In this post, I will discuss and explore the realm of responsibility for information asset protection. Whether it be personal, professional, or third-party data, ensuring that your devices, software, networks, and practices are kept up to date with the latest layers of protection are a vital cog in the wheel of information security. By knowing who accesses data, the nature, confidentiality, and sensitivity of the data, what safeguards are set in place to prevent undesired intrusion, and what disaster recovery plans will be utilized in the event of lost or misused data, you can build a top-down digital view of the entire protection system. By applying the following material, you can then use your enhanced view of your information asset security and locate weak sectors, improve on current protection measures, and formulate an attack-plan for the continued analysis, review, and update of your information asset protection plan.

Whenever a security breach occurs in a business or service, one of the first things I hear about is users complaining about how the company allowed data to be accessed by an intruder. In many situations, there may not have been anything a lone individual could have done, as the flaw may lay in the server of an environment that he/she could not access. However, more often than not, users do not take into account the various methods one can implement in securing their information assets, as well as their digital personas.

For this example, I will dive deep into my personal laptop which I use for school, highlighting many of the security measures that are in place, those that are not, any critical personal data included, my disaster recovery plan, and finally, share who could potentially access my laptop. By performing an in-depth analysis of my information security level, I can gain a further understanding of who is responsible for protecting both my personal and professional data.

Currently, as I plan to build a desktop computer now that I have purchased a home, I am using an older Asus 2-in-1 gaming laptop for school and some occasional work activities. Let me begin by outlining the security of the laptop itself, along with the security of the surrounding area (my house). My Asus laptop runs various security programs such as Webroot multi-vector protection, Malwarebytes, and enhanced Windows security settings. I have also changed the admin password, enabled facial recognition and a well-formulated unlock password, created a password-protected screensaver, encrypted my hard drive, perform regular data backups (cloud, external drive), cover my webcam, utilize a VPN, and use WPA2 Wi-Fi. I also operate secure browsers with pop-up blockers, use different emails and passwords for each of my accounts, and get instant alerts for any changes to various settings. My wife sometimes uses my laptop as well; however, she has her own secure account with the same protection settings. The guest account feature is turned off, and the device is set to not be discoverable through Bluetooth.

For my home network,  I use Cox Gigablast internet via a Technicolor CGM4141 Panoramic Wi-Fi Modem set up with the highest security settings, renamed network, changed admin and user passwords, DMZ, DHCPv4, and receive instant notifications whenever a new device attempts to connect to my network; this level of network security, coupled with my integrated home security system which includes a Qolsys IQ Panel 2, Qolsys IQ Motion, Qolsys Mini DW-S, Qolsys IQ Smoke, SkyBell Slim Video Doorbell,  and a Vivotek IB8360-w Wireless Mini Bullet Network Camera, allows me to view, using my phone, both the physical and network security of my home at all times.

In the event of a data loss or if it was compromised in any way, I have a personal disaster recovery plan (DRP) already created. I back up all my data onto the cloud, as well as an external SSD. I also have a compilation of usernames, passwords, and other sensitive information that is essential, saved in a fireproof safe. If a disaster does occur, my downtime would only be a few hours while I transfer data around and sign-in to my accounts.

Since my network only consists of a few internet-connected devices, my annualized loss expectancy (ALE) would be around $4,300; this is the cost for an entirely new network, as well as replacing my devices with new versions. Thus, my asset value would also be $4,300. My annualized rate of occurrence would be insubstantial as I have not had any disasters happen yet due to my minor level of risk. My mean time to restore (MTTR) would only be around a few days, either waiting for Cox, or most likely myself, to fix my network. My recovery time objective (RTO) would preferably be less than a day as I require my network for various work and school-related activities. I also have home insurance and a home warranty, as well as warranties on most of my devices, so my risk mitigation is very high as I practice risk transference as much as possible; this, compiled with the 24/7 live monitoring and assessment through my home security system, reduces my risk substantially.

Overall, I find my disaster recovery plan to be adequate for my situation. Some adjustments I could consider would be to update my backups more frequently and finish building my PC so I can only use my laptop for school use; this would allow my leisure and work time to be spent on a hardwired PC that has better protection against threats.

I do not store critical personal information on my computer since most of my vital documents are stored on a removable hard drive, in the cloud, or in paper form. However, if my laptop was stolen or Gmail was hacked, an intruder could potentially have access to a magnitude of quite valuable documents and website logins. The only important thing I store on the laptop itself is one of the many backups of my tech blog. Although, for my blog, I have an entire backup of my close to five-hundred posts and images stored on a separate website, SSD, and removable hard drive.

Before one begins providing and enhancing cybersecurity for organizations, the first step must be to apply what they know to their own environment. Even with the most sophisticated security system, intrusion prevention software, complex policies, proper procedures, and highly skilled personnel, a single weak link on the chain can open a security gap. By looking at my personal information protection status, I can ensure that I am not the opening that an intruder is looking for when performing a vulnerability assessment on a possible target.

References

Hirsch, M. (2014, October 17). How Has Cybersecurity Changed Operations? Retrieved November 26, 2019, from https://www.securitymagazine.com/articles/85861-how-has-cybersecurity-changed-operations.