Risk management is essential for an organization that aspires to prevent losses resulting from the occurrence of a risk. It involves risk management planning, identification, analysis, monitoring, and control as well as having contingency plans. Good risk management must be supported by a comprehensive action plan that will aid in the prevention of risks from occurring (Wang & Wang, 2018, p.712). The Dayton Soft Products Company over the recent past has suffered losses arising from attacks of its systems resulting in loss of vital information. Adoption of two-factor authentication and deployment of file integrity monitoring are the best risk management strategies that the company should put in place to secure its systems.

Two-factor Authentication

Ensuring that systems are accessed by an authorized party calls for their configuration using different techniques. A two-factor authentication technique aids in the confirming a user’s claimed identity by utilizing an aspect they know such as a password or something they have such as a card (Pinheiro, Timoteo , de Oliveira & Dias, 2016, p.125). The Dayton Soft Products Company can utilize this technique in different ways through the adoption of the factor components. The company should use a knowledge factor such as the installation of passwords to all its systems and letting the employees responsible with the systems have the passwords which will grant them the permission to access the systems’ data.

Secondly, the company should adopt the possession factor component by issuing security tokens that must be inserted in the systems before access is permitted. Thirdly, inherent factors are personalized and very restrictive hence assuring the systems of very high security. The company should get the fingerprints or voice of the employees and integrate them into the system’s security options. This will allow the right individual to get access to the secured data. Lastly, the company should adopt location-based factor that incorporates the physical location of the user in the security options. This factor allows users to utilize a GPS signal to log into the systems and get access to the required data (Wang & Wang, 2018, p.717).

The two-factor Authentication Action plan

Education is aimed to impart employees with knowledge on managing risks. In case of a problem, the training facilities gather all the employees to give guidance on the immediate actions to be taken. The training facilitators will set the priorities in the education of employees from the HR department. Every employee will be guided on individual responsibilities during the training. To ensure the sustainability of the education program, employees will be asked to attend security training sessions ones in a month. Those who are vulnerable to the risk such as the IT personnel will be guided deeply on what is expected of them.

On the other hand, Knowledge, possession and inherent factor are aimed at ensuring that all the people accessing the systems have the passwords, fingerprints or security signal details. In case of a problem, all the factors will be changed at the same time. The IT personnel will set the priorities for the management of the factorswill be set by the IT personnel. A contingency plan will involve having all the data within the systems being backed up in other devices that will be stored in locations away from the company’s premises. The systems which are highly vulnerable like those with vital data will have strong security configurations. The plan will be made sustainable through regular changing of the security codes as well as continued enlightenment of the employees on better strategies of upholding the company’s security. The strategy for ongoing risk identification will entail establishing any attempted entries using the wrong passwords and raising the alarm. In the identification of the risk, employees will be informed to be vigilant to a possible hacking followed by a subsequent change of passwords, fingerprints and signal security details. The steps for mitigating the risk will include ensuring that the data is backed up and changing security configurations. Lastly, the evaluation and proposal of future actions will be aimed at establishing the degree to which the security details installed are effective in meeting security needs of the company as well as evaluating other possible mechanisms that could be employed. In case of a problem, the evaluation will be done to assess the ability of installed techniques in securing the company’s data.

File integrity monitoring Action Plan

The Dayton Soft Products Company should also employ File integrity monitoring mechanism to secure its data.  The strategy involves examining files to establish when they change in position, how they change, who changes them as well as what can be done to restore them to their original locations (Wang, He, Wang & Chu, 2015, p.433). FIM is appropriate in detecting malware and also achieving security compliance within the company. FIM involves five tasks that are aimed at attaining the security of documents of an organization.

The first task involves setting policy by identifying the documents that require close monitoring. A continue plan should be made by having all records made in duplicate so that files that require close monitoring have a stable backup. The vulnerable files are selected based on the relevance of the information they have. Risk should also be identified based on the number of times the files are transferred. In making policies, risk mitigation will be to allow only specific individuals to be responsible for the movement of files as well as reporting unwanted file transfer to the management.

Secondly, a baseline for the files should be established. A reference point should be made to detect the transfer of files. The strategy will be creating a warning system for any missing file and taking steps of restoring the file to its position. The plan upon identification of a problem is to change the baseline criteria as it will prove irrelevant in detecting security issues promptly. This means that other baseline strategies will be proposed, evaluated and set up.

The third step will involve monitoring changes. This will involve a comparison of the baseline data and the expected targets. Negative variation will mean the change in policies as well as the reference point of detecting the transfer of files. The monitoring should be done regularly to ensure that all security strategies set are followed and that any variation acted upon. To enhance competency and continued monitoring, the employees charged with the responsibility should be trained on appropriate monitoring techniques as well as evaluating their monitoring performance.

Furthermore, another task will involve sending an alert concerning a missing file upon a claim of a missing file. To ensure the reliability of this task, training is required on the procedure for reporting any observed change in terms of file location. Employees should be informed about who they should report to as well as the data to be reported. Upon the identification of such a risk, back up data should be well secured as well as the security team taking the role of investigating the whereabouts of the file. Interrogative interviews should be conducted. For sustainability of the task, all employees responsible should be fired to stop the vice from spreading to other employees of the organization.

References

Pinheiro, A., Timoteo de Sousa, R., de Oliveira Albuquerque, R., & Dias Canedo, E. (2016). Trust-based protocol for permanent monitoring of file integrity in the cloud. Paper presented at the 1-6. doi:10.1109/CISTI.2016.7521430

Wang, D., & Wang, P. (2018). Two birds with one stone: Two-factor authentication with security beyond conventional bound. IEEE      Transactions on Dependable and Secure Computing, 15(4), 708-722. doi:10.1109/TDSC.2016.2605087

Wang, D., He, D., Wang, P., & Chu, C. (2015). Anonymous two-factor authentication in distributed systems: Certain goals are beyond        attainment. IEEE Transactions on Dependable and Secure Computing, 12(4), 428-442. doi:10.1109/TDSC.2014.2355850