Multi-Layered Security Plan

The general IT Infrastructure has seven layers: User Domain, Workstation Domain, LAN Domain, LAN-to-WAN Domain, WAN Domain, Remote Access Domain, and the System/Application Domain. All of the different layers are different aspects of your network that need to be protected against malicious attacks and vulnerabilities. In the following I have highlighted each domain and my best suggestions for security solutions. Starting with the user domain the most important thing here is to make sure that all users are trained and knowledgeable of acceptable usage of the equipment at work and their access to the employer’s network. The best way is to train them on an acceptable use policy (AUP) which outlines the dos and don’ts of using software application, email and web-access, along with their access to physical equipment. This policy should not only out line all of the above but it should also have an outline of disciplinary actions as well so the employees take the training seriously. They should also have each employee sign the AUP to recognize that they have read and understand what it means and what is expected of them. The workstation domain is where you need to start implementing login ID’s and passwords for all users and visitors. This helps to validate anyone who needs access to the systems to make sure that they have the credentials to login and also to provide the information to the system of what level of access they can have. For example, a guest is not going to have access to the same information as a basic employee, but also a basic employee is not going to have access to highly classified information that supervisors and administration have. This is also the domain where antivirus software should be run to protect the network from malicious software and in addition to the antivirus all of the latest software patches need to be ran as well to make sure everything is up to date and working efficiently. Also I would set up a Network Access Protection (NAP) system. The NAP is a platform that provides a way to evaluate the system health of a client that is attempting to connect to the network. It restricts access until the networks policies have been met. This is especially important when people bring their own devices to work. The LAN domain is where we start getting into the physical side of things. First off a wiring closet is a must. All the equipment especially a server area should be locked up and have limited access only. It should not be available to standard employees or visitors at any time. This is also where you would set your control and access policies that state who can be in that room, when, and why. This is also where you would want to set up your intrusion detection systems (IDS). An IDS is a technology built to detect malicious activity directed at an application or computer. The IDS detects the threat and alerts an administrator of any malicious activity. That way it can be prevented, fixed or analyzed further for investigation. If you wanted to be able to investigate malicious patterns to either gain more knowledge of the attack or try to locate the attacker you can install a honeypot here. A honey pot system is trap designed to gather more information on an intruder and also to try to pinpoint what the intruder was after to be able to learn from it and be able to put more preventative measures in. Also to gather if any trends in malicious users are occurring to be able to be able to be proactive in your security measures instead of reactive. The LAN-to-WAN is when we need to start implementing firewalls. The most secure measure you can have is to put a firewall on the back end and on the front end of your network. Another security measure at this level is to implement and intrusion prevention system (ISP). The difference between an ISP and an IDP, that was previously mentioned, is that an IDP only detects a threat and alerts the admin. An ISP on the other hand, detects and prevents the threats. The WAN domain is the perfect place to implement a demilitarized zone (DMZ). A DMZ is a firewall configuration for securing LANs. Any computers that run outside the firewall implemented earlier would be protected here through a DMZ. It basically works as a firewall intercepting and routing traffic on both ends of the firewall. This is also where you would set up your virtual private network (VPN). This is another measure to keep your network private and secure. The sixth level of the IT infrastructure is the remote access domain. This is where administration will start to set group policies and standards. You need to have the policy set for what is needed in passwords, how often they need to change and how many failed attempts can a system have before it locks down. The general standard for passwords is they all need to have at least one upper and one lower case letter, a number, and a certain amount of character, like 8-10. Having users change their password every three months is highly suggested as well. This helps prevent hackers from getting in. Lastly, with passwords, I suggest after 5 attempts the system should lock down for 20 minutes. Another security measure that can be introduced here is encrypting your network and its contents. This helps protect your customers, your assets, your own company secrets, and makes it harder for anyone who obtains any information to be able to read the information. Your last layer is the system/application domain. This is where all the software and web-based applications are thoroughly tested and patched before being sent up to the users. This way any malicious software or any software that leaves a hole for a malicious attack to leak through can be caught and fixed before it’s ever implemented onto the network. This is also where you need to outline your disaster recovery plan and make sure all of your information is backed up and how to be able to recover anything that is lost or stolen. You should also implement another antivirus here that spans not only the workstations and application used but the entire network. This is also the stage where you implement all of your application and operating system patches and updates.

References
Even, Loras R., Intrusion Detection FAQ: What is a Honeypot?, 12 July, 2000, http://www.sans.org/security-resources/idfaq/honeypot3.php
Microsoft developer network, Network Access Protection, 2013, http://msdn.microsoft.com/en-us/library/aa369712.aspx?
Mitchell, Bradley, dmz-demilitarized zone, About.com 2014, http://compnetworking.about.com/cs/networksecurity/g/bldef_dmz.htm
Paloalto networks, Intrusion Detection System - IDS Technology and Deployment, https://www.paloaltonetworks.com/resources/learning-center/what-is-an-intrusion-detection-system-ids.html
Paloalto networks, What is an intrusion prevention system? https://www.paloaltonetworks.com/resources/learning-center/what-is-an-intrusion-prevention-system-ips.html