Richman Investments Security Outline Welcome to Richman Investments (RI) where we strive to bring you the most secure, reliable, and available resources that we can offer. We know that work needs to be done and that most of you aren’t aware of the security procedures taking place behind the scenes. We have devised a summary of the seven domains of the company and its security model. Please take the time to read this over and understand the implications of not following company guidelines, procedures, and policies.
The user domain contains the users and/or employees that will be accessing resources within the organizations information system. A user can access systems, applications and data within the rights and privileges defined by the AUP (acceptable use policy). The AUP must be followed or the user may be dismissed or have their contracts terminated. With the user domain being one of the most vulnerable aspects of any organization, there are a wide variety of user related threats ranging from lack of awareness to blackmail and extortion. Employees are responsible for their own actions when using company assets and the HR department will be doing background checks on all employees within the company to ensure integrity within the workforce. Enforcement of the user level domain will include the use of RFID badges and pins for all areas of the facility and rooms that require special access. The workstation domain is where most users connect to the organizations infrastructure. That means that tight security and access controls will be enforced on company assets and users must authenticate themselves before access will be granted. This authentication process may be accomplished with smart cards and pins on some devices. Strong passwords or passphrases meeting password requirements will be used all other devices. A company asset can be a desktop, laptop, tablet, or smartphone device that has been approved on the network. These assets will be equipped with antivirus software and have all security patches. Data used on the assets within the company will have data restrictions ensuring data integrity. The LAN domain, or Local Area Network, is the collection of computers and devices that allows our organization to function. This includes data closets, physical network equipment, and the logical configurations of the equipment. There will be many security measures and restrictions applied to the configuration of the medium in which data travels through our organization. These rooms will have a physical layer and a logical layer of security. The logical layer of security may include but is not limited to, VPN, SSL, PPTP, and MAC enforcement (Port Security). The LAN-to-WAN domain contains the infrastructure links to the wide area network. This domain contains routers, firewalls, Intrusion detection/prevention systems, proxy servers, email content filters, and other similar devices. Routers will route the traffic leaving and coming into the network strict security ACLs will be applied to these devices. Hardware firewalls will be implemented into the network for further packet filtering. IPS and IDS systems will be present on the network as well fending off incoming attacks to our network. Proxy servers will be used for all internet access as a central point of administration and security. Also, all email will be subject to harsh scanning and filtering to prevent spam, malware, and viruses. The WAN domain contains the devices and connections between sites. The wide area network is a very complex part of the network infrastructure and will be under strict security as well. VPNs, PPTP, and other methods of encrypting traffic coming and leaving our network will take place. Firewalls will be implemented on this domain as well and will filter traffic between sites to ensure prevention of malicious attacks. Also, all WAN equipment will be subject to the high availability model, along with other domains, ensuring constant access to your data. The Remote Access domain helps our users and administrators stay connected to the network away from work. This domain includes services like email, cell phone service, VPN for home work, and secure remote access for infrastructure administrators. This domain is very important to secure because it can have the largest security footprint. Most malicious attacks come from insecure remote access services or by mistakes made by users. Risks to this domain may include brute force user ID and password attacks, multiple logon or password retries, unauthorized remote access, data compromised remotely, stolen mobile devices, stolen authentication device (smart card/token). To mitigate these risks RI will be taking measures to encrypt traffic to ensure secure data over remote access services. Also, enforcing machine lockout procedures such as timeouts and locking of the device when the smart card/token is removed will mitigate unauthorized personal using the assets. The System/Application domain holds all mission-critical systems, data, and applications. This domain is the seventh layer of defense in the model. Risks to this domain may include unauthorized access to data centers, computer rooms, and wiring closets. Policies, standard, company procedures and guidelines will prevent many of the risks associated with this domain. Also, following the data classification standards and use of second-level authentication will prevent unauthorized access to the systems. At this level, data corruption or loosing data is a large issue. A strict backup and recovery plan will be in effect and maintained at all times to ensure optimal resource availability. Backed up data will then be copied once a week to an offsite location until it is needed or no longer valid. When it comes to our systems we cannot afford them to be down for too long and having a recovery plan will ensure that RI maintains strict availability standards for its customers. Thank you for reading this summary. RI appreciates its senior members and thanks you for reading this material. Please be ever vigilant and aware of the security risks and countermeasures within RI and its systems. The users are the first step in security and often the weakest link. We must strive to keep security and procedures/policies in the front of our minds and keep them from being an afterthought.