CYB 359 - 2.5 - Assignment: Case Study: System Life Cycle Plan

downloaded from

Scholarfriends

https://scholarfriends.com Downloaded by: writerforacademic@gmail.com | https://scholarfriends.com/singlePaper/313449/cyb-359-25-assignment-case-study-systemlife-cycle-plan Distribution of this document is illegal.

2.5 Assignment: Case Study: System Life Cycle Plan 1. You and your team are in phase 2 (planning phase) of the Life Cycle and need to review the "Acquisition (AQ)" section of the Framework. For ALL the items in the AQ section (i.e., the items that are AQ-#. #), document in priority order all the processes. Your list should include the designation and the numbers in priority order in which you will address each process. Describe (100 words or more) why you selected the processes in the order you documented.

AQ-1 Prepare for security aspects of the acquisition.

1. AQ-1.1 Define the security aspects for how the acquisition will be conducted.

2. AQ-1.2 Prepare a request for a product or service that includes the security requirements.

AQ-2 ADVERTISE THE ACQUISITION AND SELECT THE SUPPLIER TO CONFORM WITH THE SECURITY ASPECTS OF THE ACQUISITION 1. AQ-2.1 Communicate the request for a product or service to potential suppliers consistent with security requirements.

2. AQ-2.2 Select one or more suppliers that meet the security criteria.

AQ-3 ESTABLISH AND MAINTAIN THE SECURITY ASPECTS OF AGREEMENTS 1. AQ-3.1 Develop an agreement with the supplier to satisfy the security aspects of acquiring the product or service and supplier acceptance criteria.

2. AQ-3.2 Identify and evaluate the security impact of necessary changes to the agreement.

3. AQ-3.3 Negotiate and institute changes to the agreement with the supplier to address identified security impacts.

AQ-4 MONITOR THE SECURITY ASPECTS OF AGREEMENTS 1. AQ-4.1 Assess the execution of the security aspects of the agreement.

2. AQ-4.2 Provide data needed by the supplier in a secure manner in order to achieve timely resolution of issues.

AQ-5 ACCEPT THE PRODUCT OR SERVICE

This study source was downloaded by 100000858468549 from CourseHero.com on 04-16-2023 12:56:44 GMT -05:00

https://www.coursehero.com/file/194905021/SimpsonNatessa-answers-week2docdocx/

1. AQ-5.1 Confirm that the delivered product or service complies with the security aspects of the agreement.

2. AQ-5.2 Accept the product or service from the supplier or other party, as directed by the security criteria in the agreement.

I chose all the Acquisition processes since they are all equally important for an organization to implement, especially in the planning phase of the life cycle. Implementing all of the processes will help especially with the security of the online store, who they select as their suppliers etc.

This is absolutely an important phase of the life cycle planning out everything. I will repeat again that all of them are equally important and should be implemented for the success of the organization and to keep the online store secure.

2. You and your team are in phase 2 (planning phase) of the Life Cycle. They need to plan the processes in the "ORGANIZATIONAL PROJECT-ENABLING PROCESSES" section, document in priority order only the processes you will address specifically for the planning phase. Your list should include the designation and the numbers in priority order in which you will manage each process. The processes you select from each section should be merged so there is only one list with all items in priority order.

Describe (100 words or more) why you chose the processes in the order you documented.

Life Cycle Model Management Process 1. LM-1.1 Establish policies and procedures for process management and deployment that are consistent with the security aspects of organizational strategies.

2. LM-2.1 Monitor and analyze the security aspects of process execution across the organization.

3. LM-3.1 Prioritize and plan for security improvement opportunities.

Infrastructure Management Process 4. IF-1.1 Define the infrastructure security requirements.

5. IF-2.2 Identify and provide security improvements or changes to the infrastructure resources as the project requirements change.

I chose what I chose for Snow Be online because the processes help establish policies and procedures for process management and deployment that are consistent with security, also monitors and analyzes the security aspects of the process execution across the whole organization, prioritizes and plans for security improvement, defines security requirements for the infrastructure, identifies and provides improvements or changes to the security of the infrastructure. These are extremely important during the planning phase for an organization, not just for Snow Be Online. Every organization should implement these processes into their planning phase.

This study source was downloaded by 100000858468549 from CourseHero.com on 04-16-2023 12:56:44 GMT -05:00

https://www.coursehero.com/file/194905021/SimpsonNatessa-answers-week2docdocx/

3. You and your team are in phases 7 and 8 (maintenance and evaluation phases) of the Life Cycle and need to monitor and identify issues with the implemented system. Using the processes in the "TECHNICAL MANAGEMENT PROCESSES " section, specifically the RM, IM, and QA processes, document in priority order only the processes you will address specifically for the maintenance AND evaluation phase. Your list should include the designation and the numbers in priority order in which you will manage each process. The processes you select from each section should be merged so there is only one list with all items in priority order. Describe (100 words or more) why you chose the processes in the order you documented.

Risk Management Process 1. RM-1.1 Define the security aspects of the risk management strategy.

2. RM-1.2 Define and record the security context of the risk management process.

3. RM-2.1 Define and record the security risk thresholds and conditions under which a level of risk may be accepted.

4. RM-3.1 Identify security risks in the categories described in the security risk management context.

5. RM-3.4 Define risk treatment strategies and measures for each security risk that does not meet its security risk threshold.

6. RM-4.1 Identify recommended alternatives for security risk treatment.

7. RM-5.1 Continually monitor all risks and the security risk management context for changes and evaluate the security risks when their state has changed.

Information Management Process 1. IM-1.1 Define the security aspects of the information management strategy.

2. IM-1.2 Define protections for information items that will be managed.

3. IM-2.2 Securely maintain information items and their storage records and record the security status of information.

4. IM-2.3 Securely publish, distribute, or provide access to information and information items to designated stakeholders.

5. IM-2.4 Securely archive designated information.

6. IM-2.5 Securely dispose of unwanted or invalid information or information 7. that has not been validated.

Quality Assurance Process 1. QA-1.1Define the security aspects of the quality assurance strategy.

2. QA-3.1Evaluate project life cycle processes for conformance to established 4. security criteria, contracts, standards, and regulations.

This study source was downloaded by 100000858468549 from CourseHero.com on 04-16-2023 12:56:44 GMT -05:00

https://www.coursehero.com/file/194905021/SimpsonNatessa-answers-week2docdocx/

3.

5.

4.

6.

QA-3.3Evaluate supplier processes for conformance to process security requirements.

QA-4.1Createrecordsandreportsrelatedtothesecurityaspectsofquality assurance activities.

The processes I chose are extremely important to Snow Be Online and the maintenance and evaluation phases of the life cycle. Since these processes follow under technical management, they mainly are about the management of security of an organization like define security measures and building of them to protect the organization and the assets involved. Every organization should follow and implement these processes to make sure their assets and organization are secure.

7. You and your team are in phases 7 and 8 (maintenance and evaluation phases) of the Life Cycle and need to monitor and identify issues with the implemented system. Using the processes in the "TECHNICAL PROCESSES" section, specifically the VE, VA, OP, and MA processes, document in priority order only the processes you will address specifically for the maintenance AND evaluation phase. Your list should include the designation and the numbers in priority order in which you will manage each process.

The processes you select from each section should be merged so there is only one list with all items in priority order. Describe (100 words or more) why you chose the processes in the order you documented.

Describe the importance of the NIST 800-160 v1 AND the 9-step life cycle as it relates to this assignment.

Verification Process 1. VE-1.1 Identify the security aspects within the verification scope and corresponding security- focused verification actions.

2.VE-1.4 Define the security aspects of the verification strategy.

3. VE-2.1 Define the security aspects of the verification procedures, each supporting one or a set of security-focused verification actions.

4. VE-2.2 Perform security verification procedures.

5.VE-3.1 Record the security aspects of verification results and any security anomalies encountered.

6. VE-3.2 Record the security characteristics of operational incidents and problems and track their resolution.

7. VE-3.3 Obtain stakeholder agreement that the system or system element meets the specified system security requirements and characteristics.

Validation Process 8. VA-1.1 Identify the security aspects of the validation scope and corresponding security-focused validation actions.

This study source was downloaded by 100000858468549 from CourseHero.com on 04-16-2023 12:56:44 GMT -05:00

https://www.coursehero.com/file/194905021/SimpsonNatessa-answers-week2docdocx/

9. VA-1.2 Identify the constraints that can potentially limit the feasibility of the securityfocused validation actions.

10. VA-1.3 Select the appropriate methods or techniques for the security aspects of validation and the associated security criteria for each security-focused validation action.

11. OP-4.1 Provide security assistance and consultation to customers as requested.

12. OP-4.2 Record and monitor requests and subsequent actions for security support.

13. OP-4.3 Determine the degree to which the delivered system security services satisfy the needs of the customers. Maintenance Process 14. MA-1.1 Define the security aspects of the maintenance strategy.

15. MA-1.2 Identify the system constraints resulting from the security aspects of maintenance and logistics to be incorporated into the system requirements, architecture, and design.

16. MA-1.3 Identify trades such that the security aspects of system maintenance and logistics result in a solution that is trustworthy, secure, affordable, operable, supportable, and sustainable.

Snow Be Online has a lot of issues with their security and firmware for their network devices, they also need to do a lot of maintenance to maintain their assets, so that’s where the technical processes will come in and help, they are an important part to implement during the maintenance and evaluation phases. All organizations should implement these processes too since that are extremely important for all organizations to implement.

8. Describe the importance of the NIST 800-160 v1 AND the 9-step life cycle as it relates to this assignment.

The importance of NIST 800 - 160 v 1 and the 9-step life cycle as it relates to this assignment is how the company should follow and implement certain frameworks inside of NIST 800 - 160 and the 9-step lifecycle so that SnowBe Can follow all regulations and procedures to make the company successful and comply with all security compliance regulations. Is a framework that provides guidance on system security engineering, and it outlines a set of processes that can be used to develop secure systems. As part of the maintenance and evaluation phase, it is important to ensure that the implemented system continues to meet the security requirements and standards set forth in NIST 800-160 v1. This can involve assessing the system's vulnerabilities and risk posture and taking steps to mitigate any identified risks. Additionally, the framework can provide guidance on how to implement new security controls or update existing controls to ensure continued protection of the system.

This study source was downloaded by 100000858468549 from CourseHero.com on 04-16-2023 12:56:44 GMT -05:00

https://www.coursehero.com/file/194905021/SimpsonNatessa-answers-week2docdocx/

This study source was downloaded by 100000858468549 from CourseHero.com on 04-16-2023 12:56:44 GMT -05:00

https://www.coursehero.com/file/194905021/SimpsonNatessa-answers-week2docdocx/ Powered by TCPDF (www.tcpdf.org)