Objeactive: The objective of this assignment is to explore Information Security and Assurance(IS&A)concepts, identification attacks, and setting account policies. Through this assignment, you are...

Assignment report
Assignment report
Information Security and Assurance (IS&A) Concepts
Contents
Objective:    3
Part A    3
1.    Discussion on Information Security Risk Concept    3
a.    There is No Such thing as Absolute Security    3
b.    Security Through Obscurity is not an Answer. Why is security through Obscurity a lousy Idea for overall security of a system    3
c.    Complexity is the Enemy of Security.    4
d.    Open Disclosure of Vulnerabilities Is Good for Security.    4
2.    5
a.    Take the “Think You Can Outsmart Internet Scammer?” quiz    5
b.    Discuss standard features, which help identify possible electronic fraud    5
Part B    7
Perform Ten specific hardening tasks    7
1.    Account Lockout    8
2.    Enforce Password History    9
3.    Minimum Password Length    10
4.    Password Complexity    11
5.    Audit Logon Events    12
6.    Rename Administrator Account    13
7.    Interactive Logon    14
8.    Firewall    15
9.    App-locker policy    17
10.    Creating a standard user account    21
Objective:
The objective of this assignment is to explore Information Security and Assurance (IS&A) concepts, identification attacks, and setting account policies. This assignment consists of 2 parts.
Part A is a discussion of Information Security Risk Concept. While Part B is a Security manual for Hardening the operating system with respect to information security concepts.
Part A
1. Discussion on Information Security Risk Concept
a. There is No Such thing as Absolute Security
There is absolutely no such thing as Absolute security in terms of Information Security Risk. Security is an on-going process. Everyday new vulnerabilities are being detected in the information systems that are known as Zero-day vulnerabilities as they do not have a patch ready. Also, there is always a delay between the patch being made public and the time by which it can be implemented in a running system. This time delay may be due to information security policies of the organization or unavailability of downtime of a critical infrastructure. It is due to these constraints that a system vulnerability is exposed to attackers for exploitation.
Then there are some unknown exploits available in the 3rd party software being authorized to use in the organization that have vulnerabilities and the 3rd party software manufacturer is having a weak security policy that leads to an attack.
Also, even after extensive background checks for their employees and giving them trainings about information security, there is always a possibility of social engineering attacks that could compromise a system from the inside and allow attackers to access the system or plant a more permanent backdoor.
In the end, there is always some residual risk remaining in the system, that is either more expensive to fix than the underlying problem it may create or it may be that such risks have very low probability of exploitation thus making such risks acceptable.
b. Security Through Obscurity is not an Answer. Why is security through Obscurity a lousy Idea for overall security of a system
Security through Obscurity means securing a network or a system by means of hiding the details of its implementation. Although it sounds a very effective idea to simply hide all details of implementation or architecture of a system to prevent anyone from knowing how the components are placed inside the system and what components are being used, it is not the answer. Security through Obscurity or (STO) should not be used as a standalone mechanism but as a part of the overall security architecture known as Defense-in-Depth.
The one major flaw with STO is that the system is...