Review the NIST Framework document at

Then, create a list of best practices for firewall and VPN man

Response#1 (Leburu)

 

Best Practices for Firewall Rules:

In a firewall rule, the action component decides if it will permit or block traffic. It has an action on match feature. For example, if the traffic matches the components of a rule, then it will be permitted to connect to the network. It is essential to consider the potential security risks when modifying a firewall rule to avoid future issues.      (Agatsuma, S. (2020)

Types of Best Practices: 

formal change procedure:

Firewall rules must be updated for new services and new devices. Before  add or modify any firewall rules, each change that  create requires that  apply the change.

Block traffic by default:

By default, start blocking all traffic, only allowing specific services for the selected services. This approach ensures that the quality of traffic is controlled and reduces the risk of infringement. This behavior is achieved by setting the last rule in the access control list to deny all traffic. This can be done explicitly and indirectly depending on the platform.

Set all explicit firewall rules first:

At the top of the rule base, set the most explicit firewall rules. This is the starting point where traffic is matched. A rule base is established rules that manage what is and what is not permitted through a firewall. Rule bases typically work on a top-down protocol in which the first rule in the list performs its action first. This action is done, so that the traffic permitted by the first rule, will never be assessed by the remainder of the rules.

Set explicit drop rules (Cleanup Rule):

The main purpose of firewalls is to drop all traffic that is not explicitly permitted. As a safeguard to stop uninvited traffic from passing through the firewall, place an any-any-any drop rule Cleanup Rule at the bottom of each security zone context.

Best practices for VPN :

Authentication:

First, if a VPN is the gateway between the network and the Internet, the network is as secure as a VPN. Well-known VPN providers provide security as they wish in the future, but they are just as secure as authentication methods Of course, not only VPN networks.

Latency: 

When properly configured, the VPN can run smoothly without affecting the end user experience. After authentication, employees do not notice its existence. However, diverting all traffic through a third party broker will lead to unavoidable results.

Split Tunneling:

Employees usually have two ways to configure VPN clients. These are complete tunnels and broken tunnels. Throughout the tunnel, all network traffic is forced to pass through the VPN provider, regardless of the destination of the traffic. In a shared tunnel, VPN traffic can only be enforced if the destination is within a private enterprise network. In this way, a shared tunnel separates corporate intranet traffic from private Internet access.

Response#2(Rallabandi)

 

Best practices for firewall

Security:

 Start with Security collect personal information that hold on to information only as long as  have a legitimate business need. Dont use personal information when its not necessary. Make sure  service providers implement reasonable security measures. Insist that appropriate security standards are part of  contracts, and verify compliance, including through cyber security audits of third-party providers.   ( Chaudhary, M. 2020).

Identify:

An organizational understanding to manage cyber security risks to systems, assets, data, and capabilities. This includes understanding the organization’s computer systems and network; the personal information it collects; potential vulnerabilities of the organization’s systems; and the degree of harm that customers may suffer by disclosure of their personal information. By understanding and weighing these risks, an organization can focus and prioritize its cyber security efforts in relation to risk management strategy and business requirements.

Protect:

Implement appropriate safeguards to ensure delivery of critical infrastructure services. This includes providing training to employees regarding cyber security risks and protection; limiting access to systems, data, and assets; using technology to secure data; and maintaining cyber security policies and procedures. Control access to data sensibly, and restrict access to sensitive data. Limit administrative access to non-public information. Require secure passwords and authentication, and insist on complex and unique passwords. This will help guard against brute force attacks. Store passwords securely, e.g., not in plain text in personal email accounts.

Detect:

Implement the appropriate activities to identify when a cyber security event occurred. This includes the monitoring of information systems frequently and testing processes to detect irregular activity. Use industry-tested and accepted methods for cyber security.

Respond:

Develop and implement the appropriate activities to take regarding a detected cyber security event. This includes executing the organization’s processes and procedures concerning a response; coordinating and communicating with internal and external stakeholders regarding the cyber security incident, as well as applicable law enforcement authorities; controlling and mitigating the cyber security incident in an adequate response time; and revisiting the organization’s processes and procedures to incorporate lessons learned from the cyber security incident. Review the law of each state in which  company does business and in which it has customers, as  will need to comply with each state’s various cyber security notification laws.

Recover:

Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were affected due to the cyber security incident. The goal is to help an organization timely recover to normal operations and to minimize the impact of the cyber security incident on the organizations internal and external stakeholders.

Best Practices for VPNs

Only use VPN access when there is a business need. According to NIST (2018), as specified under subcategory PR.AC-3, remote access is to be managed.

Use MFA. Devices that connect to  networks can be used for great harm. MFA should be required for all VPN connections to ensure that only authorized users and devices are connected.

Use only modern and robust VPN protocols. Use of insecure protocols such as PPTP put  network at risk.

Allow only authorized devices to connect via a VPN. Dont let  user connect with their home PC, issue them a company laptop instead. This way the device can still be controlled and protected by the companys IT department.

 

Part 1: Multiple Formats

Download the four zipcodeDemographics files. These files contain the same data but in different formats. Using a text editor examine the files and note differences in their structure. Perform some research to obtain brief definitions of each format, write your definitions stating your referenced source(s). Is any format easier to read compared to the others? If so, why?

Examine the file and characterize it (i.e., pick a format to analyze). Imagine that you must present your findings to an executive committee that wants to know what is important in the data. Prepare a single PowerPoint slide to succinctly characterize the data.

Part 2: Data Wrangling

Data wrangling is the process of manipulating data to change it into a format that can be used for analysis so that the data can be used in automated/computerized analysis tools. There are two major stages: data tidying and data cleaning. Data tidying is the process of transforming data so that it is in a format where it can be readily processed by automated tools. Data cleaning is the process of transforming the data to ensure to the greatest extent possible that it accurately reflects the subject that it pertains to.

Download the University returns_for_figshare_FINAL.csv file. Using a tool such as Excel examine the file. Identify as many issues as you can with the dataset. For issues that you identify develop a strategy (or strategies) as to how they can be dealt with, report the issues and strategies.

Submit an MS Word document with your findings from parts 1 & 2. Also, submit a printed copy at the beginning of the class on the date the assignment is due.

DOWN BELOW ARE THE NEEDED ATTACHMENTS!!!!!!

instructor’s question for class discussion:

What is the importance of regular expressions in data analytics? Also, discuss the differences between the types of regular expressions. Choose two types of regular expressions and discuss the differences between the two. Please be sure to include two or three differences for each. Include how they help manipulate data.

Also, Reply to your classmates:

When replying to your classmate’s posts, offer your opinion on what he/she thinks is the importance of regular expressions, whether you agree or disagree, and why.

1. Discuss the differences between left and right wing extremism.  150 words

2. What is critical infrastructure and key resources?  Explain what items fall in this category and why these items are titled this way.  150 words
3. Conduct research on some initiatives and security measures that have been taken in the aviation industry (everything from the airports to the air planes). Are these measures successful, why or why not? Recommend some other measures that you think can be effective but have not been implemented at this time.  400 words 

 Why is it so important to know your data? Discuss some methods you would implement to better learn and understand your data. What are some advantages to your methods? What are some disadvantages?

Discussion Length (word count): At least 250 words (not including direct quotes).

References: At least two peer-reviewed, scholarly journal references.

 

DEVELOPING INTIMACY WITH YOUR DATA

This exercise involves you working with a dataset of your choosing. Visit the website, browse through the options and find a dataset of interest, then follow the simple instructions to download it. With acquisition completed, work through the remaining key steps of examining, transforming and exploring your data to develop a robust familiarisation with its potential offering:

Examination: Thoroughly examine the physical properties (type, size, condition) of your dataset, noting down useful observations or descriptions where relevant.

Transformation: What could you do/would you need to do to clean or modify the existing data to create new values to work with? What other data could you imagine would be valuable to consolidate the existing data?

Exploration: Using a tool of your choice (such as Excel, Tableau, R) to visually explore the dataset in order to deepen your appreciation of the physical properties and their discoverable qualities (insights) to help you cement your understanding of their respective value. If you dont have scope or time to use a tool, use your imagination to consider what angles of analysis you might explore if you had the opportunity? What piques your interest about this subject?

(You can, of course, repeat this exercise on any subject and any dataset of your choice, not just those on Kaggle.)

Assignment Link: http://book.visualisingdata.com/chapter/chapter-4

 Select one of the three research topics listed and follow the detailed instructions. The paper can be single or double spaced. The paper’s cover page does not count as a page against the maximum number of pages, however, references do.  So you will write on 4 pages, but the 5th page will be the reference. Please check your paper against the Vericite database by submitting it for checking prior to your final submission here.  

CIS 505 discussion post responses.

Respond to the colleagues posts regarding:

After reading about and studying VPNs this week, describe a scenario where you might find a VPN useful in the business world. What are some major concerns you might have as a network manager?

There are two discussions here that need to be responded to thoroughly. Responses must be on APA format 150+words 1-2 legitimate verifiable sources per response.

GS post states the following:

As a company that utilizes VPN for the past 10 years we have found it a productive way for employees to conduct business in a secure fashion. We implemented a RSA token for extra security and this eases executives over security concerns. With our VPN (Checkpoint) we offer two ways to access our internal network:

-RSA token: This is handed out to personnel that use a laptop for business. This 3 part authentication requires username/pin/token code in order to access our network.  This is very secure for a machine that was compromised. Now I said compromised not data that has been transmitted.

-VPN Web: This is usually offered to users that need to access our network temporarily from a desktop.

Now remote access software such as GOTOMYPC have incorporated two-way authentication which has upped the security level and offers the user access from any location with internet access. Our VPN RSA needs the software client installed. We as a company now offer GOTOMYPC to internal employees that wish to work from home, but salesreps still are provided with RSA tokens.

VPN is not a new technology; it is more like a legacy security/connectivity approach of VPN and not conceived for todays world of multi-cloud and mobile configurations and not on premise settings. There has been documentation of VPNS weak link architecture.  The issue centers around the fact that data cant be routed securely at the application level with a VPN. So if your organization is still relying on VPNs to transmit sensitive data over the VPN providers server, then youre taking a big risk that you may be exposing that data to people who shouldnt see it and may compromise it. A study that included researchers from UC Berkeley and the University of South Wales revealed that the vast majority (more than 80 percent) of VPN apps on Android devices wanted access to personal user data.

The research also verified that:

Nearly 40% of the VPN apps injected malware to try to access user data.

84% leaked user traffic.

Around 20% failed to encrypt traffic.

The fact that VPNs simply cant protect privacy to the degree that is required in todays enterprises.

https://www.cpomagazine.com/cyber-security/why-virtual-private-networks-arent-very-private/

RR post states the following:

A scenario where I might find a VPN useful in the business world, would be if I were the CEO of a pharmaceutical company who was looking to do a Merger and Acquisition (M&A) of another company. Without a VPN, the companys data would be vulnerable to hackers who can see data in transit, and eventually reach the companys IP address. If hackers compromise the companys system during the M&A, confidential information may be exposed which could affect the outcome of the M&A.

As a network manager, the main concern I might have is when the company uses VPNs to provide third-party vendors access to their network. When they do, those vendors either have full access or they dont. There are no shades of gray, no ability to give partial access only to required resources. The more servers, applications, and network equipment vendors can access, the more the company has at risk (Howlett, 2019). Other network manager concerns are connection speed and performance decrease, and third-party vendors may not have in-house technical support 

References:

Howlett, T. (2019). 7 common VPN problems: The not-so-good, the bad, and the ugly. Retrieved from https://www.securelink.com/blog/vpn-problems/

BUS 517 discussion post responses.

Respond to the colleagues posts regarding:

Dedicated or Non-Dedicated Resources

You are now deciding on resources for a project team. You have a choice to staff a team of resources who will be dedicated (or allocated) 100% to the project, or staff a team of resources who will be dedicated (or allocated) three days each week to your project. Using information from the readings, explain how you can use either set of resources.

There are two discussions here that need to be responded to thoroughly. Responses must be on APA format 150+words 1-2 legitimate verifiable sources per response.

SW post states the following:

This weeks review is in regards to dedicated project staff versus temporary project staff. The dedicated project team consists of 100% project staff allocation for project activities. The ability to have a support staff that is dedicated to the project with no external activities ensures the project is the main focus. Advantages of a dedicated team are as follows:

Primary focus on tasks, risk mitigation, and results.

Removal of loyalty conflicts due to sharing across multiple roles.

Assurance that project activities can be completed with a consistent set of people.

However, a dedicated team has its negatives to the business more than the project itself.

100% dedication to the project means normal duties are not completed.

oThis can mean a loss of productivity in other parts of the business at the cost of project success.

Can create a Us vs Them dynamic as the dedicated project team builds a sense of ownership of the project results.

Can also create an atmosphere of Project over normal operation creating departmental separation.

As can be seen from the two lists the bonus that arises from a dedicated team benefits the project heavily but in turn, can create undesired assumptions and attitudes in the workplace. Whether this is an outcome that is manageable or one you wish to avoid would depend on understanding the companies governing principles and work environment. Regardless, the ability to maximize the project activities and meet objectives with a consistent team of professionals is a stable and optimal situation for most projects.

A temporary team that works three days a week is the second option for our project. This means that our project staff will provide three days of dedicated work to the project. This type of staffing can fix many of the negative issues to the business advised for the dedicated team. With less of a project first focus, other teams and departments lack the assumptions that the project comes before normal work. Three days a week can mean that project activities need either a focused approach maximizing progress or a longer timeline to avoid missing deadlines. The positives of a dedicated team become your negatives. Shared responsibilities can build an unintentional hierarchy with regards to project tasks and normal work procedures. Loyalty issues arise causing focus issues with project tasks. A good project manager will manage the staff to ensure that dont feel pressure to prioritize their different work hats and get the best out of the staff during the three days.

KR post states the following:

In deciding which resources is best suitable for this EHR Project team a dedicated support staff was chosen. The support staff will carryout the project tasks identified. The implementation of this system is critical to the organization and this structure will facilitate a successful project implementation. experienced staffing will be strategically selected in house. 

As experience staffing will be required and select in house 1st before deciding to outsource missing expertise. Staffing is one of the partial risk profile which will required great emphasis. Projects and project management are integrative by nature for example, When additional risks associated with various staffing alternatives are identified, then one or more of those processes may be revisited. Human Resources along with the head of department will oversee staffing alternatives. This includes moving people to different assignments, outsourcing some of the work, or replacing team members who leave during EHR Project. 

References:

Larson, E. W., & Gray, C. F. (2018). Project Management; The Managerial Process (7th Edition ed.). New York: McGraw-Hill.

A Guide to the Project Management Body of Knowledge (PMBOK Guide) – Sixth Edication

 

In your initial post, discuss the differences between Virtualization and Cloud Computing.

Please find one organization that has recently adopted virtualization and summarize their reasons for taking this approach. What challenges did they face?

Respond substantively to at least two other students’ posts. Compare and discuss the key challenges that other classmates listed in their initial post. Were they similar to other organizations? If not, why? If so, how?

Good forum interaction!

*please remember to include at least one credible scholarly reference with your initial post!