MIS607

(Cyber
Security)
1. Introduction Of The Company

The B&C agency was set up in NY (New York) in the year 1965. They gets payment email on the
organization's email that claims they have hacked the frameworks and procured insights regarding the
essential plans and furthermore, information of their 200,000 customers. A sample of 200 clients were
provided after confirming the information to be right. As the network safety master, I am giving a
report that will help in the recognizable proof of the dangerous types and the key factors that were
included. Understanding the danger that the association is confronting requires understanding the
organization's present security rehearses and about the danger that the association is as of now
confronting [1]. We need to decide the limits that exist in the association framework. The report will
cover an examination of the threat that the association is confronting and the activities that will be
completed to guarantee that the danger has been alleviated effectively. Network protection is a
framework forcing security to forestall the substance's data set, programming, equipment and
framework being annihilated or changed from assailants [8].

2. Data Flow Diagram

The data flow chart reflects the interaction of the organization's information and capacity. The limit
among clients and web workers is an outside limit from where the network safety hazard happens and
influences organization's information. The limit between the web worker and application server
demonstrates the internal limit. The information is put away in the organization's storage system.

User / BrowserHTTPS Request MFA RBA

Fraud
Detection
XML/HTTPS
Web Financial Transactin
HTTPS Responses Application Calls (AUH wires external transfer)
Server XML/HTTPS

Application Responses
Application
Web Server Boundary Server Message XML/HTTPS
Messaging
Bus
Service Message Response
App & DB Server Boundary

Restricted Network
Financial
Transaction Processing MainFrame
2.1 Embedded Risk

The procedure of organization is considered as a resource of the organization. It shouldn't be unveiled until it is
effectively carried out by the organization. The programmer is additionally guaranteeing that he/she has a vital
arrangement of B&C Company, which is exceptionally disturbing. Technique ought to be examined face to
face or through the organization's email. The board should abstain from talking about procedure by means of
individual portable. B&C insurance agency is now confronting installed hazard due to the idea of its business
since it has confidential customers, investors, strategy holder information and monetary organization, and these
information are the resources of the organization. Any weakness in inner control and security frameworks may
prompt burglary of secret information, which is clear from the situation that 200,000 customer's information is
hacked by the programmer. Being suspicious in regards to shortcoming of control is a key to manage
implanted threat, and it will pay the best approach to recognize the flaw in the framework.

3. Assumptions
To decide the kind of threat that the association is confronting, a few suppositions are made as the
subtleties that have been given are insufficient.

 All the important data of the association is put away at the central command.

 Personal subtleties are put away individually at every office and the focal office.
 The organization created inside the framework is utilized to keep up and control every single
day by day correspondence, sends, and record trades.
 Email frameworks can be dealt with through the application or by means of a cell phone.
 No sends are acknowledged from outside the association network with exemption of some
senior workers.
 All representatives hold fast to the above suppositions and other safety efforts that have
been set by the security group.

4. Type of threat that affect the system

The hacker who attacked the organization might have utilized different techniques. In the beginning,
the association's trust limits confine the utilization of individual gadgets in the organization to
guarantee that the programmer doesn't get the information. Yet, some way or another, they had the
option to get the association's information. The most widely recognized thinking with regards to how
they got the information is through an inside danger where one of the laborers purposely or non-
intentionally offered admittance to the programmers [2]. At the point when a client and enters a
different part of the website which may give a chance to the programmer to misuse it and access the
information. The programmer may have additionally utilized infections and worms. To get the
infection or a worm inside the association's limits, the programmer may send messages to some
specialist. The email will contain spyware that will insert itself in the association framework and will
actually want to take information gradually and gradually until they have a duplicate of all the
information that they put away in the association's data set [3].

The attackers might have additionally assaulted the organization and been ready to access the
organization for an all-inclusive timeframe without being recognized. The attacker who utilizes this
strategy can screen the organization and take data which may incorporate misusing units and
malware. It is the most widely recognized assault that might have been utilized at the B&C insurance
agency. The association may likewise be available to a phishing assault. The assaults utilize social
designing to deceive the clients to break the typical security rehearsal, and in doing so they give
private data that may incorporate names, addresses, login qualifications, federal retirement aide
numbers, Visa data, and other monetary data. The assault can be helped out through the sending of
phony messages that seem as though they are coming from a genuine source. The programmer gets
the client to do some suggested activity in the messages that take them to fake sites that will request
individual data or introduce malware on their gadgets [4]. At the point when connections are opened,
they introduce malware on clients gadgets. The malware is intended to gather touchy data, convey
messages to their contacts, and arrange the admittance to their gadgets.

4.1 STRIDE/Element: Parameter Of System's threat

Deciding the kind of assault that has been utilized will help in the assurance of the piece of the
framework that was assaulted or whether the framework was assaulted. It will likewise help in
deciding if all information is open and decide whatever other danger that the organization might be
looking for later on (Cornelius et al., 2019). To decide the specific danger that is being looked for by
the association, STRIDE displaying is utilized. Using STRIDE, it gets simpler to amass the type of
attack and hence be ready to decide on it. STRIDE represents:

On account of the B&C insurance agency, it is difficult to decide the kind of assault that was utilized
considering the quantity of suppositions that must be made. The most conceivable assault type that
was utilized would be phishing of the top administration work force, as they are the lone staff that is
 permitted to get messages from outside the organization. At the point when the data is uncovered, it
abuses the secrecy of the data.

4.2 Understanding the threats

The phishing assault utilizes a hidden email as a weapon. They stunt the beneficiary of the
email into accepting that the message is something that they are keen on, e.g., a solicitation
from the bank or a note from somebody from the organization. The aggressor may have known
this reality and accordingly sent an email to one of the top directors. At the point when the
director responded to the message or their secretaries answered or downloaded any connection
that was incorporated, the aggressor had the option to access the associations' information.
More often than not, you don't see the email is from an aggressor as it portrays itself as a
confided an element or an individual that the casualty may work together. Keep corruption free
inside the association and setup solid security framework to save company’s information from
unauthorized access [9].

Phishing is conveyed utilizing phishing units. Units make it simpler for aggressors to dispatch a
phishing even for individuals who need sufficient information. A phishing unit packs phishing sites
assets and devices that should be introduced on a worker. After the establishment, the assailant
should simply send messages to the likely casualties. An attacker may parody a confided in brand
which builds the odds of the casualty tapping on the deceitful connection [6]. There is a different sort
of phishing that the assailants use. They incorporate lance phishing, where an aggressor makes a
message to speak to a particular person. Whale phishing is utilized to focus on the top administrative
group in an association as for our situation.

4.3 Elements of Cyber Security

I. Data Security: It covers organization's data which is to be viewed as secret like customer information,
provider information and investors' subtleties and so forth. It is considerable to carry out solid security over
this information to stay away from danger that exudes from network correspondences.
II. Organization Security: Network Security incorporates execution of safety framework to improve honesty
of information and to stay away from any abuse of information, unapproved interference and fragmented
divulgence while moving of information between areas.

III. Application Security: Application security is executed to reinforce the organization's site and remote
administrations, which is significant to ensure on the grounds that any unapproved access may alter the sites in
a manner to ruin the administrations offered by the element.

IV. Operational Security: Operational security is created to get the delicate and secret information of the
organization from falling into the hands of unapproved people.

V. Representative Training: It is similarly pivotal to give legitimate preparation of staff to instruct them
about cybercrime that may happen during a period of playing out their obligations. They should think about
phishing assaults through messages and connections, so they will not open email on the off chance that they
think that it's suspects.

VI. Installation Boundary: Only an administrator has an appropriate establishment of programming with
having special certification. Representative ought to be permitted to introduce any product or information with
his departmental head endorsement. In any case, organization's information might be ruined or hacked if there
should be an occurrence of downloading pernicious programming.

The reason for above components of digital protection is to discover defects inside the framework and execute
control to alleviate those blemishes. It is conceivable that B&C Co. isn't following the above security model
since its customer information is hacked by the aggressors. Above, security should be created by the B&C
organization to relieve weakness against threat.
5. Conclusion and Recommendation

From the report, obviously the organization of the association has the correct limits set. The
actual security doesn't permit any unapproved individual into the association premises.
Additionally have various levels of getting to the data. The assault that was completed directed
the top administrators as they approached practically all the information of the association. The
information that the programmers guarantee to have in their assets is just accessible for the top
administrators and accordingly upgraded the case that the assailants focused on them. The
phishing strategy which has been closed as the assault technique utilized requires an association
with an outer substance and only the top directors have that advantage.

For the eventual fate of the association's security framework, the association ought to put
resources into guaranteeing that the security is ideal. The security of the organization and the
limits to the outside organization ought to be upgraded. The top position administrative ought to
be encouraged and browse the messages they receive from a original source [7]. At whatever
point a connection is sent, it ought not to be downloaded until it has been checked for infections
and considered infection free. To empower this, the PCs and the framework firewall ought to be
refreshed routinely. The association may likewise select to introduce an outsider enemy of
infections that will help in shielding the clients from assaults. The counter infections ought to
likewise be refreshed consistently. Programming being utilized ought to likewise be refreshed to
stay aware of safety fixes that are delivered by their produces. The utilization of cell phones and
different gadgets inside the association organization to speak with an outer organization ought to
be annulled. The association's information should just be shared inside its organization yet never
with the outside network. The association's security rules ought to be followed and followed.

References

Khandpur, R. P., Ji, T., Jan, S., Wang, G., Lu, C. T., & Ramakrishnan, N. (2017, November).
Crowdsourcing cybersecurity: Cyber-attack detection using social media. In Proceedings of the
2017 ACM on Conference on Information and Knowledge Management (pp. 1049-1057).
 Husák, M., Komárková, J., Bou-Harb, E., & Čeleda, P. (2018). Survey of attack projection,
prediction, and forecasting in cybersecurity. IEEE Communications Surveys & Tutorials, 21(1),
640-660.

Adams, S., Carter, B., Fleming, C., & Beling, P. A. (2018, August). Selecting system-specific
cybersecurity attack patterns using topic modeling. In 2018 17th IEEE International
Conference on Trust, Security And Privacy In Computing And Communications/12th IEEE
International Conference On Big Data Science And Engineering (TrustCom/BigDataSE) (pp.
490-497). IEEE.

Yeboah-Ofori, A., & Islam, S. (2019). Cybersecurity threat modeling for supply chain
organizational environments. Future Internet, 11(3), 63.

Cornelius, C., Das, N., Chen, S. T., Chen, L., Kounavis, M. E., & Chau, D. H. (2019). The
Efficacy of SHIELD under Different Threat Models. arXiv preprint arXiv:1902.00541.

Meland, P. H., Paja, E., Gjære, E. A., Paul, S., Dalpiaz, F., & Giorgini, P. (2018). Threat
analysis in goal- oriented security requirements modeling. In Computer Systems and Software
Engineering: Concepts, Methodologies, Tools, and Applications (pp. 2025-2042). IGI Global.

Satyapanich, T., Finin, T., & Ferraro, F. (2019, December). Extracting rich semantic information
about cybersecurity events. In 2019 IEEE International Conference on Big Data (Big Data) (pp.
5034- 5042). IEEE.

www.cisco.com. (2020). What is Cybersecurity? Retrieved November 11, 2020, from cisco:
https://www.cisco.com/c/en/us/products/security/what-is-cybersecurity.html

securityintelligence.com. (2016, October 12). Tough Challenges in Cybersecurity Ethics.

Retrieved November 1, 2020, from securityintelligence: https://securityintelligence.com/tough-
challenges-cybersecurity-ethics/
www.scu.edu. (2020). Best Ethical Practices in Technology. Retrieved November 1, 2020, from
https://www.scu.edu/ethics-in-technology-practice/best-ethical-practices-in- technology/