Security Assessment and Recommendations for Aircraft Solutions

Principles of Information Security and Privacy
Keller
Submitted: December 11, 2013

Executive Summary

The purpose of this report is to investigate the vulnerabilities of Aircraft Solutions (AS) in the areas of hardware and policy. Furthermore, it provides recommended solutions to the security weaknesses mentioned in Phase 1. Aircraft Solutions is a well known leader in the design and production of component products and services for companies ranging from commercial industry to the aerospace industry. In addition, Aircraft Solutions maintains a large capacity plant filled with an extensive variety of equipment, which is mostly automated alongside skilled specialists in a range of fields to ensure they meet their customers’ needs. The weaknesses that are being addressed are hardware and policy.

Company Overview

Aircraft Solutions is a leader in the planning and production of component products and services for companies in the electronics, commercial, defense, and aerospace industry. The headquarters of Aircraft Solutions is located in San Diego, California. The goal of Aircraft Solutions is to use machined products and related services to supply customer success, and to achieve cost, quality, and schedule requisites. They have a Defense Division (DD) of Aircraft Solutions located in Orange County, California and a Commercial Division (CD) located in San Diego County, California.
Aircraft Solutions has a system in place for creating programs. First, the Design Engineering department reviews electronic models. They also interact with the customers in order to get their approval to make modifications when necessary. Then, the electronic models are placed in an Engineering Release (ER) directory for programming. When the electronic models are released in the ER directory, production programs can be created. Lastly, every one of the final programs must be verified in detail to ensure accuracy before any of them can be released to the Proof for Production (PFP) directory for manufacturing.
Even though Aircraft Solutions’ system for creating programs is rather complex, their system for managing business processes is very thorough and neat. The business processes are run using Business Process Management (BPM) to take care of end-to-end processes that stretch across numerous systems and organizations. The BPM system can even handle multiple projects at once in all the departments of the company. Business processes are more effective and efficient when they are well designed and organized properly. Therefore, Aircraft Solutions’ BPM system gives customers, vendors, and suppliers a chance to connect with each other to help create more effective and efficient business processes. This system gives them an opportunity to share information in a timely fashion.

Security Vulnerabilities

Hardware Vulnerability
Aircraft Solution’s hardware vulnerability is the protection between its Commercial Division and anyone connected to the Internet, because of the absence of an extra firewall. It is very curious that there is no firewall implemented between the Commercial Division and the Internet. Especially, since the Defense Division is routed through Headquarters, while the Commercial Division is connected directly to the Internet. This vulnerability is significant for multiple reasons. Firstly, the Commercial Division’s lack of firewall protection leaves them unarmed and open to any number of attacks. As a result, their clients’ confidential information, sensitive company information, and even personal or protected information are at risk.
The real problem is when someone turns that vulnerability into a point of attack. If someone were to take advantage of the Commercial Division’s level of protection, then Aircraft Solutions could end up caught in a blackmail, espionage, or criminal scheme; after coming under attack from someone with unauthorized access, or someone altering or destroying company information. Furthermore, business strategies and profit plans could be revealed to a competitor, personal information on employees could be leaked, and operating plans could be stolen. (Pfleeger & Pfleeger, 2007) If Aircraft Solutions was to come under one of these kinds of attacks, it could give their competitors an advantage, or quite possibly even lead to a complete company shutdown.

Policy Vulnerability
One other Aircraft Solutions vulnerability is its security policy. The policy is updated once every two years with an evaluation. This evaluation is for all router rule sets and firewalls of the company, while requiring all local servers to be backed up to network attached storage devices that are being sustained at the location of the server. However, modern technology is continuously changing and with only one evaluation every two years, Aircraft Solutions could easily fall behind the eight ball. Consequently, all router rule sets and firewalls’ security measures would quickly become outdated and the company would be vulnerable to any new or recently updated threats and attacks.

Recommended Solutions

Recommended Hardware Solution
The solution to the Commercial Division’s vulnerability without a firewall to protect their Internet connection is a Virtual Private Network (VPN). A VPN is a network technology that creates a secure network connection over a public network or a private network (Fowler, 1999). Also, a VPN will add a layer of security to Internet communications, which will prevent others from intercepting financial reports, sales data, marketing strategies, and other sensitive business communications (Features, 2013). Furthermore, the Commercial Division will have more options and their Internet connection will be more secure with a VPN that offers a static IP. Also, a static IP address will make it possible to use your computer as a server to provide access to documents on your hard drive. Therefore, Aircraft Solutions should get Astrill’s business VPN solution, Enterprise, which costs $9,999.99 U.S. dollars per year and it comes with a static IP (Business VPN, 2013).

Impact on Business Processes
The most serious impact on Aircraft Solutions’ business processes are the operational processes. Astrill’s VPN will make communication for the Commercial Division much easier, so marketing and advertising will begin getting better results. One of the supporting processes that were affected is technical support; since the VPN will make it easier for employees to call for either technical support or a call center for help with any new problem that may have popped up. (Armistead & Machin, 1997)

Recommended Policy Solution
The solution to Aircraft Solutions’ security policy vulnerability would be hiring an outside company to handle firewall management. All the router rule sets and firewalls of the company are only evaluated once every two years. Therefore, Aircraft Solutions should outsource their firewall management problem by paying for the Dell SecureWorks' Firewall Management service. This service will provide around the clock firewall administration, log monitoring, and response to security and device health events (Firewall Management, 2013). Dell’s firewall management covers up to 75 users and costs $2,895 U.S. dollars per year and a one-time only setup charge of $249 (Information Security Services, 2013).

Impact on Business Processes
The changes made by this solution for Aircraft Solutions’ security policy will have an impact on its business processes. Operational business processes, like purchasing and supporting business processes, like accounting will be affected by the payments for Dell’s firewall management services (Armistead & Machin, 1997). On the other hand, the company’s security policy will no longer cause their security measures to become quickly outdated. Also, if they have a firewall that’s not only secure now, but will continue being secure, then Aircraft Solutions will earn even more of the clients’ trust; because they’ll know that their actions and information are being safeguarded.

Budget

The budget of Aircraft Solutions will be affected by the VPN and firewall management solutions to their hardware and policy vulnerabilities. First, the business VPN solution from Astrill, Enterprise will cost $9,999.99 U.S. dollars per year to solve the company’s hardware vulnerability (Business VPN, 2013). Then, Dell’s firewall management services will cost $2,895 U.S. dollars per year and a one-time only setup charge of $249. However, Dell’s firewall management website stated “Organizations that rely on Dell SecureWorks' Firewall Management service reduce the cost of managing and monitoring firewalls in-house, while supplementing their security efforts with Dell SecureWorks' proven expertise” (Information Security Services, 2013).

Summary

The company, Aircraft Solutions certainly has vulnerabilities that could prove quite problematic in the future, but for every problem there is a solution. Therefore, they should be open to at least a few quintessential changes, such as a VPN solution for its Commercial Division and having an outside source come in and hand their firewall management. All it takes is a few changes like those and their company’s level of security will rise by leaps and bounds.

References

Armistead, C., & Machin, S. (1997). Implications Of Business Process Management For Operations Management. International Journal of Operations & Production Management, 17(9), 886-898.
Astrill VPN » Business VPN. (n.d.). Astrill VPN » Business VPN. Retrieved December 14, 2013, from https://www.astrill.com/business.php
Astrill VPN » Features. (n.d.). Astrill VPN » Features. Retrieved December 14, 2013, from https://www.astrill.com/features.php
Firewall Management. (n.d.). Information Security Services, Managed Security Services. Retrieved December 14, 2013, from http://www.secureworks.com/it_security_services/firewall/
Fowler, D. (1999). Virtual private networks: making the right connection. San Francisco, Calif.: Morgan Kaufmann Publishers.
Information Security Services. (n.d.). Dell. Retrieved December 14, 2013, from http://www.dell.com/learn/us/en/19/large-business/information-security-protect-my-network-managed-firewall
Pfleeger, C. P., & Pfleeger, S. L. (2007). Security in computing (4th ed.). Upper Saddle River, NJ: Prentice Hall PTR.