Category: Cyber Security

GitHub – rapid7/metasploitable3: Metasploitable3 is a VM that is built from the

GitHub – rapid7/metasploitable3: Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.

Complete Project 1-3 to 1-5
Project 1-3
Configure Microsoft Windows Sandbox
Time

Complete Project 1-3 to 1-5
Project 1-3
Configure Microsoft Windows Sandbox
Time Required: 15 minutes
Objective: Given a scenario, implement host or application security solutions.
Description: A sandbox is an isolated virtual machine: anything run within a sandbox will
impact only the virtual machine and not the underlying computer. The Microsoft Windows
Sandbox first became available in Windows 10 Version 1903 released in 2019, and
additional features have been added with recent Windows 10 updates to provide even
more control.
Note 14
Although separate programs can perform a sandbox function, the Windows Sandbox has
the advantages of being included as part of Windows, so nothing has to be downloaded and
installed. It relies on the Microsoft hypervisor to run a separate kernel that isolates the
Windows Sandbox from the host. This makes it more efficient since it can take advantage of
the Windows integrated kernel scheduler, smart memory management, and a virtual GPU.
Once you close the Windows Sandbox, nothing remains on your computer; when you
launch Windows Sandbox again, it is as clean as new.
In this project you will configure the Windows Sandbox to use with this book.
Caution
You must be running Windows 10 Professional, Enterprise, or Education (not Home)
Version 1903 or higher. To determine which version you are running, click Settings, then
System, and then About. If you are not using the correct version, skip to the next project to
create a different virtual machine.
1.1
First check if your system has virtualization turned on. Right-click the taskbar (at
the bottom of the screen) and select Task Manager.
2.2
Click the Performance tab.
3.3
Under Virtualization, it must say “Enabled.” If it says “Disabled,” you will need to
reboot and enter your BIOS or UEFI and turn on virtualization.
Note 15
With older BIOS, you may also need to disable other settings, such as Hyper-threading.
4.4
Now enable Windows Sandbox. In the Windows search box on the taskbar,
enter Windows Features to open the Windows Features window.
5.5
Click the Windows Sandbox check box to turn on this feature.
6.6
To launch Windows Sandbox, click Start, and scroll down to Windows Sandbox,
and then click Windows Sandbox. A protected virtual machine sandbox that looks
like another Windows instance will start, as shown in Figure 1-8.
Figure 1-8
Windows sandbox
Source: Used with permissions from Microsoft
7.7
Explore the settings and default applications that come with the Windows
Sandbox.
8.8
You can download a program through the Microsoft Edge application in Windows
Sandbox. (Edge is included within Windows Sandbox along with a handful of other
Windows applications, including access to OneDrive.) Open Edge and go
to www.google.com to download and install the Google Chrome browser in the
Windows Sandbox.
Note 16
You can also copy an executable file from your normal Windows environment and then
paste it to the Windows Sandbox desktop to launch it.
9.9
After the installation is complete, close the Windows Sandbox.
10.10
Now relaunch the Windows Sandbox. What happened to Google Chrome? Why?
11.11
Close all windows.
Project 1-4
Create a Virtual Machine of Windows 10 for Security
Testing—Part 1
Time Required: 25 minutes
Objective: Given a scenario, implement host or application security solutions.
Description: If you were unable to install the Windows Sandbox in Project 1-3, a different
virtual machine can be created in which new applications can be installed or configuration
settings changed without affecting the base computer. In a virtual machine environment,
the “host” computer runs a “guest” operating system. Security programs and testing can
be conducted within this guest operating system without affecting the regular host
operating system. In this project, you create a virtual machine using Oracle VirtualBox
software.
1.1
Open a web browser and enter the URL www.virtualbox.org (If you are no longer
able to access the site through this web address, use a search engine to search for
“Oracle VirtualBox download.”)
2.2
Click Downloads (or a similar link or button).
3.3
Under VirtualBox binaries, select the latest version of VirtualBox to download for
your specific host operating system. For example, if you are running Windows,
select the version for “Windows hosts.”
4.4
Under VirtualBox x.x.x Oracle VM VirtualBox Extension Pack, click All supported
platforms to download the extension package.
5.5
Navigate to the folder that contains the downloads and launch the VirtualBox
installation program VirtualBox-xxx-nnnnn-hhh.exe.
6.6
Accept the default configurations from the installation wizard to install the
program.
7.7
If you are asked “Would you like to install this device software?” on one or more
occasions, click Install.
8.8
When completed, click Finish to launch VirtualBox.
9.9
Now install the VirtualBox extensions. Click File and then click Preferences.
10.10
Click Extensions.
11.11
Click the Add a package icon on the right side of the screen.
12.12
Navigate to the folder that contains the extension pack downloaded earlier to
select that file. Click Open.
13.13
Click Install. Follow the necessary steps to complete the default installation.
14.14
Remain in VirtualBox for the next project to configure VirtualBox and install the
guest operating system.
Project 1-5
Create a Virtual Machine of Windows 10 for Security
Testing—Part 2
Time Required: 20 minutes
Objective: Given a scenario, implement host or application security solutions.
Description: After installing VirtualBox, the next step is to create the guest operating
system. For this project, Windows 10 will be installed. Different options are available for
obtaining a copy of Windows:
 A retail version of the software can be purchased.
 If you or your school is a member of the Microsoft Azure Dev Tools for Teaching
program, the operating system software and a license can be downloaded. See
your instructor or lab supervisor for more information.
 A 90-day evaluation copy can be downloaded and installed from the Microsoft
TechNet Evaluation Center (www.microsoft.com/en-US/evalcenter/evaluate-
windows-10-enterprise).
1.1
Obtain the ISO image of Windows 10 using one of the preceding options and save it
on the hard drive of the computer.
2.2
Launch VirtualBox.
3.3
Click New.
4.4
In the Name: box, enter Windows 10 as the name of the virtual machine.
5.5
Be sure that the Type: box displays Microsoft Windows and the Version: box
changes to Windows 10 (xx-bit). Click Next.
6.6
Under Memory size, accept the recommended size or increase the allocation if you
have sufficient RAM on your computer. Click Next.
7.7
Under Hard disk, accept Create a virtual hard drive now. Click Create.
8.8
Under Hard drive file type, accept the default VID (VirtualBox Disk Image).
Click Next.
9.9
Under Storage on physical hard drive, accept the default Dynamically allocated.
Click Next.
10.10
Under File location and size, accept Windows 10. Click Create.
11.11
Now the configuration settings for the virtual machine are set. Next you will load
the Windows 10 ISO image. Click Settings.
12.12
In the left pane, click Storage.
13.13
Under Controller: click Empty.
14.14
In the right page under Attributes, click the icon of the optical disc.
15.15
Click Choose Virtual Optical Disk File.
16.16
Navigate to the location of the Windows 10 ISO file and click Open.
17.17
Click OK.
18.18
Click Start to launch the Windows 10 ISO.
19.19
Follow the Windows 10 installation wizard to complete the installation.
20.20
To close the Windows 10 guest operating system in VirtualBox, click File and then
click Exit.
21.21
Close all window

Week One: Assignment
Hide Assignment Information
Instructions
This is an individ

Week One: Assignment
Hide Assignment Information
Instructions
This is an individual assignment.
There are a large number of tools for wireless security assessments. For this assignment pick a tool and explore it’s functions in depth. The Kali Linux distribution is a good source of wireless related tools. You can use your Kali VM in the Infosec Learning Environment or a local VM. You can also use another platform.
For the tool you select provide the following:
Name of the tool
Explain how it is used
Screenshots (must be your own and not from the Internet)
Legal ramifications of using the tool
Optional screencast of the tool in action
File Submission: lastname-w1_assg.docx
Note: The intent is for students to try something at home. If you don’t have the resources at home you can use the Kali in Infosec learning for more of a walkthrough, there is no wireless network in the Infosec Learning space. You can earn full credit with either option.
Due on Jul 14, 2024 11:59 PM
Hide Rubrics
Rubric Name: Assignment (Week1)
Print
Criteria
Exceeds Expectations
Meets Expectations
Needs Improvement
Criterion Score
Screenshots
15 points
Provided your own screenshots.
11 points
Provided some screenshots or screenshots were from the internet.
4 points
Does not provide any screenshots.
Score of Screenshots,
/ 15
Tool Assessmennt
10 points
All of the points in the assignment addressed.
7 points
Some of the points in the assignment addressed.
3 points
None of the points in the assignment addressed.
Score of Tool Assessmennt,
/ 10
Total
Score of Assignment (Week1),

Discussion 1: (200 Words)
Active Directory is a program that manages permissions

Discussion 1: (200 Words)
Active Directory is a program that manages permissions and access to network resources on Windows operating systems. Describe its main functionalities. 
Discussion 2: (100 Words)
Agree or Disagree? Why?
Active Directory is a program that manages permissions and access to network resources on Windows operating systems. Describe its main functionalities.
The heart of Windows networks is Microsoft’s Active Directory (AD), which handles more than permissions. Azure Active Directory (AAD) is one of the types. Active directory creates accounts, stores data, and grants group permissions. Authentication and authorization validate user login credentials and determine file, printer, and application access rights. Domain members’ security, software deployment, and desktop configurations are defined by Group Policy. For easy access, directory services centralize domain object data (users, groups, computers).
Basically, AD streamlines administration enforces access control and ensures a consistent user experience across your Windows domain.
Reference.
(https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/group-policy-objectsLinks to an external site.).
DIscussion 3: (50 Words) (Ch.6 PPT)
1.     Explain the boot process of the Windows operating systems.

Please Seperate Each Response
Discussion 1: (205 Words)
A key component to any c

Please Seperate Each Response
Discussion 1: (205 Words)
A key component to any cybersecurity program is management of the “day to day” operations.
Instructions for Initial Post:
Thinking about what needs to take place at an organization regarding cybersecurity operations, list out at least three (3) periodic checks that should take place either on a daily, weekly, monthly or quarterly basis. In this list, detail WHY the activity needs to take place and what the expected/desired result should be if things are operating successfully.
Discussion 2: (100 Words)
Agree or Disagree? Why?
Implementing regular checks to guarantee the continuous protection and integrity of information systems is necessary for a business to maintain strong cybersecurity operations. Regular inspections are essential for fast threat identification and reaction. By checking firewall and intrusion detection system (IDS) logs on a regular basis, one can detect any security events early on and take prompt action in response to any suspicious activity or unauthorized access attempts. The goal is to make sure that all logs are examined without any indications of erroneous or malicious activity, and that any anomalies found are quickly looked into and fixed. Daily antivirus and anti-malware scans are also necessary to keep system integrity intact by finding and eliminating any new viruses or malware that may have gotten past first defenses. The goal is to finish the scans without finding any new risks; if any are discovered, they should be isolated and eliminated before looking into the source of the infection.
Ensuring the dependability and security of systems and data is the main goal of weekly checks. It is ensured that data can be properly restored in the event of a ransomware attack, hardware failure, or data corruption by routinely validating backups. The anticipated outcome is full and working backups, with any problems fixed and preventative actions taken to guarantee continued dependability. A weekly evaluation of patch management is also necessary to safeguard systems from the most recent exploits and vulnerabilities. To reduce the possibility of exploitation due to unpatched vulnerabilities, all systems should have the most recent fixes installed.
The purpose of the monthly checks is to keep security measures up to date with organizational modifications and new threats. Monthly user access evaluations lower the risk of insider threats and unauthorized access by ensuring that only authorized individuals have access to critical data. The goal is to preserve the least privilege principle by ensuring that access privileges are in line with present work duties and that any superfluous or out-of-date permits are eliminated. Additionally, keeping security policies up to date and relevant in the face of evolving risks and business needs is ensured by routine reviews and updates. The anticipated outcome is that policies are current, understandable, and practical; staff members are informed of any necessary modifications, and compliance is tracked.
Quarterly inspections include in-depth evaluations and drills for readiness. Regular vulnerability assessments and penetration tests assist in locating and fixing possible gaps in the organization’s security posture before attackers may take advantage of them. A thorough report outlining any vulnerabilities is the intended result, along with remediation actions to fix found problems and enhance the security posture in following testing. Furthermore, by testing the incident response strategy on a regular basis, the company may minimize potential harm and recovery time by ensuring that it is ready to address cybersecurity incidents. The anticipated outcome is a well-trained incident response team, a well-executed response strategy, and the identification and correction of any weaknesses or potential improvement areas.
Through the implementation of these regular assessments, companies can greatly improve their cybersecurity operations. The organization’s overall security posture is strengthened by this proactive strategy, which guarantees the identification and mitigation of possible threats, data integrity, and compliance with security policies and best practices.
Reference:
Fannon, R. (2023, July 12). Best practices for an effective cybersecurity strategy. CSO Online.
https://www.csoonline.com/article/644796/best-practices-for-an-effective-cybersecurity-strategy.htmlLinks to an external site.
Discussion 3: (205 Words)
Vulnerability management is a key ongoing effort that should be part of all cybersecurity programs. Identifying the configuration of assets and patches required is an important hardening activity.
Instructions for Initial Post:
A vulnerability management program can be wide and detailed, requiring tools and process in order to be successful. What are three activities required of a vulnerability management process that are critical for success? Don’t consider exact tools or technology at this point, the goal is to flesh out the overall key process steps. Describe them and give some details on those activities based on best practices.
Discussion 4: (100 Words)
Agree or Disagree? Why? 
1) Asset Identification and Performing Vulnerability Scan
When thinking about vulnerability management one of the first things thought about should be “What does the organization have that is vulnerable?” This is where maintaining a list of assets is crucial for the success of vulnerability management. Having a list of assets and keeping those assets updated when completing a vulnerability scan is a practice security teams should be prioritizing so there is a reflective date and time of when a scan was last performed and on which assets it was performed on. Other information should be kept in the asset list as well such as the version of the asset, what patches have been performed already, and maybe even setting configurations. Performing a vulnerability scan could be another step in the management process, but including it here seemed important. Performing the vulnerability scan should also confirm which assets in the asset list are functioning. If you perform a vulnerability scan on a system and it does not show up but is in the asset list, you might have a problem or documentation is not correct. The scan will identify information such as open ports, which services are running, and find known vulnerabilities in the systems (Rapid7, 2020).
2) Assess Vulnerability Risk and Prioritization
Once vulnerabilities are identified, it becomes important to assess the risk of each vulnerability to ensure the vulnerabilities are dealt with accordingly. Vulnerability management platforms such as CVSS (Common Vulnerability Scoring System) will provide scores and risk ratings based on the severity of the risk. According to Rapid7 (2020), some risk assessment factors are as follows: “Could someone exploit a vulnerability from the internet, what is the difficulty of exploiting a vulnerability, what would the impact on the business be if this vulnerability was exploited, how long has the vulnerability been  on the network?” etc. When prioritizing these vulnerabilities is is important to keep in mind aspects such as asset exposure, how available the asset it, and how critical the asset is to the organization (Rapid7, 2020).  
3) Address/Remediate and Mitigate
Rapid7 (2020) gives great insight on different ways to treat vulnerabilities which are: Remediation, Mitigation, and Acceptance. Remediation is completely fixing or patching a vulnerability so it can not longer be exploited and is the outcome most organizations would like to have. Mitigation efforts is lessening the probability of a vulnerability being exploited which should be done when fix or patch is not ready available. This is not a full proof  remediation effort as the vulnerability could still be exploited. Acceptable is the final way to treat vulnerabilities. This effort is only justified when a vulnerability is considered a low risk where the cost of fixing the vulnerability is much greater than the cost that the organization would sustain IF an exploit were to occur. All of these processes are risk reduction measures. One important aspect to keep in mind here is being notified when a risk reduction effort is completed. 
Rapid7. (2020). What is Vulnerability Management and Vulnerability Scanning. Rapid7. https://www.rapid7.com/fundamentals/vulnerability-management-and-scanning/

Prepare a report analyzing a case study.
Select a recent case study (last 5 year

Prepare a report analyzing a case study.
Select a recent case study (last 5 years) where a major security breach happened to a company. In 100 words or more, describe the security breach, what happened, how much was lost, etc.
Describe the consequences that the company had to face because of the breach. (50 + words)
What did the company do to rectify the breach including public relations. (50+ words)
What could the company have done to prevent the breach in the first place? (100+ words)

Please read Chapter 2, and write a double-spaced paper containing approximately

Please read Chapter 2, and write a double-spaced paper containing approximately 500-700 words in paragraph form answering the questions below. There will be no penalty for writing more than 700 words. Your paper should contain proper grammar, be free of spelling errors, and reflect critical thinking.
You should apply what you read in the textbook and at least two scholarly peer-reviewed resources to your writing (in the form of both paraphrasing and direct quotes using correct APA in-text citations).
Your writing needs to adhere to the APA 7th edition manual for in-text citations and the corresponding reference section at the end of all your responses (including initial and peer responses).
Include all elements of a professional format, which includes, a cover page, an introductory paragraph with clear thesis statements outlining the body of the paper to include logical flow from the clear thesis statements, and a concluding paragraph with a recap of main themes. Refer to the APA 7th edition sample paper for further clarification.
For this assignment, a paragraph is defined as 5-9 complex sentences of approximately 100-150 words each, for a total of 500-700 words.
Assignment: (Theoretical Foundations of Security)
In this chapter, you learned about the Origins and Foundations of Security. In this assignment, you will apply this information by answering the following questions in writing an essay between 500-700 words. There will be no penalty for writing more than 700 words.
questions to be answered:
1. How does rational choice theory explain the decision-making process in criminal behavior? Discuss the strengths and limitations of this theory in understanding criminal actions.
2. Explain the components of the crime triangle model (opportunity, offender, target/victim). How can understanding this model aid in preventing criminal incidents?
3. Discuss the main principles of deterrence theory and its application in preventing crime. How effective is deterrence in deterring individuals from engaging in criminal activities?
Please also include what you found most interesting about the chapter. Please use at least two additional references other than your course textbook. Please add your name, Introduction to Security 0235, your instructor’s name, and the date to the cover page of your paper.
Please click on the links below to view the video and to stimulate your thinking concerning the subject matter. The videos will assist you with understanding some of the major concepts in Chapter.

Please Seperate Each Response
Discussion 1: (205 Words)
Incident Response Readin

Please Seperate Each Response
Discussion 1: (205 Words)
Incident Response Readiness is a key element to any cybersecurity program. This includes creating an incident response plan, provide training, etc.
Instructions for Initial Post:
Regarding incident Response – it can be argued that “Preparation” is the most important step.  Pick and discuss three things that you feel are the most important things to have in place BEFORE an incident takes place.
The creation of an incident response plan certainly tops the list. When discussing the Plan, focus on at least 2 sections of the incident response plan that needs to be well done.  
For the other two preparation tasks, focus on preparation that is outside of the Incident Response Plan itself.
Discussion 2: (100 Words)
Agree or Disagree? Why?
When thinking about an incident response from a preparedness standpoint (before an incident occurs) it is important to already have a plan…or somewhat of a plan put in place. It can be implied when incidents happen, the IR (Incident Response) plan will be able to be modified to fit the needs of incidents along the way. Ultimately, an organization would want to improve their incident response “readiness” over time. 
1) Incident Response Plan in Place
Two aspects of the incident response plan that should be well done is the creation of the team and the response procedures.
One of the most important aspects of being prepared for an incident is making sure they have an incident response plan in place.  As part of the incident response plan, your team (below) will need to have response procedures. Responders will need to have a way to identify incidents whether its looking through the logs manually or there is a tool set up to help aid in alerting on incidents. The IRP (Incident Response Plan) should contain methods being used in the environment for identifying incidents such as the tool/software being used to capture the incident.  This could also be said to pertain to detection and analysis. There should also be documentation on how the team will contain an incident or potentially eliminate an incident. There should also be documentation on how to recover from an incident (Kryptologyst, 2024).
There also needs to be people in place to handle the incident. An organization would do well to have a CSIRT (Cybersecurity Incident Response Team) already in place. The name of this team may sound like it may only contain individuals who respond to an incident but it is more than that. Individuals on this team contain the incident response leader, the responders, legal representatives, business experts, and even public relations individuals. All of these individuals will be part of the CSIRT and will act upon a cyber security attack, MAINLY in events if the attack is severe enough and successful enough. For example, there is no reason to get all the different parties involved if there is a phishing campaign making its round in company wide emails and nobody clicks on it. The technical leader might oversee the entire IR process and making critical decisions. Technical responders would be in charge of identifying, containing, and eliminating the incident. Individuals dealing with communication might be in charge of internal and external communication with senior management and maybe even law enforcement. Legal representatives will ensure compliance and staying within certain laws and legislations and ensuring everything done is legal (Kryptologyst, 2024).
2) Training and Assessment Sessions (Outside of Incident Response Plan…mainly for employees)
Another valuable aspect as part of preparation is to prepare not only the individuals who might be part of the IR process but even the employees in the organization. Kryptologyst (2024) uses a clever term as end users act as “sensors and alert sources” when seeing anything that would potentially be malicious on their end. There are certain aspects an organization can do to keep their end users aware. Educating employees on common cyber threats is a great starting point. This will help end users potentially identify malicious activity in advance so they will not potentially click on anything that may cause harm. Employees should be trained on what to look for if they have an doubt if they should report something. This not only relates to phishing emails but also maybe receiving information they should not have access to and things of that nature (Kryptologyst, 2024).
3) Vulnerability Scanning and Analysis (Outside of Incident Response Plan)
I believe vulnerability scanning falls outside of the scope of the incident response process. Vulnerability scanning is also a process that should be in place from a preparedness standpoint as it gives valuable insight into what weaknesses are in your environment before an incident takes place. This ensures the organization can remediate/mitigate/accept vulnerability risks before they come to light as a way to prepare for an incident or an alarm. A bolster defense is an aspect organizations will achieve if they implement vulnerability scanning due to proactively  scanning for weaknesses on a timely basis (SortSec, 2024).
References:
Kryptologyst. (2024, January 6). Incident Response: Preparation – Kryptologyst – Medium. Medium; Medium. https://medium.com/@kryptologyst/incident-response-preparation-6f24d776d8eeLinks to an external site.
SortSec. (2024, January 16). The Crucial Role of Vulnerability Scanning in Incident Response Planning. Medium. https://medium.com/@sortsec/the-crucial-role-of-vulnerability-scanning-in-incident-response-planning-b09866a845d5
Discussion 3: (205 Words)
Business Continuity planning is an important part of a cybersecurity contingency planning program that deal with ensuring that preparation should situations that make systems unavailable support keeping data “available” to those that need it.
Instructions for Initial Post:
Thinking of the organization that you are creating your cybersecurity program for, detail out at least three (3) scenarios that would need to be part of the organization’s business continuity plan. Then create what the organization would do if that circumstance became a reality. We are not looking for a full-fledged plan, but the scenario, and high level first effort response to that scenario, and be sure to include the appropriate communication aspects that may be required.
(examples could be larger situations such as natural disaster, or more local such as “internet down” from within the bank)
Discussion 4: (100 Words)
Agree or Disagree? Why? 
1) Network Outage
When considering this scenario, we are simply looking at a network outage, nothing more nothing less. This is a scenario when the company may lose network connectivity  and there has not been any malicious intent (that is known) or a natural disaster. This major outage disrupts communications between different physical locations of an organization as well as cloud solutions/infrastructure. 
High Level Response: When a network failure occurs, it becomes imperative to make sure a team immediately utilizes network monitoring tools to try to find the cause of the outage (if possible). The network teams will be notified and a BCP (Business Continuity Plan) should be activated to try and bring the network back up as soon as possible According to Whitman and Mattord (2021), the network recovery team will try and determine the cause of the network outage and analyze the extend of the damage on the network as this could have something to do with switches, routers, hubs, etc. A component could have been damaged or destroyed and that needs to be kept into consideration as well. The network recovery team will need to be in touch with the current ISP (Internet service provider) and potentially need to contact their secondary service provider (pending there is one…which there should be) to bring the network back up in case of a network outage. Adams (2024) refers to this as an internet failover  and is a backup connection which implements redundancy as far as connectivity goes. The organization as a whole should be notified in ways such as SMS or some sort of notification.  The organization and their customers should be notified of the outage and business should be done manually (paper-based) for processing. There might even be a reliance on cellular networks to maintain customer service and a means to communicate until the network is brough back up online. A post incident review should be done to see what process were effective and what were ineffective. 
2) Natural Disaster
This natural disaster scenario deals with an event such as a tornado or a hurricane that causes a great deal of damage to one or more locations of an organization. 
High Level Response: The business continuity plan would need to be activated along with the CMT (crisis management team). According to Whitman and Mattord (2021) the CMT will  activate in accordance to the response. In this case of a natural disaster, employee safety is a major concern and  emergency evacuation becomes dire in the need to protect human lives and control injury risk. The disaster should be communicated with employees and customers alike and ensure there will be an alternative form of continuing business in the event of network failure. Once the people are safe, the physical structures and assets being contained become the next priority. In preparation to a natural disaster, in our day and age, there is never a time where most weather comes as a surprise. This being the case, Rock (2022) claims the importance of utilizing the cloud and ensuring cloud services are set up in preparation in case buildings are destroyed and the assets inside of them are destroyed as well. This would also allow workers to be able to work from home and continue business operations. One of the biggest things to consider here is the aspect of communicating with employees and customers to let them know a physical location of an organization might be unavailable and mobile or internet services might need to be utilized to conduct business. It would also be extremely important for the critical business operations (if ran on a physical server) to be backed up and moved to a different location to ensure the business is still able to function (Whitman and Mattord, 2021). A post incident review should be done to see what process were effective and what were ineffective. 
3) Cyber Attack
This scenario deals with a cyber attack on an organization and will give plan involving ransomware which encrypts critical data or all data and requires a ransom to get your data unencrypted. 
High Level Response: If there is an alert of ransomware then the IRP (Incident response plan) needs to activate and the CSIRT (Cybersecurity incident response plan) needs to respond to the incident. One of the most crucial aspects is to isolate the affected machine to try and contain the ransomware so it does not spread (if possible). The CSIRT needs to dive into the incident and try to figure out what systems have been affected and there needs to be communication with the selected service departments which the ransomware affects. This incident is a great scenario where it is crucial to have secure backups in an off-site location. Weekly backups are crucial to  ensuring a ransomware attack does not put an organization in more trouble than it potentially already is. No ransom should be paid and backups should be implemented to restore systems to a point in time before ransomware infected the system. If weekly backups are kept, the damage from ransomware becomes minimal compared to what it could be (Whitman and Mattord, 2021). If in the event that systems do go down, there needs to be manual processes in place to continue business operations (paper-based). The breach should ultimately be disclosed to stakeholders and it needs to be reported to authorities. There needs to be an aspect of transparency when dealing with communication (Clarke, 2023). A post incident review should be done to see what process were effective and what were ineffective. 
References:
Adams, R. (n.d.). Council Post: How To Ensure Business Continuity In The Face Of Internet Disruptions. Forbes. Retrieved July 8, 2024, from https://www.forbes.com/sites/forbesbusinesscouncil/2024/02/16/how-to-ensure-business-continuity-in-the-face-of-internet-disruptions/Links to an external site.
Clarke, C. (2023, August 2). 6 Step Ransomware Response Plan | Veeam. Veeam Software Official Blog. https://www.veeam.com/blog/ransomware-response-plan.html
Mattord, M. E. (2021). Principles Of Incident Response And Disaster Recovery, Loose-Leaf Version. Course Technology Inc.
Rock, T. (2022, March 14). 6 Real-Life Business Continuity Examples You’ll Want to Read. Invenio IT. https://invenioit.com/continuity/4-real-life-business-continuity-examples/

Instructions
Scenario:
As the IT project manager for a global payroll company, y

Instructions
Scenario:
As the IT project manager for a global payroll company, you were recently asked to lead a multinational team of product developers and have been informed that most of the work will happen virtually due to limited travel budgets. Your team has been tasked with creating a new payroll system for the German location of the company. Your team will consist of five individuals:
Two Americans, two Germans, and one Vietnamese
Some of the project members only work on the project part-time. Some have only basic English skills.
The project stakeholders are the HR director, CFO, and union representative for the employees. All stakeholders are from the German location.
The project sponsor is a high-level German manager with whom you have not previously worked.
Unfortunately, your team is experiencing conflict, and you need to apply some conflict management techniques to help your team.
Instructions:
For this assignment, you must prepare a presentation for your team that will help them to understand how to deal with conflict and work through the issues.
Your presentation should address the following:
The team is lacking in role clarity and has not determined how to prioritize their other daily tasks with the project tasks. This has created great conflict in your team because some members feel that the others are not “carrying” their own weight on the project.
The team is arguing, no one is working together, and no one is sure of where the project stands.
Represent the different cultures that contribute to the challenges of the team.
Help the team use conflict management strategies to resolve their issues. You may need to use more than one conflict management strategy since your team is culturally diverse.
Explain which communication standards and tools could be used to resolve the conflicts.
Incorporate appropriate animations, transitions, and graphics as applicable.
Length: 15-20 slides (with a separate reference slide)
Notes: 100-150 words of speaker notes for each slide
References: Include a minimum of 3 scholarly resources
The completed assignment should address all of the assignment requirements, exhibit evidence of concept knowledge, and demonstrate thoughtful consideration of the content presented in the course. The writing should integrate scholarly resources, reflect academic expectations and current APA standards

Intro
There are many actions that need to happen on a periodic basis in any orga

Intro
There are many actions that need to happen on a periodic basis in any organization. This section of the program document will detail out the operations run book and vulnerability scanning requirements and processes.
COMPLETE 
10) Security Operations
Security Operations Run Book: Extending the list of required security actions that should take place on a scheduled frequency, list out a total of ten (10) periodic checks that should take place either on a daily, weekly, monthly or quarterly basis. In this list, detail WHY the activity needs to take place and what the expected/desired result should be if things are operating successfully. You can leverage the three items that you already documented in the DB, and add 7 more.
Vulnerability Management: A vulnerability management program can be wide and detailed, requiring tools and process in order to be successful. What are three activities required of a vulnerability management process that are critical for success? Don’t consider exact tools or technology at this point, the goal is to flesh out the overall key process steps. Describe them and give some details on those activities based on best practices.