Your group has just been hired as a security advisor for a new startup company named Financial Info Quest (FIQ) that aims at providing fast, up-to-date financial data and news to investment companies in Canada and around the world. FIQ will compete in the same market than Bloomberg, but intends offer services at much lower prices and specialize in the gathering of news information related to Canadian markets.
FIQ just developed a Web platform to which clients can hook up in order to receive the offered services. The Web site has a public section, as well as a private (for members only) section, which is protected by a password. Each client will have a distinct password. The Web platform was recently developed by three graduate students who were hired as summer interns. The platform was written in Java and installed on Windows servers, with the back-end information being stored on Oracle databases. These servers have been placed in a private room, at the Montreal downtown office space of FIQ. They have rented a floor in a newly renovated building situated on Saint-Lawrence Boulevard, which is nicely located near the corner of Mount Royal Avenue where a high vacancy rate has led to low rental prices.
FIQ is about to sign a deal with an offshore company that will offer 24/7 monitoring of news events on the Internet. The owners of FIQ are really excited about this new deal since they are going to receive a great service at a very low and affordable price.
Finally, FIQ is about to hire 5 financial analysts that will coordinate the collection and sharing of information, and add valuable insight regarding Canadian financial information that will be provided to FIQ's clients. The hiring process is almost over and the new employees will begin working at FIQ in the next month. They will each be given a computer as well as a laptop and a smartphone. They are expected to be able to connect to the company's network and access work information systems at any given time of the day, any day of the week. For remote access, one of the summer interns has setup RDP (remote desktop protocol) so that every employee can remotely access their desktop and access any resource on FIQ's network, just as if the employee was physically present at the office.
One of the owners, Gino, is in charge of business development and sales. FIQ is fortunate to have more than 100 small investment boutiques in Montreal and Toronto who are already interested in FIQs services. Services will be offered as a yearly membership, with a monthly fee that will automatically be charged on client's credit card accounts. In order to get things up and running quickly, Gino is thinking of hiring the students once again to quickly develop software that will allow FIQ to manage the payments automatically and directly without needing to pay a fee to a third party payment processor.
The owners of FIQ request that you perform an information security threat and risk assessment on their business processes. They want you to present the top 5 risks that you will have identified, and recommend various risk mitigating controls that will enable FIQ to adequately manage their risks. You will need to present the risks in a convincing way since the owners of FIQ think they already have everything covered very well.