Addressing and Handling Cyber-Security Issues
Order ID:89JHGSJE83839 Style:APA/MLA/Harvard/Chicago Pages:5-10 Instructions:
Addressing and Handling Cyber-Security Issues
With growing number of attacks, it is getting difficult for the companies to address and handle cyber-security issues. Vestige Inc is a company that is acting as medium for parent company to sell advertisement space for their magazine. The business requirement states that Vestige system needs to be accessed and verified before establishing a connection to the database of the parent company.
As a Security Architect, it is required to analyze the parent’s database to define the need for connection. Database plays the important role as it contains confidential and sensitive information of the consumers. At any particular instance, evaluation of security is an effective approach to identify the weaknesses of database. The architecture should be defined considering database security and network management as a priority. Any failure of database and interference of network could affect the customer personal and financial information.
There are several attributes and factors that needs to be considered for a security evaluation. The primary components to be considered are privacy, operational security, disaster recovery and consistency planning. The above components mentioned should be a part of security portfolio and should be budgeted accordingly. Privacy is the most important component and should be allocated 40% of budget as it makes sure that the consumer information that is sensitive is secure in the database. Operational Securities, Disaster recovery and contingency should be given the other 60% of the budget.
Vestige should define the access and policy control to the parent’s database. A set of users should be defined to assign functionality and privileges per user requirements helps prevent possible cyber threats for a database. Proper assignment of privileges and separating tasks helps scheduling tasks only to authorized users such as providing time limit for accessing the data base and creating data base backups. Also, Role based Access Control (RBAC) should be implemented in the parent database. This RBAC should be able to verify all the input and output transactions by checking the consumers profile in the existing database. The database should define the level of access user has to the existing records and based the records the incoming user profile is validated.
Networking and communication also play an important part in security evaluation. It is required to understand the flow of input and output communication so that proper security and access control procedures can be implemented and vulnerabilities can be analyzed. A simple example would to provide different access roles to a developer and a user to the database. The input requests can be validated in different ways but primarily with headers. The headers contain identification and authentication tokens/ flags that define various properties such as the type of transaction whether it is inbound or outbound. These tokens identify inbound or outbound transaction and prevent unauthorized access by denying the inbound request in case of failure.
The best practices of evaluation of security should include some mandatory selection of tests that include identifying known bugs in the system, device settings, handling privileges and regulatory oversight. This includes following security protocols and keeping the data safe and locked physically along with the data in the data centers. Implementation of firewall and encryption of data should be normal practice to restrict the malware from the data that is transmitted. Firewalls such as SecureSphere and encryption tools such as CertainSafe should be implemented at certain levels to encrypt the entire database and secure it from malicious attacks.
There are many methods and applications to evaluate the security of the database but the major task is to address the database and networking issues. The functionalities that can address this issue are risk management, identifying Denial of attacks (DDOS), disaster recovery , contingency plan.
References:
Crabtree, J., & Sellers, A. (2019). U.S. Patent No. 10,432,660. Washington, DC: U.S. Patent and Trademark Office.
Williams, K. Y. B., & Griffin, J. A. (2019). Better security and encryption within cloud computing systems. In Cloud Security: Concepts, Methodologies, Tools, and Applications (pp. 812-823). IGI Global