Executive Summary
This document describes the security plan for a WAN (wide area network) that has been setup for an organization to work in an efficient manner. The WAN connects many different locations scattered across a wide area. The WAN is an important feature of the organization and has to play an important role in its working. Huge amount of information is transferred everyday and is crucial for the organization. A network crash due to any reason may cause a huge loss to the organization. Also any intrusion in the network may allow somebody to get hold of private and confidential information about the company. Hence, the security of the network is very crucial to the organization and its business.
The goals of this security plan are to ensure the complete security of the network. This would include physical security, network security and access control systems. Physical security is about keeping the network equipments safe from being physically damaged, tampered with or from being stolen. Network security is about keeping the information safe over the network while transmission. Access control systems refer to the control systems that would allow a user to access the information, that could be crucial to the organization, or the private information of the organization. These are discussed in detail in the following sections.
While discussing the security of the network, we make some assumptions. The security employees or the security guards are trustworthy. The employees of the company are trustworthy and they won’t their passwords or other secret keys with anyone. In case an employee is found malicious, he/she would be departed from access to the network immediately. For network security there is a trusted third party available for the distribution of cryptographic keys. With all these assumptions we describe the needs and the security plan for the network of the organization.
Introduction
The organization we discuss in this document is Sunica, Music and movies. It is a local multimedia chain and has four locations. Each store has been acting independently of one another and has difficulty coordinating customer sales from one store to another based on inventory. As a result of poor communications, revenue and customer base have been lost due to jumbled inventory from store to store, decentralized accounting, and no Internet-based commerce. A network has been setup to connect the four locations all allow them the ability to access a centralized database for inventory and dynamically reorder stock based on sales. Each location will tunnel all financial transactions through a central accounting package, eliminating bookkeeping errors and centralizing the company finances. All transactions and customer inventory browsing will be done through a web interface and custom Intranet Web site. To meet their need for an Internet customer base, web servers will be located in their data center and will tie in to the company’s accounting and transaction servers to provide real-time sales and inventory information to customers. In this document we discuss the security of the above mentioned WAN.
Physical Security policy
Security of the facilities
A number of customers visit the stores of the company. Some of them might be malicious and might try to cause harm to store by stealing, damaging the belongings of the stores or bringing in some unwanted items. All these activities need to be checked.
Physical entry controls: - at the place of entry to store, every entrant must be checked for security and a metal detector machine must be placed at the entrance of the store. The customers should not be allowed to carry any bags inside the store. They should be kept outside the store.
Security offices, rooms and facilities: - a security office will be built at every store and rest rooms for security guards will be provided.
Isolated delivery and loading areas: - each and every store will have a delivery and loading area in the backyard and security guards will monitor the area.
Security of information systems
The equipment for setting the network is very costly and must be kept at a secure place. There should be one server room with proper cooling facilities, since the servers generate a lot of heat. For every store there should be a network administrator who would manage all the servers. Nobody should be allowed to access the server machines.
There would be unused ports over the network, which are connected to no server or laptop. These ports could be misused by the employees or customers visiting the store, so the network administrator must monitor the ports being used. By using simple programs, a network administrator can know the IP’s and description of the machines currently connected to the network. So if some unwanted machine is found on the network, the network administrator can forcibly close the connection.
Laptops would be issued to the employees of the store and it’s their responsibility to make sure that they are not stolen, also they should not be allowed to take any laptop or other equipment out of the store without the permission of the manager.
Access Control Policy
User enrollment
There would be mainly two users of the system- the employees and the customers. The employees would be registered by the administrator of the system. As a new employee is hired, the administrator will create an account for him and a password will be given to him to access the account. The employee can change the password.
The customers will have to register through the web interface and their registration will be linked through a payment gateway. They will have to provide their credit/debit card number to register and they will also be given a username and password, through which they can login and operate.
Identification and Authentication
Every user will be issued a username and password, for security purposes the passwords will be encrypted and authentication will be done by using a public key cryptography technique such as RSA. For employees, the physical identification will be done by storing their finger prints in a database and matching them to prove their identity.
Privileged and special account access
For those users confirming their accounts through payment gateways, a privileged account will be provided. Their private information i.e. the credit cards number and pin numbers will be transferred in encrypted form using public key cryptography algorithms. The information will be transmitted using a secure shell connection.

Remote access
To certain employees remote access will be provided to the servers using VPN technologies. VPN refers to virtual private network. It creates a secure channel over the internet and allows to access a remote machine from far distances over the internet. This would allow the employees from accessing the information from their homes also and they would not have to run to the office if any problem occurs. VPN comes with many distributions and also there is an open source distribution called OpenVPN that could be used. The remote users will be connected to the network using VPN technologies.
Network Security Policy
Network access
The network would be prevented by a firewall to prevent the intrusion; access to the network will only be available through secure channel only. Routes and reverse routes need to be set to get access. The servers will only be visible to other servers, or to the web interface through specific ports only. The server will deny secure shell connection to all machines except the specified machines.
Network security control devices
There will be a firewall placed at the gateway of each store. This firewall will block all the attacks from the outside. To prevent the access of unauthorized sites, a black list will be maintained, if any users try to visit a malicious site, he/she would not be allowed to do so. Bandwidth meter software will be used to monitor the bandwidth being used by every machine. This would ensure proper allocation of bandwidth to all users.
References:-
1. Forouzan, Behrouz (2005), TCP/IP Protocol suite, 3rd edition, McGraw-Hill publications.
2. Cheswick, William (2003), Firewalls and Internet Security, 2nd edition, Addison-Wesley