Answer To: MIS607_Assessment_3_Brief_Mitigation plan for threat report_ Module 6.1 Page 1 of 4 Task Summary For...
Karthi answered on Aug 10 2021
Table of Contents
Introduction .................................................................................................................... 3
Prioritising the Risks ........................................................................................................ 4
Identified Categories of the Risk ....................................................................................... 6
Standard Mitigations ....................................................................................................... 6
Specific Resolutions and their Significance ........................................................................ 7
Techniques to Mitigate the threats ................................................................................... 7
Recommendation ............................................................................................................ 9
Conclusion ....................................................................................................................... 9
References ..................................................................................................................... 10
Introduction
This article highlights the Business & Communication Insurance (B&C Insurance) mitigation
strategy. After prioritising risks or threats, a mitigation plan will be developed. In order to
develop goals for risk, a model will be applied to classify various risk variables and analyse
them based on their effect on the organisation. In addition, defined categories of risk such as
UTILITY
CONFIDENTIALITY
POSSESION
AUTHENTICITY
hacking, spy and phishing will be evaluated. In addition to this STRIDE model, the case of the
insurance firm will be studied, and mitigation measures such as setting up of a high-tech
cyber protection framework that guarantees that only permitted individuals have access to
their individual accounts will therefore be proposed.
Prioritising the Risks
Different researchers have used multiple models for prioritising risks. One of the models was
to determine different risk variables and then score each variable following their significance
and impact on the organisation. In the Business and Communication case, risk variables can
be Strategic plan risk, client's data leakage risk, and leakage of the company's confidential
information such as financial and its internal strategy risk variable. Every variable will be
scored, and at the end, the overall score will be identified. The overall score helps in
determining the degree of threat either it is normalised or not based on a predefined scale.
An example of such a model is shared in figure 1, where risks 3 and 4 are prioritised based
on assigned scores (Hinkelmann, 2012).Moreover, after determining the overall score, every
risk variable is prioritised based on the highest score. In the case of an insurance company, a
highly prioritised risk is the leakage of clients' information that is considered an important
resource of the organisation. Second priority will be given to strategic planning and in the
last unauthorised access to an internal strategy. Moreover, in other scenarios, risk variables
can be personnel and funding related depending on the company's operations and
cybersecurity system, and accordingly, variables are prioritised (Martins & Lambe, 2013)
INFORMATION
SECURITY
Figure 1. Parkerian hexad
INTEGRITY AVAILABILITY
The six elements were identified explicitly by Parkerian hexad related to ISOs and stressed
that companies concentrate on those elements highlighted: control or ownership, secrecy,
usefulness, honesty, integrity and utility. These components protect businesses, as
mentioned in the case of insurance companies, from such cyber-attacks. Organisations
understand, however, that they cannot fully defend themselves from certain attacks and
threats, even though they can avoid threats because of the factors above. Furthermore, it
calls on businesses to prioritise data protection, networks, processes and analyse the
opportunities available to reduce the risk of cybercrime.
Companies must increase resources for the authentication, instead of stressing the secret
details, of the credibility of individual information. Experts would definitely claim that
privacy cannot be overlooked, so businesses have to choose carefully. It is necessary to
remember that priority should be given to honesty over secrecy, and the regulatory
implications should be possible under sanction or penalty. The tools for cyber attacks have
been restricted to businesses. This needs to be handled carefully, and the risk must be
prioritised accordingly (Boyes, 2015)
Apart from protecting and prioritising the most critical items, clear measures can be taken to
deter individual cyber assaults by exchanging threat information. Companies in particular
industries must exchange information by setting up a Security Council as a protective tool to
deter cyber attacks. The concept behind the establishment of an information-sharing council
is clear. Take a case of a business and communications insurance firm exchanging cyber
attacks, through a common strategy and priority approach and solution models, with other
insurance firms that have the same digital assets which other players in the industry will
prevent from using the same nature of the cyber attack.
Identified Categories of the Risk
The threats facing business and communications insurance companies have been listed in
various categories, such as; hacking, malware, social engineering, espionage, and more
precision phishing Phishing is described as an external party entity or business that receives
emails. External parties have easy access to internal networks,...