PROJECT 1 - INFORMATION SYSTEMS IDENTITY MANAGEMENT - NIMMY I have done the labs (see attached), just need help on the technical and non technical paper (for business executives and board members. I will do the executive summary I My choice of organization here is CAREFIRST CYBER ATTACK IN 2015 (THIS IS A HEALTH INSURANCE COMPANY IN THE US) Here is a video to watch: https://youtu.be/YIGZ867fryk Please select part of your references from this below. http://resources.sei.cmu.edu/library/ The deliverables for this project are as follows: NOTE : I tried to scoop out in bulleted points what we need to do in each of the steps below regarding technical paper and non-technical paper. Please still read through the project to satisfy what the professor requires. 1. Technical report: Your report should be a 5 page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables or citations. CASE STUDY - CAREFIRST CYBERATTACK IN 2015 (THIS IS A HEALTH INSURANCE COMPANY IN THE US) CAREFIRST ORGANIZATION AND STRUCTURE • Choose (CAREFIRST) and research the healthcare organization, noting its organization and structure. • Define the CAREFIRST organization and structure and identify the different business units and their functions. You may use an organizational chart (I need a typical organizational chart in a IT/Systems Security department as chart 1) to provide this information. (cite reference) CAREFIRST INFORMATION SYSTEM INFRASTRUCTURE • Define the Information System Infrastructure of CAREFIRST as stated in STEP 1 • Choose one or more mission critical systems (they use Trizetto facets system) of the CAREFIRST health insurance organization. (cite reference) • Define the health insurance information needs, as they relate to the organization's mission critical Protected Health Information (PHI). This information is stored in database medical records for doctors, nurses, and insurance claims billing systems, which are used to fulfill the organizational information needs. (cite reference) • Define the workflows and processes for the high-level information systems. Your definition should include a high-level description of information systems hardware and software components and their interactions. You may supply this information as an IMAGINARY diagram with inputs, outputs, and technologies (I need this diagram 2) identified in STEP 1. • Consider how you might restrict access and protect billing and PHI information (cite reference). • Define the Open Systems Interconnections (OSI) Model, TCP/IP protocols and network protocols as part of the CAREFIRST WEB SECURITY AND THREATS WITH IDENTITY MANAGEMENT AS SOLUTION • As stated in STEP 2, cover the web security and threats the system faces and introduce identity management as a solution. o Identify potential threats to operating systems and the security features necessary to guard against them. o Include a brief summary of insider threats, intrusion motives, and hacker psychology in this technical report as it relates to CAREFIRST data processing systems. (be creative, imagine it). o Relate these threats to the vulnerabilities in the CIA triad. (cite reference) o Include a description of the purpose and components of an identity management system to include authentication, authorization, and access control (cite reference) o Include a discussion of possible use of laptop devices by doctors who visit their patients at the hospital, and need access to hospital PHI data. (cite reference) o Define the types of access control management to include access control lists in operating systems, role-based access controls, files, and database access controls. (cite reference) o Define types of authorization and authentication and the use of passwords, password management, and password protection in an identity management system. o Describe common factor authentication mechanisms to include multi-factor authentication. (cite reference) PASSWORD CRACKING AND TOOLS USED • Write on what you know about password cracking and mention some tools as it applies to YOUR organization (be creative) as stated STEP 3 RISKS COMPARISON • Provide a comparison of risk scenarios to include the following: (cite reference) o What will happen if the CIO and the leadership do nothing, and decide to accept the risks? o Are there possible ways the CIO can transfer the risks? o Are there possible ways to mitigate the risks? o Are there possible ways to eliminate the risks? o What are the projected costs to address these risks? OVERALL RECOMMENDATION • Provide recommendations for access control and authentication mechanisms to increase the security within the identity management system. (cite reference) • Define the roles within the organization; recommend the accesses, restrictions, and conditions for each role. Present these in a tabular format (I need this table 3), as part of your list of recommendations. • Provide an overall recommendation, with technical details to the director of IT. o Propose a way to prioritize these risks and include possible remediation actions. o Create a roadmap for organizations to use in development of an IMA (Identity management application) program (to address gaps in their current offerings). (possible diagram) 2. The executive summary:This will be summary of technical report in 2–pages report. 3. Nontechnical presentation: This is a 8 slide PowerPoint presentation for business executives and board members. Please, provide speaker notes, I will be the one to present this for 30 minutes • Itemize identity management system vulnerabilities that can be discovered in password cracking and access control (cite references) • Compare Cain and Abel and OphCrack password cracking tools, considering their performance in speed, precision, and results. Put the comparison as part of your assessment and come up with some recommendations on the use of these tools. STEP 4 o Just imagine you test the CAREFIRST systems for password strength and complexity and complete validation testing. Compare the results that can be obtained from Cain and Abel and OphCrack tools. o Describe in simple nontechnical terms for the leadership, identifying which tool is the most effective and why for your organization's IT environment (cite reference) o Define what cyberattack is referred to with examples (cite reference) o Compare and contrast the results from the two methods used to crack the accounts for the three passwords (each encrypted by the two hash algorithms). Show their benefits. You can make certain conclusions that help your company's cybersecurity posture after using these methods.(cite reference) o Explain to the director of IT and the members of the board that the healthcare organization's anti-virus software will detect password cracking tools as malware. Also explain how this impacts the effectiveness of testing security controls like password strength. .(cite reference) o Help the leadership understand the risks and benefits of using password cracking tools, through persuasive arguments in your non-technical report and presentation. .(cite reference) o Write how the password cracking results affect business operations (cite reference) • Executive summary: This should be a 2 page double-spaced Word document. • In a Word document, share your lab experience and provide screen prints to demonstrate that you performed the lab. The technical report and the nontechnical presentation will identify compromises and vulnerabilities in the information systems infrastructure of the healthcare organization, and identify risks to the organization's data. You will propose a way to prioritize these risks and include possible remediation actions. The technical report: Provide recommendations for access control and authentication mechanisms to increase the security within the identity management system. After you have defined the roles within the organization, recommend the accesses, restrictions, and conditions for each role. Present these in a tabular format, as part of your list of recommendations. Provide a comparison of risk scenarios to include the following: 1. What will happen if the CIO and the leadership do nothing, and decide to accept the risks? 2. Are there possible ways the CIO can transfer the risks? 3. Are there possible ways to mitigate the risks? 4. Are there possible ways to eliminate the risks? 5. What are the projected costs to address these risks? Provide an overall recommendation, with technical details to the director of IT. The executive summary: This will be summary of technical report in 2–pages report. The deliverables for this project are as follows: • Nontechnical presentation: This is a 8 slide PowerPoint presentation for business executives and board members. • Technical report: Your report should be a 5 page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables or citations. • Executive summary: This should be a 2 page double-spaced Word document. • In a Word document, share your lab experience and provide screen prints to demonstrate that you performed the lab. There are six steps that will lead you through this project to create your final deliverables. You should complete Project 1 during Week 1. After beginning with the workplace scenario, continue to Step 1: "Defining the Information System Infrastructure," which builds upon the problem presented in the scenario. When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission. • 1.1: Organize document or presentation in a manner that promotes understanding and meets the requirements of the assignment. • 2.3: Evaluate the information in logical manner to determine value and relevance. • 5.4: Identify potential threats to operating systems and the security features necessary to guard against them. • 6.2: Create a roadmap for organizations to use in development of an IMA program (to address gaps in their current offerings). Step 1: Defining the Information System Infrastructure The director of IT and the members of the board would like an as-is definition of the information system infrastructure of a healthcare organization. You will begin your report with this background description. You will provide the following information in your review of the current information systems infrastructure: 1. Choose and research a healthcare organization, noting its organization and structure. Define the healthcare organization's structure and identify the different business units and their functions. You may use a variety of methods to provide this information, such as an organizational chart. 2. Choose one or more mission critical systems of the healthcare organization. Define the information needs, as they relate to the organization's mission critical Protected Health Information (PHI). This information is stored in database medical records for doctors, nurses, and insurance claims billing systems, which are used to fulfill the organizational information needs. 3. Define the workflows and processes for the high-level information systems. Your definition should include a high-level description of information systems hardware and software components and their interactions. Take time to read the following resources. They will help you construct your definition. o Information systems hardware o Information systems software You may supply this information as a diagram with inputs, outputs, and technologies identified. Consider how you might restrict access and protect billing and PHI information. 4. The links shown below provide access to essential information you'll need to complete this part of the hospital's information system infrastructure definition. Click each link, review its resources, and refer to them as you compose this part of the definition. o Open Systems Interconnections (OSI) Model o TCP/IP protocols o network protocols You will include these definitions in your report. Step 2: Threats Now that you have defined the hospital's information system infrastructure, you will cover the web security and threats the system faces and introduce identity management as a solution. To complete this section of the report, you'll brush up on your knowledge of threats by reading the following resources: web security issues, insider threats, intrusion motives/hacker psychology, and CIA triad. Take what you learned from these resources to convey the threats to the hospital's information systems infrastructure. Include a brief summary of insider threats, intrusion motives, and hacker psychology in your report as it relates to your hospital data processing systems. Relate these threats to the vulnerabilities in the CIA triad. This section of your report will also include a description of the purpose and components of an identity management system to include authentication, authorization, and access control. Include a discussion of possible use of laptop devices by doctors who visit their patients at the hospital, and need access to hospital PHI data. Review the content of the following resources. As you're reading, take any notes you think will help you develop your description. 1. Authorization 2. Access control 3. Passwords 4. Multi-factor authentication Next, expand upon your description. Define the types of access control management to include access control lists in operating systems, role-based access controls, files, and database access controls. Define types of authorization and authentication and the use of passwords, password management, and password protection in an identity management system. Describe common factor authentication mechanisms to include multi-factor authentication. You will include this information in your report. WILL DO LAB Step 3: Password Cracking Tools Note: You will utilize the tools in Workspace for this step. If you need help outside the classroom to complete this project, you must register for CLAB 699 Cyber Computing Lab Assistance (go to the Discussions List for registration information). Primary lab assistance is available from a team of lab assistants. Lab assistants are professionals and trained to help you. Click here to access the Project 1 Workspace Exercise Instructions. Explore the tutorials and user guides to learn more about the tools you will use. You have successfully examined the threats to a healthcare organization's information systems infrastructure. Now, you must begin your research into password cracking software. Start by experimenting with the password cracking tools available to you in the lab. PASSWORD CRACKING TOOLS IN THE LAB ● Cain and Abel (Windows) http://www.oxid.it/cain.html ● Ophcrack (Windows, Linux, Apple OS) http://ophcrack.sourceforge.net/ Enter Workspace and complete the lab activities related to authentication and password recovery/cracking. Do some quick independent research on password cracking as it applies to your organization. WILL DO LAB ONLY Step 4: Comparing Software Note: You will utilize the tools in Workspace for this step. You have successfully tested more than one password cracking tool. Compare them. Not all password cracking tools will necessarily perform with the same speed, precision, and results, making it important to test a few different products. The comparison will be part of your assessment and help you make recommendations on the use of such tools. You will test the organization's systems for password strength and complexity and complete validation testing. You will compare the results obtained from your first and second tool. 1. Read this article about cyberattacks, perform two different types of cyberattacks in the first, and in the second tool, crack user account passwords. Describe them in simple nontechnical terms for the leadership. You can identify which tool is the most effective and why for your organization's IT environment 2. Compare and contrast the results from the two methods used to crack the accounts for the three passwords (each encrypted by the two hash algorithms). Show their benefits. You can make certain conclusions that help your company's cybersecurity posture after using these methods. 3. Explain to the director of IT and the members of the board that the healthcare organization's anti-virus software will detect password cracking tools as malware. Also explain how this impacts the effectiveness of testing security controls like password strength. Help the leadership understand the risks and benefits of using password cracking tools, through persuasive arguments in your report and presentation. If any of the tools take longer than 4-5 minutes to guess a password, record the estimated length of time the tool anticipates to guess it. Step 5: The Non-Technical Presentation You now have the information you need to prepare your product for stakeholders. Based on the research and work you've completed in Workspace, you will develop two items: a technical report for the director of IT, and a nontechnical slide show presentation for the members of the board. You will tailor the language of your reports appropriately to the different audiences. The nontechnical presentation: Your upper-level management team consists of technical and nontechnical leadership, and they are interested in the bottom line. You must help these leaders understand the identity management system vulnerabilities you discovered in password cracking and access control. They need to clearly see what actions they must either take or approve. The following are a few questions to consider when creating your presentation: 1. How do you present your technical findings succinctly to a non¬technical audience? Your technical report for IT will span many pages; but you will probably be afforded no more than 30 minutes or 8 slides for your presentation and the following discussion with leadership. 2. How do you describe the most serious risks factually but without sounding too temperamental? No one likes to hear that their entire network has been hacked, data has been stolen, and the attackers have won. You will need to describe the seriousness of your findings while also assuring upper-level management that these are not uncommon occurrences today. 3. How do your results affect business operations? Make sure you are presenting these very technical password cracking results in business terms upper-level management will understand. 4. What do you propose? Management will not only want to understand what you have discovered; they will want to know what you propose as a solution.