Scenario
Montana Out Door Inc. (MOD) is a provider of outdoor equipment and hunting adventures in Montana. The CEO has decided to pursue a digital transformation designed to support a more robust Internet presence including integrated social media outreach and an online store that integrates with its newly adopted software solutions including HubSpot Suite for CRM, SAP SCM for supply chain management, and Salesforce Service Cloud to support the expansion.
Security is an obvious consideration for this endeavor and you have been asked to assess the security risks of the integration of one of these systems with the Internet and other internal systems. In assignments 2 and 3 you will address integration policies and testing respectively.
Preparation
Choose one of the applications identified in the scenario and research its vulnerabilities and ways to safeguard them.
Instructions
Consider the scenario and the research you performed on your chosen application and do the following:
Describe 3 significant security vulnerabilities inherent in the software that includes historical security performance data. Cite your sources.
Describe 2 security tools designed to mitigate one of the vulnerabilities. One should be internal to the software and the other a 3rd party solution. Explain how each works.
Evaluate the application’s effectiveness in addressing 5 of the following security elements. Rank each as Excellent, Good, or Weak. Support the rationale for your ranking.
Data encryption
Access control and management
Data retention
Management and processing
System login requirements
Process monitoring and traceability
Analysis and reconstruction of transactions and events due to adversarial actions (forensic reconstruction)
Integration with the existing Oracle DB
The specific course learning outcome associated with this assignment is:
Evaluate application technologies and the security issues associated with them.
This assignment asks you to assess the security risks of integrating one of MOD’s new systems (HubSpot CRM, SAP SCM, or Salesforce Service Cloud) with the internet and internal systems during a digital transformation. Pick one system and do a focused risk assessment.
Key takeaways
- Choose one system (HubSpot CRM, SAP SCM, or Salesforce Service Cloud) to assess.
- Identify the security risks of integrating it with the internet and internal systems.
- Consider data exposure, access, APIs/integration points, and compliance.
- Rate risks by likelihood and impact.
- Set up for the later policy/mitigation assignments.
Scope the system and integration
Pick one system and describe how it connects — to the internet (online store, social outreach), to customers, and to MOD’s other internal systems. The integration points are where risk concentrates.
Identify the security risks
For a CRM/SCM/service platform, assess: data exposure (customer PII, payment, supply-chain data), access control (authentication, privilege, third-party access), integration/API vulnerabilities, data-in-transit/at-rest protection, and compliance (PCI DSS for the online store, privacy laws).
Rate and prioritize
Assess each risk by likelihood and impact (a simple risk matrix) so MOD knows where to focus. Note the shared-responsibility split with the SaaS vendor.
Format
Keep the assessment focused on your chosen system and set up the integration policies and mitigation you’ll address in assignments 2 and 3.