Security Solutions
Jonathan E. La Rosa
July 22, 2014
NTC/411
Randal C. Shirley

Security Solutions Firewalls have been around for years. In that time, they have protected various different organizations and corporations from possible hacker attacks. They play a critical part in protecting the internal network and making sure that packets are screened and checked before being provided access. Although firewalls are extremely powerful, especially in today’s world, they cannot be the only source of protection that the network can have. Various other technologies need to be used in order to actually make sure that the data is secure and that information has not be tampered with. Intrusion Prevention Systems, or IPS’, as well as Intrusion Detection Systems, or IDS’ are great in making sure that the network is free of any attacker or unwanted individual. These different technologies working together can provide the best protection possible, although they do have to be monitored in order to make sure they are working in the best way possible.
Firewall Protection Managing firewalls is a fundamental function in making sure a network is secure. Network security managers are the main individuals who have to make sure that the firewall is constantly working in the most effective and efficient way possible. The rules that are in place within this device can and will affect the network and how it responds. Firewalls need to be constantly upgraded and put with the latest software in order to be effective. There are always individuals are work trying to get past firewalls and while they are able to get through most, patches and upgrades are provided to fill in the holes that these hackers expose. Without these upgrades, the firewall is vulnerable and easy to collapse. Different firewalls protect different sections and some of are either hardware based or software based. The network firewalls protect the entire network and are located just before the Internet gateway. These firewalls act like a gatekeeper to traffic that comes in through the internet. Rules and guidelines need to be set by the IT Managers and network security engineers in order to make sure that the right packets are not being blocked and that the correct ones are being sent to the correct departments or VLANs depending on how the actual network is set up. Hardware firewalls are physical devices, such as routers and switches that are interconnected on the actual network. Software firewalls are installed on servers and are usually more customizable to the demands of the network security engineer.
Intrusion Protection System Although firewalls are extremely powerful and helpful, a great complement to them is an Intrusion Protection System, or IPS for short. An IPS analyzes the network in order to calculate data movement and look out for malware that might have filtered its way in. Harmful traffic is never obvious and can conceal itself as standard data packets, therefore, an IPS can sort them out and alert to their existence before it is too late. An IPS uses various formats to actually filter out the data which include signature based findings, incongruity based detections and also protocol analysis. IPS’ are being adopted by many organizations in order to provide more support to the firewall in defending against harmful packets. The network of an ecommerce website is packed with various types of data and packets that are coming from the open internet. In this situation an IPS is highly recommended to work in correlation with the firewall as it can assist in preventing a possible unwanted intrusion.
Network Monitoring There should be a strong level of monitoring constantly going on with these systems. The infrastructure team needs to work hand in hand with the network operations team in order to make sure that individuals are trained and told what they need to do in order to prevent any possible issue in the future. The logs that are produced by these security devices help in protecting all of the private and confidential information that the business handles and therefore they need to be taught what they have to look for and what process to take if something were to arise. Policies and procedures would need to be created just for this role and it can be handled by multiple individuals on a rotating shift.
It is essential to constantly monitor the system to make sure that nothing wrong is going on. If the system is able to send alerts when an issue is found, it can be set to send e-mail alerts and create a ticket in order to work through the alerts and warnings. This too is another way that the management of the system can be handled. It allows specified individuals to be alerted in the moment that something happens and it also creates a ticket into the ticketing system helping track and document the adequately.
Real-Time Response Real-time response to an issue is one of the hardest goals to reach when dealing with network intrusions and packets filtering through. Many organizations are having difficulties actually reaching this goal and trying to get everything set up properly. When an issue happens, there has already been an effect, and therefore, any response is already after the fact. Viewing and maintaining a constant watch on the network making sure that all packets are trusted is going to require a full department and even then, most of the responses will always be reactive and not proactive. The response time will definitely be lowered as much as possible and help in getting it as close to immediate, but practice and making sure procedures are limited in errors is the best way to improve this metric.