Intro to Information AssuranceModule 3Chaston Carter0417.docx

Intro to Information Assurance
Module 3
Chaston Carter
04/17/17
Target Corporation
Target has had many ethical challenges over the
years but one of the biggest ones they have encountered was
the a credit and debit card data breach thought to have exceed
ed $700 million which was the biggest retail hacking in U.S.
history to date. While this is serious, what is even more serious
is that Target had clear warning signs that hacking was
occurring, but due to the lack of action the hacking continued
within the organization. It was estimated that close to 70
million people had their personal data stolen. That information
consisted of names, mailing addresses, phone numbers and
email addresses. Not only was it personal information shared ,
but a-lot of people encountered unauthorized, charges on their
credit card or debit card. The organization was shocked at the
amount of people that were affected by this recent attack.
I had only 10 days to implement changes to its
security policies, to prevent this from happening again. The
ultimate goal was to come up with quick solutions to solve this
problem. My first goal was to develop a written information
security program, which would ultimately document potential
security risk. Since the confidentiality of the customers
information is a important key factor. The goal of the whole
credit breach is to prevent customers information from getting
stolen . We can start by eliminating the problem, by offering
security training to current workers, this would not only
educate them but they would learn the importance of

safeguarding personal information , and it will allow them to
learn when to be alert to potential threats. To insure integrity in
the organization a system must be put in place to detect any
changes in data that might cause the server to crash when
making a purchase, or interfere when a customers makes a
purchase at a target store.
To Ensure Availability in Target Corporation ,
we would maintain all certain possible customers information,
to prevent any data from being lost, data could be store in a
isolated protected location. One of the main issues with the
credit cards hacked in the breach was that when the cards were
swiped the magnetic strip on the back contained unchanging
data. Whoever accessed the data got ahold of information
necessary to make purchases. Which eventually made traditional
cards prime targets for counterfeiters. The problem with Target
corporation is that they had no real structure on how to be
alerted when there was suspicious activity in a customers
account. The main objective for this information assurance plan
is to develop an alerting system that will alert a middle man
when there is suspicious, or unusual activity in a customers
account.
Even Though , target already had current policies in
place, six months prior to hackers
getting into their security system . They had began a
$1.6 million malware detection tool
they purchased from a computer security firm called
FireEye. Even with this billion dollar
infrastructure, which was much more extensive than other
retailers. It still couldn't do much
for the company because, target failed to act upon their
finding in the new security system.
Hackers were eventually able to infiltrate Target’s
network by using an HVAC. When
they gained access, they installed a pair of malware

programs. They then sent malware
designed to steal credit card numbers to cashier stations
in every domestic Target store.
November 30, 2013, FireEye was alerted to the presence
of the malware. Target’s security
teams in Bangalore were immediately notified of the
potential breach. FireEye had the ability
to automatically disable the malware, but Target had turned
this feature off. By target turning
the feature off, they no longer had any way of being alerted
so FireEye also alerted Target on
December 2 after hackers released a new version of
malware. (Adkins, 2014)
Based on the evaluation, the best approach to
targets security system . Is to come up with a security system
that alerts the user immediately giving the middle man the
opportunity to find a quick solution to the breach and putting a
stop to it right away. There are several key leaders since
confidentiality is a important factor , it is essential to have
designated a security officer who would be responsible for
coordinating and executing the program that would protect
customers information . This security officer would also report
to someone outside of the organization to make sure everything
is secure and in line. The officer would also offer classes to
current employees , by teaching them how to detect a potential
threats to the organization.
Thats why it is important develop a risk
assessment team who would manage the security program. This
team would be one the most important key factors to the
organization because they would identify the risk and would
ultimately decide on the appropriate, most cost effective ways

to manage them. The main objective would be to minimize
potential threats , but not eliminate them . To insure integrity in
the organization and to prevent data integrity failure an alerting
system would be put into place. This system will be designed to
detect potential threats, and give the risk assessment team
options on how to get rid of the threats.
Target already has had a bad reputation with
immediate response to the breaches. They also claimed that it
had suffered a data breach despite its best efforts, but it was
later revealed that it had been alerted more than once about
breaches. It was said Target also waited six days after it was
informed to tell consumers about the hacking attack, and about
a month before it revealed the extent of it. More than 90
lawsuits have been filed against Target by both customers and
banks, and Target's profit during the holiday shopping period
dropped 46 percent from the previous year.
Since a lot of customers were left out of the loop,
target came up with the solution of
sending customers emails with general security tips and
were offered with one year of free
credit monitoring and identity theft protection.
Additionally, The CEO assured customers
that they would not be held liable for any fraudulent
charges made to their credit cards as a
result of the hack. Customers were offered 10 percent off
in-store purchases following the
data breach.
The best solution thus far was Target announcing that it
would begin to release credit and debit cards with chips instead
of magnetic strips on the back of the cards by 2015. They had
invested over $100 million in registers and technology that will
be able to read the new chip cards.
As result in the huge percentage of customers lost CEO Gregg
Steinhafel stepped down.

References:
Kossman, S. (2016, xxsssdddFebruary 02). 8 FAQs about EMV
credit cards. Retrieved April 21, 2017, from
http://www.creditcards.com/credit-card-news/emv-faq-chip-
cards-answers-1264.php
Initiative, Daniels Fund Ethics, University Of New Mexico, and
Http://danielsethics.mgt.unm.edu. Target: Putting Customers
First? (n.d.): n. pag. Web.
Chaston Carter
05/30/17
Statement of Policy
Purpose: This policy outlines the incident response protocols,

disaster response protocols, access control protocols, and
maintenance plan, which will serve as controls and guidelines to
address instances of unauthorized access to CFZ information
and also as response to disastrous events or conditions that
might adversely impact operations at CFZ.
Incident Response Protocol
Incidence Response Protocols have become integral part of
information technology and they are used for detecting and
handling incidents, minimizing loss and destruction, mitigating
weaknesses and restoring IT services (Cichonski et.al, 2012).
The incident response process has several phases which includes
preparation, detection & analysis, containment, eradication and
recovery and post incident activities (Cichonski et.al, 2012).
The preparation phase attempts to limit or prevent the number
of security incidence that might occur by selecting controls such
as regular risk assessments, host security, network security,
malware prevention, and implementing user awareness training
etc. that will effectively reduce the number of incidence
occurring (Cichonski et.al, 2012).
Detection and analysis phase uses precursors and indicators to
monitor and analyze attack vectors such as external media,
attrition, web, email, impersonation, improper usage or
unauthorized accesses etc. that can be used to propagate attacks
against an organization. Some of the precursors that have been
put in place at CFZ includes:
Intrusion Detection and Prevention systems to identify and log
suspicious events, alert the necessary response team and take
automated mitigative actions;
Security information and event management (SIEM) products to
generate alerts based on the analysis of log data;
Antivirus and Anti-malware softwares to detect and prevent
attacks from infecting the systems;
File integrity checker to detect changes to important files during
attack incidents, and
Awareness programs for both internal and external users to keep
them abreast of the latest attack incidents and to create a

reporting route after anomalies have been identified (Cichonski
et.al., 2012).
The Containment, Eradication and Recovery phase is used to
manage incident attacks before they overwhelm the system and
result into more fatal damages, using predetermined procedures
such as disabling system functions or shutting down the systems
and disconnecting them from the network to mitigate the effects
of any attack (Cichonski et.al, 2012).
Finally the post incident activity phase is used by the
organization or response team to reflect on the new threats and
use lessons learned to improve on incident response plan
(Cichonski et.al, 2012).Within CFZ, the incident response plan
created will be used in responding to a variety of potential
threats such as:
Unauthorized access or unauthorized privilege escalation and
data breaches,
Denial or Distributed Denial of Service Attacks,
Firewall Breaches,
Viruses and malware outbursts,
Theft or physical loss of equipment, and
Insider Threats (Rouse, 2014).
To mitigate these issues, some of the recommended actions that
have been put in place at CFZ include the following:
Incident Type
Kill Chain Stage
Priority Level
Recommended Action
Unauthorized Access
Exploitation & Installation
High
Detect, monitor and investigate unauthorized access attempts
with priority on those that mission critical or contain sensitive
data.
Unauthorized Privilege Escalation
High

Critical systems are configured to record all privileged
escalation events and set alarms for unauthorized privilege
escalation attempts.
Data Breach
System Compromise
High
During a data breach, all evidence is captured carefully and
evidentiary data is collected. Alarms are set to alert system and
administrators and emergency system shut down and data
recovery steps is initiated.
All critical documents or data are backed up on a different
system.
Denial or Distributed Denial of Service Attacks
High
An IPS is implemented to monitor, detect and automatically
terminate all traffic patterns that steps out of the normal
behavior of the system.
Viruses or Malware
Delivery & Attack
Low
Remediate any malware infections as quickly as possible. The
rest of the network needs to scanned to ensure no further
compromise were associated with the outbreak.
Insider Breach
System Compromise
High
User accounts are routinely monitored using system log events
and security information and event management products that
can generate alerts based on the analysis of log files
Theft of Physical Loss
System Compromise
High
Whole disk encryption is used to protect all laptops and mobile
devices. Lockout screen or remote wiping is lost or stolen
equipment is used to remotely remove all critical data on stolen

or lost equipment.
Firewall Breaches
System Compromise
High
Technology additions and updates are used to evaluate firewall
settings and adjust them as needed in order to minimize the
impact on business.
Firewall rules are regularly reviewed and actively updated to
protect against the latest security threats and dedicated and
ongoing monitoring practices are employed to maximize system
uptime while actively defending network and connected network
devices.
Justification of Incident Response protocol
Since it is really difficult to assume the path that an attacker
will take to infiltrate the network, CFZ decided to create their
incidence response plan through the cyber kill chain sequence
(Malik, 2016). The cyber kill chain sequence is the stages
required for an attacker to successfully infiltrate a network and
exfiltrate data from it. The cyber kill chain involves the
following stages:
Reconnaissance and Probing - This is the stage when the
attacker is probing the network to exploit any vulnerability or
opportunities that may present in the system (Malik, 2016).
Delivery and Attack – Once a vulnerability has been
established, then a delivery mechanism (attack mechanism) is
put in place to deliver the attacks or social engineering is
employed to induce the target (Malik, 2016).
Exploitation and Installation – This is the stage after the
attacker have found the vulnerability to the system. They
proceed to exploit those vulnerability in order to acquire access
to the system and once access has been granted, they proceed to
elevate their user privileges in order to elevate the access or
even install persistence payload (Malik, 2016).
System Compromise - At the stage, high value data is been
exflitrated as quickly as possible (Malik, 2016).

Designing an incidence response plan or protocol around these
different stages will allow CFZ to understand the threats being
faced in their network environment, the steps an attacker can
used to exploits such threats and take steps to adequately
prevent or mitigate the effects of any of such security threats.
Disaster Response Protocol
Disaster response protocols are other critical components
of computer security operations that ensure the continuation of
vital business processes in the event that a disaster occurs
(Martin, 2002). At CFZ, the disaster response and recovery
protocols was not only focused on the physical infrastructure,
back up and restoration systems but was expanded to include
other critical components such as perimeter defenses, IDS
network, threat evaluation and assessment, virus protections,
patches and host configurations and vulnerability surveillance
(Velliquette, 2005). Paying proper attention all these aspects is
very critical to addressing computer security within disaster
recovery planning to ensure the most efficient and successful
recovery operations (Velliquette, 2005). Some of the major
components that was developed into the disaster response
protocols at CFZ includes:
Crisis Management Plan: This was a plan designed to ensure
continuation of vital business processes in case of an emergency
(Martin, 2002). This plan was developed to provide information,
procedures, responsibilities and checklists that will enhance an
organized and effective system of handling situations during a
crisis occurrence (Martin, 2002).
Alternate Recovery Site: To ensure that IT services and
recovery time matches the business recovery time objective,
CFZ implemented a back-up site at an alternate location, where
all data infrastructure is configured to run similar hardware and
software applications to ensure that regular operations can be
restored at the shortest time possible in the case of a disaster
occurrence (Velliquette, 2005).

Regular Data Backup: CFZ also implemented a scheduled
hardware and software backup and periodically validates that
critical systems, applications and data are accurately backed up
in a standard hardware in order to be able to easily replicate a
new hardware in the case of a disaster.
Perimeter Defenses: Perimeter defenses such as firewall and
VPN management are important aspects of CFZ disaster
recovery plan because they assist in monitoring traffic during a
recovery process and also ensuring a safe connection for users
and clients to the alternate network in order to get the operation
back online and reduce downtime (Velliquette, 2005).
Intrusion Prevention and Protection: This is another component
that been built into the recovery plan to ensure that during the
recovery process, proper configuration is established to keep
virus definition files current and to ensure new threat and
vulnerability are detected and prevented to improve the
fortification process in order to reduce system downtime and
return the system back to normal operations (Velliquette, 2005).
Justification of Disaster Response Protocol
The primary goal of CFZ is to get critical infrastructure,
networks and systems back up and running as quickly as
possible in order to minimize the potential long term impact on
the business. Having a crisis management plan is highly
important to coordinate the recovery effort in a systematic way
that enables the disaster response team to make quick and
effective decisions that will limit the impact of such disaster or
crisis. Not having this type of systematic plan might cause
ineffective decisions to be made and in turn cause an increase in
disruption time, which can be very detrimental not only to the
business but also to customers, stakeholders and investors alike
(Velliquette, 2005). The presence of an alternate recovery site,
an emergency response location and backup data are
instrumental to the strategic and tactical implementation of the
recovery procedures, without which the recovery process is
impossible. Also implementing perimeter defenses, intrusion
prevention system and virus protection during the recovery

process will ensure that new threats that could impede the
recovery process do not arise and increase the magnitude of the
already bad situation (Martin, 2005). The survivability of any
organization after a disaster is dependent on the premise of a
successful continence planning, which would determine how
effective an organization would responds to mitigate the
business impacts of such disaster (Martin, 2005).
Access Control Protocols
Security challenges faced at CFZ due to data breaches caused
the management to implement network access control protocols
that will provide endpoint assessment, authentication and
authorization of entities trying to gain access to their network,
while also limiting the privileges of user assigned roles. First,
CFZ decided to implement smart cards for employees, which
digital certificate and underlying password associated with
individual users. The smart cards provided authentication and
authorization used by employees and users to gain secure access
to the organization’s network (Boscolo, 2008). It also formed
the basis of accountability for users in ensuring that their smart
card are used in accordance to the organization’s acceptable use
policy and cannot be shared with any other users (Boscolo,
2008).
CFZ also implemented the Role Based Access Control List,
which grants permissions to users based on assigned roles rather
than granting permission to actual users. Users can only inherit
certain permissions or privileges based on the role they have
been assigned to (Conklin & White, 2015). The least privilege
security approach was also implemented to grant the least
necessary permission and privileges that will enable users to
perform their daily tasks according to their assigned roles
(Conklin & White, 2015).
Finally, the company also implemented separation of duties
with the different departments. This concept ensures that tasks
are broken down into several duties to be performed by
different individuals, in order to limit the probability of an
employee exploiting the organization system for their personal

gains (Conklin & White, 2015).
Justification of Access Control Protocols
CFZ decided to utilize smart cards, because it satisfies two
factor authentication, which was more secure than a one factor
authentication process such as passwords. Even though it cost
more in terms of infrastructure to support it, two factor
authentication provided two step verification process, which
makes data breaches twice as hard for an external intruder,
because not only do they need to have physical control of the
smart card but they will also need to have the pin number
associated to that card before they can be granted access to the
organization’s network (Conklin & White, 2015). The smart
card also created accountability measures, which makes the
owner of the card responsible for it usage on the network. It
also provided non repudiation, which means that a user cannot
deny to certain information as long as their digital signatures
was associated with the retrieval or access of such information.
In order words, it provided easy tracking of user and employee
activity across the network. Finally it improves integrity of
information because users can use embedded digital signatures /
private keys to encrypt files and emails before transmission and
also makes it easy for other members of organization to easily
decrypt such files or information using the corresponding public
keys (Conklin & White, 2015).
CFZ also decided to utilize role based access control list
because of the flexibility it create of granting and revoking user
access based on specified roles within the organization. Users
can be granted permissions to objects in terms of the specific
duties they must perform and not according to a security
classification associated to the individual objects (Rouse,
2012).
Finally implementing separation of duties helps CFZ
manage conflict of interest and fraud, by restricting power held
by any one individual. This provides checks and balances and
also limits the harm that can be caused by one single individual
and reduces the organization’s exposure to damage (Conklin &

White, 2015).
Maintaining Information Assurance Plan
CFZ understands that maintaining this information
assurance plan will involve every member of the organization
and also require a day to day monitoring, so it is stays effective
and relevant in improving their network security. Therefore
management created some critical steps and programs that will
enforce daily maintenance and continuous implementation of
the plan.
Security Awareness Programs: CFZ management decided to
implement monthly security meetings to talk about security
policies, risks and incidents assessments performed for the
organization. The awareness program serves as a monthly
refresher to the daily security risks facing the organization as
well as creating continous awareness for relevant security
incidents that has occurred within their organization or industry
(Kadam, 2002).
Monitor and Review Security Performance: Since the
implementation of an information assurance policy is not a one-
time event, CFZ created controls to monitor and review
performance of the plan, to ensure that it is still serving the
purpose for which it was created (Kadam, 2002).
Quarterly Audits: CFZ IT department also set up quarterly
audits with an external auditor to review the various
performance controls in place, gather performance results,
document all non-conformities that will require corrective
actions and identify new threats (Kadam, 2002).
Management Review: This review meetings will be conducted to
revisit issues, analyze audit reports and take decisive actions,
whether to keep the information assurance plan as is or to
recommend improvements in order to accommodate the newly
identified threats (Kadam, 2002).
Justification of Maintenance Plan
The importance of these maintenance steps is that they help to
periodically access risks, identify new risks, and measure

effectiveness of the program. Periodic audits are important
because they serve as compliance controls that help the
organization to monitor compliance to the plan. They also help
access new risks, which gives the management the most updated
information concerning risk facing their organization, and helps
determine proper corrective actions to taken in order to ensure
the most adequate security controls are implemented.
Awareness training programs are also critical to keep users and
employees abreast of the latest security information that will
ensure conformance or unanimous compliance to the most
updated security controls (Garbars, 2002). When users are
unaware of the latest threats, then they cannot protect
themselves nor the organization from such threats and damages
that will ensue afterwards.
Monitoring the effectiveness of the information assurance
plan is also critical to the safety and security of the
organization. After plan has been created and implemented, it is
important to monitor and review the security performance of the
plan in order to analyze its effectiveness in improving the
security posture of the organization (Garbars, 2002).
References
Boscolo, C. (2008). How to Implement Network Access Control.
Retrieved from
http://www.computerweekly.com/opinion/How-to-
implement-network-access-control
Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012).
Computer Security Incident Handling Guide. NIST
Special Publication Vol 800, pp. 61
Conklin, W. & White, G. (2015). All-in-one CompTIA
Security+ Exam Guide. Fourth Ed.
(Exam SYO-401). San Francisco: McGraw Hill.
Garbars, K. (2002). Implementing an Effective IT Security
Program. Retrieved from
https://www.sans.org/reading-
room/whitepapers/bestprac/implementing-effective-security-

program-80
Kadam, A. (2002). Implementation Methodology for
Information Security Management System.
Retrieved from
https://www.giac.org/paper/gsec/2693/implementation-
methodology-information-security-management-system-to-
comply-bs-7799-requi/104600
Martin, B. C. (2002). Disaster Recovery Plan Strategies and
Processes. Retrieved from
https://www.sans.org/reading-
room/whitepapers/recovery/disaster-recovery-plan-strategies-
processes-564
Rouse, M. (2012). Role Based Access Control (RBAC).
Retrieved from
http://searchsecurity.techtarget.com/definition/role-based-
access-control-RBAC
Rouse, M. (2014). Incidence Response Plan (IRP). Retrieved
from
http://searchsecurity.techtarget.com/definition/incident-
response-plan-IRP
Velliquette, D. (2005). Computer Security Considerations in
Disaster Recovery Planning. Retrieved from
http://www.sans.org/reading-
room/whitepapers/recovery/computer- security-
considerations-disaster-recvery-planning-1512.
IT 549 Final Project Guidelines and Rubric
Overview
The final project for this course is the creation of a functional
information assurance plan.

The effective management of information and protection of
pertinent data is essential for leveraging the required knowledge
to serve customers and
stakeholders on a continuous basis. Employing information
assurance best practices will ensure a firm is able to eliminate
hierarchical structures, become more
flat, and have greater customer touch points by leveraging the
correct information at the right time. Successful firms will
maintain an established information
assurance plan and posture that are reviewed on a weekly basis.
This assessment will consist of the creation of a functional
information assurance plan. You will review a real-world
business scenario in order to apply
information assurance research and incorporate industry best
practices to your recommendations for specific strategic and
tactical steps. These skills are crucial
for you to become a desired asset to organizations seeking
industry professionals in the information assurance field.
The project is divided into four milestones, which will be
submitted at various points throughout the course to scaffold
learning and ensure quality final
submissions. These milestones will be submitted in Modules
Two, Four, Five, and Seven. The final product will be submitted
in Module Nine.
In this assignment, you will demonstrate your mastery of the
following course outcomes:
integrity, and availability of
information in a given situation for their relation to an
information assurance plan

responses and managing security functions that adhere to best
practices for information
assurance
research and industry best practices to inform network
governance
practices for maintaining an information assurance plan
decisions about security, access controls, and legal issues
information assurance to determine potential impact on an
organization and mitigate associated
risks
Prompt
Your information assurance plan should answer the following
prompt: Review the scenario and create an information
assurance plan for the organization
presented in the scenario.
Specifically, the following critical elements must be addressed
in your plan:
I. Information Assurance Plan Introduction
a) Provide a brief overview of the goals and objectives of your

information assurance plan, including the importance of
ensuring the confidentiality,
integrity, and availability of information. What are the benefits
of creating and maintaining an information assurance plan
around those key
concepts?
b) Assess the confidentiality, integrity, and availability of
information within the organization.
c) Evaluate the current protocols and policies the organization
has in place. What deficiencies exist within the organization’s
current information
assurance policies? What are the potential barriers to
implementation of a new information assurance plan?
II. Information Security Roles and Responsibilities
a) Analyze the role of the key leaders within the organization
specific to how their responsibilities are connected to the
security of the organization’s
information. What is the relationship between these roles?
b) Evaluate key ethical and legal considerations related to
information assurance that must be taken into account by the
key leaders within the
organization. What are the ramifications of key leaders not
properly accounting for ethical and legal considerations?
c) What are the key components of information assurance as
they relate to individual roles and responsibilities within the
information assurance
plan? For example, examine the current policies as they relate
to confidentiality, integrity, and availability of information.

III. Risk Assessment
a) Analyze the environment in which the organization operates,
including the current protocols and policies in place related to
information
assurance.
b) Evaluate the threat environment of the organization.
c) Based on your analysis and evaluation, what are the best
approaches for implementing information assurance principles?
Where do you see the
most areas for improvement to current protocols and policies?
d) Assess the threats and vulnerabilities of the organization by
creating a risk matrix to outline the threats and vulnerabilities
found and determine
possible methods to mitigate the identified dangers.
IV. Statements of Policy
a) Develop appropriate incident response protocols to respond
to the various threats and vulnerabilities identified within the
organization.
b) Justify how the incident response protocols will mitigate the
threats to and vulnerabilities of the organization. Support your
justification with
information assurance research and best practices.
c) Develop appropriate disaster response protocols to respond to
the various threats and vulnerabilities identified within the
organization.
d) Justify how the disaster response protocols will mitigate the
threats to and vulnerabilities of the organization. Support your
justification with

e) Develop appropriate access control protocols that provide an
appropriate amount of protection while allowing users to
continue to operate
without denial of service.
f) Justify your access control protocols. Support your
justification with information assurance research and best
practices.
g) Recommend a method for maintaining the information
assurance plan once it has been established.
h) Justify how your maintenance plan will ensure the ongoing
effectiveness of the information assurance plan. Support your
justification with
V. Conclusion
a) Summarize the need for an information assurance plan for the
selected organization, including the legal and ethical
responsibilities of the
organization to implement and maintain an appropriate
information assurance plan.
b) Defend the key elements of your information assurance plan,
including which members of the organization would be
responsible for each
element.

Milestones
Milestone One: Information Assurance Plan Introduction
In Module Two, you will submit your introduction to the
information assurance plan. This section of the plan will
provide the overview of the current state of
the organization. Provide a brief overview of the goals and
objectives of your information assurance plan, including the
importance of ensuring the
confidentiality, integrity, and availability of information. What
are the benefits of creating and maintaining an information
assurance plan around those key
concepts? Are there current protocols and policies the
organization has in place? Additionally, what deficiencies exist
within the organization’s current
information assurance policies? What are the potential barriers
to implementation of a new information assurance plan? This
milestone is graded with the
Milestone One Rubric.
Milestone Two: Information Security Roles and Responsibilities
In Module Four, you will submit your roles and responsibilities
portion of the final project. Who are the key leaders of the
organization specific to how their
responsibilities are connected to the security of the
organization’s information? You must also identify key ethical
considerations. What are the ramifications of
key leaders not properly accounting for ethical and legal
considerations? What are the key components of information
assurance as they relate to individual roles
and responsibilities within the information assurance plan? For
example, examine the current policies as they relate to
confidentiality, integrity, and availability of
information. This milestone is graded with the Milestone Two
Rubric.
Milestone Three: Risk Assessment

In Module Five, you will submit the risk assessment portion of
the information assurance plan. You will provide the
organization with an assessment of the
threat environment and the risks within, as well as methods
designed to mitigate these risks. Based on your analysis and
evaluation, what are the best
approaches for implementing information assurance principles?
Where do you see the most areas for improvement to current
protocols and policies? This
milestone is graded with the Milestone Three Rubric.
Milestone Four: Statements of Policy
In Module Seven, you will submit your plan pertaining to
statements of policy. You will recommend protocols and
mitigating factors to the organization. Justify
how the disaster response protocols will mitigate the threats to
and vulnerabilities of the organization. You will focus on
disaster and incident response protocols
as well as access control. Assess, your proposed method for
maintaining the success of the plan going forward. Justify how
your method will ensure the ongoing
effectiveness of the information assurance plan. This milestone
is graded with the Milestone Four Rubric.
Final Submission: Information Assurance Plan
In Module Nine, you will submit your information assurance
plan. It should be a complete, polished artifact containing all of
the critical elements of the final
product. It should reflect the incorporation of feedback gained
throughout the course. This submission will be graded with the
Final Product Rubric.

Deliverables
Milestone Deliverable Module Due Grading
1 Information Assurance Plan Introduction Two Graded
separately; Milestone One Rubric
2 Information Security Roles and
Responsibilities
Four Graded separately; Milestone Two Rubric
3 Risk Assessment Five Graded separately; Milestone Three
Rubric
4 Statements of Policy Seven Graded separately; Milestone
Four Rubric
Final Submission: Information Assurance
Plan
Nine Graded separately; Final Product Rubric
Final Product Rubric
Guidelines for Submission: Your information assurance plan
should adhere to the following formatting requirements: 10–12
pages, double-spaced, using 12-
point Times New Roman font and one-inch margins. Use

discipline-appropriate citations.
Instructor Feedback: This activity uses an integrated rubric in
Blackboard. Students can view instructor feedback in the Grade
Center. For more information,
review these instructions.
Critical Elements Exemplary (100%) Proficient (90%) Needs
Improvement (70%) Not Evident (0%) Value
Overview of Goals
and Objectives
Meets “Proficient” criteria and
quality of overview establishes
expertise in the discipline
Provides a brief but
comprehensive overview of the
goals and objectives of the
information assurance plan,
including the importance of
ensuring the confidentiality,
information and the benefits of
creating and maintaining an
Provides a brief overview of the
goals and objectives of the
information assurance plan but
does not include the importance
of ensuring the confidentiality,

information or the benefits of
creating and maintaining an
Does not provide a brief overview
of the goals and objectives of the
4
Confidentiality,
Integrity, and
Availability of
Information
demonstrates a nuanced
understanding of key information
assurance concepts
Accurately assesses the
confidentiality, integrity, and
availability of information within
the organization
Assesses the confidentiality,
information within the
organization but some elements
of the assessment may be
illogical or inaccurate
Does not assess the
confidentiality, integrity, and
availability of information within

the organization
5
Current Protocols
and Policies
demonstrates deep insight into
complex deficiencies and barriers
to implementation of a new
Logically evaluates the current
protocols and policies in place,
including deficiencies that
currently exist and potential
barriers to implementation of a
new information assurance plan
Evaluates the current protocols
and policies in place but does not
address the deficiencies that
currently exist or potential
barriers to implementation of a
new information assurance plan,
or evaluation is illogical
Does not evaluate the current
protocols and policies in place
4
Responsibilities of
Key Leaders

understanding of the relationship
between these roles and
information security
Analyzes the role of the key
leaders within the organization
specific to how their
responsibilities are connected to
the security of the organization’s
information
Analyzes the role of the key
but misses key roles or aspects of
responsibilities specific to the
security of the organization’s
information
Does not analyze the role of the
key leaders within the
organization
5
http://snhu-
media.snhu.edu/files/production_documentation/formatting/rubr
ic_feedback_instructions_student.pdf
Key Ethical and Legal
Considerations

provides complex or insightful
reflection of the ramifications of
key leaders not properly
accounting for ethical and legal
considerations
Accurately evaluates key ethical
and legal considerations related
to information assurance that
must be taken into account by
the key leaders within the
organization, including the
ramifications of key leaders not
properly accounting for ethical
and legal considerations
Evaluates ethical and legal
considerations related to
information assurance that must
be taken into account by the key
but does not include the
ramifications of key leaders not
properly accounting for ethical
and legal considerations, or
evaluation is inaccurate
Does not evaluate ethical and
legal considerations related to
information assurance that must
be taken into account by the key

5
Key Components of
Information
Assurance
understanding of how each key
component identified impacts
each individual’s role and
responsibility
Comprehensively addresses
components of information
assurance as they relate to
individual roles and
responsibilities within the
Addresses components of
information assurance as they
relate to individual roles and
does not address confidentiality,
integrity, and/or availability of
information
Does not address any
components of information
assurance as they relate to
individual roles and

5
Analysis of
Environment
demonstrates unique or
insightful reflection of current
protocols and policies
Logically analyzes the
environment in which the
organization operates, including
the current protocols and policies
in place related to information
assurance
Analyzes the environment in
which the organization operates
but does not include the current
protocols and policies in place
related to information assurance
Does not analyze the
environment in which the
organization operates
5
Threat Environment

hidden or complex threats or
vulnerabilities
Accurately analyzes the threat
environment of the organization
Evaluates the threat environment
of the organization but misses
crucial threats or vulnerabilities,
or the evaluation is inaccurate
Does not evaluate the threat
environment of the organization
5
Best Approaches
insightful reflection regarding
areas for improvement
Comprehensively discusses best
approaches for implementing
information assurance principles,
including areas of improvement
to current protocols and policies
Discusses best approaches for
implementing information
assurance principles, but does
not fully develop ideas related to
areas of improvement to current
protocols and policies

Does not discuss best approaches
for implementing information
assurance principles
5
Risk Matrix
hidden or complex threats or
vulnerabilities and possible
methods to mitigate the
identified dangers
Creates a risk matrix to
comprehensively and accurately
assess the threats to and
vulnerabilities of the
organization, including possible
methods to mitigate the
identified dangers
Creates a risk matrix to assess the
threats to and vulnerabilities of
the organization but does not
include possible methods to
mitigate the identified dangers,
or assessment is incomplete or
inaccurate

Does not create a risk matrix to
assess the threats to and
vulnerabilities of the organization
5
Incident Response
Protocols
provides secondary incident
response protocols in the event
that primary protocols fail
Develops appropriate incident
response protocols to respond to
the various threats and
vulnerabilities identified
Develops incident response
protocols to respond to the
various threats and
vulnerabilities identified, but they
are not all appropriate or do not
respond to all the threats and
vulnerabilities
Does not develop incident
response protocols
5
Justification of
Incident Response

Protocols
provides unique or insightful
reflection into the dangers of not
providing for adequate incident
response protocols
Logically justifies how the
incident response protocols will
mitigate the threats to and
with support from information
assurance research and best
practices
Justifies how the incident
response protocols will mitigate
the threats to and vulnerabilities
of the organization with minimal
support from information
practices, or justification is
illogical
Does not justify how the incident
the threats and vulnerabilities to
the organization
5
Disaster Response
Protocols

responding to hidden or complex
threats or vulnerabilities
Develops appropriate disaster
response protocols to respond to
the various threats and
vulnerabilities identified
Develops disaster response
protocols to respond to the
various threats and
vulnerabilities identified, but they
are not all appropriate or do not
respond to all the threats and
vulnerabilities
Does not develop disaster
response protocols
4
Justification of
Disaster Response
Protocols
providing for adequate disaster
response protocols

disaster response protocols will
mitigate the threats to and
with support from information
practices
Justifies how the disaster
of the organization with minimal
practices, or justification is
illogical
Does not justify how the disaster
of the organization
5
Access Control
Protocols
insightful reflection into
appropriate protocols

Develops appropriate access
control protocols that provide an
appropriate amount of protection
while allowing users to continue
to operate without denial of
service
Develops access control
protocols, but they do not
provide an appropriate amount
of protection while allowing
users to continue to operate
without denial of service
Does not develop access control
protocols
4
Justification of Access
Control Protocols
providing for adequate access
control protocols
Logically justifies the access
control protocols with support
from information assurance
research and best practices
Justifies the access control
protocols with minimal support

from information assurance
research and best practices, or
justification is illogical
Does not justify the access
control protocols
5
Method for
Maintaining the
Information
Assurance Plan
provides an established interval
for the recommended
maintenance actions
Recommends a comprehensive
method for maintaining the
information assurance plan once
it has been established
Recommends a method for
maintaining the information
assurance plan once it has been
established but
recommendations are not fully
developed
Does not recommend a method
for maintaining the information
assurance plan once it has been

established
5
Justification of
Maintenance Plan
provides insight into the dangers
of not providing for an adequate
maintenance plan
maintenance plan will ensure the
ongoing effectiveness of the
information assurance plan with
practices
Justifies how the maintenance
plan will ensure the ongoing
effectiveness of the information
assurance plan with minimal
practices or justification is
illogical
Does not justify how the
maintenance plan will ensure the
ongoing effectiveness of the
5

Summary of Need for
Information
Assurance Plan
understanding of the need for an
Concisely summarizes the need
for an information assurance
plan, including the legal and
ethical responsibilities of the
organization to implement and
maintain an appropriate
Summarizes the need for an
does not include the legal and
ethical responsibilities of the
organization to implement and
maintain an appropriate
information assurance plan or is
not concise
Does not summarize the need for
an information assurance plan
5
Defense of Key
Elements of

Information
Assurance Plan
understanding of which members
of the organization should be
responsible for each element
Strongly defends key elements of
the information assurance plan,
including which members of the
organization would be
responsible for each element and
who should be contacted in the
event of an incident
Defends key elements of the
does not include which members
of the organization would be
responsible for each element, or
defense is weak
Does not defend elements of the
5
Articulation of
Response

Submission is free of errors
related to citations, grammar,
spelling, syntax, and organization
and is presented in a professional
and easy-to-read format
Submission has no major errors
spelling, syntax, or organization
Submission has major errors
that negatively impact readability
and articulation of main ideas
Submission has critical errors
that prevent understanding of
ideas
4
Earned Total 100%

Intro to Information AssuranceModule 3Chaston Carter0417.docx

Recommended

Recommended

More Related Content

Similar to Intro to Information AssuranceModule 3Chaston Carter0417.docx

Similar to Intro to Information AssuranceModule 3Chaston Carter0417.docx (20)

More from normanibarber20063

More from normanibarber20063 (20)

Recently uploaded

Recently uploaded (20)

Intro to Information AssuranceModule 3Chaston Carter0417.docx