Enterprise Network Security. Conduct a Policy Gap Analysis.

Enterprise Network Security

[MUSIC]

Good news: The media and entertainment company you work for has decided to acquire a media streaming company to complement the business. That means there’s a need to assess the financial strength and operational capabilities of the target company, including cybersecurity. The acquisition team needs to take a look at everything—operating systems, network infrastructure, data protection mechanisms, applications, patch levels, and all technology components to assess systems integration between the two companies. You are the cybersecurity engineering architect who will develop a strategy to mitigate risk, protect systems, and prevent threats to data. Your scope includes the enterprise network, data, architecture, and technology capabilities, operating systems, applications, and security processes of the streaming company.

Although the streaming company’s technology leader did not provide information on any system or trusted environments, you suspected that the company may be using older unsupported versions of Microsoft Windows and Adobe Acrobat. Another challenge: You know that your media and entertainment company doesn’t have the staff with the technical know-how, to assess the security of a technology-oriented streaming company. You will have to be detail-oriented and specific with staff members, to ensure the most important aspects of the integration of the two companies will be covered. You will develop a cybersecurity for a successful acquisition report that details the cybersecurity posture of the target company, trusted mechanisms to incorporate, and remedies to implement, to prevent threats and exploits. The report will be part of the larger assessment report the leaders of the acquisition will present to executives of both companies.

Businesses involved in mergers and acquisitions must exercise due diligence in ensuring that the technology environment of the future organization is robust and adequately protects their information assets and intellectual property. Such an effort requires time and open sharing to understand the physical locations, computing environment, and any gaps to address. Lack of information sharing can lead to a problematic systems integration and hamper the building of a cohesive enterprise security posture for the merged organization.

Often, the urgency of companies undergoing a merger and acquisition (M&A) impedes comprehensive due diligence, especially in cybersecurity. This creates greater challenges for the cybersecurity engineering architect, who typically leads the cybersecurity assessment effort and creates the road map for the new enterprise security solution in the future organization. However, the business interest and urgency in completing the merger can also represent an opportunity for CISOs to use additional resources and executive attention on strategic security matters.

In this project, you will create a report on system security issues during an M&A. The details of your report, which will also include an executive summary, can be found in the final step of the project.

Step 1: Conduct a Policy Gap Analysis

As you begin Step 1 of your system security report on cybersecurity for mergers and acquisitions (M&A), keep in mind that the networks of companies going through an M&A can be subject to cyberattack. As you work through this step and the others, keep these questions in mind:

  • Are companies going through an M&A prone to more attacks or more focused attacks?
  • If so, what is the appropriate course of action?
  • Should the M&A activities be kept confidential?

Now, look at the existing security policies in regard to the acquisition of the media streaming company. You have to explain to the executives that before any systems are integrated, their security policies will need to be reviewed.

Conduct a policy gap analysis to ensure the target company’s security policies follow relevant industry standards as well as local, state, and national laws and regulations. In other words, you need to make sure the new company will not inherit any statutory or regulatory noncompliance from either of the two original companies. This step would also identify what, if any, laws and regulations the target company is subject to. If those laws are different from the laws and regulations the acquiring company is subject to, then this document should answer the following questions:

  • How would you identify the differences?
  • How would you learn about the relevant laws and regulations?
  • How would you ensure compliance with those laws and regulations?

The streaming company that is being acquired has a current customer base of 150,000 users, who on average pay $14.99 in monthly fees. Based on the overall income, use PCI Standards DSS 12 requirements and the PCI DSS Quick Reference Guide to identify a secure strategy and operating system protections to protect the credit card data.

Select at least two appropriate requirements from the PCI Standards DSS 12 set of requirements and explain how the controls should be implemented, how they will change the current network, and any costs associated with implementing the change.

This policy gap analysis will be part of the final Cybersecurity System Security Report.

In the next step, you will review the streaming protocols that the companies are using.

Step 2: Review Protocols for Streaming Services

After reviewing the policies from the company and the policy gap analysis, the M&A leader asks you about the protocols used by the streaming company. He wants to know if the protocols used would affect the current state of cybersecurity within the current company environment. For this section of the report, review the protocols, explain how they work along with any known vulnerabilities, and how to secure the company from cyberattacks. Start with researching the commonly known streaming protocols and the vulnerabilities of those protocols. Some examples are the Real-Time Streaming Protocol (RTSP), Real-Time Transport Protocol (RTP), and the Real-Time Transport Control Protocol (RTCP).

Additionally, the leadership wants to know if any vulnerabilities identified would or could lead to a no-go on the M&A.

In other words:

  • You need to identify the kind of streaming that such companies might be doing and the specific technology they would be using.
  • What are the technical vulnerabilities associated with the protocols involved?
  • Have those been mitigated? And to what extent (i.e., has the risk been reduced to zero, reduced somewhat, shifted to a third party, etc.)?
  • What residual risk to the target company’s assets and IP remain?
  • Would those risks extend to the current (takeover) company after the merger? Would that be bad enough to cancel the M&A?
  • If the response to the last question is yes, then what should the target company do to further mitigate the risk? How should the takeover company mitigate the risk?
  • What are the costs associated to the target company (implementing the appropriate mitigation)? If the takeover firm has to take additional measures, identify those costs as well.

After assessing and reviewing the streaming protocols, move to the next step, where you will assess the infrastructure of the merged network.

Step 3: Assess the Merged Network Infrastructure

You’ve just reviewed the streaming services of the companies, and now you will assess the infrastructure of the new network. The networks of the two companies could be configured differently, or they could use the same hardware and software, or completely different hardware and software.

You need to understand what tools the company is using, the benefits and shortcomings of those tools, and the gaps within the network. Explain in your security report what tactics, techniques, and procedures you would use to understand the network. You should identify firewalls, DMZ(s), other network systems, and the status of those devices.

When your assessment of the infrastructure is complete, move to the next step, where you will assess any existing policies for wireless and bring your own device (BYOD) within the companies.

Step 4: Review the Wireless and BYOD Policies

Within Project 2, you learned about and discussed wireless networks. An M&A provides an opportunity for both companies to review their wireless networks. Within your report, explain the media company’s current stance on wireless devices and BYOD. However, the company that is being acquired does not have a BYOD policy. Explain to the managers of the acquisition what needs to be done for the new company to meet the goals of the BYOD policy.

When the review of the wireless and BYOD policies is complete, move to the next step: developing a data protection plan.

Transcript

Image 1

The very next day at the tech conference, a conference attendee picks up a thumb drive in the parking lot of the conference hotel. “Hey, someone lost a drive! I bet I can find a name in one of the files … then the hotel or conference staff can make an announcement.”

Image 2

A few minutes later, the Blue Screen of Death is showing on the attendee’s laptop. The dismayed attendee takes the laptop to the cyber team for help. A few hours later…

Attendee says, “Hi! Did you figure out what happened to my laptop?”

You reply, “Yes, I sure did. That strange thumb drive had a rootkit hidden on it. It ran automatically as soon as it was plugged into the USB port. Fortunately, it was a flawed rootkit and froze your machine. It’s likely this was a baiting attack intended to take advantage of your good nature. So, we’ve removed it from your machine, and now we’re making sure it isn’t anywhere else on the network.”

Image 3

Attendee says with a puzzled look, “How did you know what it was?”

You say, “I searched for signatures of known viruses, rootkits, etc., and found a hex signature for a known rootkit on your machine and on the thumb drive…3F 6A 2B 7C, I think.”

“Okay, signature makes sense. But what’s hex?” asks the attendee.

You explain, “Um…computers use different counting systems like binary and hexadecimal. Binary only uses numerals 1s and 0s. Hex uses 1-9 but also uses letters to represent additional numerals. Just another way to count.”

Attendee puzzles, “Whaa..? How can you use letters to count? Okay, I don’t need to know. Pretty cool that you know all that. Seems like magic to me! Thanks for fixing that!” While walking away, the attendee thinks, “That’s the last time I plug in a random thumb drive.”

Step 5: Develop a Data Protection Plan

You’ve completed the review of the wireless and BYOD policies. In this step, you will develop the recommendations portion of your report in which you will suggest additional mechanisms for data protection at different levels of the acquired company’s architecture.

Include the benefits of defense measures such as full disk encryption (BitLocker is an example) and platform identity keys as well as the required implementation activities. You also want to convey to your leadership the importance of system integrity and an overall trusted computing base, environment, and support. Describe what this would entail and include Trusted Platform Module (TPM) components and drivers. How are these mechanisms employed in an authentication and authorization system? Include this in the report and whether the merging company has this.

In the next step, you will assess any risks with the supply chain of the acquired company.

Step 6: Review Supply Chain Risk

The data protection plan is ready. In this step, you will take a look at risks to the supply chain. Acquiring a new company also means inheriting the risks associated with its supply chain and those firm’s systems and technologies. Include in your report the supply chain risks and list the security measures in place to mitigate those risks. Use the NIST Special Publication 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations, to explain the areas that need to be addressed.

After your supply chain review is complete, move to the next step, where you will create a vulnerability management program.

Step 7: Build a Vulnerability Management Program

After your supply chain review, you conduct an interview with the company’s current cybersecurity team about vulnerability management. The team members explain to you that they never scanned or had the time to build a vulnerability management program. So, you need to build one. Use the NIST Guide to Enterprise Patch Management Technologies, Special Publication 800-40, to develop a program to meet the missing need.

Explain to the managers how to implement this change, why it is needed, and any costs involved.

The next step is a key one that should not be overlooked—the need to educate users from both companies of the changes being made.

Step 8: Educate Users

You’ve completed your vulnerability management program, but it’s important to educate all the users of the network about the changes. During the process of acquiring a company, policies, processes, and other aspects are often updated. So the last step in the process is to inform users in both the parent company and the acquired company of the changes. Within your report, explain to the acquisition managers the requirements for training the workforce.

When you’ve completed this step, move to the final section of this project, in which you will prepare and submit your final report.

Step 9: Prepare and Submit Your Report and Executive Summary

You’re ready now for the final step, in which you will compile and deliver the Cybersecurity System Security Report for a Successful Acquisition for the company leaders to enable them to understand the required cybersecurity strategy.

Again, keep in mind that companies undergoing an acquisition or merger are more prone to cyberattacks. The purpose of this paper is to analyze the security posture of both companies and to develop a plan to reduce the possibility of an attack.

The assignments for this project are as follows:

  • Cybersecurity System Security Report for Successful Acquisition: Your report should be a minimum 12-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.
  • Executive summary: This is a one-page summary at the beginning of your report.

Goal: You will develop a cybersecurity for a successful acquisition report during an M&A that details the cybersecurity posture of the target company, trusted mechanisms to incorporate, and remedies to implement, to prevent threats and exploits. You suspect that the streaming company may be using older unsupported versions of Microsoft Windows and Adobe Acrobat. Another challenge, you know that your media and entertainment company doesn’t have the staff, with the technical know how, to assess the security of a technology-oriented streaming company. Make sure that these are also addressed in your report.

Deliverables: Cybersecurity System Security Report for Successful Acquisition with Executive Summary, Slides to support Executive Briefing


Step 1: Conduct a Policy Gap Analysis

“Policy Gap Analysis” section

  • ●Find actual or think about fictional security policies of a media streaming company.
  • ●Identify what, if any, laws and regulations the target company is subject to.
  • ●Identify the differences between the laws and regulations the acquiring company is subject to.
  • ●Use PCI Standards DSS 12 requirements, and the PCI DSS Quick Reference Guide to identify a secure strategy, and operating system protections to protect the credit card data.
  • ●Select at least two appropriate requirements from the PCI Standards DSS 12 set of requirements and explain
    • ○how the controls should be implemented,
    • ○how they will change the current network, and
    • ○any costs associated with implementing the change.
  • ●Explain how would you ensure that the new company will not inherit any statutory or regulatory noncompliance from either of the two original companies.

Step 2: Review Protocols for Streaming Services

“Protocols for Streaming Services” section

  • ●Find and identify if any of the existing vulnerabilities would or could lead to a no-go on the M&A.
  • ●Review common streaming protocols,
    • ○explain how they work,
    • ○describe any known vulnerabilities,
    • ○explain how to secure the new company from cyber attacks.
  • ●M&A related questions.
    • ○What are the technical vulnerabilities associated with the protocols involved the target company is leveraging?
    • ○Have those been mitigated? And to what extent (i.e., has the risk been reduced to zero, reduced somewhat, shifted to a third party, etc.)?
    • ○What residual risk to the target company’s assets and IP remain?
    • ○Would those risks extend to the current (takeover) company after the merger, and would that be bad enough to cancel the M&A? If yes, then, what should the target company do to further mitigate the risk? How should the takeover company mitigate the risk?
    • ○What are the costs associated to the target company (implementing the appropriate mitigation)? If the takeover firm has to take additional measures, identify those costs as well.
  • ●Describe the network infrastructure of the target company.
  • ●Understand what tools the company is using, the benefits and shortcomings of those tools, and the gaps within the network.
  • ●Describe what tactics, techniques, and procedures you would use to understand their network.
    • ○Make sure that you identify critical assets on the network, such as firewalls, DMZ(s) and other physical or logical subnetworks, other critical network components such as servers, databases, IDS, IPS devices, and the status of those components.
  • ●Explain the media company’s current stance on wireless devices and BYOD.
  • ●Since the company that is being acquired does not have a BYOD policy, explain to the managers of the acquisition what needs to be done for the new company to meet the goals of the BYOD policy.
  • ●Develop the recommendations portion of your report, suggest additional mechanisms for data protection at different levels of the acquired company’s architecture.
  • ●Describe the benefits, implementation activities required for protection and defense measures such as
    • ○full disk encryption,
    • ○BitLocker, and
    • ○platform identity keys,
    • ○the importance of system integrity,
    • ○an overall trusted computing base, environment, and support.
      • ■Describe what this would entail and include Trusted Platform Module (TPM) components and drivers.
  • ●How are these mechanisms employed in an authentication and authorization system?
    • ○Describe whether the merging company has these, if not, why?
  • ●Describe the supply chain risks associated with the target company and list the security measures in place to mitigate those risks.
  • ●Explain the areas that need to be addressed.
  • ●Use NIST Special Publication 800-40 Guide to Enterprise Patch Management Technologies to develop a vulnerability management program to meet the missing need.
  • ●Explain to the managers
    • ○how to implement this change,
    • ○why it is needed, and
    • ○any costs involved.
  • ●Inform the users of the new and old company of the necessary changes.
    • ○Describe what policies, procedures, processes, standards and other areas that you reviewed must be updated.
  • ●Explain to the acquisition managers the requirements for training the workforce.
  • ●Executive briefing: This is a three- to five-slide visual presentation for business executives and board members.
  • ●Executive summary: This is a one-page summary at the beginning of your report.

Step 3: Assess the Merged Network Infrastructure

“Merged Network Infrastructure” section

Step 4: Review the Wireless and BYOD Policies

“Wireless and BYOD Policies” section

Step 5: Develop a Data Protection Plan

“Data Protection Plan” section

Step 6: Review Supply Chain Risk

“Supply Chain Risk” section

Step 7: Build a Vulnerability Management Program

“Vulnerability Management Program” section

Step 8: Educate Users

“Training requirements” section

Step 9: Prepare the Report, Executive Briefing, and Executive SummaryCybersecurity System Security Report for Successful Acquisition: Your report should be a minimum 12-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables or citations

× How can I help you?