Incidental Insurance Ltd.

Incidental Insurance Ltd.. Will Edge and Abdul Kadir.

Executive summary. This PowerPoint presents a critical assessment of Incidental Insurance Ltd.'s cybersecurity and information management. The findings highlighted within this power point show various vulnerabilities across the organization's infrastructure, leading to significant data breaches, financial losses, and reputational damage. the Key findings include: Malware Attacks and Phishing Incidents Application Layer Attacks and DoS Incidents DNS Redirection and Domain Hijacking Database Breach and Poor Authentication Practices Data Loss and Inadequate Backup Procedures Physical Security Concerns Network and System Inefficiencies.

Obligation. Compliance and Regulatory Adherence: Ensure compliance with industry standards (GDPR, data protection laws) and regulatory requirements to the insurance sector. Implement measures to protect data and sensitive information in line with legal obligations. Protection of Client and Company Data: Safeguard client information and company-owned intellectual property through security measures. Enforce encryption, access controls, and regular audits to protect sensitive data. Continuous Monitoring and Mitigation: Conduct regular risk assessments, vulnerability scans, and penetration tests to identify and address security weaknesses. Establish a proactive security posture to mitigate future risks and vulnerabilities. Employee Training and Awareness: Provide comprehensive training programs to staff regarding security best practices, phishing awareness, and incident reporting. Foster a culture of security consciousness amongst all employees..

Scope. Security Enhancement: Identify and implement advanced security solutions to combat malware attacks, phishing attempts. Enhance network security measures, including firewalls, intrusion detection systems. Data Protection and Recovery Strategies: Develop data protection strategies, including regular backups, redundancy configurations, and disaster recovery plans. Test and ensure the effectiveness of backup and recovery procedures in real-world scenarios. Physical Security Strengthening: Improve physical security measures during off-peak hours to prevent theft or unauthorized access to sensitive information. Review and enhance access controls and surveillance systems in critical areas. Network and System Upgrades: Upgrade systems to handle increased loads, preventing network and hardware failures. Implement proactive monitoring tools to predict and prevent system/network failure and disruptions. Employee Training and Resource Allocation: Provide necessary training and resources to personnel responsible for IT operations, security, and compliance. Ensure adequate staffing and support for the implementation of security measures across all departments..

Asset management. Virtual assets Customer Data Description: Personal information of clients. Location: Sheffield Data Center. Responsible Party: IT Security Team. Intellectual Property Description: Company-owned proprietary data. Location: Head Office. Responsible Party: Data Governance Team. Databases Description: MySQL databases in Sheffield. Location: Sheffield Data Center. Responsible Party: Database Administrators..

Further asset management. Network Assets: Routers and Switches Description: Cisco-based network infrastructure. Location: All Offices. Responsible Party: Network Team. VPNs Description: Site-to-site VPNs and remote access VPNs. Location: All Offices. Responsible Party: IT Security Team..

Risk management. System Description: As a company you operate a multinational company with three offices (Sheffield, Edinburgh, Kansas City), a network infrastructure including Cisco routers, Microsoft Active Directory, Linux LDAP servers, MySQL databases. As the company is across the united kingdom and the united states a hybrid approach to this risk management would be beneficial. In this hybrid approach it will contain iso 27001 and NIST. We have broken this up into sections of threats, vulnerabilities, likelihood assessment, impact assessment, risk analysis. Risk mitigation strategies..

Risk management. Threat Sources: External threats: Malicious actors exploiting network vulnerabilities. Insider threats: Unauthorized access or malicious intent by employees. Environmental threats: Physical incidents, such as floods or hardware failures..

Risk management. . Likelihood Assessment: High Likelihood: Malware attacks given recent incidents. Insider threats due to concerns about data breaches. Environmental threats, especially without a robust disaster recovery plan. Medium Likelihood: Firewall breaches and DNS redirections may persist, leading to unauthorized access. Database breaches through phishing attacks on weak passwords. Network and system performance issues due to the absence of proactive measures..

Risk management. . Risk Mitigation Strategies: Implement advanced malware protection and conduct regular security awareness training. Strengthen firewall configurations and implement intrusion detection systems. Enhance DNS security to prevent redirection attacks. Enforce stronger password policies and implement two-factor authentication for sensitive systems. Develop a comprehensive disaster recovery plan. Regularly update risk assessments based on changes in the threat landscape. Implement a feedback loop for incident response to enhance risk management practices. Financial Risk Mitigation: Allocate budget for redundancy measures and backup improvements. Provide a budget for these mitigations to stop financial losses due to downtime and data breaches..

Risk register.

Conclusion. Hierarchy. Incidental Insurance Ltd. faces security vulnerabilities across various fronts, leading to data breaches, financial losses, and reputational damage. Urgent action is required to fortify security measures, improve backup strategies, reinforce physical security, and upgrade network infrastructure to prevent future incidents and safeguard the company's operations and reputation. The recommendations provided serve as a strategy for stronger security measures. By implementing security measures, enhancing data protection protocols, strengthening physical security, and investing in network upgrades, Incidental Insurance Ltd. can proactively mitigate risks and losses.