scenario:Consider the following scenario:
Paul Gray is the proprietor of a small share trading company that allows individuals to enter the stock market. He is currently running it with manual procedures and communicating with his clients using a free e-mail service provider and Skype telephone. He is planning to convert it to an online share trading company, but he is aware that there are security concerns when doing this. Gray needs his online trading portal to have the following key requirements:
It should allow its registered users to trade from any net-enabled PC.
It should allow real-time portfolio tracking.
It should enable instant credit and money transfer.
Its users should be able to communicate with the company using any e-mail service, free or paid.
You were hired as a security consultant for Gray. You need to respond to the queries below in your initial meeting with Gray.
In this assignment, you will consider the need for security controls to protect the availability, confidentiality, and integrity of electronic data. Continuing with the scenario from Week 2 Discussion, every registered user of Paul Gray’s online share trading company is required to read the safety and privacy page of the portal. As a secure portal, it has Secure Socket Layer (SSL) as a security measure. Gray has asked you to help him with this aspect of security as well.
As many of Gray’s clients would also like to know about tax saving measures when they trade, Gray has hired Steve Davis as a tax consultant. Davis works from home and travels to his clients all over the country. Occasionally, he visits client sites, and takes his laptop with him on all such trips.
Gray has asked for recommendations on his current system and for Davis and his setup.
Answer the following questions:
On Gray’s portal, what security measures in addition to SSL can be deployed to ensure the privacy of users in an online environment? Provide at least two security measures and explain why they would be beneficial. What benefit does each provide to the user? How can the user be sure it is working properly?
For Davis, which top two security measures should he take to ensure that his data and the connection to Gray’s network are best protected against attack? Describe the security provided by each measure and explain why it is important. Defend your choice of measures in the discussions that follow. Are these two measures sufficient to call the laptop secure? Why or why not? If not, what aspect of security is still missing?
