Please create a Risk Mitigation Plan for thisscenario.
Scenario: You are an information technology (IT) intern workingfor Health Network, Inc. (Health Network), a fictitious healthservices organization headquartered in Minneapolis, Minnesota.Health Network has over 600 employees throughout the organizationand generates $500 million USD in annual revenue. The company hastwo additional locations in Portland, Oregon and Arlington,Virginia, which support a mix of corporate operations. Eachcorporate facility is located near a colocation data center, whereproduction systems are located and managed by third-party datacenter hosting vendors.
Company Products Health Network has three main products:HNetExchange, HNetPay, and HNetConnect.
HNetExchange is the primary source of revenue for the company.The service handles secure electronic medical messages thatoriginate from its customers, such as large hospitals, which arethen routed to receiving customers such as clinics.
HNetPay is a Web portal used by many of the company’sHNetExchange customers to support the management of secure paymentsand billing. The HNetPay Web portal, hosted at Health Networkproduction sites, accepts various forms of payments and interactswith credit-card processing organizations much like a Web commerceshopping cart.
HNetConnect is an online directory that lists doctors, clinics,and other medical facilities to allow Health Network customers tofind the right type of care at the right locations. It containsdoctors’ personal information, work addresses, medicalcertifications, and types of services that the doctors and clinicsoffer. Doctors are given credentials and are able to update theinformation in their profile. Health Network customers, which arethe hospitals and clinics, connect to all three of the company’sproducts using HTTPS connections. Doctors and potential patientsare able to make payments and update their profiles usingInternet-accessible HTTPS Web sites.
Information Technology InfrastructureOverview
Health Network operates in three production data centers thatprovide high availability across the company’s products. The datacenters host about 1,000 production servers, and Health Networkmaintains 650 corporate laptops and company-issued mobile devicesfor its employees. Threats Identified Upon review of the currentrisk management plan, the following threats were identified:
? Loss of company data due to hardware being removed fromproduction systems ? Loss of company information on lost or stolencompany-owned assets, such as mobile devices and laptops
? Loss of customers due to production outages caused by variousevents, such as natural disasters, change management, unstablesoftware, and so on
? Internet threats due to company products being accessible onthe Internet
? Insider threats
? Changes in regulatory landscape that may impact operationsManagement Request
Senior management at Health Network has determined that theexisting risk management plan for the organization is out of dateand a new risk management plan must be developed. Because of theimportance of risk management to the organization, seniormanagement is committed to and supportive of the project to developa new plan. You have been assigned to develop this new plan.
Additional threats other than those described previously may bediscovered when re-evaluating the current threat landscape duringthe risk assessment phase.
The budget for this project has not been defined due to seniormanagement’s desire to react to any and all material risks that areidentified within the new plan. Given the company’s annual revenue,reasonable expectations can be determined.
Please create a Risk Mitigation Plan
Senior management at Health Network allocated funds to support arisk mitigation plan, and have requested that the risk manager andteam create a plan in response to the deliverables produced withinthe earlier phases of the project. The risk mitigation plan shouldaddress the identified threats described in the scenario for thisproject, as well as any new threats that may have been discoveredduring the risk assessment. You have been assigned to develop thisnew plan.
