanced Research’s corporate information
system.You understand information security issues better than anyone
else in the company. You also know that the network is vulnerable to
outside threats because it has experienced attacks in the past and
because you haven’t had the resources to properly test the corporate
information system to identify the vulnerabilities that might exist and
take action prevent possible attacks. You have a responsibility to bring
these concerns to the attention of the executive team and ask for
approval to purchase the necessary testing software.

Your education and training have introduced you to variety of
security tools for testing computer and network security. The majority
of these tools you either only read about or have practiced using in lab
environment. You have decided to research some of these tools and test
them out in your own lab environment and choose one for recommendation
to executive team.

You will need to present information that proves the chosen tool will
be beneficial to the security of corporate information system. To
accomplish this you will need to research the product, if possible, test
the product in a virtual lab environment. If the tool is part of your
iLab exercise, it is recommended that you practice using and testing the
tool beyond the scope of the lab exercise. Based on your research and
analysis, you will include this information in your proposal in way that
the executive staff can understand and allowing them to make an
informed decision to approve purchase of the product.

The executive management team of Advanced Research:

The proposal should include:

· Detailed description of the software and benefits.

· Include reviews, case studies and customer recommendations

· Include your own hands-on experience with the tool and test results

· Cost of product. Include additional costs such as training or
hardware software that might be needed in order to properly deploy
manage and maintain the software.

· How will the software impact the production environment? For
example, the software may test for Denial of Service attacks. You need
to explain any interruptions the test may have on business operations.
You need to justify the need for such a test. Also explain how to you
plan to minimize or prevent possible production outages.

The software should test for one or more of the following types of attacks:

· Denial of Service (DoS)

· Cross Site Scripting (XSS)

· Authentication Bypass

· Directory Traversal

· Session Management

· SQL injection

· Database Attacks

· Password Attacks

· Firewall/Router Attacks

· Operating System Attacks