Assignment Brief and Guidance:

EMC Cloud Solutions is reputed as the nation’s most reliable Cloud solution provider in Sri Lanka. A number of high-profile businesses in Sri Lanka including Esoft Metro Camps network, SME Bank Sri Lanka and WEEFM are facilitated by EMC Cloud Solutions. EMC Cloud provides nearly 500 of its customers with SaaS, PaaS & IaaS solutions with high-capacity compute and storage options. Also, EMC is a selected contractor for Sri Lanka, The Ministry of Defense for hosting government and defense systems.

EMC’s central data center facility is located at Colombo Sri Lanka along with its corporate head-office in Bambalapitiya. Their premises at Bambalapitiya is a six-story building with the 1st floor dedicated to sales and customer services equipped with public wifi facility. Second-floor hosts HR, Finance and Training & Development departments and the third-floor hosts boardroom and offices for senior executives along with the IT and Data center department. Floor 4,5,6 hosts computer servers which make up the data center.

With the rapid growth of information technology in Kandy area in recent years, EMC seeks opportunity to extend its services to Kandy, Sri Lanka. As of yet, the organization still considers the nature of such extension with what to implement, where is the suitable location and other essential options such as security are actually being discussed.

You are hired by the management of EMC Solutions as a Security Expert to evaluate the security-related specifics of its present system and provide recommendations on security and reliability related improvements of its present system as well as to plan the establishment of the extension on a solid  security foundation.

Activity 01

Assuming the role of External Security Consultant, you need to compile a report focusing on following elements to the board of EMC Cloud Solutions;
Identify types of security risks EMC Cloud is subject to, in its present setup and the impact, such issues would create on the business itself.

Develop and describe security procedures for EMC Cloud to minimize the impact of issues discussed in section (1.1) by assessing and treating the risks.

Activity 02
Discuss how EMC Cloud and its clients will be impacted by improper/ incorrect configurations which are applicable to firewalls and VPN solutions.

Explain how following technologies would benefit EMC Cloud and its Clients by facilitating a ‘trusted network’. (Support your answer with suitable illustrations).
DMZ
Static IP iii) NAT
Discuss the benefits of implementing network monitoring systems.


Activity 03
Formulate a suitable risk assessment procedure for EMC Cloud solutions to safeguard itself and its clients.


Explain the mandatory data protection laws and procedures which will be applied to data storage solutions provided by EMC Cloud. You may also highlight on risk management methodology.

Comment on the topic, ‘IT Security & Organizational Policy’

Review the following case study and answer the questions at the end of the case study. 
MoMP CobIT Case Study

While attending one of the ISACA continuous professional education (CPE) sessions related to optimizing IT spending using COBIT 5 practices, it was surprising to realize that many IT audit and assurance professionals who attended the session confided having difficulty in initiating governance of enterprise IT (GEIT) and wished they had more insight on where to begin when implementing GEIT in their respective organization. This article describes the experience of initiating GEIT at the 

The Primary Stakeholders
The MoMP was established to regulate the labor market by providing stable work environments with a productive national workforce with the contribution from all three stakeholders (government, employers and employees) and to increase the percentage of national man power in the private sector to enhance its role in supporting the national economy. One of the objectives of MoMP is building an integrated labor market informational system and preparing the national labor force register with the aim of developing human resources (HR) in the country and ensuring their optimum utilization.

The Information Technology Authority (ITA), Sultanate of Oman, was established to implement national IT infrastructure projects and supervise all projects related to implementation of the Digital Oman Strategy while providing professional leadership to various other e-governance initiatives of the Sultanate. ITA serves as a competency center on best practices in e-governance and in harnessing information and communication technologies (ICTs), thereby offering efficient and timely services, integrating processes, and improving efficiency in service delivery.

The Background
In alignment with the eOman e-Transformation vision of 2020 as part of the Digital Oman Strategy, ITA mandated services provided by all the Ministries to be transformed into electronic format and, consequently, qualifying as many as 145 key government services that MoMP provides to the sponsors (companies), residents (expatriates) and citizens (Omani nationals) as part of the e-governance initiative.

As a response to the mandate, MoMP’s network and information security department and systems and applications development department set out to first implement an information security management system (ISMS) across the entire Ministry, adopting ISO/IEC 27001:2005 in 2010 and, subsequently, getting certified in 2011. It took the initiative until 2012 to setup a project management department as a provision to effectively and efficiently manage several IT projects associated with MoMP e-Transformation Strategy. The project management department adopted a combination of the Projects in Controlled Environments version 2 (PRINCE2) methodology and the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK Guide) for the project management system (PMS). Additionally, it adopted Information Technology Infrastructure Library version 3 (ITIL V3), as an ITSM methodology to manage the IT services provided to the internal and external stakeholders, and to manage the e-services provided to the MoMP beneficiaries.

The Challenges
The biggest challenge was the unstructured awareness, absence of training and the knowledge gap of IT governance among the stakeholders within MoMP. The situation was made trickier due to the prevalence of inaccurate information and incorrect perceptions about the term “governance” itself. The “unlearning” and “relearning” was quite an uphill task, and it took a majority of the time and efforts.

ITA also acknowledged1 the challenges of obsolete technologies, lack of sharing of infrastructure and data, ad hocapplication development and manual government services. As a solution, it introduced an enterprise architecture framework specifically designed for ministries and other government entities. The framework was aptly titled the Oman e-Governance Architecture Framework (OeGAF), a set of standards/best practices and process management systems to enhance the delivery of government services in alignment with the mission of ITA.

At MoMP, the ISMS was already quite mature and generally accepted by the stakeholders; however, since the PMS and the ITSM were relatively new, there were mixed feeling about the effectiveness and value of additional systems. Furthermore, there were concerns raised about additional paperwork and documentation related to these 2 systems, which were perceived as a burden to an already overloaded MoMP staff of more than 5,000 employees across numerous branches, locations and directorates.

Another challenge was that while the ISMS was more prescriptive in nature, the PMS and the ITSM were more adaptive, more like guidelines. Hence, initially the ISMS team was somewhat reluctant to cooperate with the other two teams, fearing noncompliance in their control objectives.

Choosing a Framework
The PMS team realized that their current role needed enhancement to address the challenges at hand. Hence, it was transformed into a functional IT project and program management office (IT PMO), within the network and information security department and the systems and applications development department.

After conducting carefully facilitated workshops with the identified stakeholders, the IT PMO eased all fears and reluctance relating to common pain areas, and common functional and organizational objectives. Eventually, the ISMS and IT PMO teams joined hands forming the process engineering group (PEG) as a potential IT governance implementation team.

One of the critical points of initial discussions was how to integrate the external mandates, along with 3 somewhat divergent management systems (ISMS, ITSM and PMS). Some of the other points raised were: who would be held responsible and accountable for the different interdependent functional duties and who would provide direction for the strategies.

The PEG team was tasked to research, review and analyse the drivers and the pain areas. It determined that the gap or the missing piece was IT governance, especially since MoMP had already embarked on the e-governance journey. Various options for implementing IT governance and available frameworks were categorically and systematically reviewed and, finally, the PEG recommended COBIT 5 as the solution for the implementation of GEIT, specifically its 5 principles 

⦁ Who are the stakeholders and how did they go about identify them? (what activity was conducted)

Review the following case study and answer the questions at the end of the case study. 
MoMP CobIT Case Study

While attending one of the ISACA continuous professional education (CPE) sessions related to optimizing IT spending using COBIT 5 practices, it was surprising to realize that many IT audit and assurance professionals who attended the session confided having difficulty in initiating governance of enterprise IT (GEIT) and wished they had more insight on where to begin when implementing GEIT in their respective organization. This article describes the experience of initiating GEIT at the 

The Primary Stakeholders
The MoMP was established to regulate the labor market by providing stable work environments with a productive national workforce with the contribution from all three stakeholders (government, employers and employees) and to increase the percentage of national man power in the private sector to enhance its role in supporting the national economy. One of the objectives of MoMP is building an integrated labor market informational system and preparing the national labor force register with the aim of developing human resources (HR) in the country and ensuring their optimum utilization.

The Information Technology Authority (ITA), Sultanate of Oman, was established to implement national IT infrastructure projects and supervise all projects related to implementation of the Digital Oman Strategy while providing professional leadership to various other e-governance initiatives of the Sultanate. ITA serves as a competency center on best practices in e-governance and in harnessing information and communication technologies (ICTs), thereby offering efficient and timely services, integrating processes, and improving efficiency in service delivery.

The Background
In alignment with the eOman e-Transformation vision of 2020 as part of the Digital Oman Strategy, ITA mandated services provided by all the Ministries to be transformed into electronic format and, consequently, qualifying as many as 145 key government services that MoMP provides to the sponsors (companies), residents (expatriates) and citizens (Omani nationals) as part of the e-governance initiative.

As a response to the mandate, MoMP’s network and information security department and systems and applications development department set out to first implement an information security management system (ISMS) across the entire Ministry, adopting ISO/IEC 27001:2005 in 2010 and, subsequently, getting certified in 2011. It took the initiative until 2012 to setup a project management department as a provision to effectively and efficiently manage several IT projects associated with MoMP e-Transformation Strategy. The project management department adopted a combination of the Projects in Controlled Environments version 2 (PRINCE2) methodology and the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK Guide) for the project management system (PMS). Additionally, it adopted Information Technology Infrastructure Library version 3 (ITIL V3), as an ITSM methodology to manage the IT services provided to the internal and external stakeholders, and to manage the e-services provided to the MoMP beneficiaries.

The Challenges
The biggest challenge was the unstructured awareness, absence of training and the knowledge gap of IT governance among the stakeholders within MoMP. The situation was made trickier due to the prevalence of inaccurate information and incorrect perceptions about the term “governance” itself. The “unlearning” and “relearning” was quite an uphill task, and it took a majority of the time and efforts.

ITA also acknowledged1 the challenges of obsolete technologies, lack of sharing of infrastructure and data, ad hocapplication development and manual government services. As a solution, it introduced an enterprise architecture framework specifically designed for ministries and other government entities. The framework was aptly titled the Oman e-Governance Architecture Framework (OeGAF), a set of standards/best practices and process management systems to enhance the delivery of government services in alignment with the mission of ITA.

At MoMP, the ISMS was already quite mature and generally accepted by the stakeholders; however, since the PMS and the ITSM were relatively new, there were mixed feeling about the effectiveness and value of additional systems. Furthermore, there were concerns raised about additional paperwork and documentation related to these 2 systems, which were perceived as a burden to an already overloaded MoMP staff of more than 5,000 employees across numerous branches, locations and directorates.

Another challenge was that while the ISMS was more prescriptive in nature, the PMS and the ITSM were more adaptive, more like guidelines. Hence, initially the ISMS team was somewhat reluctant to cooperate with the other two teams, fearing noncompliance in their control objectives.

Choosing a Framework
The PMS team realized that their current role needed enhancement to address the challenges at hand. Hence, it was transformed into a functional IT project and program management office (IT PMO), within the network and information security department and the systems and applications development department.

After conducting carefully facilitated workshops with the identified stakeholders, the IT PMO eased all fears and reluctance relating to common pain areas, and common functional and organizational objectives. Eventually, the ISMS and IT PMO teams joined hands forming the process engineering group (PEG) as a potential IT governance implementation team.

One of the critical points of initial discussions was how to integrate the external mandates, along with 3 somewhat divergent management systems (ISMS, ITSM and PMS). Some of the other points raised were: who would be held responsible and accountable for the different interdependent functional duties and who would provide direction for the strategies.

The PEG team was tasked to research, review and analyse the drivers and the pain areas. It determined that the gap or the missing piece was IT governance, especially since MoMP had already embarked on the e-governance journey. Various options for implementing IT governance and available frameworks were categorically and systematically reviewed and, finally, the PEG recommended COBIT 5 as the solution for the implementation of GEIT, specifically its 5 principles 

Steps to Initiate GEIT

Once the gap in GEIT was confirmed, the first task of the PEG was training on GEIT and COBIT 5. Weekly training workshops were held for all the PEG members to enhance their knowledge of the COBIT 5 framework (COBIT 5 Foundation certificate), and, in turn, the PEG members conducted awareness workshops and informal discussions about GEIT and COBIT 5 with the rest of the MoMP IT staff members.

Next, PEG drafted an outline of a business case for GEIT implementation, which was based on COBIT 5 Implementation.2 Since ITA helped tremendously by surveying the external stakeholders through a nationwide landscape survey, as part of the e-Transformation Business Process Re-engineering (BPR) initiative for MoMP, simultaneously the PEG also drafted a MoMP internal survey for assessing the IT challenges within the organization, especially for the network and information security department and the systems and application development department. The survey was modeled from the GEIT pain points to COBIT 5.3 To get better responses, the survey which was initially presented in English, was translated to Arabic as well, and distributed among the staff while attending a short awareness workshop regarding the same.

Both the ITA’s BPR Landscape Survey and MoMP’s internal IT Challenges Survey reports served as starting reference points to address any additional drivers and to initially identify the relevant COBIT 5 and MoMP business processes to prioritize. These details were added in an executive-level recommendation report and presented to the directorate general (DG) of planning and development of MoMP, along with the outline business case and the updated survey results. A short visual presentation further elaborating the need for GEIT and for adopting COBIT 5 was conducted for the DG.

As a result of this meeting, the scope of the GEIT implementation program was finalized, and the initial mandatory processes from COBIT 5 and key performance indicators (KPIs) were agreed upon with the DG. This helped secure executive sponsorship from a business stakeholder and a business champion, which helped ensure the sustainability of the GEIT program in MoMP in the long term.

Next Steps
The GEIT journey for the MoMP is a long, but strategically positioned initiative. The immediate next steps for GEIT include baselining the business case, preparing the GEIT implementation program plan, drafting and formulating IT governance polices and processes, forming the IT executive strategy committee and the IT governance steering committee in the MoMP, defining the IT-related goals, and conducting the “as-is” current state assessment using self-assessment guides such as the COBIT Process Assessment Model (PAM): Using COBIT 5 and ISO/IEC 15504.

⦁ What government mandated framework/strategy were they trying to comply to and who set it?

Review the following case study and answer the questions at the end of the case study. 
MoMP CobIT Case Study

While attending one of the ISACA continuous professional education (CPE) sessions related to optimizing IT spending using COBIT 5 practices, it was surprising to realize that many IT audit and assurance professionals who attended the session confided having difficulty in initiating governance of enterprise IT (GEIT) and wished they had more insight on where to begin when implementing GEIT in their respective organization. This article describes the experience of initiating GEIT at the 

The Primary Stakeholders
The MoMP was established to regulate the labor market by providing stable work environments with a productive national workforce with the contribution from all three stakeholders (government, employers and employees) and to increase the percentage of national man power in the private sector to enhance its role in supporting the national economy. One of the objectives of MoMP is building an integrated labor market informational system and preparing the national labor force register with the aim of developing human resources (HR) in the country and ensuring their optimum utilization.

The Information Technology Authority (ITA), Sultanate of Oman, was established to implement national IT infrastructure projects and supervise all projects related to implementation of the Digital Oman Strategy while providing professional leadership to various other e-governance initiatives of the Sultanate. ITA serves as a competency center on best practices in e-governance and in harnessing information and communication technologies (ICTs), thereby offering efficient and timely services, integrating processes, and improving efficiency in service delivery.

The Background
In alignment with the eOman e-Transformation vision of 2020 as part of the Digital Oman Strategy, ITA mandated services provided by all the Ministries to be transformed into electronic format and, consequently, qualifying as many as 145 key government services that MoMP provides to the sponsors (companies), residents (expatriates) and citizens (Omani nationals) as part of the e-governance initiative.

As a response to the mandate, MoMP’s network and information security department and systems and applications development department set out to first implement an information security management system (ISMS) across the entire Ministry, adopting ISO/IEC 27001:2005 in 2010 and, subsequently, getting certified in 2011. It took the initiative until 2012 to setup a project management department as a provision to effectively and efficiently manage several IT projects associated with MoMP e-Transformation Strategy. The project management department adopted a combination of the Projects in Controlled Environments version 2 (PRINCE2) methodology and the Project Management Institute’s A Guide to the Project Management Body of Knowledge (PMBOK Guide) for the project management system (PMS). Additionally, it adopted Information Technology Infrastructure Library version 3 (ITIL V3), as an ITSM methodology to manage the IT services provided to the internal and external stakeholders, and to manage the e-services provided to the MoMP beneficiaries.

The Challenges
The biggest challenge was the unstructured awareness, absence of training and the knowledge gap of IT governance among the stakeholders within MoMP. The situation was made trickier due to the prevalence of inaccurate information and incorrect perceptions about the term “governance” itself. The “unlearning” and “relearning” was quite an uphill task, and it took a majority of the time and efforts.

ITA also acknowledged1 the challenges of obsolete technologies, lack of sharing of infrastructure and data, ad hocapplication development and manual government services. As a solution, it introduced an enterprise architecture framework specifically designed for ministries and other government entities. The framework was aptly titled the Oman e-Governance Architecture Framework (OeGAF), a set of standards/best practices and process management systems to enhance the delivery of government services in alignment with the mission of ITA.

At MoMP, the ISMS was already quite mature and generally accepted by the stakeholders; however, since the PMS and the ITSM were relatively new, there were mixed feeling about the effectiveness and value of additional systems. Furthermore, there were concerns raised about additional paperwork and documentation related to these 2 systems, which were perceived as a burden to an already overloaded MoMP staff of more than 5,000 employees across numerous branches, locations and directorates.

Another challenge was that while the ISMS was more prescriptive in nature, the PMS and the ITSM were more adaptive, more like guidelines. Hence, initially the ISMS team was somewhat reluctant to cooperate with the other two teams, fearing noncompliance in their control objectives.

Choosing a Framework
The PMS team realized that their current role needed enhancement to address the challenges at hand. Hence, it was transformed into a functional IT project and program management office (IT PMO), within the network and information security department and the systems and applications development department.

After conducting carefully facilitated workshops with the identified stakeholders, the IT PMO eased all fears and reluctance relating to common pain areas, and common functional and organizational objectives. Eventually, the ISMS and IT PMO teams joined hands forming the process engineering group (PEG) as a potential IT governance implementation team.

One of the critical points of initial discussions was how to integrate the external mandates, along with 3 somewhat divergent management systems (ISMS, ITSM and PMS). Some of the other points raised were: who would be held responsible and accountable for the different interdependent functional duties and who would provide direction for the strategies.

The PEG team was tasked to research, review and analyse the drivers and the pain areas. It determined that the gap or the missing piece was IT governance, especially since MoMP had already embarked on the e-governance journey. Various options for implementing IT governance and available frameworks were categorically and systematically reviewed and, finally, the PEG recommended COBIT 5 as the solution for the implementation of GEIT, specifically its 5 principles 

Steps to Initiate GEIT

Once the gap in GEIT was confirmed, the first task of the PEG was training on GEIT and COBIT 5. Weekly training workshops were held for all the PEG members to enhance their knowledge of the COBIT 5 framework (COBIT 5 Foundation certificate), and, in turn, the PEG members conducted awareness workshops and informal discussions about GEIT and COBIT 5 with the rest of the MoMP IT staff members.

Next, PEG drafted an outline of a business case for GEIT implementation, which was based on COBIT 5 Implementation.2 Since ITA helped tremendously by surveying the external stakeholders through a nationwide landscape survey, as part of the e-Transformation Business Process Re-engineering (BPR) initiative for MoMP, simultaneously the PEG also drafted a MoMP internal survey for assessing the IT challenges within the organization, especially for the network and information security department and the systems and application development department. The survey was modeled from the GEIT pain points to COBIT 5.3 To get better responses, the survey which was initially presented in English, was translated to Arabic as well, and distributed among the staff while attending a short awareness workshop regarding the same.

Both the ITA’s BPR Landscape Survey and MoMP’s internal IT Challenges Survey reports served as starting reference points to address any additional drivers and to initially identify the relevant COBIT 5 and MoMP business processes to prioritize. These details were added in an executive-level recommendation report and presented to the directorate general (DG) of planning and development of MoMP, along with the outline business case and the updated survey results. A short visual presentation further elaborating the need for GEIT and for adopting COBIT 5 was conducted for the DG.

As a result of this meeting, the scope of the GEIT implementation program was finalized, and the initial mandatory processes from COBIT 5 and key performance indicators (KPIs) were agreed upon with the DG. This helped secure executive sponsorship from a business stakeholder and a business champion, which helped ensure the sustainability of the GEIT program in MoMP in the long term.

Next Steps
The GEIT journey for the MoMP is a long, but strategically positioned initiative. The immediate next steps for GEIT include baselining the business case, preparing the GEIT implementation program plan, drafting and formulating IT governance polices and processes, forming the IT executive strategy committee and the IT governance steering committee in the MoMP, defining the IT-related goals, and conducting the “as-is” current state assessment using self-assessment guides such as the COBIT Process Assessment Model (PAM): Using COBIT 5 and ISO/IEC 15504.

⦁ What other standards (3 standards) are they already compliant to? And what are they for?