Perform an evaluation of the SLA that you created, and in a checklist format, report on the performance of the ISP during thedata exfiltrationattack. Conduct independent research if a checklist example is needed. If you model your checklist after an existing resource, cite and referenceitusingAPA format. Estimate costs of services or any compensation owed to the nation team. Include written justification to the ISP for the downtime due todata exfiltration. This evaluation is included in the three- to five-page requirement.
Project 2: Nations Behaving Badly Step 13: Evaluate and Execute the Data Exfiltration Service-Level Agreement (SLA) You've communicated the attack to your other nation teams, your team has determined that all the nation teams were under data exfiltration attack, and they sustained latency or even unavailability of their networks. Now the CIOs have directed that the service-level agreements (SLAs) be reviewed on what the attack means to the cost and services rendered. Technologically trained professionals increase their marketability and hire-ability when they can demonstrate business acumen as well as technical expertise. And with more integrated environments following services on-demand structures such as cloud computing, it is imperative that cybersecurity professionals be able to assess if their organization is getting what it paid for. You may have determined a network topology for your nation team, or you may have researched a network topology and are using that to base your analysis, citing the researched information using APA format. In these topologies, you will research the operating system vulnerabilities (operating system fundamentals, operating system protections). You will identify requirements for operating system security to address these vulnerabilities. You will then formulate a service-level agreement to mitigate the vulnerabilities, particularly for data exfiltration activities. Produce a three- to five-page Service-Level Agreement (SLA) that you believe is best to serve the nation teams’ security protections. If you research sample SLAs, provide citations. Include: · an agreement not to engage in testing data exfiltration without notifying the internet service provider (ISP) · metrics for availability · bandwidth requirements · monitoring from the ISP's network · traffic reports to be received and access to ISP information on net defense and best practices · testing nation teams’ configurations by ISP · other components needed to fulfill your nation team's requirements Perform an evaluation of the SLA that you created, and in a checklist format, report on the performance of the ISP during the data exfiltration attack. Conduct independent research if a checklist example is needed. If you model your checklist after an existing resource, cite and reference it using APA format. Estimate costs of services or any compensation owed to the nation team. Include written justification to the ISP for the downtime due to data exfiltration. This evaluation is included in the three- to five-page requirement. Part 1: Service-Level Agreement (SLA) sample: Introduction: SLA defines the standard of service that any customer expects from a supplier, as well as the metrics used to measure that services and any solutions or penalties that may be imposed if the agreed-upon services levels are not met. SLAs are typically agreements between organizations and their external suppliers, but they could also be agreements between two departments inside an organization. Purpose of SLA: SLAs can help to ensure that concrete and clear goals are established for all IT services. It can monitor and reduce customer satisfaction also with the quality of care offered. It can ensure that all parties recognize the level of service that will be provided. It can make certain that suitable measures to enhance service quality are put in place. Scope of SLA: An SLA assists service providers in determining the scope of the project and, in doing so, protects them from unwanted damages. An SLA provides customers with a clear picture of the work that could be done and any exceptions, allowing them to keep comparing the service provider to anyone and make informed choices. The ways to avoid the vulnerabilities for data exfiltration activities: · By converting data into ciphertext, data encryption helps protect confidential data contained in internal processes. Without a key, intruders are unable to understand or use the data. · While the data exfiltration threat is being evaluated, data backup ensures that the company can regain lost data as well as resume operations. Metrics for availability: · Business results: Utilizing KPIs to evaluate how service providers' efforts affect business performance. · Technical quality: It is measured in outsourced business applications using commercial analytical techniques that examine factors including program size and scripting defects. · Security: Application, as well as network security flaws, can be costly in these highly regulated times. Measuring manageable security measures like the anti-virus latest update and patching is critical in demonstrating that all reasonable preventive action is taken in the case of an incident. Bandwidth requirements: With an SLA bandwidth package, users get exactly what users pay for, namely a certain number of Mbps. Unique Wireless clients usually purchase among 50/50mbps as well as 200/200mbps of Mbps for just a single event. Whereas if bandwidth drops below what users purchased at any moment during the event, users will be full or partial refunded, based on the severity of the drop. Monitoring of the ISP's network: ISP control systems were limited to personal devices, resulting in visibility issues that made pinpointing and resolving performance problems or outages difficult. Detailed ISP monitoring entails using a combination of active and passive analysis methods to properly manage ISP connections along the entire service delivery sequence, allowing the nation team to identify and resolve traffic connections that experience difficulties or latency. Here are the traffic reports to be received and access to ISP information on net defense: Encryption that is truly pervasive mostly on the Internet is indeed a long way off: Because some parts of a site, including third-party advertising, are not encrypted, a page that uses HTTPS may issue browser warning signs to users. Then there are IoT devices that struggle to encrypt all being sent as well as received network traffic. That's a lot of information that ISP can see. Encrypted Network traffic will be surprisingly revealing: Researchers have successfully inferred "the company problem of users of a company's website, and the annual terms of investment choices of customers of a major investment company website," as well as "reconstruct sections of encrypted VoIP interactions" even when consumers surf surrounded by white HTTPS connections. ISPs may well not rely on methods in general, but that could change if people begin to use encryption more frequently. "Policymakers must have a clear idea of what ISPs are capable of learning, now and in the future," wrote Upturn. Configuration testing is indeed limited to software but also to devices, which is why it is also known as Hardware configuration checking, in which designers test various hardware devices such as printers, webcams, scanners, and so on that help the web application under testing. Configuration testing is a kind of product testing in which the application under test must be tested using various combinations of development tools. Here are the other components required to fulfill the nation team's requirements: · Description of services: The SLA must include detailed explanations of every service provided under all possible situations, as well as processing times. · Service performance: Metrics for measuring productivity and development levels are established. The client and cloud provider must agree on a ranking of all the metrics that could be used to assess the provider's service levels. · Disaster recovery and risk management: Risk assessments and a disaster recovery process have been established and communicated. · Service reporting and tracking: This component defines the reporting system, tracking time interval, and stakeholder groups involved in the agreement. Part 2: Evaluation of the SLA in a checklist format: · Introduction of SLA · Statement of purpose · Statement of scope · The methods of mitigation of data exfiltration attack · Metrics for availability(Business results, Technical quality, Security, and so on.) · Bandwidth requirements within the SLA security protection. · ISP's network monitoring · Testing configuration via ISP · Other components to fulfill the nation team's requirements. Part 2: Performance of ISP: ISPs are essential for securing Internet access, configuring Internet traffic, addressing domain names, and maintaining the network structure that allows Internet access. While providing Internet access is an ISP's primary function, many ISPs do so much more. Cost of services: Around $29.99-$84.99 is the cost of services per month and the provider of this service is Xfinity Internet which provides 50-1200 Mbps download speed. Here is the justification for the downtime caused by data exfiltration to the ISP: · The organization is also not the ISP's main priority: If an ISP detects excessive traffic to the network, ISP may block only that traffic, including traffic to the website. At some stage, the ISP aids attackers in their goal of shutting down networks. · ISP has restricted bandwidth: As previously stated, the default reaction for ISPs under data threat is to carelessly block traffic. To remove volumetric attacks, a security-first vendor can distribute traffic across multiple ISPs and leverage massive amounts of bandwidth across multiple data centers. · ISPs are not required to use "most excellent efforts" to block a data exfiltration attack. Downtime caused by DDoS attacks is expensive, so the quicker the response time, the stronger. ISPs do not provide an SLA that describes attack detection periods, mitigation times, or prevention quality. References: SLA Management Checklist Template | Process Street. (2021). Retrieved 10 August 2021, from https://www.process.st/checklist/sla-management/ What is a Service-Level Agreement (SLA)?. (2021). Retrieved 10 August 2021, from https://searchitchannel.techtarget.com/definition/service-level-agreement Preventing Data Exfiltration: Definition, Examples and Best Practices. (2021). Retrieved 10 August 2021, from https://securityboulevard.com/2020/06/preventing-data-exfiltration-definition-examples-and-best-practices/ What is a Service Level Agreement (SLA) for SaaS Solutions? | GetVoIP. (2021). Retrieved 10 August 2021, from https://getvoip.com/blog/2020/07/29/service-level-agreement/ Storm, D. (2021). What can your ISP really see and know about you?. Retrieved 10 August 2021, from https://www.computerworld.com/article/3043490/what-can-your-isp-really-see-and-know-about-you.html