Network Security Risks and Solutions

This assignment examines the multifaceted world of network security. It delves into various risks and threats that networks face, including common vulnerabilities and attack vectors. The focus then shifts to comprehensive solutions and best practices for mitigating these risks. From firewalls and intrusion detection systems to encryption and secure protocols, the assignment explores a range of technical and administrative measures essential for safeguarding network infrastructure.

7 | P a g e

Executive Summary
The objective of this report is to assess the networking environment which is recently
implemented in STP Ltd. Company. The focus of the report is on the environment
and its connections with the company employees. The report explains the background
information of the project and its objective. The report discusses the steps involved in
network security, hardware purchase and business continuity planning. Risk
management details are provided in the report to explain how STP can manage risk
scenarios and identify the risk categories. The report presents a list of
recommendations that aim to make the implementation successful for a long term.

Table of Contents
EXECUTIVE SUMMARY...............................................................................................8
INTRODUCTION..........................................................................................................10
PROJECT BACKGROUND..........................................................................................10
PROJECT SCOPE..................................................................................................................10
PROJECT GOALS..................................................................................................................10
STRATEGIC ALIGNMENT OF THE PROJECT...........................................................................10
NETWORK SECURITY................................................................................................11
IDEAL BRANCH-OFFICE SECURITY SOLUTION....................................................................11
SECURING DATA.................................................................................................................12
MOBILE DEVICE SECURITY..................................................................................................12
WIRELESS LOCAL AREA NETWORK (WLAN) ATTACKS.....................................................12
BYOD RISKS......................................................................................................................13
PLAN FOR HARDWARE PURCHASES......................................................................13
ACQUISITION OF NEW HARDWARE......................................................................................13
END USER FEEDBACK AND REVIEWS...................................................................................13
PURCHASING STRATEGIES...................................................................................................15
ASSET REGISTER.................................................................................................................15
BUSINESS CONTINUITY.............................................................................................15
RISK MANAGEMENT..................................................................................................16
RISK MANAGEMENT STRATEGY.........................................................................................16
Risk Identification..........................................................................................................16
Risk Responsibilities.......................................................................................................16
Risk Assessment..............................................................................................................16
Risk Response.................................................................................................................16
Risk Mitigation...............................................................................................................17
Tracking and Reporting..................................................................................................17
SECURITY POLICY.....................................................................................................17
TRAINING AND AWARENESS................................................................................................18
INTEGRATION TECHNOLOGY...............................................................................................18
CONCLUSIONS.............................................................................................................18
RECOMMENDATIONS................................................................................................18
REFERENCES...............................................................................................................19

Introduction
STP Limited is an organization that is based out of Wollongong and has its head
office in the same city. The organization manufactures cabinets and is expanding to
the other regions as well. The sales and revenue are going good for the organization
and as a result, it recently bought office premises in Bathurst and Lithgow. They have
also set up a new office in Sydney. The company is currently located in four locations
and has warehouse machines and other equipment installed in these locations.
Project Background
Every office of STP Limited is equipped with a modem and a switch and the Internet
connection is made active with the aid of ADSL. The members of the staff are
allowed to bring their own devices at work. The wireless connections are also made
enable by the organization.
The enhanced network connections will allow enhanced connectivity and timely error
resolution. The customers will also be able to contact the organization in case of any
query or complaint which will make it easy to increase the levels of customer trust
and engagement (Cisco, 2008).
Project Scope
The scope of the project will include the design, development and deployment of the
measures so that the enhanced networking mediums are implemented. The efforts will
also be implemented to make sure that the privacy of the information and the
communication networks is not disturbed or violated.
Project Goals
 Integration of the company units in terms of execution of business operations.
 Maintenance of information security and privacy (Pareek, 2011).
 Enhanced customer engagement and revenues.
Strategic Alignment of the Project
Alignment Perspective Description
Strategic Execution  Project goals are in line with
organizational goals.

 Project activities will be executed
to achieve the goals.
Technological Potential  No compatibility issues
 The integration and security
solutions are feasible
Competitive Potential  Demand of security in market
 Enhancement of the quality of
service
Service Level  Networking strategy in line with
the organizational goals
 Adequate allocation of resources
Network Security
It must be made sure that there are enough human resources in the department of
local IT as the support staff. The device configuration that is set up shall be allowed
to be accessed with the means of HTTP, HTTPS, Telnet, SSL and likewise. Remote
management, secure routing, WAN connections etc. shall also be included. This will
eliminate the requirement of installing separate networking devices and equipment.
Another condition that must be considered is the changing landscape of the security
threats and attacks. There are signature based countermeasures that are being
implemented in the organizations which cannot be updated at such a short period of
time (Canavan, 2001).
Supplementing of the reactive countermeasures will be required that may have the
ability to prevent the uncertainties and security attacks that are not predicted earlier.
Ideal Branch-Office Security Solution
 Fast & safe VPN connection based on the site-to-site connectivity.
 A direct and secure access to the internet shall be provided.
 Improved security services and solutions shall be provided for the internal
services and network connections (Alabady, 2009).
 Easy to use and cost-effective.

Securing data
 Virtual Private Networks: The establishment of IPSec VPNs will be a prime
necessity for the branch security solutions and services (Joshi and Karkade,
2015). NAT traversal and Microsoft VPN clients shall also be made available
for the maintenance of security.
 Firewall: The effectiveness of firewalls can be realized only by the mode of
application of the same, for instance, the implementation of firewall at the
network layer only will not be able to prevent the security risks associated
with the application layer.
 Attack Protection: There are anomaly based, signature based, network based
and behaviour based intrusion detection and prevention systems that have
been developed for preventing many of the denial of service, flooding and
integrity attacks (Strebe, 2004).
 Advanced Content Filtering: There are many of the anti-malware packages
that are present such as, anti-viruses, anti-spyware etc. these are completely
reactive. There is Web/URL filtering measure that may focus on the outbound
traffic and prevent the access to the web sites that are not safe (Soriano, 2011).
 Segmentation & Security Domains: It makes sure that the associated
appliances have the capabilities such as multiple LAN interfaces along with
VLAN connections.
Mobile device security
Mobile devices have become a crucial part of the IT infrastructure of a small
business. However, it also presents certain risks to the company that is not always
identified at the time of first implementation.
A security strategy shall be developed and implemented to ensure the safety and
security of the mobile devices. There are also unknown devices that may be
connected to the office network with the use of BYOD technology.
Wireless Local Area Network (WLAN) attacks
Capturing wireless data is one of the most common enterprise attacks external of the
enterprise while rogue access points and evil twin access point are internalized.
WLAN attacks can be overcome by proper configuration of devices and employee
training programs.

BYOD risks
Currently, the staff of STP Ltd can connect to the organization’s wireless network
through their personal devices. The confidential information of the company can get
exposed because of user actions. Malicious software can also attack the device or the
network affecting the security baseline of the organization.
There are some essential tools that may be used for enhancing the mobile device
security.
 Fingerprinting: It is a mechanism that enhances and inspects the
characteristics that are associated with the mobile devices to understand the
device properties (Souppaya, 2013).
 Network Access Controls: An in-depth analysis of the device is done under
NAC to highlight the presence of any intruders associated with the device,
anti-virus and anti-span packages and so on.
 Authentication: It authenticates the users on the basis of the WLAN
standards such as 802.1x standard (Sujithra and Padmavathi, 2012).
Plan for Hardware Purchases
Hardware purchases would put some financial burdens to the organization and thus,
contingency plans are required to be developed for ensuring that business operations
remain continued.
Acquisition of new hardware
For preparing to deal with circumstances, certain documents and assets such as asset
register, budget forecasts, emergency plans, policies, procedures, reviews and
strategies can be created and maintained.
End user feedback and reviews
A review from employees as users of the hardware system can help identify concerns
around outdated or overloaded application. Reviews can be scheduled for evaluation
of the hardware performed such that the management can take more informed
decisions about procurement.

Purchasing strategies
The management must make sure that the company has enough funds for the hardware purchase
which needs a careful, cash flow planning. Suppliers have to be identified appropriately and the
business needs have to be understood through exploration of the business requirements.
Asset register
 Computer Systems: These may be required for accessing the tools and applications for
the purpose of installation and testing.
 Servers: There are web and file servers that may be required for accessing various
information sets along with the database servers as well.
 Peripheral Equipment: Networking equipment would be required for establishing and
maintaining network connections.
 Simulators and Emulators: It would not be possible to carry out testing activities on all
the devices and these tools will come into the picture for gaining a virtual experience and
testing purposes.
 Diagnostic Equipment: The troubleshooting and diagnostic processes will be carried out
for network management and security using this equipment.
 Communication Devices: These will be necessary for the sharing of information and data.
Business continuity
Data Backup
An offsite backup of the store has to be created such that data can be retrieved in case the site is
damaged so that the business can be continued without interruptions. A cloud based system can
be used for creating this backup. Multi-general backups can be created by administrators who
would be responsible for the management of the departmental servers.
Physical security
Disaster recovery planning is essential such that staff can be made prepared to deal with such
situations and ensure that business operations continuity is still maintained. In case of insider
14 | P a g e

STP Limited
threats, it is the responsibility of the administrator to ensure that the systems remain secure and
protected from insider threats.
Succession planning
There can be situations when an important employee or the owner of the organization is unable
to work because of unforeseen situations such as injuries from accidents. The company must
remain prepared to deal with such situations.
Risk management
Risk management is defined as a process that may include the measures for the identification,
assessment and treatment of the risks.
Risk Management Strategy
Risk Identification
A risk register will be prepared by the Project Manager covering all of the possible risks and
attacks.
Risk Responsibilities
The responsibility of dealing with the risks shall be distributed to all of the stakeholders (Berg,
2010).
Risk Assessment
The assessment of the risk shall be done on the basis of its impact and likelihood along with the
various factors that may be associated with the risks.
Risk Response
There are various methods that may be applied for the risks, such as, avoidance, acceptance,
transfer and mitigation (Crane, 2013).
15

STP Limited
Risk Mitigation
It shall include the activities for the control of the risk along with the contingency plan associated
with the same (Dcu, 2015).
Tracking and Reporting
There shall also be a weekly report that must be prepared to keep a track of the risks and the
senior management must carry out monitoring and control activities (Debono, 2016).
Security Policy
A security policy can act as a tool that creates awareness in the people and help in building a
culture that is supportive for the organization in terms of security.
 Acceptable use policy
Outlines acceptable and unacceptable use while accessing systems and networking
equipment.
 An Antivirus policy must be developed containing details of procedures used for
minimizing dangers of virus attacks in computers.
 A Data policy can be developed for outlining of the process for storage of data, its
retention and disposal
 An Email policy would be used for identifying how email services may be used and how
much of the information can be shared with the third party
 An Ethics policy can capture the details of openness of culture, integrity issues, trust
factors, ethical practices and impacts on unethical behaviour.
 Password management: Identification of the minimum requirements for creation and
management of passwords.
 Privacy policy: It can be used to tell how data can be used by the organization
maintaining the privacy of users or others who are associated with the organization.
 VPN security policy: It highlights the necessary actions that are required to be completed
for gaining access to the virtual private network remotely.
16

STP Limited
 Wireless communication policy: This policy outlines the standards to be used for wireless
systems for connecting to the network of the organization
 The policy must be maintained and supported by the Information Security Manager
 Everyone working in the organization must comply with the Information Security Policy
Training and awareness
It is recommended that all the staff members are trained on security aspects such that they are
able to deal with security challenges posed by web presence. Training can also foster a
compliance program by pushing employees to use certain practices that can ensure that security
threats are minimized.
Integration technology
If the information systems are integrated to provide real time reporting, it can give the company
more capabilities than the case of Software as a Service model of adoption. Integration between
applications is something like the web pages mashups in which external sources can be
combined on the platform as a service (PaaS).
Conclusions
Brach offices along with the personnel working in the offices are critical assets for the
organization at the strategic level. It is essential to make sure that the security of these branch
offices is ensured by developing and implementing the measures for security the data and mobile
devices. There is an enhanced network management that must be carried out for securing the
information and for maintaining the business continuity.
Recommendations
Network security:
 Third party testing process should be used and implemented
 WLAN access logs should be compared so that risks and attacks associated with the
unknown devices are uncovered
 Determination of the usage of the app usage associated with the network tools
17

STP Limited
 Use and implementation of an identify-centric security model for the purpose of mobility
Evaluation of the level of infrastructure integration:
 The set of applications, cloud services and devices that is available and visible in an
unified manner.
 The identification of the set of appliances that are old and make use of obsolete
technology.
 Estimation of the people hours that may be saved from the IT staff for using a wired or a
wireless network.
Mobile population of the company:
 The number of employees that tele-commute an d the mediums that they use
 The number of employees that are present in this field
 Associated VPN capabilities
WLAN usage and the population of the devices:
 The number of the inventory device types
 The number of form factors and operating systems
 Site survey for the determination of the current usage of geographies and hotspots
 WLAN capacity that will be required along with the factors that contribute in the growth
of tablet and the usage of Smartphones
 Evaluation of the VoIP and related latency sensitive applications
 Evaluation of the 802.11ac
References
Alabady, S. (2009). Design and Implementation of a Network Security Model for Cooperative
Network. [online] Available at: http://www.iajet.org/iajet_files/vol.1/no.2/Design%20and
%20Implementation%20of%20a%20Network%20Security%20Model%20for%20Cooperative
%20Network.pdf [Accessed 18 Sep. 2017].
18

STP Limited
Berg, H. (2010). Risk Management: Procedures, Methods and Experiences. [online] Available
at: http://ww.gnedenko-forum.org/Journal/2010/022010/RTA_2_2010-09.pdf [Accessed 18 Sep.
2017].
Canavan, J. (2001). Fundamentals of Network Security. [online] Available at:
https://whc.es/Network/Fundamentals%20of%20Network%20Security.pdf.1.pdf [Accessed 18
Sep. 2017].
Cisco (2008). Wireless and Network Security Integration Solution Overview. [online] Available
at: https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/secwlandg20/
sec_wireless_overview.pdf [Accessed 16 Sep. 2017].
Crane, L. (2013). Introduction to Risk Management. [online] Available at:
http://extensionrme.org/pubs/IntroductionToRiskManagement.pdf [Accessed 18 Sep. 2017].
Dcu (2015). Introduction to Risk Management. [online] Available at:
https://www.dcu.ie/sites/default/files/ocoo/pdfs/Risk%20Mgt%20Training%20Slides.pdf
[Accessed 18 Sep. 2017].
Debono, R. (2016). Project Risk Management. [online] Available at:
http://www.isaca.org/chapters11/Malta/Documents/Events/210416%20-%20Mark_Debono%20-
%20Understanding_Risk_in_the_Field_of_Project_Management.pdf [Accessed 18 Sep. 2017].
Joshi, M. and Karkade, R. (2015). Network Security with Cryptography. [online] Available at:
http://www.ijcsmc.com/docs/papers/January2015/V4I1201544.pdf [Accessed 18 Sep. 2017].
Pareek, R. (2011). Network Security: An Approach towards Secure Computing. [online]
Available at: https://www.rroij.com/open-access/network-security-an-approach-towards-secure-
computing-160-163.pdf [Accessed 16 Sep. 2017].
Soriano, M. (2011). Information and Network Security. [online] Available at:
http://improvet.cvut.cz/project/download/C2EN/Information_and_network_security.pdf
[Accessed 18 Sep. 2017].
Souppaya, M. (2013). Guidelines for Managing the Security of Mobile Devices in the Enterprise.
[online] Available at: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-
124r1.pdf [Accessed 18 Sep. 2017].
19

STP Limited
Strebe, M. (2004). Network Security Foundations. [online] Available at:
https://imcs.dvfu.ru/lib.int/docs/Networks/Security/Network%20Security%20Foundations.pdf
[Accessed 18 Sep. 2017].
Sujithra, M. and Padmavathi, G. (2012). Mobile Device Security: A Survey on Mobile Device
Threats, Vulnerabilities and their Defensive Mechanism. [online] Available at:
http://dl.icdst.org/pdfs/files/35dc646a4630971fd27c6b2d32661555.pdf [Accessed 18 Sep. 2017].
20