Project 2 – e-Commerce Risk Analysis

Description

For this project, you will begin by researching a publicly traded company that engages in e-Commerce. You will then review the company’s risk statements as published each year in the company’s Annual Report to Investors (also published in the company’s annual filing of SEC Form 10-K). After analyzing the company’s e-Commerce operations and its risk statements about those activities, you will construct and document your own cybersecurity risk analysis which focuses upon the company’s e-Commerce activities (including all supporting business processes).

A list of approved companies appears at the end of this file (see Table 2). If you wish to use a company not on the approved list you must first obtain the approval of your instructor.

Note: before beginning this assignment, you should review NIST SP 800-30 R1: Guide for Conducting Risk Assessments. Pay special attention to Appendix D: “Threat Sources: Taxonomy of Threats Sources Capable of Initiating Threat Events” and Appendix H: “Impact: Effects of Threat Events on Organizations, Individuals, and the Nation.”

Research Your Chosen Company

1. Review the company’s website to learn about the products and services which it sells via e-Commerce.

2. Retrieve and review the Hoovers profile for the company. These profiles are written by professional analysts; pay close attention to the types of questions the analysts ask and answer in the company profile. Use this URL to access the database http://ezproxy.umuc.edu/login?url=https://www.mergentonline.com/Hoovers

3. Use the search bar at the top of the “Search & Build a List” tab to find your chosen company.

4. The company profile web pages in the Hoovers database are interactive and have expanding menus / options (see figure below). You may find it helpful to use the “OneStop Report” button to generate a PDF version of the information. Select “Core” under categories (Available Fields: Company Summary, Contacts, Corporate Family, Corporate Overview, SWOT, and News). Click on the field names in the middle column to select them for your report.

5. After you have looked at the company website and the Hoovers report, Identify 3 or more additional sources of information about the company and how it operates in cyberspace. These can be news articles, data breach reports, etc.

6. Using the information obtained from your sources, identify the types of information and business operations which drive this company’s need for cybersecurity products and services. (What needs to be protected?)

Analyze the Company’s Risk Statements

1. Using the links from Table 1 (at the end of this file), download a copy of your selected company’s most recent Annual Report to Investors from its Form 10-K filing with the United States Securities and Exchange Commission. (Note: the company is the author of its Form 10-K. Do not list the SEC as the author.)

2. Read and analyze the Risk Factors section in the company’s report to investors (Item 1.A). This section is a professionally written risk analysis that has been written for a specific audience. Pay close attention to what the company includes as risk factors and how the writers chose to present this information.

3. Analyze the risk factors to determine which ones are related to e-Commerce / Internet operations or are otherwise affected by the use of information in digital form and Information Technology systems and infrastructures. Make a list that shows what information, digital assets, and/or business operations (processes) need to be protected from cyberattacks and/or cybercrime (including insiders and external threats) and the type of risk or threat that could affect those assets and processes.

Write

1. An introduction section which identifies the company being discussed and provides a brief introduction to the company including when it was founded and significant events in its history.

2. A business profile for the company. This information should include: headquarters location, key personnel, primary types of business activities and locations, major products or services sold by the company, major competitors, stock information (including ticker symbol or NASDAQ code), recent financial performance, and additional relevant information from the business profiles. (Use information from Hoovers and other authoritative sources)

3. An overview of the company’s e-Commerce operations which summarizes information obtained from its annual report, the Hoovers profile for the company, and other sources which you found in your research.

4. A separate section in which you describe this company’s needs or requirements for cybersecurity. What information and/or business operations need to be protected? While your focus should be upon the company’s e-Commerce activities, you should also address the back-office or supporting information and business processes required to deliver those e-commerce activities.

5. A separate section which provides a detailed summary of the identified risks and potential impacts upon the company’s operations as a whole. What are the likely sources of threats or attacks for each type of information or business operation? (E.g. protect customer information from disclosure or theft during online purchase transactions.). What are the possible impacts should these risks occur? You may present your summary in table format.

Submit for Grading

Submit your work in MS Word format ( x or file) using the Project #2 Assignment in your assignment folder. (Attach the file.)

Additional Information

1. Your 5-8 page e-Commerce Risk Analysis should be professional in appearance with consistent use of fonts, font sizes, margins, etc. You should use headings to organize your paper. The CSIA program recommends that you follow standard APA formatting since this will give you a document that meets the “professional appearance” requirements. APA formatting guidelines and examples are found under Course Resources > APA Resources. An APA template file (MS Word format) has also been provided for your use CSIA_Basic_Paper_Template(APA_6ed,Dec2018) x.

2.

Your paper should use standard terms and definitions for cybersecurity.

3. You must include a cover page with the assignment title, your name, and the due date. Your reference list must be on a separate page at the end of your file. These pages do not count towards the assignment’s minimum page count. (An example and template file are available in the LEO classroom.

4. You are expected to write grammatically correct English in every assignment that you submit for grading. Do not turn in any work without (a) using spell check, (b) using grammar check, (c) verifying that your punctuation is correct and (d) reviewing your work for correct word usage and correctly structured sentences and paragraphs.

5. You are expected to credit your sources using in-text citations and reference list entries. Both your citations and your reference list entries must follow a consistent citation style (APA, MLA, etc.).

6. Consult the grading rubric for specific content and formatting requirements for this assignment.

See Table 1 at the end of this file for the list of approved e-Commerce companies which may be used for this project.

CSIA 350: Cybersecurity in Business & Industry

Copyright © 2020 by University of Maryland Global Campus. All rights reserved.

Table 1. List of Approved Companies for Project #2: e-Commerce Risk Analysis

Company Name

Corporate Website / Investor Relations

Form 10-K from SEC Edgar Database

Alphabet, Inc (Google)

https://www.google.com/intl/en/about/company/
https://investor.google.com/

https://www.sec.gov/Archives/edgar/data/1652044/000165204419000004/goog10-kq42018.htm

Amazon

http://www.amazon.com

http://phx.corporate-ir.net/phoenix.zhtml?c=97664&p=irol-irhome

https://www.sec.gov/Archives/edgar/data/1018724/000101872419000004/amzn-20181231x10k.htm

Apple

https://www.apple.com/newsroom/

http://investor.apple.com/

https://www.sec.gov/Archives/edgar/data/320193/000032019318000145/a10-k20189292018.htm

Booking Holdings

https://www.bookingholdings.com/ http://ir.bookingholdings.com/investor-relations

https://www.sec.gov/Archives/edgar/data/1075531/000107553119000009/bkng1231201810k.htm

Facebook

https://www.facebook.com/facebook

http://investor.fb.com/

https://www.sec.gov/Archives/edgar/data/1326801/000132680119000009/fb-12312018x10k.htm

Microsoft

http://www.microsoft.com
http://www.microsoft.com/investor/default.aspx

https://www.sec.gov/Archives/edgar/data/789019/000156459018019062/msft-10k_20180630.htm

Oracle Corp.

http://www.oracle.com/us/corporate/index.html
http://investor.oracle.com/overview/highlights/default.aspx

https://www.sec.gov/Archives/edgar/data/1341439/000119312518201034/d568983d10k.htm

PayPal Holdings

https://www.paypal.com/us/webapps/mpp/about

https://investor.paypal-corp.com/

https://www.sec.gov/Archives/edgar/data/1633917/000163391719000043/pypl201810-k.htm

Salesforce

https://www.salesforce.com/company/
http://investor.salesforce.com/about-us/investor/overview/default.aspx

https://www.sec.gov/Archives/edgar/data/1108524/000110852419000009/crmq4fy1910-k.htm

Rubric Name: Project 2: e-Commerce Risk Analysis

Introduction to the Company

1

5 points

Provided an excellent introduction section which identified the company being profiled and included a brief overview of the company (when it was founded, by whom, major products or services provided by the company, and significant events in the company’s history). Appropriately used information from 3 or more authoritative sources.

Business Profile (e-Commerce Activities & Supporting Operations, Locations, Finances)

20 points

Provided an excellent overview of the company’s e-commerce activities and supporting operations. Summarized information from its annual report, the Hoovers profile for the company, and other authoritative sources. This information included: headquarters location, key personnel, primary types of e-commerce activities and related business activities and locations, major products or services sold by the company, major competitors, stock information (including ticker symbol or NASDAQ code), recent financial performance, and additional relevant information from the business profiles. Appropriately used and cited information from authoritative sources.

Business Needs for Cybersecurity Products and Services

15 points

Provided an excellent discussion of this company’s business needs or requirements for cybersecurity. Fully answered the question: What information and/or business operations need to be protected? Appropriately used information from 3 or more authoritative sources.

Detailed Summary of Risks and Potential Impacts

20 points

Provided an excellent summary of the risk analysis including potential impacts to the company as a whole. This section was clear, concise, and accurate. Appropriately used information from authoritative sources

Addressed security issues using standard cybersecurity terminology

5 points

Demonstrated excellence in the use of standard cybersecurity terminology to support discussion of security issues. Appropriately used 5 or more standard terms.

Professionalism Part 1: Consistent Use and Formatting for Citations and Reference List

5 points

Work contains a reference list containing entries for all cited resources. Sufficient information is provided to allow a reader to find and retrieve the cited sources. Reference list entries and in-text citations are consistently and correctly formatted using an appropriate citation style (APA, MLA, etc.).

Professionalism Part 2: Organization & Appearance

10 points

Submitted work shows outstanding organization and the use of color, fonts, titles, headings and sub-headings, etc. is appropriate to the assignment type.

Professionalism Part 3: Execution

10 points

No formatting, grammar, spelling, or punctuation errors.