Option #1: Risk Assessment and Mitigation Plan

Posted: June 6th, 2021

Risk Assessment and Mitigation Plan
Option #1: Risk Assessment and Mitigation Plan

Create a hypothetical risk assessment and mitigation plan.

Assume the role of risk manager/security professional and include the following information in your plan:

1. Choose a hazard or threat. (It cannot be one that you have already analyzed in class in a previous assignment. This includes both the Critical Thinking assignments and the discussion forums).

2. Assess the criticalities and consequences of your chosen hazard or threat.

3. Choose a facility (business, school, government, etc.).

Your plan should answer the following questions:

1. What countermeasures are in place?

2. Are the countermeasures in place designed to deal with your threat or hazard?

3. How will you assess the probability of the threat or hazard occurring?

4. Considering your answers to the above questions, what mitigation strategies would you recommend to handle your hazard or threat? Why?

Your paper must meet the following requirements:

• Your written paper should be 8 pages in length not counting the title and reference pages, which you must include.

• Cite at least six scholarly sources for this assignment. Scholarly resources include: peer-reviewed journal articles, books, the class textbook, or reports/documents from the government (.gov sites). A scholarly source does not include general sources from the internet (.com, .org, .edu, and .net sites are not scholarly). Scholarly resources should be current (no older than five years). If the class textbook is used as a source, then two other scholarly sources must be used

• Your paper must be formatted according to APA guidelines.
Hazard/Threat Chosen: Cyberattack on a university network
Criticalities and Consequences: A successful cyberattack could compromise sensitive student and employee data, disrupt online classes and services, and damage the university’s reputation. Stolen data such as names, addresses, social security numbers, grades, and financial information could be misused for identity theft or fraud. Network downtime would disrupt teaching, learning, research, and administrative functions. Loss of public trust in the university’s ability to protect data could damage enrollment and funding.
Facility: Large public research university with 30,000 students and 5,000 employees
Countermeasures in Place: The university has firewalls, antivirus software, and intrusion detection/prevention systems to monitor network traffic and block malicious activity (Cisco, 2022). Multi-factor authentication is required for sensitive systems. Regular security training educates students and staff about cyberthreats like phishing (EDUCAUSE, 2019).
Are Countermeasures Designed for the Threat?: Existing countermeasures are designed to address common cyberattacks but may not fully mitigate new or sophisticated threats. Firewalls and antivirus become less effective as attack methods evolve. Additional layers of defense are needed.
Probability Assessment: Cyberattacks on universities are increasingly common (EDUCAUSE, 2021). As more functions move online, the university’s “attack surface” expands, increasing vulnerability. A skilled adversary could exploit known or unknown system vulnerabilities. The probability of a successful attack within the next year is moderate.
Mitigation Strategies: Implement a security information and event management system to enhance monitoring of network activity. Conduct regular external and internal vulnerability assessments to identify weaknesses. Require annual security awareness training and phishing simulations to strengthen the “human firewall.” Back up critical data offline. Develop an incident response plan to quickly contain and recover from an attack. Upgrade outdated systems and promptly apply security patches. Justify increased IT security spending to senior leadership given evolving threats.
In summary, the university has basic cyber defenses but could take additional steps to strengthen security posture and reduce risks from cyberattacks through enhanced monitoring, staff training, vulnerability testing, backups, and incident response planning. Regular reassessment is needed to address emerging threats.
References:

Cisco. (2022). Network security overview. Cisco. https://www.cisco.com/c/en/us/products/security/what-is-network-security.html
EDUCAUSE. (2019). IT security in higher education. EDUCAUSE Review, 54(4). https://er.educause.edu/articles/2019/8/it-security-in-higher-education
EDUCAUSE. (2021). 2021 IT issues in higher education. EDUCAUSE Review. https://er.educause.edu/articles/2021/1/2021-it-issues-in-higher-education