Technical Paper: Risk Assessment Global Finance, Inc. Network Diagram Above is the Global Finance, Inc. (GFI) network diagram. GFI has grown rapidly this past year and acquired many network devices as displayed in the diagram. The company invested in the network and designed it to be fault tolerant and resilient from any network failures. However, although the company’s financial status has matured and its network has expanded at a rapid pace, its network security has not kept up with the company growth. GFI’s network is fairly stabilized as it has not experienced many outages due to network failures. GFI has hired three (3) network engineers to keep up with the network growth and the bandwidth demand by the company employees and the clients. However, the company has not hired any security personnel who can take care of the operational security responsibility. The trusted computing base (TCB) internal network in the Global Finance, Inc. Network Diagram hosts the company’s mission critical systems without which the company’s operations and financial situation would suffer. The Oracle database and email systems are among the most intensively used application servers in the company. GFI cannot afford system outages because its cash flow and financial systems heavily depend on the network stability. GFI has experienced DOS network attacks twice this year and its Oracle database and email servers had been down for a week. The recovery process required GFI to use $25,000 to restore its operations back to normal. GFI estimated the loss from these network attacks at more than $100,000 including lost customer confidence. Write a twelve to fifteen (12-15) page formal risk assessment proposal and redraw the above diagram of a secure and risk-mitigating model in which you: 1. Describe the company network, interconnection, and communication environment. 2. Assess risk based on the Global Finance, Inc. Network Diagram scenario. Note: Your risk assessment should cover all the necessary details for your client, GFI Inc., to understand the risk factors of the organization and risk posture of the current environment. The company management will decide what to mitigate based on your risk assessment. Your risk assessment must be comprehensive for the organization to make data-driven decisions. a. Describe and defend your assumptions as there is no further information from this company. The company does not wish to release any security-related information per company policy. b. Assess security vulnerabilities, including the possibility of faulty network design, and recommend mitigation procedures for each vulnerability. c. Justify your cryptography recommendations based on data-driven decision making and objective opinions. 3. Examine whether your risk assessment methodology is quantitative, qualitative, hybrid, or a combination of these. 4. Use at least three (3) quality resources in this assignment. Note: Wikipedia and similar Websites do not qualify a ...

1. Technical Paper: Risk Assessment
Global Finance, Inc. Network Diagram
Above is the Global Finance, Inc. (GFI) network diagram. GFI
has grown rapidly this past year and acquired many network
devices as displayed in the diagram. The company invested in
the network and designed it to be fault tolerant and resilient
from any network failures. However, although the company’s
financial status has matured and its network has expanded at a
rapid pace, its network security has not kept up with the
company growth.
GFI’s network is fairly stabilized as it has not experienced
many outages due to network failures. GFI has hired three (3)
network engineers to keep up with the network growth and the
bandwidth demand by the company employees and the clients.
However, the company has not hired any security personnel who
can take care of the operational security responsibility.
The trusted computing base (TCB) internal network in the
Global Finance, Inc. Network Diagram hosts the company’s
mission critical systems without which the company’s
operations and financial situation would suffer. The Oracle
database and email systems are among the most intensively used
application servers in the company. GFI cannot afford system
outages because its cash flow and financial systems heavily
depend on the network stability. GFI has experienced DOS
network attacks twice this year and its Oracle database and
email servers had been down for a week. The recovery process
required GFI to use $25,000 to restore its operations back to
normal. GFI estimated the loss from these network attacks at
more than $100,000 including lost customer confidence.

2. Write a twelve to fifteen (12-15) page formal risk assessment
proposal and redraw the above diagram of a secure and risk-
mitigating model in which you:
1. Describe the company network, interconnection, and
communication environment.
2. Assess risk based on the Global Finance, Inc. Network
Diagram scenario. Note: Your risk assessment should cover all
the necessary details for your client, GFI Inc., to understand the
risk factors of the organization and risk posture of the current
environment. The company management will decide what to
mitigate based on your risk assessment. Your risk assessment
must be comprehensive for the organization to make data-driven
decisions.
a. Describe and defend your assumptions as there is no further
information from this company. The company does not wish to
release any security-related information per company policy.
b. Assess security vulnerabilities, including the possibility of
faulty network design, and recommend mitigation procedures
for each vulnerability.
c. Justify your cryptography recommendations based on data-
driven decision making and objective opinions.
3. Examine whether your risk assessment methodology is
quantitative, qualitative, hybrid, or a combination of these.
4. Use at least three (3) quality resources in this assignment.
Note: Wikipedia and similar Websites do not qualify as quality
resources.
5. Create the redrawn diagram of a secure and risk-mitigating
model using Microsoft Visio or its open source equivalent.
Note: The graphically depicted solution is not included in the
required page length.
Your assignment must follow these formatting requirements:
· Be typed, double spaced, using Times New Roman font (size
12), with one-inch margins on all sides; citations and references
must follow APA or school-specific format. Check with your

3. professor for any additional instructions.
· Include a cover page containing the title of the assignment, the
student’s name, the professor’s name, the course title, and the
date. The cover page and the reference page are not included in
the required assignment page length.
· Include charts or diagrams created in Excel, Visio, MS
Project, or one of their equivalents such as Open Project, Dia,
and OpenOffice. The completed diagrams/charts must be
imported into the Word document before the paper is submitted.
The specific course learning outcomes associated with this
assignment are:
· Evaluate an organization’s security policies and risk
management procedures, and its ability to provide security
countermeasures.
· Describe the details and the importance of application security
models and their implementation from a management
perspective.
· Analyze the methods of managing, controlling, and mitigating
security risks and vulnerabilities.
· Evaluate and explain from a management perspective the
industry-standard equipment, tools, and technologies
organizations can employ to mitigate risks and thwart both
internal and external attacks.
· Explain access control methods and attacks.
· Use technology and information resources to research issues in
security management.
· Write clearly and concisely about the theories of security
management using proper writing mechanics and technical style
conventions.
Grading for this assignment will be based on answer quality,
logic / organization of the paper, and language and writing
skills, using the following rubric.
Points: 150
Technical Paper: Risk Assessment

4. Criteria
Unacceptable
Below 70% F
Fair
70-79% C
Proficient
80-89% B
Exemplary
90-100% A
1. Describe the company network, interconnection, and
communication environment.
Weight: 25%
Did not submit or incompletely described the company network,
interconnection, and communication environment.
Partially described the company network, interconnection, and
communication environment.
Satisfactorily described the company network, interconnection,
and communication environment.
Thoroughly described the company network, interconnection,
and communication environment.
2a. Describe and defend your assumptions as there is no further
information from this company.
Weight: 5%
Did not submit or incompletely described and defended your
assumptions as there is no further information from this
company.
Partially described and defended your assumptions as there is
no further information from this company.
Satisfactorily described and defended your assumptions as there
is no further information from this company.
Thoroughly described and defended your assumptions as there is
no further information from this company.
2b. Assess security vulnerabilities, including the possibility of
faulty network design, and recommend mitigation procedures
for each vulnerability.
Weight: 5%

5. Did not submit or incompletely assessed security
vulnerabilities, including the possibility of faulty network
design; did not submit or incompletely recommended mitigation
procedures for each vulnerability.
Partially assessed security vulnerabilities, including the
possibility of faulty network design; partially recommended
mitigation procedures for each vulnerability.
Satisfactorily assessed security vulnerabilities, including the
possibility of faulty network design; satisfactorily
recommended mitigation procedures for each vulnerability.
Thoroughly assessed security vulnerabilities, including the
possibility of faulty network design; thoroughly recommended
mitigation procedures for each vulnerability.
2c. Justify your cryptography recommendations based on data-
driven decision making and objective opinions.
Weight: 5%
Did not submit or incompletely justified your cryptography
recommendations based on data-driven decision making and
objective opinions.
Partially justified your cryptography recommendations based on
data-driven decision making and objective opinions.
Satisfactorily justified your cryptography recommendations
based on data-driven decision making and objective opinions.
Thoroughly justified your cryptography recommendations based
on data-driven decision making and objective opinions.
3. Examine whether your risk assessment methodology is
quantitative, qualitative, hybrid, or a combination of these.
Weight: 20%
Did not submit or incompletely examined whether your risk
assessment methodology is quantitative, qualitative, hybrid, or a
combination of these.
Partially examined whether your risk assessment methodology
is quantitative, qualitative, hybrid, or a combination of these.
Satisfactorily examined whether your risk assessment
methodology is quantitative, qualitative, hybrid, or a
combination of these.

6. Thoroughly examined whether your risk assessment
methodology is quantitative, qualitative, hybrid, or a
combination of these.
4. 3 references
Weight: 5%
No references provided
Does not meet the required number of references; some or all
references poor quality choices.
Meets number of required references; all references high quality
choices.
Exceeds number of required references; all references high
quality choices.
5. Clarity, writing mechanics, and formatting requirements
Weight: 10%
More than 6 errors present
5-6 errors present
3-4 errors present
0-2 errors present
6. Create the redrawn diagram of a secure and risk-mitigating
model using Microsoft Visio or its open source equivalent.
Weight: 25%
Did not submit or incompletely created the redrawn diagram of
a secure and risk-mitigating model using Microsoft Visio or its
open source equivalent.
Partially created the redrawn diagram of a secure and risk-
mitigating model using Microsoft Visio or its open source
equivalent.
Satisfactorily created the redrawn diagram of a secure and risk-
mitigating model using Microsoft Visio or its open source
equivalent.
Thoroughly created the redrawn diagram of a secure and risk-
mitigating model using Microsoft Visio or its open source
equivalent.
CIS 502 – Assignments and Rubrics

7. Remote
Dial UpUsers
Trusted Computing Base Internal Network
Off-Site Office
Internet
Global Finance, Inc.
VPN
Gateway
VPN
Gateway
PBX
PSTN
Worstations
(x25)
Worstations
(x12)
Worstations
(x63)
Worstations
(x5)
Worstations
(x10)
Worstations
(x49)
Border (Core) Routers
Accounting
Loan Dept
Customer
Services
Mgmt
Credit Dept
Finance
Internal
DNS

8. Exchange
2000 Email
Distribution Routers
DMZ
File and Print Server
Oracle 9i DB
Server
Intranet Web
Server
Printers
(x7)
Printers
(x5)
Printers
(x3)
Printers
(x3)
Printers
(x3)
Printers
(x5)
Workstations
(x7)
SUS Server
Access
Layer
VLAN
Switch
10 Gbps
100Mbps
10Gbps
10Gbps
10 Gbps
OC193
10Gbps
RAS

9. 10 Gbps
10 Gbps
10 Gbps
OC193
10Gbps
PBX
Laptop
Server
Computer
Workstation