Creating Policies for Systems and Web Services
You have been hired as a security consultant to develop policies that document the minimum security requirements for Regional Bank covering its financial system and customer-facing online web service.
Part 1: Regional Bank Financial Software System (RBFSS)
Regional Bank has an accounting system that tracks its revenue, accounts receivable, accounts payable, and employee payroll.
Write a 2- to 3-page security policy for RBFSS in which you describe:
Access control-based user roles for each component (accounts receivable, accounts payable, employee payroll)
Password requirements and protection
Password protected screen savers
Data encryption at rest
Annotate each security control with at least one Critical Security Control (CSC) from the Center for Internet Security (CIS).
Part 2: Regional Bank Financial Software System (RBFSS)
Regional Bank has an online web-based service for its customers that allows for online banking.
Write a 1- to 2-page security policy for the RBFSS web-based online banking system that includes a brief description of the following security controls:
Authentication method for customers to log in
Encryption of data in transit
Web browser security
Deployment of anti-malware software
Annotate each security control with at least one Critical Security Control (CSC) from the Center for Internet Security (CIS).
Annotate at least one OWASP Top 10 security risk that could be associated with each of the security controls above.
