Reflection – Learning Launch

Challenge

I am a member of telecommunications company and my/our challenge is to improve the  Information Security to increase security level in the IT devices. The project scope includes the  Information Security department composed of seven employees, as well as the larger IT  department, with whom we work closely. The project is limited to internal and external  infrastructure networking involving a large number of technological devices. The project  should not exceed 3 months and the solution should include perform penetration testing and  vulnerability analysis. We will focus to prevent hacker attacks that could compromise the  company's image and reputation as well as online sales, which may result in financial losses to  shareholders.

Selection

Our team evaluated several design thinking tools, where we opted for learning launch tool.  After many meetings and strategic planning, the learning launch is an experiment meant to  quickly test an idea and prototype.

Application

The company is very concerned about maintaining an up-to-date technology environment,  prioritizing the security of its data. Vulnerability scans and Penetration tests are intended to  prevent unauthorized actions by exploiting faulty vulnerabilities or more coding practices in  applications, security breaches, in addition to database information, information manipulation,  and unavailability. In addition, they aim to measure the effectiveness of corporate protection  systems against targeted attacks via the internet or other private networks against their users.  To this end, company defined a scope of External and Internal Ethical hacking Tests in several  operations

Insight

When applying the learning launch tool, our team identified some assumptions that would  need to be tested. With this we have achieved early results, taking a more agile approach that  improves our IT Security from our team and prioritize testing and processes. Our actual results  were different than anticipated, however our team was willing to prioritize the invasion tests,

Key stakeholders such as the Information Security Department and IT department expressed  some concerns. Our team will review this vision and incorporate it into future launching  projects. The continuous incorporation of insights is extremely important at this stage, for a  complete launch in the timeline of design thinking.

Approach

The security testing that was performed is classified as a black box testing (without knowledge  of the environment). This approach was chosen to support efficiency and effectiveness of  testing, since testing is a time-boxed effort in which easy to retrieve information can be shared  with the testing team directly. Security testing in company  IT infrastructure consisted of the  following:   ■ Network mapping Mapping concerns the identification of systems and services in scope of  security testing.

■ Vulnerability scanning Scanning concerns the identification of services and weaknesses for  known systems and applications that are likely to be vulnerable for penetration testing.     ■ Exploiting Testing is focused on exploiting vulnerabilities to gain entry, or determining how  difficult it would be to do so given unlimited time, based on a certain level of skills and  experience. Penetration testing is a form of testing whereby the techniques of a hacker are  used. They serve to test the level of effectiveness of the implemented security measures, and  real attempts are made to break in to the environment.     We concluded that our team carried out several studies and activities aiming at the timeline  where learning launch tool has proven to be more efficient and appropriate. As demonstrated  earlier, our team has to review and improve the methodologies learned in order to incorporate  this in future projects, improving the perception and progress made. Finally we will arrive at a  convincing solution for the complete launching of an effective information technology security  program.


Reflection – Learning Launch Challenge I am a member of telecommunications company and my / our challenge is to improve the Information Security to increase security level in the IT devices . The project scope includes the Information Security department composed of seven employees , as well as the larger IT department , with whom we work closely . The project is limited to internal and external infrastructure networking involving a large number of technological devices . The project should not exceed 3 months and the solution should include perform penetration testing and vulnerability analysis . We will focus to prevent hacker attacks that could compromise the company 's image and reputation as well as online sales , which may result in financial losses to shareholders . Selection Our team evaluated several design thinking tools , where we opted for learning launch tool . After many meetings and strategic planning , the learning launch is an experiment meant to quickly test an idea and prototype . Application The company is very concerned about maintaining an up - to - date technology environment , prioritizing the security of its data . Vulnerability scans and Penetration tests are intended to prevent unauthorized actions by exploiting faulty vulnerabilities or more coding practices in applications , security breaches , in addition to database information , information manipulation , and unavailability . In addition , they aim to measure the effectiveness of corporate protection systems against targeted attacks via the internet or other private networks against their users . To this end , company defined a scope of External and Internal Ethical hacking Tests in several operations Insight When applying the learning launch tool , our team identified some assumptions that would need to be tested . With this we have achieved early results , taking a more agile approach that improves our IT Security from our team and prioritize testing and processes . Our actual results were different than anticipated , however our team was willing to prioritize the invasion tests , Key stakeholders such as the Information Security Department and IT department expressed some concerns . Our team will review this vision and incorporate it into future launching projects . The continuous incorporation of insights is extremely important at this stage , for a complete launch in the timeline of design thinking . Approach The security testing that was performed is classified as a black box testing ( without knowledge of the environment ) . This approach was chosen to support efficiency and effectiveness of testing , since testing is a time - boxed effort in which easy to retrieve information can be shared with the testing team directly . Security testing in company IT infrastructure consisted of the following : ■ Network mapping Mapping concerns the identification of systems and services in scope of security testing . ■ Vulnerability scanning Scanning concerns the identification of services and weaknesses for known systems and applications that are likely to be vulnerable for penetration testing . ■ Exploiting Testing is focused on exploiting vulnerabilities to gain entry , or determining how difficult it would be to do so given unlimited time , based on a certain level of skills and experience . Penetration testing is a form of testing whereby the techniques of a hacker are used . They serve to test the level of effectiveness of the implemented security measures , and real attempts are made to break in to the environment . We concluded that our team carried out several studies and activities aiming at the timeline where learning launch tool has proven to be more efficient and appropriate . As demonstrated earlier , our team has to review and improve the methodologies learned in order to incorporate this in future projects , improving the perception and progress made . Finally we will arrive at a convincing solution for the complete launching of an effective information technology security program .