Running Head VULNERABILITY ASSESSMENT SUMMARY REPORT 1VULNER

Running Head: VULNERABILITY ASSESSMENT SUMMARY
REPORT 1
VULNERABILITY ASSESSMENT SUMMARY REPORT 4
Vulnerability Assessment Summary Report Comment by
Hank Williams: Project 2 is the Risk Assessment Summary
Report, not the Vulnerability assessment summary report.
University of Maryland Global College University
CMP 620 Cybersecurity Governance
Vulnerability Assessment Summary Report
Executive Summary Comment by Hank Williams: Your focus
for the ES is not correct as this is a risk assessment based upon
project 1. Please watch the video.
Your project is missing key sections per the outline and
templates I provided, and it does not address the required
information as I laid out in the project 2 video. You’ve done a
lot of work here, but since you didn’t actually follow the
requirements, most of it is not relevant to the project.
I recommend you schedule a meeting with me at your earliest
convenience.
Risk assessment is an activity that involves the identification of
possible risks and analyzing their impact on the organization.
This risks assessment is intended to assist the SGT Inc. to
manage its projected risks. SGT Inc is a company that makes
and sells airplanes in Maryland. This assessment report is
intended for all the company stakeholders-customers,

employees, board of directors, government agencies, vendors,
and partners. This assessment process has mainly been based on
the assessment of different kind of malware that exists in the
security system SGT Inc. Information security threats are
usually many-they include software attacks, identity theft, and
theft of intellectual property, information theft, theft of
equipment, information extortion, and sabotage (Mylrea,
Gourisetti, Larimer & Noonan, 2018). Software attacks
identified in the vulnerability assessment report were the
attacks by viruses, Trojan Horses, worms, etc. other malicious
software that can attack information software include malware
and bots. Comment by Hank Williams: is to provide senior
leadership of SGT Inc. with an analysis of the vulnerabilities
discovered during the assessment performed on <DATE> to
enable them to make informed, risk management decisions
relating to these vulnerabilities. Comment by Hank
Williams: It should be based on the vul assessment done in
project 1.
Malware is malicious software that can be an intrusive program
code. It can also be anything designed to perform malicious
operations on an information system. There are two types of
malware categories: infection methods and malware actions.
The following are examples of malware based on infection
methods: viruses, worms, Trojan, and bots. Viruses are
malicious software that can multiply through hooking
themselves into the program. They hook themselves on the host
computer through videos, songs, and then they travel to the
internet. Examples of viruses include the Ther Creeper, macro
virus, file virus, stealth virus, and boot sector virus. Worms are
also similar to viruses only that they don’t hook themselves
through the program on the host computer (Ten, Liu &
Manimaran, 2008). Another difference between worms and
viruses is that worms are network-aware. They travel faster in
the presence of the internet and can travel from one computer t
another. Worms are not highly risky when they are exposed to
the target computer. They have minor effects on an

organizational information system. The purpose of Trojan
horses is to conceal them into software that appears legitimate-
after the software has been executed, the Trojan will perform
their intended work of either stealing information or any
information they are intended to do. Examples include Proxy
Trojan, FTP Trojans, and Remote Access Trojans. Bots are an
advanced form of warms. Bots are automated processes that can
interact over the internet even if there are no human
interactions. Their effects can either be good or bad
Another category of malware is based on action. Such malware
includes Adware, Spyware, Ransomware, Scareware, Rootkits,
Zombies, theft of intellectual property, identity theft, theft of
information and equipment, sabotage, and information
extortion. Other cybersecurity threats include social media
attacks, mobile malware, and technology with weak security,
outdated security software, social engineering, and the use of
corporate data on personal devices.
Some of the examples of information security vulnerabilities of
SGT Inc.that were identified include malware, unpatched
security vulnerability, hidden backdoor programs, superuser
account privileges, automated running of scripts without virus
check, unknown programming interfaces, phishing attacks, IoT
devices, and employees. Vulnerabilities that exist in SGT Inc.
are due to an anticipated interaction of different software
programs, underlying weakness in an individual program, or
system components.
Internal threats contribute to more than 60 percent of SGT Inc.
security vulnerabilities. Internal vulnerabilities come from
partners, employees, and ex-employees (Tucci, 2017). Common
internal threats in SGT Inc. security system results from
opening malicious emails, accessing corporate systems on
unknown people, loss of the laptop and other electronic devices,
taking advantage of database privileges, introducing a corrupt
tool to the organizational network, social engineering, and
becoming victims of phishing schemes. Internal vulnerable also
come as a result of the wrong procedures used in the installation

of security systems as well as policies used.
Recommended Risk Management Strategies
The specification and selection of a system security control are
completed as part of an organizational information security
program which entails organizational risk management.
Organizational risk management involves the management of
risks that appertains to the organizations or management of
risks that come from the individuals that operate the system.
risk management in an organization is an important component
in an organizational information security system. it provides an
effective framework for selecting the appropriate security
controls for a system. Appropriate security control is one that is
necessary to protect the operations, individuals, and assets of
the company. The risk management framework I will
recommend for SGT Inc. is the risk-based approach. The risk-
based framework is a risk management framework that outlines
a process that integrates risk management activities and security
into the system development life cycle. This approach to
security specification and selection considers efficiency,
constraints, and effectiveness due to directives, applicable laws,
policies, executive orders, regulations, or standards (Wilbanks,
2018). The framework involves the following steps: select
controls, implement controls, assess controls, authorize
systems, monitor controls, and categorize systems.
The following are the risk management technologies that will be
used in this assessment process: risk dashboards, automated
processes, risk assessment tools, and advanced risk management
tools. Dashboards are considered the easiest technology for
undertaking the risk assessment process. The use of dashboard
is important because it allows for the creation of helpful views
of the current risk profile of a program, portfolio of the project
with a few clicks. The business can use a dashboard interface
that allows all employees to crate and report to organizational
risks in the same way. The use of an automated process is
another alternative technology that can be used in risk
management through workflows within a tool. This will involve

managing all the processes within tool-processes of risk
identification, risk assessment, risk management, risk
monitoring, and risk escalation.
Risk assessment tools are mainly important during the risk
assessment stage. It is an important tool because it makes it
easier to compare risks across portfolios and programs.
Advanced risk management tools are used for risk modeling.
Risk management strategies that have been identified in this
study include risk transfer, remediation, acceptance, and
mitigation. To remediate means to fix the issue. Mitigate is part
of accepting the risk and includes implementing compensating
controls because you are not going to fix the issue. Transfer
means to transfer the risk to an outside agency such as an
insurance company
Risk Management Implementation Recommendati ons
External factors such as government policies, regulatory factors,
and previous industry issues contribute to threats and
vulnerabilities in different ways. Threats such as social media
attacks and opening malicious emails are cybersecurity threats
that are controlled and regulated by the terms and conditions of
the software manufacturers. Security software manufacturers are
responsible for issuing license and user terms of the devices
before they are accessed. When the terms and conditions of the
manufacturers do not comply, there can be a serious
consequence to the users of the devices. Some of the best
practices that can be used to mitigate external factors include
the implementation of Password Protocol Policy. Password
protocol policy is created for users to enable them to protect
their passwords.
This internal vulnerability mitigation practice is achievable
through undertaking a thorough explanation and training so that
everyone in the organization understands and becomes aware of
their roles in system security. CITG is a technology integration
company. it plays the role of providing tips on office security.
According to the report issued by the company in 2018, the
company reported that the establishment of policy and security

practices for employees is the best tip for contracting agencies.
This protocol is highly recommended because it enables
employees who are not well equipped with technological
knowledge in an organization to learn and know their roles in
system security. Another best practice is the policy that detects
malware before the use of network security devices regularly
before access to the internet.
SGT Inc is an airplane manufacturing company that sells and
makes airplanes in Maryland. In the transport industry, the
airplane sector experience most challenges regarding
cybersecurity threats. The industry is technologically based and
most of the industry information is stored in the information
system. the industry issues can contribute to the threats and
vulnerabilities that the industry is associated with. The nature
of the networks that the industry uses can be easily hacked
when adequate security is not put in place to protect the
network system.
Threats and vulnerabilities impact businesses in different ways.
The impact of the vulnerabilities can be classified as severe,
devastating, noticeable, and low. The nature of the threat also
determines an organizational response to such threats. Threats
that are more likely to cause more harm to the organizations are
supposed to be given high priorities. The impact of the threats
and vulnerabilities can be estimated in monetary value. The
more the vulnerability is severe, the more the amount it will
cost to mitigate the risks. The following are some of the
vulnerabilities that were identified to be devastating and risky
during the vulnerability assessment process: malware, hidden
backdoor programs, unknown programming interfaces, and
unpatched security vulnerabilities. Those which were identified
to have a low impact include phishing attacks, superuser
account privileges, and automated running of scripts without
virus check.
Since there are many types of malware, the company can
consider dealing with those which are highly dangerous to the
information system such as viruses, bots, and Trojan. In

handling these threats, the organization should consider dealing
with the threats which are identified to have major impacts on
the organization before going to those which are projected to
have minor effects. Internal threats are classified first in
consideration of the potential impact of loss from a successful
attack. The following factors should be considered in the
calculation of information security threats: revenue loss
resulting from downtime, infrastructure damage, and the cost
required to implement the compensation controls, staff time
required for post-incident analysis, legal costs, and post-attack
notification cost.
References
Mylrea, M., Gourisetti, S. N. G., Larimer, C., & Noonan, C.
(2018, May). Insider threat cybersecurity framework webtool &
methodology: Defending against complex cyber-physical
threats. In 2018 IEEE Security and Privacy Workshops (SPW)
(pp. 207-216). IEEE.
Ten, C. W., Liu, C. C., & Manimaran, G. (2008). Vulnerability
assessment of cybersecurity for SCADA systems. IEEE
Transactions on Power Systems, 23(4), 1836-1846.
Tucci, A. E. (2017). Cyber risks in the marine transportation
system. In Cyber-Physical Security (pp. 113-131). Springer,
Cham.
Wilbanks, L. (2018). Whats Your IT Risk Approach?. IT
Professional, 20(4), 13-17.
Vulnerable Assets Template
In this step, list all the vulnerable assets for the enterprise.
Note that assets should simply be identified at this stage. Items

do not need to be prioritized or assigned values. Pay particular
attention to application software in both the acquisition and
implementation phases.
This initial list should be as comprehensive as possible, even if
you don’t keep every item in your final working list of
resources to be protected.
Vulnerable Assets

Internal and External Threats Template
In this step, you will build on your vulnerable asset list from
the first step to identify threats and vulnerabilities -- internal
and external to the enterprise, for each asset.
Vulnerable Assets
Threats and Vulnerabilities

Note: You can add more rows to the bottom of the table if
needed.
VUL ID #
Asset
Vulnerability Description
Threat Description
From P1
From P1

From Project 1
From Project 1
Likelihood
Impact
From P1
From P1
Recommended Remediation
Risk Response Strategy/Factor
Risk Level
Priority
From Project 1
(Remediate, Accept and Mitigate, or Transfer)/(Cost,
Capabilities, or Resources)
From P1
From P1
VUL ID #
Asset
Threat Description
Likelihood
Impact

Risk Response Strategy
Risk Level
Priority
VUL ID #
Asset
Threat Description
Likelihood
Impact
Risk Level
Priority

VUL ID #
Asset
Threat Description
Likelihood
Impact
Risk Level
Priority

Prioritized Risks and Response Matrix
Notes on the Risk Response Strategy Cell:
The possible options are:
1. Remediate,
2. Accept and Mitigate, or
3. Transfer
Remember, remediate is to fix the issue. Mitigate is part of
accepting the risk and includes implementing compensating
controls because you are not going to fix the issue. Transfer
means to transfer the risk to an outside agency such as an
insurance company.
You only need to list the risk response along with the factor for
any responses other than remediate. This should state the factor
that was most in play for why you were not able to remediate.
For example, cost would be the factor if the cost to remediate
outweighed the potential damage. Resources could be the factor
if you did not have enough employees to implement the
remediation. Capability could be a factor if the risk was with
vendor software and they had not yet developed a patch.
Your entries in this cell should look like this.
Remediate
Accept/Cost
Transfer/resource
These are just some of the examples and you’ll need to
determine your actual entries for yourself.
Vulnerable Asset List - Submit the completed list of vulnerable
assets
Internal and External Threats List - submit the itemized list of
threats
External Inputs of Threats and Vulnerabilities - Submit your list
of external inputs of threats and vulnerabilities
Business Impacts and Probabilities Matrix - Submit your

Business Impacts and Probabilities Matrix
Prioritized Risks and Response Matrix – Submit Prioritized
Risks and Response Matrix
Risk Assessment Summary Report – see Template
Start Here
Organizations must stay up-to-date on their vulnerabilities and
protection measures. Once vulnerabilities have been evaluated,
the organization uses this information to develop a risk
assessment plan. This plan should consider the perspectives of
owners, shareholders, employees, policy makers, suppliers, and
customers.
In this project, "Risk Assessment," use the previous findings
from Project 1, "Vulnerabilities Assessment Report," to
recommend an action plan for the risk assessment assigned i n
this project. The final assignment is a five- to seven-page
review or summary of the risk assessment. Note that this is not
a complete risk management report, but a "what if" report
outlining potentials in both attacks and possible responses.
For this particular project, grades are based on the ability to
clearly and accurately assess policies, processes, and
technologies to identify and assess risk and articulate effective
mitigation strategies to achieve the appropriate security needed
for the enterprise.
This is the second of four sequential projects. There are 12
steps in this project. Begin below to review the project
scenario.Risk Assessment Transcript
You receive an email from your boss, Maria Sosa.
The email reads: Hello, great job with the vulnerability
assessment last month. This will help fulfill our DoD contract
requirements.
For our next project, you will use the information from that
vulnerability assessment to begin a risk assessment. This will
help us understand the cybersecurity risk to our mission,
function, image, and reputation. This formal assessment will be
completed in the spring, but I’d like you to start thinking about

the process now and prepare an executive summary of your plan
by the first of the month.
You should use the information in the vulnerability assessment,
including internal and external threats, vulnerability
information, likelihoods and impacts, to outline the elements for
inclusion in your risk assessment. This is the starting point to
establish our long-term risk management strategy.
The final report should focus on two elements. The first element
is defining the policies, processes, and technologies used to
assess and manage risks across all levels of the organization
within budget and other logistical constraints. The second
element is identifying software acquisition and installation risk,
network access risk, and risks associated with social media.
Please submit the initial report for review. Once we have agreed
on the final document, we will communicate the findings to all
appropriate stakeholders.
FYI - I will be traveling the rest of this week, but feel free to
email me with any questions.
Very Respectfully, MariaStep 1: Review the Risk Management
Framework
As the first step in preparing the risk assessment, review
the risk management implementation framework and the risk
management technologies that you might use in your
assessment.
In the subsequent sections of this project, you will write a risk
assessment summary report that can be used in addressing
cybersecurity threats through risk management.
When this first step is complete, move to the next step, where
you will create a list of vulnerable assets.Step 2: Document
Vulnerable Assets
In the opening step, you considered the risk management
implementation framework and the risk management
technologies you might use. Now, it's time to list the
organization's vulnerable assets.
In order to conduct effective information risk management, the
vulnerabilities of the system must be understood and

documented prior to starting the assessment, regardless of
which of the risk risk assessment approaches is used.
Begin by conducting a thorough review of the recently
completed Vulnerability Assessment report. During the review,
pay particular attention to which security risks to information
systems that might be relevant and consider varying types of
risk assessment and analysis.
Using the Vulnerable Assets Template, identify and create a list
of assets considered vulnerable. This is a simple list, not
prioritized, not valued, simply identified, but complete. Pay
particular attention to application software in both the
acquisition and implementation phases. This list of vulnerable
assets will also be used during the next step.
Submit the completed list of vulnerable assets for feedback. In
the next step, you will take the vulnerable assets and use them
to identify specific internal and external threats.Step 3: Review
the Vulnerable Assets List
In the previous step, a list of vulnerable assets was compiled
from the Vulnerability Report in the previous project. Now,
incorporate any feedback from the previous step and identify
specific cybersecurity threats, including network access risk by
devices to those assets.
Again, the Vulnerability Assessment final report is the starting
point to fulfill this step in the Risk Assessment. Compiling a
complete list of threats and vulnerabilities will act as a
comprehensive review of your vulnerability assessment as well
as potentially expand the list, now that you have greater input
and a second look at your previous results.Step 4: Document
Internal and External Threats
You've reviewed the list of vulnerable assets, and in this step,
you will document threats. Recall that a threat is any event,
action, or factor that has the potential to cause damage to the
enterprise. Threats can come from a variety of sources,
including people (a hacker stealing employee passwords) and
natural events (a power blackout causing data loss).
Use the Internal and External Threats Template to add all

threats and vulnerabilities -- internal and external to the
enterprise, and tie them to the itemized assets that will be
impacted. Note that external threats will include a
comprehensive review by device type at network access, both
direct and indirect, a view of the social media landscape as a
threat.
Submit the itemized list of threats for feedback. In the next
step, you will conduct research and report on inputs for threats
and vulnerabilities.Step 5: Research Relevant Environmental
Factors
This step continues to build on the internal and external threats
as itemized in the previous step by researching relevant external
inputs.
Since cybersecurity is a complex and multifaceted endeavor, an
effective analysis of threats includes consideration of the threat
landscape inherent within the context in which the enterprise
operates.
Researching how the external context and environment
contribute to threats and vulnerabilities is critical because no
company or industry is an island, particularly as it pertains to
cybersecurity. The very nature of cybersecurity is
hyperconnectivity -- across companies within the same industry
and across industries with similar information demands.
Be sure to seek external input into the particular situation,
specific threats and vulnerabilities, best practices, regulatory
factors, government policy issues, previous industry issues, etc.
Conduct thorough research in the industry and related industries
about previous actions and activities that could affect your
company.
When the research is complete, you will use it in the next step
to create a list of external threats and vulnerabilities.Step 6:
Describe External/Environmental Inputs to Threats and
Vulnerabilities
Using your research from the previous step, create a list of
external industry sources and best practices that might apply.
Include one or two sentences for each input, commenting on

why you think it would add value to your Risk Assessment.
Submit your list of external inputs of threats and vulnerabilities
for feedback. Next, you will identify potential and actual
business impacts.Step 7: Identify Business Impacts and
Probabilities
Remember, cyber risk management and compliance is not just
about the technology. It is also about the impact people,
policies and processes can have on the financial results of the
company. After the previous step when you created a list of
threats and vulnerabilities, now it's important to consider the
effects on business as part of risk assessment.
Each enterprise must identify and address its own unique thr eat
issues because the most obvious threats are not always the most
dangerous ones. Many common threats, such as fire, are already
mitigated to a high degree through local building codes and
modern infrastructure redundancies. These might not require
any further action. However, obscure threats, such as disruptive
actions taken by a malicious insider, may be completely
unmitigated.
Any risk assessment should include a view of the business
impact should an identified threat become a reality. Also
consider the likelihood of occurrence for each threat so the list
can be prioritized and appropriately managed.
For this step, use the external inputs of threats and
vulnerabilities compiled in the previous step to consider the
business (monetary) impact of any realized threats and the
prioritization of these threats by potential impact to the
enterprise. In the next step, you will create a list of the business
impacts.Step 8: List Business Impacts and Probabilities
You identified the potential financial impacts should identified
threats become realities in the last step. Here, use your findings
to complete the Business Impacts and Probabilities Matrix,
listing each identified threat and the risk, the probability, and a
potential mitigation to include all policies, processes, and
technologies to be used in formulation of financially and
logistically sound mitigation strategy.

After you've completed this step, you will document and
prioritize risk responses. Submit your Business Impacts and
Probabilities Matrix for feedback.Step 9: Consider Risk
Response Strategies
Now that you have developed a comprehensive list of potential
risks with probabilities and potential business impact, it is time
to consider possible risk response strategies for these risks. In
the next step, you will document and prioritize risk
responses.Step 10: Document and Prioritize Risk Responses
In this step, you will prioritize your selected risk responses
from the last step based on several factors:
· The economic impact to the organization should the assessed
risk occur.
· The likelihood (probability) of an event that would activate
the risk.
· The arrangement of assets ranked by priority based on the
highest value of the following formula: (economic impact) X
(probability) = risk
Risk Formula
Use the Prioritized Risks and Response Matrix to submit your
findings for feedback. After this process, you will be ready for
the final step, the risk assessment summary report.Step 11:
Compile Your Work Up to This Point
You've prioritized your list of risk responses. It's time to take a
look at everything compiled so far for the Risk Assessment
Summary Report. Keep in mind that a full risk management
report is an intensive team endeavor that takes considerable
time and resources to create. Remember that Maria has not
tasked you with generating a full risk management report;
rather, she has asked you to write a brief "what if" report
outlining potentials in both attacks and possible responses.
In this step, take some time to review, make any updates, and
compile your risk findings up to this point in preparation for
creating the final report in the next step.Step 12: Write the Risk
Assessment Summary Report

Throughout this project, the necessary information has been
assembled to provide your boss Maria with a risk assessment so
that she may begin developing a long-term risk management
strategy. This final step is compiling that information into a
cogent "summary report" for presentation to company
executives. This report will summarize the Vulnerability
Assessment with the addition of the Risk Assessment just
completed.
It is critical to provide recommendations to help the
organization implement effective information risk management
practices. Use findings in the previous steps to recommend risk
management strategies such as least privilege, separation of
duties, mandatory vacation, risk management technologies, and
others you have found appropriate.
Remember, the recommendations included in the report should
address all aspects of the research -- business, economic, and
technical reasoning for the conclusions.
Use the Final Risk Assessment Summary Report Template to
submit the final risk assessment summary.
Project 2: Risk Assessment Summary Report Template
Your CIO, Maria Sosa, has asked you to write a "what if" report
outlining risks and responses.
Final Risk Assessment Summary Report (five- to seven-page
report using this template: Step 13) This report should include
the following components:
· Title Page
· Include:
· for whom you are preparing the document, the title, the date
prepared, and your name as the preparer of the document
· Executive Summary
· Include:
· the purpose of the report, intended audience, and an
explanation of the importance of risk assessment
· relevant external/environmental factors (from Step 6)
· Prioritized Risks and Response Matrix (table from Step 8: Use

Template from Discussion Area)
· Include introductory text prior to the matrix
· Recommended Risk Management Strategies and Technologies
(one- to two-page narrative, from Step 10) This is a discussion
of strategies and/or technologies that could be used
· Include:
· An in-depth discussion of your Prioritized Risks and Response
Matrix discussing each of the possible Risk Response Strategies
for each vulnerability
· the consideration of relevant compliance issues
· Risk Management Implementation Recommendations (two- to
three-page narrative) This is a discussion of your actual
recommendations and why they were chosen and is based upon
your research in the previous section.
Prioritized Risks and Response Matrix
In this step, you will add a final column to your existing
threat/asset table that demonstrates a potential response to a
breach. In addition, add a column showing prioritization of
these responses.
Asset
Threat
Risk
Probability
Mitigation strategies
Potential Response
Prioritization of Responses

Note: You can add more rows to the bottom of the table i f
needed.
Business Impacts and Probabilities Matrix
Paste your findings on vulnerable assets and threats into this
table, and add the risk, the probability, and potential mitigation
strategies.
Your mitigation strategies should include all policies,
processes, and technologies that can be used.
Asset
Threat
Risk
Probability
Mitigation Strategies

Note: You can add more rows to the bottom of the table if
needed.

Running Head VULNERABILITY ASSESSMENT SUMMARY REPORT 1VULNER

Recommended

Recommended

More Related Content

Similar to Running Head VULNERABILITY ASSESSMENT SUMMARY REPORT 1VULNER

Similar to Running Head VULNERABILITY ASSESSMENT SUMMARY REPORT 1VULNER (20)

More from MalikPinckney86

More from MalikPinckney86 (20)

Recently uploaded

Recently uploaded (20)

Running Head VULNERABILITY ASSESSMENT SUMMARY REPORT 1VULNER