FAYETTE MORTGAGE, INC.
Fayette Mortgage, Inc. (FMI) is a mortgage loan company that manages thousands of accounts across the United
States. A public company traded on the NYSE, FMI specializes in financial management, loan application approval,
wholesale loan processing, and investment of money management for their customers.
The diagram below displays the executive management team of FMI:
Figure 1 FMI Executive Organizational
Chart BACKGROUND AND YOUR ROLE
You are the Chief Security Officer, hired by COO Kelly Smith, to protect the physical and operational
security of FMIâ€™s corporate information systems. Shortly after starting in your new position, you recognize
numerous challenges that you will be facing in this pursuit.
Your primary challenge, as is usually the case, is less technical and more of a political nature. The CEO
has been swept up in the â€œeverything can be solved by outsourcingâ€ movement. He believes that the IT
problem is a known quantity and feels the IT function can be almost entirely outsourced at fractions of the
cost associated with creating and maintaining an established internal IT department. In fact, the CEOâ€™s
strategy has been to prevent IT from becoming a core competency since so many services can be obtained
from 3rd parties. Based on this vision, the CEO has already begun downsizing the IT department and
recently presented a proposal to his senior management team outlining his plan to greatly reduce the
internal IT staff in favor of outsourcing. He plans on presenting this approach to the Board of Directors as
soon as he has made a few more refinements in his presentation.
COO Smithâ€™s act of hiring you was, in fact, an act of desperation: the increasing operational dependence
on technology services combined with a diminishing IT footprint gravely concerned Smith, and he begged
to at least bring in an Information Security expert with the experience necessary to evaluate the current
security of FMIâ€™s infrastructure and systems. The COOâ€™s worst nightmare is a situation where the
Confidentiality, Integrity, and Availability of FMIâ€™s information systems were compromised â€“ bringing the
company to its knees â€“ then having to rely on vendors to pull him out of the mess.
COO Smith has reasons for worrying. FMI has experienced several cyber-attacks from outsiders over the
past a few years:
â€¢ In 2018, the Oracle database server was attacked, and its customer database lost its confidentiality,
integrity, and availability for several days. Although the company restored the Oracle database
server back online, its lost confidentiality damaged the company reputation. FMI ended up
paying its customers a large sum of settlement for their loss of data confidentiality.
â€¢ In 2019, another security attack was carried out by a malicious virus that infected the entire
Director of HR
network for several days. While infected, the Oracle and e-mail servers had to be shut down to
quarantine these servers. COO Smith isnâ€™t sure whether the virus entered FMIâ€™s systems through
a malicious email, from malware downloaded from the Internet, or via a userâ€™s USB flash drive.
Regardless of the source of the infection, the company lost $1,700,000 in revenue and intangible
â€¢ In a separate incident in 2019, one of the financial advisors left his company laptop unprotected
at the airport while travelling and it was stolen. It contained customer financial data and the
hard drive was not encrypted. Financial reparations were paid to impacted customers.
â€¢ In 2020, a laptop running network sniffer software was found plugged into a network jack under a
desk in one of the unoccupied offices.
It is apparent from the number of successful cyber-attacks that FMI is an organization severely lacking in
information security maturity. COO Smith has commissioned you to perform a quantitative and qualitative
risk assessment of FMIâ€™s infrastructure to determine where improvements could be made to reduce the
risk of future attacks.
CORPORATE OFFICE NETWORK TOPOLOGY
The diagram on the following page displays FMIâ€™s Corporate Office Topology.
The FMI network infrastructure consists of a corporate WAN spanning 20 remote facilities that are
interconnected to the FMI headquartersâ€™ central data processing environment. Data is transmitted from a
remote site through a VPN gateway appliance that forms a VPN tunnel with the VPN gateway in
headquarters. Through this VPN connection, remote office users access the internal Oracle database to
update the customer data tables. Through your inspection of the VPN configuration you discover that the
data transaction traversing the remote access connection to the corporate internal databases is not
Users are authorized to work from home and both dial-up and VPN remote access are available. Dial-up is
provided via Private Branch Exchange (PBX) and a Remote Access Server and VPN remote access is
provided via the VPN gateway. Authentication is password-based via MS-CHAP V2. Users are also able
to take advantage of FMIâ€™s Bring Your Own Device (BYOD) policy and a Wireless antenna allows
wireless networking within headquarters. WEP is used to provide wireless security to BYOD users.
The network perimeter between the Internet and FMIâ€™s internal network infrastructure is separated by two
Border (Core) Routers. These Border Routers then connect to two Distribution Routers and the VPN
Gateway. The Distribution Routers connect to a RAS Server, a Wireless Router that provides a bridge
between the Wireless Antenna and the internal network, and two Multi-layer switches. The Multilayer
switches connect to six (6) Access Layer VLAN switches that segregate the Accounting, Loan Dept,
Customer Services, Mgmt, Credit Dept, and Finance VLANs. The Multi-layer switches also connect to a
third Multi-layer switch that provides a connection to FMIâ€™s servers in the Trusted Computing Base
The trusted computing based (TCB) internal network is situated in a physically separated subnet. A bulk of
the data processing for FMI is handled by an Oracle database on a high end super computer located in the
TCB and the TCB also contains an intranet web server used by the internal support team, a Software
Update Services (SUS) server used for patch management, an internal DNS server, an e-mail server, and
other support personnel workstations. Although each corporate department is segregated physically on a
different subnet, they share access to the corporate data in the TCB network.
NOTE: The symbol represents a multilayerswitch
CONSIDERATIONS WHEN CONDUCTING THE RISK ASSESSMENT:
This Risk Assessment and your suggested security improvements are of critical importance. The CEO is set on
outsourcing FMIâ€™s IT competency and youâ€™ve been told of a plan from COO Smith to outsource network
management and security functions away from your department and over to a service integrator. COO Smith warns
you that the political environment will only become more contentious over time; you must make a compelling case
as to what value your department can bring over an integrator to provide security improvements in certain key areas
without a significant increase to the IT budget. It is extremely important that you take into account the value of the
assets being protected when selecting security controls to mitigate the risks (i.e. donâ€™t spend $1000 to protect an
asset worth $500). In addition to what you learned from COO Smith about the previous exploits of FMIâ€™s
vulnerabilities and what you gathered when reviewing FMIâ€™s network infrastructure, COO Smith has provided
some additional information that he wants you to take into account:
- Ever since an article ran in Inc. Magazine about FMI, the network engineers report that theyâ€™ve noted
a significant spike in network traffic crossing into the internal networks. They report that they cannot
be certain what or who is generating this traffic, but the volume and frequency of traffic is certainly
abnormal. The management is very concerned over securing the corporate confidential data and
customer information. Suggestions on improvements to perimeter security and/or methods of
identifying the source of intrusions should be presented in your risk assessment.
- The interrelationship between data and operations concerns COO Smith. Increasingly, some of the
twenty remote sites have been reporting significant problems with network latency, slow
performance, and application time-outs against the Oracle database. The companyâ€™s business model
is driving higher and higher demand for data, but your capability to respond to these problems are
drastically limited. Suggestions on reducing network latency or increasing application response time
and availability should be presented in your riskassessment.
- Mobility is important for the organization to interact with the customers and other co-workers in near
real-time. However, COO Smith is concerned with mobility security and would like you to research
best practices for mobile computing. Security within the BYOD environment should be presented in
your risk assessment.
- Employees enjoy the flexibility of getting access to the corporate network using a WiFi network.
However, COO Smith is concerned over the security ramifications over the wireless network that is
widely open to the company and nearby residents. Security within the wireless environment should be
presented in your risk assessment.
- The company plans to offer its products and services online and requested its IT department to design
a Cloud Computing based e-commerce platform. However, COO Smith is particularly concerned over
the cloud computing security in case the customer database is breached.
â€¢ Provide an Executive Summary.
â€¢ From the devices and systems identified in the FMI Corporate Network Topology, conduct a
thorough asset inventory, assign monetary values to each asset (quantitative), and assign a priority
value for each asset (qualitative) that could be used to determine which assets are most critical for
restoral in the event of a catastrophic event or attack.
â€¢ Evaluate the perimeter security, make a list of access points internal and external(remote), identify
vulnerabilities and make suggestions for improvements to perimeter and network security.
â€¢ Evaluate the remote access infrastructure, identify vulnerabilities and suggest security
improvements to mitigate risks to remote access.
â€¢ Address the COOâ€™s concern over the mobility security and design a secure mobile computing
(smart phones, tablets, laptops, etc.) in terms of authentication technologies and dataprotection.
â€¢ Identify wireless vulnerabilities and recommend what safeguards, authentication technologies,and
network security to protect data should be implemented.
â€¢ Evaluate the authentication protocols and methodologies within the wired, wireless, mobility and
remote access environments and suggest improvements to secure authentication forFMI.
â€¢ Evaluate the web system protocols and vulnerabilities within the Intranet server and suggest
secure protocol improvements to improve security for web authentication.
â€¢ Design a cloud computing environment for the company with a secure means of data protection at
rest, in motion and in process.
â€¢ Assess all known vulnerabilities on each asset in this environment and impacts if compromised.
â€¢ Using the asset inventory and the assigned values (monetary and priority) conduct a quantitative
and qualitative risk assessment of the FMInetwork.
Compelling correspondence is essential to the achievement all things considered but since of the changing idea of the present working environments, successful correspondence turns out to be more troublesome, and because of the numerous impediments that will permit beneficiaries to acknowledge the plan of the sender It is restricted. Misguided judgments.In spite of the fact that correspondence inside the association is rarely completely open, numerous straightforward arrangements can be executed to advance the effect of these hindrances.
Concerning specific contextual analysis, two significant correspondence standards, correspondence channel determination and commotion are self-evident. This course presents the standards of correspondence, the act of general correspondence, and different speculations to all the more likely comprehend the correspondence exchanges experienced in regular daily existence. The standards and practices that you learn in this course give the premise to additionally learning and correspondence.
This course starts with an outline of the correspondence cycle, the method of reasoning and hypothesis. In resulting modules of the course, we will look at explicit use of relational connections in close to home and expert life. These incorporate relational correspondence, bunch correspondence and dynamic, authoritative correspondence in the work environment or relational correspondence. Rule of Business Communication In request to make correspondence viable, it is important to follow a few rules and standards. Seven of them are fundamental and applicable, and these are clear, finished, brief, obliging, right, thought to be, concrete. These standards are frequently called 7C for business correspondence. The subtleties of these correspondence standards are examined underneath: Politeness Principle: When conveying, we should build up a cordial relationship with every individual who sends data to us.
To be inviting and polite is indistinguishable, and politeness requires an insightful and amicable activity against others. Axioms are notable that gracious “pay of graciousness is the main thing to win everything”. Correspondence staff ought to consistently remember this. The accompanying standards may assist with improving courtesy:Preliminary considering correspondence with family All glad families have the mystery of progress. This achievement originates from a strong establishment of closeness and closeness. Indeed, through private correspondence these cozy family connections become all the more intently. Correspondence is the foundation of different affiliations, building solid partners of obedient devotion, improving family way of life, and assisting with accomplishing satisfaction (Gosche, p. 1). In any case, so as to keep up an amicable relationship, a few families experienced tumultuous encounters. Correspondence in the family is an intricate and alluring marvel. Correspondence between families isn’t restricted to single messages between families or verbal correspondence.
It is a unique cycle that oversees force, closeness and limits, cohesiveness and flexibility of route frameworks, and makes pictures, topics, stories, ceremonies, rules, jobs, making implications, making a feeling of family life An intelligent cycle that makes a model. This model has passed ages. Notwithstanding the view as a family and family automatic framework, one of the greatest exploration establishments in between family correspondence centers around a family correspondence model. Family correspondence model (FCP) hypothesis clarifies why families impart in their own specific manner dependent on one another ‘s psychological direction. Early FCP research established in media research is keen on how families handle broad communications data. Family correspondence was perceived as an exceptional scholastic exploration field by the National Communications Association in 1989. Family correspondence researchers were at first impacted by family research, social brain science, and relational hypothesis, before long built up the hypothesis and began research in a family framework zeroed in on a significant job. Until 2001, the primary issue of the Family Communication Research Journal, Family Communication Magazine, was given. Family correspondence is more than the field of correspondence analysts in the family. Examination on family correspondence is normally done by individuals in brain science, humanism, and family research, to give some examples models. However, as the popular family correspondence researcher Leslie Baxter stated, it is the focal point of this intelligent semantic creation measure making the grant of family correspondence special. In the field of in-home correspondence, correspondence is normally not founded on autonomous messages from one sender to one beneficiary, yet dependent on the dynamic interdependency of data shared among families It is conceptualized. The focal point of this methodology is on the shared trait of semantic development inside family frameworks. As such, producing doesn’t happen in vacuum, however it happens in a wide scope of ages and social exchange.
Standards are rules end up being followed when performing work to agree to a given objective. Hierarchical achievement relies significantly upon compelling correspondence. So as to successfully impart, it is important to follow a few standards and rules. Coming up next are rules to guarantee powerful correspondence: clearness: lucidity of data is a significant guideline of correspondence. For beneficiaries to know the message plainly, the messages ought to be sorted out in a basic language. To guarantee that beneficiaries can without much of a stretch comprehend the importance of the message, the sender needs to impart unmistakably and unhesitatingly so the beneficiary can plainly and unquestionably comprehend the data.>