1. Background 3
2. Network, Transport, Application Layers and their Protocols 3
2.1 Network Layer 3
2.2 Transport Layer 3
2.3 Application Layer 4
3. Hardware solutions for TechE Inc 4
4. Data, Reputation & Financial losses 4
5. Security Threats 4
6. Intruders 5
7. Different types of Security Services 5
8. Standards 6
9. Conclusion 6

1. Background
Provide the mission statement of TechE Inc and the objective of TechE Inc, plays in the cloud market. TechE Inc is a cloud provider to small medium business markets and its partners to provide cloud solutions with Security in mind. Following the completion of the background of TechE Inc provide a review of the portfolio Part A that was discuss in the first meeting.
Provide a high level history of TechE Inc and the role it plays in the IT industry. TechE Inc is a cloud solutions provider and advisor to SMBs focusing on virtualization and cloud solutions. In this topic the focus will be the important role Information Systems Security plays in the organization and as one of the main players on keeping TechE Inc secured, their customers and its partners.
2. Network, Transport, Application Layers and their Protocols
2.1 Network Layer
The network layer is part of the OSI model and it functions in layer3. This layer and its protocols are responsible for the functional means of transferring the data in sequence from a source to destination. At the same time maintaining quality assurance to ensure full delivery.
2.1.1 Internet Protocol Security (IPsec)
The IPsec is a series of collection of none standards used to ensure the confidentiality, integrity and authentication of communications conducted over a network. This protocol encrypts at this network layer and authenticates to an end to end security solution. IPsec also provides services through the use of two additional protocols. The Authentication Header (AH) and Encapsulation Security payload (ESP) protocol.
2.1.1.1. Authentication Header (AH)
The Authentication Header Protocol facilitates access control, authenticated data origin, connectionless integrity, and rejects replay attacks.
2.1.1.2. Encapsulation Security payload (ESP)
The Encapsulation Security payload (ESP) protocol assures confidentiality of IP data in transit across a network.
2.1.2 Internet Key Exchange (IKE)
This is the second technology used under this protocol and network layer. The IKE provides security associations and it works in two phases. The first phase two IKE peers establish a secured connection by using the common IKE security association using main or aggressive mode in case. The second phase, security associates are negotiated on behalf of services using a quick mode exchange.

2.2 Transport Layer
The Secure Socket Layer (SSL) provides encryption and authentication in a session. It is a secure pipeline between two lines that have server authentication. This type of protocol is the common used today to establish security and encryption.

2.3 Application Layer
2.3.1 S/MIMME
The first security protocol under this layer is the S/MIME. It provides a second layer security on top of the standard MIME data thru the use of the enveloped, signed, and clear-signed data.
2.3.2 Secure Electronic Transaction (SET)
The second protocol layer is called Secure Electronic Transaction (SET). It provides a framework that protects payment transactions cards used in the ecommerce business.

3. Hardware solutions for TechE Inc
In this section I will highlight the different cryptographic hardware that are solutions for TechE Inc.

3.1.1 Authentication Tokens
Authentication tokens are physical devices that contain a microprocessor and semiconductor memory. These tokens provide automatic information encoded on the token itself. These devices can come in many different sizes, shapes, and materials. These attributes are known as the token's form factor. Form factors fall into two general categories: noncontact tokens and contact tokens. They include
Proximity cards, one time password generators, challenge/repose calculators, smart cards
3.1.2 Biometrics
Biometrics is the science of measuring the characteristics of the human body. These devices are increasing and utilized for authentication method due to high security. These systems operating in two phases the first phase is enrollment and the second is verification.
The common types of biometric systems are the following: Fingerprint, Optical, Facial, Voice, Signature, and Keystroke.
4. Data, Reputation & Financial losses
In this section there are three different type of losses and how they can impact TechE Inc. The following three types are

• Loss of data: This type of loss can include financial health information that is critical.
• Loss of reputation: This can result from a breach in security and result in end users deciding to abandon a service or product.
• Financial losses: Direct financial theft, this includes the impact of the other two types of losses.

5. Security Threats
This section will provide types of security threats that can impact TechE Inc. These include the following:

• Unauthorized disclosure of data: Results from unauthorized access of information and revealing it. The revealing of the information can be either intentional or accidental.
• Unauthorized data modification: The modification, deletion, or destruction of data or software on purpose or by accident.
• Unauthorized access: Occurs when an unauthorized person gains system or network access, often by posing as a legitimate user of the network. This can be accomplished by password sharing, password guessing, and password capture.
• Disclosure of network traffic: By obtaining information as it travels across the network. Sniffers are often used to capture user names, passwords, e-mail messages, application data, critical records, and more that pass over a network.
• Spoofing of network traffic: The "ability to receive a message by masquerading as the legitimate receiving destination, or masquerading as the sending machine and sending a message to a destination.
6. Intruders
In this section I will provide the different intruders that can motivate havoc into TechE Inc network.

• Insiders: Could be an employee, contractor, or vendor who has been given authorization to access the system.
• Hackers: Also called crackers, these are individuals who generally break into a network for the thrill or bragging rights.
• Terrorists: Terrorist groups that have begun to make extensive use of the Internet to conduct operational planning, raise funds, spread propaganda, and communicate securely.
• Foreign Intelligence Services (FIS): Several countries routinely employ hackers to collect sensitive, proprietary government and industry information. This information is then shared with concerned individuals, including their own country's national industries.
• Hacktivists: These individuals are cause oriented and generally engage in attacks on publicly accessible web pages or e-mail servers. Targets can include governments and large, multinational corporations.
7. Different types of Security Services
A security service is a collection of policies, procedures, and other controls that are implemented to help reduce the risk associated with the threat of data loss or possible compromise. The main areas of security services include the following:
• Authentication: Ensure that individuals accessing the network are authorized.
• Confidentiality: Used to ensure that the data is not compromised and disclosed to unauthorized parties.
• Integrity: Ensure that unauthorized parties do not modify data, software, and messages.
• Nonrepudiation: This is a service that can be used to ensure that the entities involved in a communication cannot deny having participated in it.
8. Standards
In this section I will cover and complete the standards, guidelines, and regulations that are necessary to ensure that security has been properly implemented
The following are organizations involved in this effort
• Internet Engineering Task Force (IETF): An "international community of network designers, operators, vendors, and researchers involved in the technical operation of the Internet and the continuing evolution of Internet architecture" (www.isoc.org).
• ANSI X9: A division of ANSI that "develops and publishes voluntary, consensus technical standards for the financial services industry" (consortiuminfo.org).
• National Institute of Standards and Technology (NIST): U.S. government agency that has published guidelines and standards on the topic of information security, including the federal information processing standard (FIPS 140-1), which describes a standard for secure cryptographic modules. NIST also administers a certification process for software and hardware crypto modules.
• Common Criteria: An international effort devoted to the development of criteria for evaluation of information security.
• Health Insurance Portability and Accountability Act (HIPAA): A federal law that governs the standards for access to patient records as well as the transmission of electronic health information in between organizations.
9. Conclusion
Setting up all these different security policies into TechE Inc will benefit the cloud solutions organization specially, but will be the corner stone and perhaps the model of the over main security at TechE Inc.