Hide Assignment Information

Instructions

Your boss wants you to draft a two- to three-page vulnerability process and assessment memorandum addressing the main points of a VM process for Mercury USA. You will cover the main elements of a vulnerability management process, tailored to Mercury USA's business in the transportation sector, evaluate the OpenVAS scanning tool, and provide recommendations for mitigating the vulnerabilities found within the OpenVAS report.

The third-party pen tester used the free tool Open Vulnerability Assessment Scanner (OpenVAS) to scan Mercury USA’s network. Review the report from the  OpenVAS Scan.

As you review the scan, consider some important points from Lesson 5:

· Priority

· Difficulty of implementation

· Communication/change control

· Inhibitors to remediation

· MOUs

· SLAs

· Business process interruption

· Degrading functionality

How Will My Work Be Evaluated?

An important part of your duties as a cybersecurity analyst will involve analyzing data from multiple sources and sensors such as antivirus/antimalware scanners, firewalls, insider threat monitoring systems, intrusion detection/prevention systems, SIEMs, vulnerability scanners, web application scanners, and other tools. You will also process logs from applications, auditing, network infrastructure devices, internet of things (IoT) devices, mobile communications devices, printers, servers, security appliances, and generalized logging collectors like syslog and Windows Event Logs.

As a cybersecurity analyst, you will be considered the subject matter and technical expert. A large part of your work will focus on identifying, analyzing, and mitigating vulnerabilities. For this assignment, you are asked to provide your supervisor with a technical evaluation of the organization’s vulnerabilities and propose a vulnerability management process. By summarizing your results in a short memorandum, you are showing how you use your technical knowledge to convey your ideas to others in a professional setting. Your ability to express your findings using the right mix of technical detail in a business context using an accepted format is an important workplace skill.

The following evaluation criteria aligned to the competencies will be used to grade your assignment:

· 1.1.1: Articulate the main idea and purpose of a communication.

· 1.3.1: Identify potential sources of information that can be used to develop and support ideas.

· 1.4.1: Produce grammatically correct material in standard academic English that supports the communication.

· 10.1.1: Identify the problem to be solved.

· 10.1.2: Gather project requirements to meet stakeholder needs.

· 12.1.2: Formulate policies, processes, and procedures based upon identified business needs.

· 12.2.1: Identify systems for the risk assessment.

You will use this report to write a two- to three-page memorandum for your manager, Judy. Follow the instructions in the  VM Process Overview Template  to record your work.

Delete the instruction text before you submit your project.

When you are finished, click “add a file” to upload your work, then click the Submit button.

Project 1: Vulnerability Process and Assessment Memo

Top of Form

Bottom of Form

CMGT/410 v20

Scope Statement

CMGT/410 v20

Page 2 of 2

Scope Statement

Project Title:

Date: Prepared by:

Project Justification:

.

Product Characteristics and Requirements:

1.

1.

1.

1.

Product User Acceptance Criteria:

Summary of Project Deliverables

Project management-related deliverables: business case, charter, team contract, scope statement, WBS, schedule, cost baseline, status reports, final project presentation, final project report, lessons-learned report, and any other documents required to manage the project.

Product-related deliverables: research reports, design documents, software code, hardware, etc.

1.

1.

1.

1.

.

Copyright2020 by University of Phoenix. All rights reserved.

CMGT/410

Global Treps Scenario

CMGT/410

Global Treps Scenario

Note: Refer to the following scenario for the Wk 2 Team – Apply: Creating a Scoping Document assignment and Wk 4 Team – Apply: Scrum Board assignment.

You have been selected as the project manager for the Global Treps project. You helped to run a local Shark-Tank-like event at your college last year as part of a class project, so you have a general idea of what is involved. The schedule goal is 6 months, and the budget is $120,000. Your favorite professor, Dr. K., and a few of her associates have agreed to fund the project. Your strengths are your organizational and leadership skills.

You are a senior who lives on-campus and gets free room and board by being a resident assistant in your dorm. Bobby, a computer whiz who funded most of his college expenses by building websites, will be your main technical guy on the project. He goes to your college and lives off-campus. Three other people will form your core project team: Kim, a new college grad now working for a nonprofit group in Vietnam; Ashok, a business student in India; and Alfreda, a student in the United States planning to visit her home town in Ethiopia for 2 months in a few months. You will hold most meetings virtually, but you can meet face-to-face with Bobby and Dr. K. as needed. You have all known each other for at least a year and are excited to make this project a success.

You and your team members will do the work part-time while you finish school or work at other jobs, but you can use up to $50,000 total to pay yourselves. You estimate that you will need another $30,000 for travel expenses, $20,000 for hardware and software, and the other $20,000 will go toward organizing events, consultants, legal/business fees, etc.

Your goal is to develop a fully functioning website and test it by holding 4 events in 4 different countries. You’ll make improvements to the site after those events, develop plans to scale it up, and recommend how to transition the project results into a successful business.

Recall from Chapter 4 that this system would include the following capabilities:

· Provides guidelines and templates for running a Shark-Tank-type event

· Provides guidelines and templates for running a Shark-Tank-type event

· Accepts donations from potential investors targeted toward specific schools or organizations wishing to host an event (similar to the popular www.donorschoose.org site, where people can fund teachers’ requests)

· Accepts ideas for needed new products or services

· Provides the ability for organizations to create their own custom site to solicit local participants and sharks, accept applications, and promote the winners as well as losers.

Note that you decided not to include the idea of providing an online version of the event as part of the initial project as your sponsor and team decided that physical events would be most effective. You have also decided to limit the scope of this first project to provide the ability for 20 organizations to create their own custom websites. Your team members will screen the organizations and assist people in using the site to plan their events.

You plan to hold 4 Shark-Tank-like events within 4 months, using your team members abroad to help organize and run those events, plus 1 at your college. Your semester has just started, so you plan to hold your event at the end of the term. The project will fund refreshments for the events and prizes for the winners, with a budget of $1,000 for each event. You don’t think you’ll get any donations via the new website before these events, but you’ll try to have it set up to accept donations by the last month.

You will create some short videos to show people how to use the site and provide suggestions for holding the events.

After testing the site and getting customer feedback, you will make some changes and document recommendations for a follow-on project. You will also create a business plan recommending how to transition this project into a real business that can make a profit after 2 years.

Assume that you would pay for a new website and account through an online provider. Bobby would do most of the customization/programming for the site, but you would consider outsourcing or purchasing services to provide some of the capabilities like accepting donations and developing the short videos on the site. You would also buy a new laptop and Internet access for your 3 team members abroad so that they could share information with their contacts in those countries.

You and Dr. K. want to attend all of the events as part of the project, and you might include a full face-to-face meeting with the whole team if possible.

MEMO

[date]

[Your name and course number/section]

[Opening Salutation]:

Overview

In this section, provide a brief overview to establish the purpose of your memorandum. You should introduce the topics in Parts 1, 2, and 3, below. Remember that you are writing to your immediate boss to help her address the CEO’s concerns over recent cybersecurity attacks against the transportation sector. Additionally, your boss has provided you with the results of a recent pen testing engagement performed by a third party on behalf of Mercury USA.

Part 1: Vulnerability Management (VM) Process Recommendation

In this section, present a recommended VM process for Mercury USA. Highlight the major VM process components as you learned in your studies. Explain how your recommendation meets the business needs of Mercury USA. Consider the transportation sector and the overall scenario in context. The text and questions below represent specifics to focus on while writing the memorandum. Do not include the specific text of the questions in your final submission.

· What are the main elements of a VM process, tailored to Mercury USA and the transportation sector?

· How will you plan for and define the scope of a VM process?

· How will you identify the assets involved?

· How will you scan and assess vulnerabilities?

· What is/are the industry standard scanning tools? Support your findings.

· What frequency of scanning do you recommend and why?

· How will you report the results of scanning and recommended countermeasures?

Part 2: Vulnerability Scanning Tool Evaluation and Recommendations

After performing an analysis of the vulnerability report provided by the third-party penetration testers, present your evaluation of the tool and your recommendations here. The text and questions below represent the specifics to focus on while writing your memorandum. Do not include the specific text of the questions in your final submission.

· Identify the scanner used to produce the report. Is the tool open source or commercial? Do you consider the tool to be industry standard?

· What are some advantages to using the tool? Disadvantages?

· What is your overall impression of the tool’s output?

· Does the tool provide enough reporting detail for you as the analyst to focus on the correct vulnerabilities? Can you appropriately discern the most critical vulnerabilities?

· Do you think mitigations for the vulnerabilities are adequately covered in the report?

· Do you think the reports are suitable for management? Explain why or why not.

· Would you distribute the report automatically? Explain why or why not.

· Would you recommend that Mercury USA use the tool? Explain why or why not.

Part 3: Business Case Example

In this section, provide an example of what could happen if Mercury USA does not implement your recommendations for a VM process (e.g., data exfiltration, hacker intrusions, ransomware, etc.). The text and questions below represent the specifics to focus on while writing your memorandum. Do not include the specific text of the questions in your final submission.

· What are some of the outcomes to the business if your example occurred?

· How does your recommended VM process address the example you used?

· For the tool you evaluated in Part 2 above, do you think the tool will be adequate? Why or why not?

Closing

In this section, summarize the main points of your argument for a VM process, tool evaluation, and use the case example to support your recommendations. Keep in mind that you are addressing the CEO’s concerns over recent cybersecurity attacks against the transportation sector and how you can help increase Mercury USA’s overall security posture to protect the organization against attacks, breaches, and data loss.

<Closing Salutation>

<Your Name> Cybersecurity Threat Analyst

Mercury USA

References

Use in-text citations in the body of your memorandum as appropriate. Add all sources you used here. This example citation uses IEEE style. Use a style of your choice or ask your instructor for clarification. When using the associated course content, ensure that you cite to the chapter level.

[1] "Chapter 5: Implementing an Information Security Vulnerability Management Process", Pearson CompTIA Cybersecurity Analyst (CySA+), 2020. [Online]. Available: https://www.ucertify.com/. [Accessed: 28- Apr- 2020].

Vulnerability Management Process Memo | [Document subtitle]

Get help from top-rated tutors in any subject.

Efficiently complete your homework and academic assignments by getting help from the experts at homeworkarchive.com