Overview
Project: Information Systems Security
© 2018 by Jones & Bartlett Learning, LLC, an Ascend Learning Company. All rights reserved. www.jblearning.com Page 1
Purpose
This project provides you an opportunity to analyze risks, threats, and vulnerabilities, apply
countermeasures, and audit an information systems environment.
Required Source Information and Tools
To complete the project, you need the following:
1. Course textbook
2. A Windows 7, 8 or Windows 10 computer, preferably with the default installation
3. Access to the Internet
4. The following documentation:
NIST SP 800-30 revision 1, Guide for Conducting Risk Assessments (also available at
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf)
Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) (focus on the
Allegro version) (also available at http://www.cert.org/resilience/products-services/octave/)
Learning Objectives and Outcomes
You will:
Explain how to assess risks, threats, and vulnerabilities
Evaluate potential outcomes of a malware attack and exposure of confidential information
Evaluate information systems security countermeasures
Create a gap analysis plan
Evaluate and select a risk assessment methodology
Analyze the purposes of system hardening
Analyze Windows security events
Evaluate information systems security activities in terms of business success
Introduction
Contemporary organizations collect, store, and transmit a tremendous amount of highly sensitive data.
Despite the many benefits that information technology offers, these systems are not always completely
secure. Proper controls must be put in place to mitigate security risks and protect vital business
information.
Web References: Links to web references are subject to change without prior notice. If a web reference
is no longer available, try searching for an updated version on Google or by using the Wayback Machine
(https://archive.org/web/) to access it.