Risk Management Plan

RISK MANAGEMENT PLAN IT 313 Project Two Thistle, Cameron SNHU | 03/21/2023 Importance: At Health Network Inc., a healthcare company with headquarters in Tampa, Florida, I oversee IT risk assessment. Wellbeing Organization utilizes around 700 individuals and procures more than $500 million in deals every year. The company has locations in Seattle, Washington, and Arlington, both in Virginia. These websites provide support for various aspects of business operations. Each location is close to a data center, where production systems are housed and maintained by third-party data center hosting providers. This risk assessment's objective is to offer suggestions for dealing with threats and risks found on Health Network, Inc. systems. Since it offers information, the arrangement is more critical to partners and particularly to the chief. They must be able to determine the most effective strategy for mitigating the identified dangers and risks. Scope: The strategy is meant to deal with the risks and threats that were found in the risk assessment that came before it. It will guarantee: It will be avoided that hardware decommission errors could result in data loss. The misfortune or burglary of organization possessed resources, like cell phones and PCs, doesn't represent a gamble to safeguarded wellbeing data. It is avoided that production data corruption caused by a system failure could result in data loss. On the internet, hackers and other malicious actors are avoided. Spyware and social engineering are two examples of insider risks that are avoided. The risks and threats identified in the prior risk assessment will be addressed by the plan. Data will not be lost because of improper device decommissioning thanks to this. Protected health information is unaffected by the loss or theft of company assets like mobile phones. Corrupt production data generated by a system failure poses no risk of data loss. On the internet, hackers and other malicious actors are prohibited. Malware and social engineering are examples of insider risks that must be avoided. Risk: The assessment will assist in achieving the following information security goals: classification, honesty, and information accessibility. The current security posture of the Health Network is vulnerable to a variety of potential risks and threats that, if ignored, are likely to influence the three goals. The firm obtains and keeps a colossal amount of information from its buyers, and it must, obviously, stay safe. The extensive and intricate nature of the company's network infrastructure should also be mentioned. Several of its data centers are the locations where it conducts its commercial activities. Third-party management is also utilized in production systems. A higher level of risk exposure is caused by each of these features. If the network infrastructure was not adequately protected, it would be vulnerable to both internal and external attacks. For instance, nefarious individuals are likely to employ strategic strategies to persuade employees, particularly those who are unaware of their intentions, to provide sensitive information that they would use to put critical digital assets in jeopardy. When unauthorized individuals gain access to a crucial part of the system and reveal information that should not be made public, insider attacks pose a risk as well. Additionally, the company runs the risk of losing valuable assets like computers to theft because not everyone is trustworthy. If this occurs, it runs the risk of having some of its sensitive data stolen or made public. There is a risk when sensitive information is shared with third parties who handle parts of the organization's systems. An assailant can undoubtedly think twice about network framework that isn't very much safeguarded by performing man-in-the-center assaults, executing noxious code into the framework, social designing, or whatever else that compromises the privacy, trustworthiness, and accessibility of information sent or put away in the database. Safety: Three production data centers house Health Network's products, ensuring high availability. The data centers house approximately 1,000 production servers, and Health Network employees have access to 650 company-issued laptops and mobile devices. Physical security controls that help identify illegal access should be considered by the business to protect the servers from threats. This includes things like fire suppression, biometric access controls, and surveillance cameras that would help keep data centers physically safe. Since business-issued devices should not be shared or abused by employees, the company should think about implementing security measures. Because of this, it will be able to steer clear of any potential security issues that may arise because of ignorance or any other means by which criminals could gain access to the systems. As part of the policies, they should be discouraged from bringing home devices provided by the company. Even though the company might have some BYOD rules, it should also have policies that say employees can't put software from their own devices on company-issued devices. These measures would make sure that the risks that were highlighted don't happen again. Business Impact: Health Network, Inc. must be aware of the risks that are more likely to be critical to develop a business continuity strategy and the solutions that should be evaluated for inclusion to lessen the company's impact. An examination of how the risks affect business continuity follows. Timeouts on the network: The company would need to know how long it could tolerate a system outage in the event of a hack of the network, servers, or systems. On a size of 1 to 10, the need of recuperation in this situation would be a 10 since it would essentially affect business tasks and congruity. Risk: Data Loss The company would like to know how much data it can save or recover if the network systems are compromised by internet attacks, DDoS attacks, malware, system failure, or any other threat, such as server damage caused by fire or another disaster. System Failure Is a Danger: The company needs to determine whether the external companies or third-party organizations that manage its systems are dependable enough to ensure business continuity. This business influence study has a modest bunch of conditions for this action. Costs of failing to reduce the risks: There may be financial losses because of business disruption if the organization's systems are not restored within the anticipated recovery period. It's also important to note that Health Network, Inc. collects a lot of client data, including personally identifiable information. Under laws like the Gramm-Leach-Bliley Act in the United States and PCI-DSS in the United Kingdom, businesses must take adequate security precautions to prevent breaches of financial information. The company is held accountable for any breach, which results in financial penalties. Failure to comply could result in a monthly fine of up to $25,000, depending on the maximum penalties. Mitigation: A complete procedure will be utilized to moderate the various dangers and perils recorded in this paper, and it Should adjust with ISO/IEC 27001 necessities. The procedures that should be followed by businesses to safeguard the security of information are outlined in ISO/IEC 27001. Implementation of the Control System Within: Internal control mechanisms, such as the creation of procedures and rules, should be considered by management for the purpose of assisting in the prevention of security concerns. For instance, account rules can be used to ensure that only authorized individuals have access to sensitive data at the granular level. In numerous data breach scenarios, attackers mislead employees into sharing sensitive information, which they then use to attack the systems. Accordingly, account access approaches may not be adequate. The company would need to organize educational and training seminars in which all employees, relevant contractors, and third parties would be educated on the most effective security procedures for their job responsibilities to fulfill this requirement. By raising awareness, the organization would be able to avoid risks like phishing within the organization. Encryption of Data: The company must encrypt data while it is in transit and stored to prevent unauthorized access to information security. The company must incorporate encryption technology into all its products to accomplish this. networks to ensure the safe transmission of data from beginning to end. Since decryption would require key pairs, encryption would be so effective at preventing man-in-the-middle attacks that even if an attacker were to intercept communication across the network, the packets they obtained would be worthless. Integration of Physical Security Entry Controls: The data center's interior should only be accessible to authorized personnel. The company needs to make sure that there are enough physical controls in place to accomplish this. Unique mark scanners ought to be used at passages to distinguish approved laborers, and all server farms ought to have Observation and sensors introduced. Access Controls: Over 700 people work for Health Network, Inc., and some of them have access to the most sensitive parts of the system, like databases and servers where sensitive data is kept. To ensure that a database administrator does not access the database outside of the company, all access permissions reserved for that individual must be removed from the system. Implementation of Preventative Controls: The company must ensure that preventative security measures are in place to avoid successful assaults. Data security is most at risk on the Internet. Setup of a firewall is one of the most effective ways to mitigate security issues caused by attacks on a network. To ensure that attacks are quickly detected and stopped, other network security controls like intrusion detection and prevention systems need to be designed appropriately. References: Risk Management "Risk Management". Corporate Finance Institute, 2023, https://corporatefinanceinstitute.com/resources/risk-management/riskmanagement/. Accessed 21 Mar 2023.