You are a cybersecurity analyst working at a prominent regional hospital. On Monday morning, the organization’s technology help desk received a call from Dr. John Beard, a long-time resident physician. Dr. Beard called them to report that his company laptop was stolen from his car after he stopped to work out at a local gym on his way home from the office.

Case Study Activity Guidelines and Rubric

Overview

In this case study assignment, we will continue to investigate the Fundamental Security Design Principles at work in a real-world scenario. Through the lens of data protection, we will analyze the following principles:

Least Privilege

Layering (Defense in Depth)

Fail-Safe Defaults / Fail Secure

Modularity

Usability

Case Study Scenario

You are a cybersecurity analyst working at a prominent regional hospital. On Monday morning, the organization’s technology help desk received a call from Dr. John Beard, a long-time resident physician. Dr. Beard called them to report that his company laptop was stolen from his car after he stopped to work out at a local gym on his way home from the office.

A representative from the help desk informed you of the theft and also mentioned that Dr. Beard stated that his laptop case contained a USB thumb drive that he purchased to “back up” important patient files he saved onto his laptop. Dr. Beard also revealed that his daily planner “might have” been in the bag, and that the planner had his hospital computer user name and password written on the back cover. Prior to ending the call, Dr. Beard told the representative that he would call her back if his daily planner turned up.

As your conversation with the help desk representative wound down, she commented that Dr. Beard had many different computer “issues” that keep her team busy. She recalled talking to Dr. Beard about the hospital’s policy against accessing patient files remotely, and his annoyance with her inability to help him “get work done” while away from the hospital. And just a week ago, a junior member of her team completed a service ticket to reconfigure Dr. Beard’s laptop to grant him administrative rights. The service request stuck out because it did not have a “reason” indicated (a company policy requirement), but was still approved by James Davis, the hospital’s senior system administrator and close personal friend of Dr. Beard.

Prompt

After reading the scenario above, complete the Fundamental Security Design Principles mapping table in the Case Study Template and answer the short response questions. You’ll notice that the listed Fundamental Security Design Principles differ from those presented in previous activities. In the cybersecurity trade, there are many different design principles and frameworks. Successful practitioners learn to work with many different (but conceptually similar) principles to achieve their security goals.

Specifically, you must address the critical elements listed below:

Fundamental Security Design Principles Mapping: Fill in the table in the Module Two Case Study Template by completing the following steps for each control recommendation:

Specify which Fundamental Security Design Principle best applies by marking all appropriate cells with an X.

Indicate which security objective (confidentiality, availability, or integrity) best reflects your selected control recommendation.

Explain your choices in one to two sentences, providing a selection-specific justification to support your decision.

Short Response Questions:

How might you work with someone like Dr. Beard to cultivate a security mind-set that is more in line with the organization’s ethical norms? Hint: Consider his attitude, his past behaviors, and his opinion about organizational policies.

How would you help the hospital better secure its patient files? Make sure to incorporate at least one data state (data-at-rest, data-in-use, or data-in-motion) and one of the control recommendations from your completed table in your response.

What to Submit

Submit your completed Fundamental Security Design Principles map and short response answers in the Module Two Case Study Template. Your submission should be 1–2 pages in length (plus a cover page and references, if used) and written in APA format. Use double spacing, 12-point Times New Roman font, and one-inch margins. Use a filename that includes the course code, the assignment number, and your name—for example, CYB_100_1- 4_Neo_Anderson.docx.

Module Two Case Study Activity Rubric

Criteria Proficient (100%) Needs Improvement (65%) Not Evident (0%) Value

Mapping: Fundamental Security Design Principle Specifies which Fundamental Security Design Principle applies to at least 8 of the control recommendations Specifies which Fundamental Security Design Principle applies to fewer than 8 of the control recommendations Does not address critical element, or response is irrelevant 20

Mapping: Security Objective Indicates which security objective (CIA) best applies to 8 or more control recommendations Indicates which security objective (CIA) best applies to fewer than 8 control recommendations Does not address critical element, or response is irrelevant 20

Mapping: Explain Explains choices with relevant justifications for at least 8 of the control recommendations Explains choices with relevant justifications for fewer than 8 of the control recommendations Does not address critical element, or response is irrelevant 25

Short Response: Cultivating Mind-Set Explains how you might work with someone like Dr. Beard to cultivate a security mind-set that is more in line with the organization’s ethical norms Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 10

Short Response: Better Secure Explains how you would help the hospital better secure its patient files incorporating at least one data state (data-at-rest, data-in-use, or data-in-motion) and one of the control recommendations from your table Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail Does not address critical element, or response is irrelevant 20

Articulation of Response Submission has no major errors related to citations, grammar, spelling, or organization Submission has some errors related to citations, grammar, spelling, or organization that negatively impact readability and articulation of main ideas Submission has critical errors related to citations, grammar, spelling, or organization that prevent understanding of ideas 5

Total: 100%

Requirements: 2-3 PAGES LENGTH

CYB 200 Module Two Case Study Template

After reviewing the scenario in the Module Two Case Study Activity Guidelines and Rubric document, fill in the table below by completing the following steps for each control recommendation:

Specify which Fundamental Security Design Principle best applies by marking all appropriate cells with an X.

Indicate which security objective (confidentiality, availability, or integrity) best reflects your selected control recommendation.

Explain your choices in one to two sentences, providing a selection-specific justification to support your decision.

After you have completed the table above, respond to the following short questions:

How might you work with someone like Dr. Beard to cultivate a security mind-set that is more in line with the organization’s ethical norms? Hint: Consider his attitude, his past behaviors, and his opinion about organizational policies.

How would you help the hospital better secure its patient files? Make sure to incorporate at least one data state (data-at-rest, data-in-use, or data-in-motion) and one of the control recommendations from your completed table in your response.

CIA Triad and Fundamental Security Design Principles The terms listed below are essential in the field of cybersecurity and will be a topic of conversation and application throughout the program. It is therefore important for you to familiarize yourself with these terms and their definitions. Note that the CIA triad is sometimes referred to as the tenets of cybersecurity. The Fundamental Security Design Principles are sometimes called fundamental design principles, cybersecurity first principles, the cornerstone of cybersecurity, and so on. CIA Triad Information that is secure satisfies three main tenets, or properties, of information. If you can ensure these three tenets, you satisfy the requirements of secure information (Kim & Solomon, 2013).  Confidentiality Only authorized users can view information (Kim & Solomon, 2013).  Integrity Only authorized users can change information (Kim & Solomon, 2013).  Availability Information is accessible by authorized users whenever they request the information (Kim & Solomon, 2013). Fundamental Security Design Principles These principles offer a balance between aspirational (and therefore unobtainable) “perfect security,” and the pragmatic need to get things done. Although each of the principles can powerfully affect security, the principles have their full effect only when used in concert and throughout an organization. These principles are a powerful mental tool for approaching security: one that doesn’t age out of usefulness or apply only to a few specific technologies and contexts; one that can be used for architecture, postmortem analysis, operations, and communication. The principles are ultimately only one piece in the security practitioner’s toolkit, but they are a flexible piece that will serve different roles for different people (Sons, Russell, & Jackson, 2017).  Abstraction Removal of clutter. Only the needed information is provided for an object-oriented mentality. This is a way to allow adversaries to see only a minimal amount of information while securing other aspects of the model (Tjaden, 2015).  Complete Mediation All accesses to objects should be checked to ensure that they are allowed (Bishop, 2003).  Encapsulation The ability to only use a resource as it was designed to be used. This may mean that a piece of equipment is not being used maliciously or in a way that could be detrimental to the overall system (Tjaden, 2015).

 Fail-Safe Defaults / Fail Secure The theory that unless a subject is given explicit access to an object, it should be denied access to that object (Bishop, 2003).  Information Hiding Users having an interface to interact with the system behind the scenes. The user should not be worried about the nuts and bolts behind the scenes, only the modes of access presented to them. This topic is also integrated with object-oriented programming (Tjaden, 2015).  Isolation Individual processes or tasks running in their own space. This ensures that the processes will have enough resources to run and will not interfere with other processes running (Tjaden, 2015).  Layering Having multiple forms of security. This can be from hardware or software, but it involves a series of checks and balances to make sure the entire system is secured from multiple perspectives (Tjaden, 2015).  Least Astonishment (Psychological Acceptability) Security mechanisms should not make the resource more difficult to access than when security mechanisms were not present (Bishop, 2003).  Least Privilege The assurance that an entity only has the minimal amount of privileges to perform their duties. There is no extension of privileges to senior people just because they are senior; if they don’t need the permissions to perform their normal everyday tasks, then they don’t receive higher privileges (Tjaden, 2015).  Minimization of Implementation (Least Common Mechanism) Mechanisms used to access resources should not be shared (Bishop, 2003).  Minimize Trust Surface (Reluctance to Trust) The ability to reduce the degree to which the user or a component depends on the reliability of another component (Bishop, 2003).  Modularity The breaking down of larger tasks into smaller, more manageable tasks. This smaller task may be reused, and therefore the process can be repurposed time and time again (Tjaden, 2015).  Open Design The security of a mechanism should not depend on the secrecy of its design or implementation (Bishop, 2003).

 Separation (of Domains) The division of power within a system. No one part of a system should have complete control over another part. There should always be a system of checks and balances that leverage the ability for parts of the system to work together (Tjaden, 2015).  Simplicity (of Design) The straightforward layout of the product. The ability to reduce the learning curve when analyzing and understanding the hardware or software involved in the information system (Tjaden, 2015).  Trust Relationships A logical connection that is established between directory domains so that the rights and privileges of users and devices in one domain are shared with the other (PC Magazine, 2018).  Usability How easy hardware or software is to operate, especially for the first-time user. Considering how difficult applications and websites can be to navigate through, one would wish that all designers took usability into greater consideration than they do (PC Magazine, 2018). References Bishop, M. (2003). Computer security: Art and science. Boston, MA: Addison-Wesley Professional. Kim, D., & Solomon, M. G. (2013). Fundamentals of information systems security (2nd ed.). Burlington, MA: Jones & Bartlett Publishers. PC Magazine. (2018). Encyclopedia. Retrieved from https://www.pcmag.com/encyclopedia Sons, S., Russell, S., & Jackson, C. (2017). Security from first principles. Sebastopol, CA: O’Reilly Media, Inc. Tjaden, B. C. (2015). Appendix 1: Cybersecurity first principles. Retrieved from https://users.cs.jmu.edu/tjadenbc/Bootcamp/0-GenCyber-First-Principles.pdf

Collepals.com Plagiarism Free Papers

Are you looking for custom essay writing service or even dissertation writing services? Just request for our write my paper service, and we'll match you with the best essay writer in your subject! With an exceptional team of professional academic experts in a wide range of subjects, we can guarantee you an unrivaled quality of custom-written papers.

Get ZERO PLAGIARISM, HUMAN WRITTEN ESSAYS

Why Hire Collepals.com writers to do your paper?

Quality- We are experienced and have access to ample research materials.

We write plagiarism Free Content

Confidential- We never share or sell your personal information to third parties.

Support-Chat with us today! We are always waiting to answer all your questions.