There was a security breach at the Office of Personnel Management and the information assurance manager was asked to assess the vulnerabilities. The manager reviewed an OPM report which found that hackers gained access through compromised credentials. Had OPM followed previous audit reports and security findings, the breach could have been prevented. Implementing encryption and regular system scans may also have helped prevent and detect the breach. The manager was tasked with creating a Security Assessment Report and Risk Assessment Report identifying threats, vulnerabilities, risks, and recommended remediation.

1. CST 610 Proj 2
Project 2 ScenarioAssessing Information System Vulnerabilities and RiskYou are an
information assurance management officer (IAMO) at an organization of your choosing. One
morning, as you’re getting ready for work, you see an email from Karen, your manager. She
asks you to come to her office as soon as you get in. When you arrive to your work, you head
straight to Karen’s office. “Sorry for the impromptu meeting,” she says, “but we have a bit of
an emergency. There’s been a security breach at the Office of Personnel Management.”We
don’t know how this happened, but we need to make sure it doesn’t happen again, says
Karen. You’ll be receiving an email with more information on the security breach. Use this
info to assess the information system vulnerabilities of the Office of Personnel
Management.At your desk, you open Karen’s email. She’s given you an OPM report from the
Office of the Inspector General, or OIG. You have studied the OPM OIG report and found that
the hackers were able to gain access through compromised credentials. The security breach
could have been prevented if the Office of Personnel Management, or OPM, had abided by
previous auditing reports and security findings. In addition, access to the databases could
have been prevented by implementing various encryption schemas and could have been
identified after running regularly scheduled scans of the systems.Karen and the rest of the
leadership team want you to compile your findings into a Security Assessment Report, or
SAR. You will also create a Risk Assessment Report, or RAR, in which you identify threats,
vulnerabilities, risks, and likelihood of exploitation and suggested remediation.