Global Finance, Inc.: Financial Management Services

Global Finance, Inc. (GFI) is a financial organization that specializes in financial management. The firm is listed on the New York Stock Exchange, and it specializes in the following areas: financial management, approval of credit applications, and processing of credits. GFI also specializes in money investment management for its clients. GFI serves clients across several nations, such as Canada, the U.S., and Mexico. 

In the recent past, cybercriminals attacked GFI’s information and database security systems. The attacks had a negative impact on GFI. First, it damages the reputation of the organization. For example, in 2013, attackers attacked the organization’s Oracle database server. As a result, GFI’s customer database lost its confidentiality, integrity, and availability for a number of days. This attack damaged the organization’s reputation. Secondly, the attacks led to monetary losses. For example, in 2014, a security attack affected the entire network of GFI. The organization was forced to shut down its Oracle and e-mail servers. This led to monetary losses. GFI lost $1,700,000 in revenue. In addition to monetary losses, GFI lost intangible customer confidence following this attack. In a separate incident in 2014, GFI had the financial data of its customers compromised after one of its financial consultants forgot and lost his company laptop at an airport. The laptop was not secured, and the hard drive, which contained the data, was not encrypted. Following this attack, GFI had to pay the affected customers financial reparations. 

My Role

Due to the success of these cyber-attacks, it is apparent that GFI lacks a good information security system to keep its sensitive data protected from both internal and external attacks. Therefore, the management of the organization ought to perform a risk assessment of the organization’s security infrastructure to determine the areas they need improvements. This will help the organization protect its infrastructure from cyber-attacks or unauthorized access and data exfiltration in the future. 

Following the success of recent cyber-attacks, GFI’s network engineers have reported that the attacks have resulted in increased network traffic. The engineers are unable to recognize who is generating increased traffic. This increase in the volume of traffic in GFI’s network is a major concern for the organization’s management. The management, particularly the Chief Operating Officer (COO) Mike Willy, is concerned over securing GFI’s information system. Because of the increased operational dependence on technology pooled with the weakening information technology (I.T.) footprint in GFI, Willy has hired me and appointed me as the Chief Security Officer (CSO) of the organization. As the new CSO, I am required to protect the information system of GFI. To protect the security of GFI’s corporate information systems, a security risk assessment of GFI’s infrastructure was conducted and documented. 

Purpose

This report delves into conducting a security risk assessment for GFI. More specifically, a quantitative and qualitative risk assessment of GFI’s infrastructure will be performed. This will helps identify the threats that are highly likely to affect GFI’s information technology infrastructure. The current infrastructure has several vulnerabilities. These vulnerabilities pose a severe threat to GFI’s confidentiality, integrity, and availability of data. This assessment will provide solutions to identified system vulnerabilities and risks. Through this, the management would be able to make some improvements to reduce the risk of future attacks. This because the assessment will help the management and security experts or engineers of GFI to create an array of risk mitigation measures. This risk assessment will: 

Conduct a thorough asset inventory 

Evaluate the perimeter security –GFI’s access points will be identified. For each access point that has been identified, the current and potential vulnerabilities will be identified. The assessment will then suggest improvements to address each vulnerability in order to improve the perimeter and network security of GFI. 

Assess GFI’s remote access infrastructure –the current and potential weaknesses will be identified. Based on the identified vulnerabilities, security improvements will be made to secure GFI’s remote access infrastructure. 

Identify wireless vulnerabilities and recommend network security technologies to protect GFI’s organizational and customer database 

Evaluate current GFI’s authentication protocols and recommend solutions to address vulnerabilities 

Evaluate GFI’s web system protocols and recommends solutions to improve the security for web authentication 

Design a cloud computing environment for GFI 

Assess the business impacts of each known vulnerability 

Conduct risk assessment of GFI network using the organization’s asset inventory 

Recommend risk mitigation procedures that will strengthen GFI’s information security infrastructure. 

The risk assessment will address all the issues discussed above. 

Roles and Responsibilities

John Thompson, Chief Executive Officer (CEO)

The role of John Thompson is to make sure that GFI’s strategic business plans increase shareholder value. As such, Thompson is responsible for making the final decision regarding GFI’s I.T. strategic plans and GFI’s overall business plans. For example, in the case of GFI, the computer security manager (CSM) will present to Thompson the plan to implement penetration testing software. The CEO seeks the views of other managers and shareholders and decide whether the implementation of the security has an impact on the return on investment (ROI) and shareholder value. 

Mike Willy, Chief Operations Officer (COO)

Mike Willy is responsible for overseeing GFI’s business operations. He is responsible for overseeing how I.T. projects in the organization are aligned with daily operations. Other roles and responsibilities of the COO include the following: to provide leadership and input for the implementation of the company’s strategic plan and to oversee how operational I.T. processes impact the budget. 

Rick Santos, Computer Security Manager

Rick Santos is responsible for the development, implementation, and management of the organization’s corporate security vision, strategy, and programs. His main focus on scientific and technological issues. Other areas that Rick Santos is supposed to focus on include developing and managing GFI’s security policy, and research and development on GFI’s network confidentiality, integrity, and availability. The CSM is also responsible for addressing the vulnerabilities and threats to GFI information system resources as well as identifying and implementing security controls measures in the organization to mitigate the risks and vulnerabilities. 

Security Risk Assessment

Information security threats evolve as technology continues to advance. Thus, the defenses against information security threats should evolve as well. A risk assessment is key to ensuring a firm is well protected from both internal and external attacks. Security risk assessment gives the management of an organization a good picture of the security risks as well as the vulnerabilities that might compromise the confidentiality, integrity, and availability of a company’s information assets. A comprehensive risk assessment can help a business prevent cyber-attacks. Cyber-attacks often lead to monetary losses, and in most cases, it damages an organization’s reputation. With this in mind, organizations are required to conducted risk assessments frequently. This will help an organization prevent not only security breaches but also build its reputation. 

Risk Impact

As stated earlier, the management of GFI is highly concerned with the confidentiality, integrity, and availability of the company’s information system. According to Willy, if the information system of GFI is compromised, it will put the company to its knees. As a result, the company would be required to rely on vendors to pull him (Willy) out of the mess. With this in mind, there is a need to identify information types and establish risk impact or security impact levels for loss of confidentiality, integrity, availability of information types. In addition, there is a need to assign security categorization for each of the information types that have been identified. According to Hash et al. (2005), security categorization is very vital because it forms the basis for identifying and an initial baseline set of security controls for the information system. The Federal Information Processing Standards (FIPS) summarizes the potential impact definitions security objective, which is given in Table 1. 

Table 1: Risk Impact: Definitions for Security Objectives 

Source: FIPS (2004) 

Network Office Topology

Network topology refers to how an organization’s network is arranged. In this case, it refers to how a network is arranged. Figure 1 shows GFI’s corporate office topology. 

Figure 1: GFI’s Corporate Office Topology 

The network infrastructure of this organization is composed of a corporate-wide area network (WAN) that spans ten remote sites. Each of these remote sites is connected to the company headquarters’ central data processing environment. In addition, these ten remote sites communicate with the central processing environment through a corporate virtual private network (VPN). The security experts of GFI has implemented a role-based access control system (RBAC). GFI implemented this security mechanism to restrict system access to authorized users. For instance, if the human resource manager o GFI wants to access data available in the human resources department, each role will define the permissions that are required to access the data. This security approach helps protect an organization from internal attacks. 

Network Security

The security experts at GFI have taken preventative measures to protect GFI’s underlying networking infrastructure from cyber-attacks. One of the security measures is the use of VPNs. GFI uses a VPN gateway appliance to transmit data from a remote site. VPNs are often used to secure connections. According to Salman (2017), this network security use tunneling, authentication, and encryption computer technologies to create secure connections. The level of security created depends on the computer technologies used to create a VPN. Salman (2017) recommends organizations to use Layer Two Tunnelling Protocol with Internet Protocol security (L2TP/IPsec) when deploying a VPN. This is because these technologies help ensure the highest level of security. VPNs ensure unauthorized users are restricted from accessing GFI’s network infrastructure. 

VPNs offer a high degree of security protection. The security experts at GFI deployed VPNs to prevent unauthorized users from establishing a connection with the network of GFI. However, VPNs are susceptible to attacks. With the advance in technology, attackers develop several technological tools to attacks the organization’s VPN systems. With this in mind, the security experts at GFI ought to update GFI’s VPN system to remove software patches. For example, Secure Sockets Layer (SSL) VPN systems are very susceptible to attacks. SSL VPN systems are very susceptible to Denial of Service (DoS) attacks. To address these attacks, security experts should update VPN systems to ensure software patches are updated on a regular basis. This type of attack presents a moderate risk to availability. With this in mind, the security experts at GFI should schedule software patches and updates regularly to keep the network safe and secure. The patches and updates should be scheduled at night or during off-peak hours to minimize interruptions. 

Access Points

Internal Access

GFI’s workforce accesses the organization’s Internet using GFI’s workstations. These workstations are pre-inspected before making it available for use. In addition, the individualized workstations are installed antivirus software to protect them from external attacks. GFI’s internet network topology is composed of 10gbps virtual local area network (VLAN) switches separated by departments. Access privileges will be restricted to only the required resources they have the “need to know.” The access to GFI’s applications and servers will also be monitored by auditing and reporting channels. There is a need to ensure appropriate control lists are implemented. This helps identify individuals or users that will have access to every VLAN. This will, in turn, help ensure that the systems are safe and secure. 

There is a need to secure VLANs because some VLANs contain confidential and classified data. Implementation of UCLs helps mitigate the risk of access to classified data by unauthorized persons. ACLs restrict who has access to private VLANs, databases, applications, printer servers, and e-mails. Failure to implement ACLs constitutes a high risk to the integrity and confidentiality of the systems. Encryption of Wireless Access Points should be carried out, and the SSIDs made invisible. It is vital to install firewalls to protect GFI’s network. In addition, there is a need to use Web Proxy and strict Web Browser settings in the organization. These technologies will help the organization reduce the potential risks of malicious attacks. This includes DoS attacks and man-in-the-middle attacks. 

The organization ought to deploy a group policy. This will help enhance the organization’s network security at the internal level. Group policy is an infrastructure that allows an individual to implement certain configurations for computers and system users (Krahl, 2017). The Group Policy objects (GPO) contain the group policy settings and are interconnected to the Active Directory (A.D.) service containers such as the sites, domains, and organizational units (O.U.s). The default policy settings such as Password Policy, ought to be managed by the default Domain Policy GPOs. There is a need to implement these controls. Failure to implement these controls may result in a high risk that can lead to loss of integrity and breach of confidentiality. 

External Access

The external access at GFI is attained via remote access servers (RASs). GFI’s RAS uses 100 megabytes per second router to communicate to distribution routers, VPN gateways, and 10gbps switches. The organization has put measures in place to ensure only authorized mobile users have access to the organization’s systems. More specifically, authentication is required for all individual using their personal devices, such as personal computers, mobile devices and other technological devices through a dial-up. However, it is important to note that the access to the internal corporate databases is not through encryption. This poses a great risk to GFI’s information and network system. 

Access Control

Authentication

According to Chandra et al. (2014), asymmetric systems are far much better than symmetric system in terms of flexibility. At GFI, messages are encrypted through a single key. To decrypt the message, one ought to have the decryption key. Typically, the publication of the public key is made while the private key remains private. Public key infrastructure (PKI) is utilized to make sure that the certification of the public key is updated and authorized. 

The asymmetric pair of keys is composed of one public as well as one private key. According to Chandra et al. (2014), the public key is usually available to every person while the owner only knows the private key. PGP uses a trusting scheme that creates two keys for utilization by a user. One key is public and is centrally located and can be accessed by everyone while the second key is private and is held in the confidentiality of the user. The encryption of an e-mail is through the receiver’s public key, and its signing is through a sender’s private key. Upon receiving the message, its decryption is through the recipient’s private key while its validation is done through the sender’s public key. Companies use different techniques to ensure the security of their networks and the topology of their infrastructure. The methods used include Kerberos, SSL, Biometrics. Microsoft CHAP, Smart Card, IPSec Authentication, Single Sign-On (SSO), Password Authentication Protocol (PAP), and the extensible Authentication Protocol (EAP). 

Privilege Access

The sensitivity of the data stored on GFIs networks necessitates the need to install a Mandatory Access Control (MAC). MAC brings a specific approach to access control. Implementation of MAC is mostly in organizations possessing sensitive and classified information, and its access is based on security labels. According to Van Riel et al. (2013), some of the features of Mandatory Access Control are: 

The changes to a resource’s security label can only be made by administrators and not data owners. 

The security level assigned to data is dependent on its sensitivity, confidentiality, and protection value. 

All users are allowed access to read from lower classification than their own. 

All users are allowed to write to higher classification than their own. 

The read/write access to objects is allowed to all users only within the same classification. 

Authorization or restriction to aces objects is dependent on the time of the day, labeling on the resources, and user’s credentials. 

Security features of the HTTP client such as SSL bit length and originating I.P. address determine if access to objects is authorized or restricted. 

Mobility

Mobility ensures that clients, co-workers interact within an organization in near real-time. Mobility can help increase employees’ productivity by forming an environment with virtual offices to work from as long as one is connected to a Wi-Fi network. This would help increase the GFI’s effectiveness in the wake of its expanded growth. Employees can serve customers better when there is mobility in an organization. Bring Your Own Device is also a good policy, but its security concerns make it unattractive. Mobile devices pose a risk due to their potential to circumvent a company’s firewall and antivirus programs (Kearns, 2016). 

Wireless

Wireless capabilities within GFI offer flexibility to the employees. The GFI wireless network is, however, currently not encrypted. The SSID is also accessible to anyone within the WAP range, including neighbors to the organization. This creates a high risk to the CIA. My recommendation is that GIF implements WPA2-Enterprise with an AES or TKIP encryption to ensure the security of the network (Chyrun et al., 2019). The SSID should also be hidden. 

Cloud Computing

Utilization of cloud computing e-commerce platforms will enable GFI to provide its products and services to their clients online. However, security concerns need to be addressed first before implementing such a program. Remote data storage poses a compromise risk (Ashktorab and Taghizadeh, 2012) . Additional levels of security and network standard need to be implemented to mitigate such risks. My recommendation is that GFI utilizes Microsoft Azure Cloud Computing Platform and Services. This is because Azure easily blends with the existent I.T. environment (Microsoft Azure, 2019). It offers an extensive network of safe, private connections, hybrid databases and storage solutions, and information residency and encryption characteristics. This ensures that an organization’s assets remain where needed. Azure hybrid cloud solutions ensure that one obtains increased I.T. options, but the complexity and cost are decreased. 

Microsoft Azure’s security features will be fortified by using “McAfee Endpoint Security for Microsoft Azure” (MESMA) Environments to create an additional security level. MESMA combines easily with Microsoft Azure through the Azure PowerShell platform. The integration offers advanced security features for various endpoints such as physical, virtual, and cloud servers. It also provides additional features to tackle malware, threats, and evasion attacks in mobile, data, web, e-mail, and network. The additional features are anti-malware, host intrusion prevention, antivirus, device control, and a host-based firewall. 

Inventory

Item	Department	Quantity	Cost	Total	Priority	Objective
Dell Precision Workstations	Accounting	55	$500	$27,500	High	To provide the following services: Accounting, Financial support, and Payroll and Inventory
	Credit	15	$500	$7,500	High	To measure credit risk, to mitigate credit risk, and to provide credit support arrangements
	Customer Service	10	$500	$5,000	Moderate	To provide customer support
	Finance	30	$500	$15,000	High	To oversee financial planning and management activities, to be used for budgeting and forecasting, and to provide other financial analysis services
	Loans	10	$500	$5,000	Moderate	To be used to process loan applications
	Management	15	$500	$7,500	High	To be used to oversee and manage operations
	TCB Network	10	$500	$5,000	High	To be used for processing corporate data
	Subtotal	145		$72,500
HP LaserJet Printers	Accounting	5	$400	$2,000
	Credit	1	$400	$400
	Customer Service	1	$400	$400
	Finance	3	$400	$1,200
	Loans	2	$400	$800
	Management	1	$400	$400
	TCB Network	0	$400	$0
	Subtotal	13		$5,200
Wireless Access Point		3	$300	$900
Private Branch Exchange		1	$1,400	$1,400
VPN Gateway		2	$35,000	$70,000
Border Routers		2	$30,000	$60,000
	Subtotal	8		$132,300
Grand Total				$210,000

Network Vulnerabilities

System/Entity	Vulnerability	Risk Level	Priority
Wireless Technology	GFI staff and GFI’s neighboring residents can access the organization’s network. This creates a high risk to the CIA	High	High
Encryption	No encryption in the remote connectivity to and from the TBC and corporate database. This constitutes a high risk to the CIA	High	High
Mobility	Malicious programs on infected devices can access corporate networks since there are no existent systems to prevent them. For a lost or stolen device, data may be compromised since there is no system in place to safeguard the data	High	High
Network Intrusion	Increase in network traffic in GFI network servers generated by unknown people. This creates a high risk	High	High
Cloud Computing	Prone to data breaches if not appropriately secured	Medium	Medium

Risk Mitigation

The company needs to have detailed and well-structured cybersecurity measures to mitigate the potential risks of data security and privacy. Cybersecurity threat mitigation measures refer to the processes and policies a company adopts to prevent security and data breaches. Besides, it reduces the extent of damage in case the attacks happen. Cyber threat mitigation is a multi-level process involving the following steps. 

Threat Prevention – this refers to the policies and practices adopted to protect GFI’s data from being threatened by hackers or potential threat actors 

Threat Identification – this refers to the management and security tools used to pinpoint any active security threats. 

Threat Remedy – this refers to the company’s tools and techniques to reduce the impact of active security threats that have found its way past the company’s security defenses and infiltrated the network. The risk can be contained or isolated to render it powerless 

Cyber hackers are always persistent and use sophisticated techniques constantly evolving to breach corporate data for financial gain. It is, therefore, crucial that companies stay extra vigilant in protecting their data and network systems. 

As observed, the current network system and I.T. processes have some loopholes that make it vulnerable that can be mitigated using soft and hard security controls. The advancement in technology and creativity among hackers is vital for the company to address the network’s vulnerability to protect its assets, data, and business intelligence in keeping up with the CIA model. This will save GFI from suffering immense losses as a result of the client’s data privacy being jeopardized. Moreover, this will build the company’s reputation gaining trust with its customers and potentially attract more clients who are cautious about the confidentiality and privacy of their data. 

Wireless Control

Currently, the wireless network access process is based on the open authentication approach. This is because any remote connection to and from the TBC databases is not encrypted. This presents a high-level threat to the CIA. This model allows anyone with proximity to the GFI WAP’s using a Wi-Fi enabled device to have access to sensitive and classified information in the database. This poses a number of risks to GFI that include denial of service, interception of data, endpoint attacks, wireless intrusion, and phishing. The occurrence of these risks causes qualitative damages and quantitative damages to availability and confidentiality. The I.T. department proposes the following to be implemented in order to mitigate these risks. 

Network cloaking should be adopted. This is where the SSID is hidden within the GFI framework. Hiding the SSID makes the name invisible, and this prevents inexperienced users from accessing the network. This is a secondary encryption measure as it inhibits people from accessing the network’s name. This is the first measure to implement to prevent any breach of the system since it acts as the door to the network; therefore, hiding the door means there is limited access. 

WPAK2-PSK (AES) encryption should be adopted for implementation. This is because it allows the highest level of network encryption while maintaining high user speeds. 

GFI should have two separate networks, one dedicated for employees while the other serves guests of the company. The guest network should give temporary access to visitors to the company and will have restricted rights. Those using this network will not have sensitive and classified information. This will prevent any suspicious user masquerading as a guest to the company from access to the company’s vital information. On the other hand, on the employee network, each employee will have their login credentials different from each other and will always indicate the time the employee logged into the network, and when they log out. This is to enable tracking of what the employees do. Therefore if there is any breach of the company’s sensitive data and information, it would be easy to tell which employees might be responsible. 

Encryption

Encryption is a cyber-security measure that protects sensitive, private, and confidential data using unique codes that alter the data making it difficult for intruders to read. It is a strong defense mechanism system, which ensures that data is safe even if threat actors manage to get past the company’s firewall. To ensure the data is secure during transmission through the GFI remote network, VPN and TCB communications IPSec will be used as it uses cryptography and packet filtering. Cryptography ensures encryption through network user authentication, ensures data confidentiality and integrity, and lastly provides trusted communication. The cryptography-based authentication and encryption process provided by IPSec is vital for securing data transmitted through untrusted paths such as those traversing the Internet or the large corporate intranet. In addition, IPSec ensures the protection of traffic that employs protocols and applications that do not provide sufficient security for communications. Lastly, the firewall, routers, and intrusion detection devices will be configured to allow IPSec traffic. In addition, all data stored in the devices of employees should be encrypted. This is to ensure in case the device such as a laptop is stolen, the theft will not jeopardize the information’s privacy. This is based on the incident where a financial consultant’s laptop was stolen at the airport and had the information on the hard drive in an unencrypted form. 

Mobility

The I.T. department proposes the following practices to ensure that the BYOD devices do not harm the company’s network. 

Malware protection software such as Kaspersky Internet Security, McAfee Mobile Security, and Norton Endpoint Protection will be installed in every device. This is to protect the system from any virus or malware that may be introduced to the devices either through e-mail or through USB drives that are aimed to breach the database. 

Mobile devices will be tracked using mobile device management to monitor applications, operating systems, and manage patches. In case a suspicious application is detected on the device, it will be suspended until a fix or patch is obtained. 

Multi-level authentication procedures will be used for one to gain access to the GFI asset or network. 

A clear separation of GFI resources and personal user resources will be demarcated. Personnel wishing to gain access to their information MAC will be used. In addition, sensitive and classified information will not be accessed from BYOD devices. This measure protects GFI’s information and assets while giving the employees flexibility in using their individual devices. 

Network Intrusion

Reports from the network personnel indicate a drastic increase in the network traffic volume whose origin cannot be identified. This suggests there might be individuals getting unauthorized access to the network. This poses a great threat as valuable resources can be stolen, or the security of the network jeopardized. Due to the increased volume, it is appropriate to have signature-based IDS (Intrusion Detection Systems). The IDS system is aimed to assess the activities conducted on the network, thereby providing substantial reports that can be used by the I.T. personnel to make decisions on how to secure the network. Installation of the intrusion detection systems should be accompanied by firewalls that will scan incoming and outgoing traffic. In addition, penetration-testing software such as Metasploit should be utilized in conjunction with the IDS. Metasploit software is embedded with powerful tools and utilities essential to perform penetration testing. 

Assumptions

The CSM operates and manages the network with the following assumptions put in place to ensure that sensitive data and information are safe and secure. 

Employees will not grant their login credentials or any other confidential information to unauthorized persons. 

The team members employed by the company or contactor will inform the company of any issues they experience while using the hardware or the network. 

The owner of the system will be responsible for giving access to any user requesting access. 

Any changes in employee position or even termination of employment should be communicated to the CSM promptly so that any network access privilege bestowed on any individual can be adjusted with immediate effect or revoked. 

The Systems Administrator will be responsible for approving any changes with authorization from the CSM. Implementation will be executed by the administrator and later on verified, tested, and maintained by the CSM. 

Conclusion

Security is an expense that any company must foot if it wishes to provide its customers with the required security on data and confidentiality. GFI possesses highly secretive data for its customers that are stored at various locations. Therefore, GFI cannot afford to have any leakage or breach of its client’s data due to the heavy losses they are likely to suffer as compensation accompanied with a damaged reputation. 

Risk management is a vital process aimed at identifying the risks and potential mitigation measures for the network. By addressing the issues that prevail within the network and encryption issues, GAI will be well-positioned to mitigate the risks it faces. A sound risk management plan is accompanied by security awareness training to all parties involved, unique employee access credentials, and the use of multi-level authentication. GFI should adopt a risk management plan that incorporates the following in order to protect the integrity, confidentiality, and availability of its network. Considering all these factors, the outsourcing option must be put on hold until the security concerns are addressed conclusively. 

References

Chandra, S., Paira, S., Alam, S. S., & Sanyal, G. (2014, November). A comparative survey of symmetric and asymmetric key cryptography. In  2014 International Conference on Electronics, Communication and Computational Engineering (ICECCE)  (pp. 83-93). IEEE. 

Chyrun, L., Chyrun, L., Kis, Y., & Rybak, L. (2019, May). Information System for Connection to the Access Point with Encryption WPA2 Enterprise. In  International Scientific Conference “Intellectual Systems of Decision Making and Problem of Computational Intelligence”  (pp. 389-404). Springer, Cham. 

Hash, J., Bowen, P., Johnson, A., Smith, C. D., & Steinberg, D. I. (2005).  An introductory resource guide for implementing the health insurance portability and accountability act (HIPAA) security rule . U.S. Department of Commerce, Technology Administration, National Institute of Standards and Technology. 

Kearns, G. S. (2016). Countering mobile device threats: A mobile device security model.  Journal of Forensic & Investigative Accounting ,  8 (1), 36-48. 

Krahl, K. M. (2017).  Using Microsoft Word to Hide Data  (Doctoral dissertation, Utica College). 

Metivier, B. (2017). 6 Steps to a Cybersecurity Risk Assessment. Retrieved 14 December 2019, from https://www.tylercybersecurity.com/blog/6-steps-to-a-cybersecurity-risk-assessment 

Microsoft Azure. (2019). What is Azure—Microsoft Cloud Services | Microsoft Azure. Retrieved 14 December 2019, from https://azure.microsoft.com/en-us/overview/what-is-azure/ 

Pub, F. I. P. S. (2004). Standards for security categorization of federal information and information systems.  NIST FIPS ,  199 . 

Salman, F. A. (2017). Implementation of IPsec-VPN tunneling using GNS3.  Indonesian Journal of Electrical Engineering and Computer Science ,  7 (3), 855-860. 

Van Riel, H. H., Walsh, D. J., & Togami, W. I. (2013).  U.S. Patent No. 8,479,256 . Washington, DC: U.S. Patent and Trademark Office.