Information Security Gap Analysis: EZTechMovie
For the past 2 years, you have been working as a system administrator. Even though you have gained valuable experience in system administration and incorporating security into your daily tasks, you felt it was necessary to branch out and look for a job in the cybersecurity field. Fortunately for you, you attended Association for Computing Machinery (ACM), InfraGard, the International Information System Security Certification Consortium (ISC)2, Information Systems Security Association (ISSA), ISACA, and Open Web Application Security Project (OWASP) meetings. You learned about an opportunity at the EZTech Orientation (Links to an external site.), a private video-streaming company, from the networking that you did at these meetings. After visiting Career Services at UAGC, you are now prepared for your interview. After a strenuous interview with the CEO, CIO, and CISO, you were offered and accepted a position as a cybersecurity engineer. Mr. Martin, your esteemed CISO, is counting on you to construct the appropriate countermeasures to ensure the principles of information security when protecting the seven domains of EZTechMovie.
For this assignment, you will produce an information security gap analysis based upon the steps listed in Closing the Gaps in Security: A How-To Guide (Links to an external site.), which pulls information from this week’s recommended reading, Gap Analysis 101 (Links to an external site.), a webpage article written by Amy Helen Johnson. An Information Security Gap Analysis Template has been provided with the criteria needed to complete the assignment. Mr. Martin has provided documentation that you will need, but he did not provide any details about the laws, regulations, standards, or best practices that apply to EZTechMovie. As lead cybersecurity engineer and Mr. Martin’s go-to person, you will need to research any applicable laws, regulations, standards, or best practices (“framework”) that apply to EZTechMovie for a critical business function (CBF) that applies to EZTechMovie. An explanation as to why the framework applies to EZTechMovie is also required. An example has been provided to you.
Example of gaps identified using the provided template. Gaps are identified in red font.
Frameworks Section
PCI-DSS v 3.2 is the latest industry standard designed to protect consumers’ cardholder data and is required to be used by any company that accepts credit cards. EZTechMovie accepts credit cards, so the company must comply with the regulation. In your assignment, complete the Information Security Gap Analysis Template as it would apply to EZTechMovie. When formatting the sections of your paper within the template, you may find it helpful to refer to the Level Headings section of the Writing Center’s Introduction to APA (Links to an external site.) to be sure you are following APA 7th standards.
In your paper,
Explain the scope of the information security gap analysis by preparing a scope statement that includes an introduction to the analysis, deliverables, assumptions, and constraints. (Scope Section)
Choose an appropriate framework, if applicable. (Gap Analysis Section)
Identify at least 10 controls distributed among selected frameworks. (Gap Analysis Section)
Identify an existing EZTechMovie policy, if applicable. (Gap Analysis Section)
Evaluate any gap, if applicable. (Gap Analysis Section)
Summarize why a gap does not exist, if applicable. (Gap Analysis Section)
State the framework. (Frameworks Introduction Section)
Critique the framework. (Frameworks Introduction Section)
Justify why EZTechMovie needs to comply with the stated framework. (Frameworks Introduction Section)
The Information Security Gap Analysis paper
Must be presented using the Information Security Gap Analysis Template.
Must be three to five double-spaced pages in length (not including title and references pages) and formatted according to APA Style (Links to an external site.) as outlined in the Writing Center’s APA Formatting for Microsoft Word (Links to an external site.) resource.
Must include a separate title page with the following:
Title of paper in bold font
Space should be between title and the rest of the information on the title page.
Student’s name
Name of institution (UAGC)
Course name and number
Instructor’s name
Due date
Must utilize academic voice. See the Academic Voice (Links to an external site.) resource for additional guidance.
Must include an introduction and conclusion paragraph. Your introduction paragraph needs to end with a clear thesis statement that indicates the purpose of your paper.
For assistance on writing Introductions & Conclusions (Links to an external site.) as well as Writing a Thesis Statement (Links to an external site.), refer to the Writing Center resources.
Must use at least two scholarly, peer-reviewed, or credible sources in addition to the course text.
The Scholarly, Peer-Reviewed, and Other Credible Sources (Links to an external site.) table offers additional guidance on appropriate source types. If you have questions about whether a specific source is appropriate for this assignment, please contact your instructor. Your instructor has the final say about the appropriateness of a specific source for this assignment.
To assist you in completing the research required for this assignment, view this Quick and Easy Library Research (Links to an external site.) tutorial, which introduces the UAGC Library and the research process, and provides some library search tips.
Must document any information used from sources in APA Style as outlined in the Writing Center’s APA: Citing Within Your Paper (Links to an external site.) guide.
Must include a separate references page that is formatted according to APA Style as outlined in the Writing Center. See the APA: Formatting Your References List (Links to an external site.) resource in the Writing Center for specifications.
Carefully review the Grading Rubric (Links to an external site.) for the criteria that will be used to evaluate your assignment.
Information Security Gap Analysis: EZTechMovie
Student’s name
Name of institutions (UAGC)
Course name and number
Instructor’s name
Due data
Information Security Gap Analysis
Introduction
EZTechMovie is a privately-owned video-streaming company headquartered in San Diego. With revenues of about $1.5 million, it is poised for growth (Eues, 2017). The company now seeks to protect the seven domains of its data center and IT infrastructure: User, LAN, WAN, LAN-to-WAN, Remote Access, workstation, and System/Application. These domains are entry points for most cyberattacks, and necessary countermeasures are mandatory for any business such as EZTechMovie (Alexandra, 2018). In constructing appropriate countermeasures and ensuring information security principles when protecting the domains, an information security gap analysis is needed. This process follows the eight steps as described by Johnson (2001) in the “Gap Analysis 101” article. While EZTechMovie has provided necessary documentation, laws, regulations, standards, and best practices or frameworks applicable to the company have not been identified. In designing appropriate countermeasures based on the principles of information security necessary to protect EZTechMovie’s critical business function (CBF), this paper applies the Payment Card Industry Data Security Standard (PCI-DSS) v.3.2 Framework, which is the latest industry-standard that protects consumers’ cardholder data and a recommended standard for all credit cards-accepting companies. The paper also presents some of the security gaps and 12 controls based on gap analysis to protect EZTechMovie against cybersecurity challenges.
Scope of the Information Security Gap Analysis
EZTechMovie is a private video-streaming company that accepts credit cards to receive payments from customers. EZTechMovie must, therefore, comply with the PCI-DSS requirements of protecting consumers’ cardholder data. Scoping ensures that all business aspects are covered during gap analysis with the relevant framework that categorizes system components inside and outside the cardholder data environment (CDE). The CDE will include users/people, processes, and technology involved in handling the cardholders’ data or any sensitive information used to authenticate users and processes. On the other hand, the system components will include servers, network devices, computing hardware, and software applications. It is recommended to define the scope and ensure that it is not too narrow to expose the cardholder’s data to security risks or too broad to introduce high cost during analysis.
In PCI-DSS gap analysis, the CDE in EZTechMovie should be reviewed against the latest PCI DSS. This includes reviewing networks and systems and preparing a detailed report indicating the areas that demand attention. The Qualified Security Assessor (QSA) maps the critical information processes as well as the technical infrastructure in determining areas where PCI controls would have the most impact on the business (IT Governance, n.d). This step is necessary to outline the approach that would be cost-effect in meeting PCI demands, assess EZTechMovie’s readiness for an upcoming PCI audit, and spot lacking controls that could result in failures or costly repercussions for the firm.
An appropriate gap analysis should determine the scope in terms of networks and system components for PCI DSS and assess the compliance of system components after testing for each of the PCI DSS requirements. Deliverables include thorough documentation of all the compensating controls are then prepared, and the appropriate attestation of compliance (AOC) completed. It is also necessary to submit the self-assessment questionnaire or report on compliance, including any other documentation, to the requester (PCI Security Standards Council, 2018). If needed, remediating should be performed to address the requirements which are not in place and update the report.
The PCI-DSS v.3.2 Framework
The PCI-DSS v.3.2 was established by the Payment Card Industry Security Standards Council (PCI-SSC) in 2006 following increased incidences of credit card fraud. The PCI-SSC comprises five major credit card companies, including American Express, Visa, Inc., MasterCard, Discover, and JCB International. The council has outlined six categories of security controls that companies such as EZTechMovie need to implement (SecurityScorecard, 2022). For instance, it is mandatory for companies accepting card payments from customers to build and maintain a secure system and network that can prevent cyberattacks. Secondly, companies should protect consumer cardholder’s data and maintain security and privacy. Third, a business should maintain vulnerability management programs to check security loopholes. Fourth, firms need to implement strong access control measures to avoid unauthorized data access. Firth, firms should monitor and test networks to identify and prevent threats before they happen, and lastly, credit card payment-accepting businesses should maintain information security policies.
PCI-SSC has identified 12 requirements that companies need to implement as countermeasures to security attacks within the six categories of controls. EZTechMovie must install and configure firewalls, avoid vendor-supplied defaults, and protect customers’ stored cardholder data. The company also needs to encrypt cardholder data transmission in vulnerable open and public networks, protect all systems from malware attacks, and develop and maintain secure applications and systems. EZTechMovie must also restrict access to cardholder data, identify and authenticate access to systems, and restrict any form of physical access to cardholder data. It is also mandatory for the company to track and monitor access to network resources, restrict security ...
👀 Other Visitors are Viewing These APA Essay Samples:
-
The Major Concerns and Issues with Facebook and its Other Applications
9 pages/≈2475 words | 10 Sources | APA | IT & Computer Science | Research Paper |
-
Role Mutual Information Play in Feature Selection
5 pages/≈1375 words | No Sources | APA | IT & Computer Science | Research Paper |
-
Mutual Information for Feature Selection
7 pages/≈1925 words | 3 Sources | APA | IT & Computer Science | Research Paper |