CYB 462 Project Cloud and Virtualization Security

Introduction:

The purpose of this report is making a migration plan for Just Ducky which is an online store that deal with selling of plastic ducks and they want to ship their products around the world. The present networking infrastructure of them is including 2 Linux servers, routers, switches and 3 windows servers (Raghavan, Desai & Rajkumar, 2017). Along side in the network there is Email server, File server, Database server (SQL), Virtual Private Network and Web and e-commerce servers. For management of risk while migrating from legacy computer network to a Cloud infrastructure a risk management and disaster recovery plan will be made for the organization.

Risk management plan:

The online selling company named Just Ducky utilizes 2 factor authentication for accessing the network while tele working  as the tele work is highly encouraged. Also they face high volume of sales during the peak seasons like Christmas, Halloween, Spring, and Summer as that time the sales figures are around 350%.

Physical security vulnerabilities:

The server room of the company should be secured as the unsecured server room might result in hacking or destroying the crucial hardware or the database with a malware (Quyet & Cuong, 2017). A server tracking tool and a CCTV camera should be install their to keep track about all the incidents.

Bring your own device policy:

This policy is for providing allowance to the employees for bringing their own devices which can be a huge threat for the security as the devices of the employees can be less secure than the company owned devices so it will be easy for the hackers to get access to the network from the employee device. For this kind of issue a VPN should be installed their in the network which will help in encrypting the data which will be used for communication.

Incident response plan:

The data breaches can provide ultimate freedom to the hackers to jeopardize the ecommerce businesses as well as their potential consumers. The data breaches can also put the business in danger. For such kind of cases an incident response plan should be ready for immediate response. The steps for incident response are:

• Preparation: An advanced plan is needed for any of the plausible attacks or threats as well as the organization will need to prepare a security incident response planning (Sugiantoro, Anshari & Sudrajat, 2020).
• Detection and analysis: The attack detection is very much important as the attack may lead to the data leak. A cyber security team will need to be active always for detection and fixing of the attacks.
• Containment, Eradication, and Recovery: This stage is also very crucial as it will mitigate the systems and host while they will be under attack (Ahmad et al., 2020).
• Post-Incident Activity: This stage will be needed after fixing the issues successfully as it will review the reason of attacking so that the security holes can be detected for future safety implementation.

Disaster recovery strategy:

The disaster recover plan is actually a plan that is documented as well as a structured approach which can describe how the organization will be able to resume their work quickly after having an attack to their system or for an unplanned incident. This is applied to all of the aspects of the organization that is having dependencies on a functional IT infrastructure. As the company will move to a cloud based infrastructure so a lot of risks can be there. The most dangerous risks and their recovery plans are given as follows:

Ransomware attack:

The ransomware is actually a malicious piece of some codes which can encrypt the entire drive or data on the infected system. Once the information and data will be fully encrypted by the hacker, the organization will get a message of demanding money for decrypting the data (Affia, Matulevičius & Nolte, 2020). These things can be prevented through taking back up of the data to some other secured location such as external hard drive or encrypted cloud storage. By keeping back up of the data will reduce the risks and threats of ransomware as the organization will be having their data potentially encrypted if the system will ne encrypted.

These kind of attack is actually an interception as well as monitoring of the communication which are internet based such as mails for gaining information without knowing about the user. With the help of this attack the sensitive information can be exposed from the cloud or physical system (Mlelwa & Yonah, 2017). The attack can be prevented through making encryption of the data communication on the network which can be achieved by utilizing techniques like point to point encryption as it is having the ability of preventing the interceptor from reading the intercepted messages as that will be a cypher text message.

Auditing strategy:

Just ducks is an online based company and they are one of the largest growing business sectors however they will need a auditing strategy for improvement of their site. The auditing strategy is given below:

• The audit of ecommerce business needs time and effort. For auditing google analytics tool can be used as the tool is great for identification of the problem areas as well as providing an understanding of the contents existed in the website (Padmalatha, 2020).
• The organization can also use Screaming frog which is a powerful SEO tool which can crawl the site as well as can return actionable and useful data.
• The page speed is also needed to be tested as the speed should be sufficient for the users as a slow loading page can present major issues for any of the ecommerce platform.
• The checkout procedure is needed to be audited as that procedure is an essential component for the users, the google analytics tool can provide a great overview of this process.

Conclusion:

Thus it can be concluded from the report that in this paper a risk management and disaster recover plan has been developed for Just Ducky. As the company faces high sales in the seasons like Christmas, Halloween, Spring, and Summer around 350% sales so that plan will be very much helpful at that time. By following the plans properly the network will be protected from any risks of data lost or data theft.

References:

Affia, A. A. O., Matulevičius, R., & Nolte, A. (2020). Security Risk Management in E-commerce Systems: A Threat-driven Approach. Baltic Journal of Modern Computing, 8(2), 213-240.

Ahmad, A., Desouza, K. C., Maynard, S. B., Naseer, H., & Baskerville, R. L. (2020). How integration of cyber security management and incident response enables organizational learning. Journal of the Association for Information Science and Technology, 71(8), 939-953.

Mlelwa, K. L., & Yonah, Z. O. (2017). Requirement’s for Proposed Frameworks for Secure Ecommerce Transactions. Communications on Applied Electronics, 6(9), 1-15.

Padmalatha, N. A. (2020). Digital Forensic Science in Indian Ecommerce Environment. Psychology and Education Journal, 57(9), 2985-2995.

Quyet, C. B., & Cuong, H. C. (2017). Ecommerce risk management: analysing the case Vietnam Airlines incident. Open Science Journal, 2(4).

Raghavan, K., Desai, M. S., & Rajkumar, P. V. (2017). Managing cybersecurity and ecommerce risks in small businesses. Journal of management science and business intelligence, 2(1), 9-15.

Sugiantoro, B., Anshari, M., & Sudrajat, D. (2020, June). Developing Framework for Web Based e-Commerce: Secure-SDLC. In Journal of Physics: Conference Series (Vol. 1566, No. 1, p. 012020). IOP Publishing.

Online exams can be a pain in the head. But, you needn’t worry since our online exam help is here at your disposal. No matter how tough the questions are, we have the right team of experts to help you out. The team guides you through all the questions are you struggling to find an answer to. We will provide you with credible study and research material as well, depending on the question. Besides online exam help, we also provide unmatched quality essay writing services and custom writing assistance. You can also hire qualified ghostwriters from our team and get rid of all academic burdens easily.