ABC Insurance Company is one of the largest insurance companies in U.S. It has several branches/agents across the nation. Their branches can communicate with the central company headquarters and with each other through computer network. Customer information and company sensitive data has to be protected at all times. ABC Insurance Company has database servers, J2EE application server, and web application server for its employers to access. It allows the customers to access insurance policy information, purchase, and change or cancel insurance policies online, and other services. The customers include individual policy holders and business policy holders.

The company employees and the customers need login accounts to access the company servers. The company adopts the JRA architecture for the log-in capability. This infrastructure has many components. Many of the components consist of active directories, web servers, and databases. Each of the JRA architectures has a Business to Enterprise connection which is internal, Business to Customers which is individual policy customers and Business to Business which is business customers with the insurance company. These connections are called realms. Each realm is located at a different physical location.

ABC Insurance Company holds customer information which is a valued asset to the company. The company has to ensure that this information is confidential to have the customers trust. The company has to protect the customers insurance policies which are the drive for the company's success. Agents login credentials and data needs to be secure too.

A problem with ABC Insurance Company is the amount of hours needed to maintain the architecture. ABC Insurance Company wants a different way to implement this architecture. It was suggested to virtualize the JRA architecture. Virtualization can enable processes to share resources more efficiently. This would have different operating systems, web servers, and databases run on a virtual machine. Each realm would run on one machine as a virtual realm. This would cut down component costs, and cut down manpower to maintain the architecture. Two or more realms can run on one machine if they face the same kind of risks.

1. Determine the adverse impact resulting from a successful threat exercise of vulnerability. (Hint: reference: [1], Section 3.6, pg. 21)

2. Determine the risk level of the vulnerabilities based on NIST methodology (reference [1], Section 3.7, pg. 23-25.

3. Conduct cost benefit analysis on virtualization.