Multi-Layer Security Plan

In: Computers and Technology

Submitted By tymax
Words 821
Pages 4
User Domain:
 Define AUPs for each of IT service or equipment.
• Acceptable Use Policy (AUP) to help you use the products, services and equipment provided by us (Services), and ensure that you understand policies and procedures we have developed to comply with certain laws and regulations. All users of the Service must comply with this AUP. This AUP is made part of our Terms of Service (TOS). Your use and/or continuation of the Service constitutes your acceptance of this AUP. It is your responsibility, and contractual obligation, to ensure that your affiliates, agents, and/or customers (End User(s)) comply with this AUP.
 Establish unique logon credentials for each user and require strong passwords.
• Assign unique login credentials from the very beginning and have generally been very secure because of this. With the increasing demands of system security to ensure, logins have been made even more secure. This additional security is made possible through the use of Strong Passwords. A strong password is a series of words, letters, symbols and numbers which may be easy for a user to remember but difficult for another person to guess. We will review here the way in which you can implement additional login security through the use of strong passwords, and other advanced security settings.
 Grant only the minimum privileges to each user required to accomplish that user’s tasks.
• Identifying and influencing user behaviors that affect security are important to ensuring compliance within the User Domain. Behaviors that support or violate compliance with your security goals get the most attention. The following best practices do not guarantee compliance with all goals. However, they will lay the foundation to develop and maintain a secure environment.
Workstation Domain:
 Require unique user accounts for each person.
• Only a user with administrator…...

Similar Documents

Project Part 1 Multi-Layered Security Plan

...Project Part 1 Multi-Layered Security Plan Introduction The components that make up cyberspace are not automatically secure. This includes cabling, physical networks, operating systems, and software applications that computers use to connect to the Internet. There is a raging information security war. The goal is to protect national security and business information. Therefore, IT is in great need of proper security controls. Scenario Richman Investments is a mid-level financial investment and consulting firm. The Richman corporate headquarters is located in Phoenix, Arizona. Currently, there are eight branch offices in:  Atlanta, Georgia  Chicago, Illinois  Cincinnati, Ohio  Denver, Colorado  Los Angeles, California  Montreal, Canada  New York City, New York  Washington, D.C. Tasks You are a networking intern at Richman Investments. This morning, you received an e-mail from your supervisor stating that you need to create an outline of the general security solutions planned for the safety of data and information that belongs to the organization. You are told that every month, the networking division needs to submit a report to the senior management about the security plan for the month, and this time, your outline will become a part of that report. Therefore, you need to research the elements of a multi-layered security plan and to create an outline. Your outline should indicate one or more general security solutions for each of the seven......

Words: 347 - Pages: 2

Project: Part 1 Multi-Layered Security Plan

...Multi-Layered Security Outline To: Richman Investments Senior Management Outline includes: Security solutions for each of the seven domains. User Domain: This is where the first layer of defense starts for a layered security strategy. We will conduct security awareness training, restrict access for users to specific systems and programs, create an acceptable use policy, and track and monitor employee behaviors. Workstation Domain: Start by creating strong passwords to protect workstation access, then enable antivirus protections, and mandate security awareness training to all employees. This domain is almost as vulnerable as the user domain and also needs constant monitoring. LAN Domain: To prevent unauthorized access we can physically secure wiring closets and data centers, implement encryption protection, define strong access control policies and strong second-level authentications. LAN-to-WAN Domain: Disable ping, probing and port scanning, apply strict security monitoring controls, and update devices with security fixes and software patches right away are excellent measures to take. WAN Domain: Use encryption and VPN tunnels for end-to-end secure IP communications, and scan all e-mail attachments for type, antivirus, and malicious software. Back up and store data in off-site data vaults. Remote Access Domain: Establish user ID and password policies requiring periodic changes, set automatic blocking for attempted logon retries, and encrypt all data within......

Words: 257 - Pages: 2

Multi Layered Security Plan

...Multi Layered Security Plan Richman Investments 1) General This MLS plan will give a brief overview of the security strategies that will be implemented at each level of the IT infrastructure. In this Multi Layered Security Plan we will describe how we will improve the security of each domain and how to protect our information. We will update all firewalls on the infrastructure and secure our ports that are open and stop incoming traffic that is malicious. All anti-virus software will be updated throughout the company. All IT employees will be informed about the new MLS Plan that we putting into effect once the Senior management approves it. 2) User Domain a. The usage of security awareness training to instruct employees of Richman Investments security policies We have to train the employees on the protection of their user IDs and login information to the companies system. Show the employees how to create a better password and security questions and not to write there passwords down on sticky notes to help remember. Making them aware of friends, family, or people that ask questions out of the ordinary, because the questions could possibly your security questions or part of your password. The user only has three attempts and they are locked out and will have to see a admin to be unlocked. b. Auditing of user activity We will watch how the users go about their daily activities on the company’s internet/network and make notes......

Words: 518 - Pages: 3

Multi-Layered Security Plan

...Part 1: Multi-Layered Security Plan Security is a fundamental aspect of any network infrastructure. The goal is to always have the most up to date programs and protocols to ensure the protection of the network. No aspect is too small to over look. That could mean the difference between a secure network and a compromised network. The best way to achieve this is to break down every level and approach each one as a separate entity and secure it. Then you can modify it to suit the needs of your network. We can start with the Application layer. The Application layer provides the interface to the user. First the end user should be subjected to a background check to ensure against any potential malicious or questionable acts in the users past. Then the end user should be properly trained in the use of the computer and the proper protocols to access the network. Updates should be made frequently to keep the user up to date. When the user is in the network, make sure that any unnecessary devices, USB ports and any back doors are disabled. You also want to make sure that all files and emails and downloadable attachments are all thoroughly scanned prior to downloading. Finally, be sure to ensure content filtering, and restrict the end user to only what pertains to their primary function. The Presentation layer is responsible for encoding and decoding data that is passed from the application layer to another station on the internetwork. You must first ensure that all USB ports are......

Words: 328 - Pages: 2

Multi-Layers Security

...current attack techniques are multi-staged. Hackers use their initial compromise to establish a beachhead from which they can launch subsequent attacks. With an estimated 1.25 billion Internet users worldwide, according to Computer Economics, cybercriminals have never had a bigger pool of potential victims from which to choose. While these current threat trends should give any Internet user pause, they can be particularly worrisome for small businesses. After all, with confidential business information at risk yet limited IT staff on hand to focus on security, small businesses must be very vigilant. To that end, by putting in place multiple layers of defense, small businesses can protect their assets from increasingly complex, multifaceted threats. An Actionable Plan A sound security plan is the first step towards a multi-layered defense. To develop a plan, the company must assess its most important assets, identify vulnerabilities as well as the infrastructure and technology most appropriate for mitigating risk, then implement a strategy for putting the plan into action. Email is a prime example.  It has become a critical business communications tool and is also a primary conduit for malicious code. Protecting email against viruses, worms, spam, Trojan horses, phishing attacks and other threats requires a variety of security technologies. These include antivirus and antispyware software, content filtering, and firewalls. Such security technologies must......

Words: 1139 - Pages: 5

Multi-Layer Security Plan

...Ken Hoge System Security Project Multi-layer Security Plan When working in the field of IT we must make sure all data can be accessed to the proper employees when the need it. We would love to know that all of the information we have in our database is safe and secure however the number of hackers online today is skyrocketing. Most of these hackers are from other countries such as China or Russia that are trying to gain access to important information of large corporations and government institutions. Some of these hackers have all the time in the world on their hands and are taking any steps they can think of to try and exploit or gain access to financial assets. The first and for most thing we need to do is setup a multi-layered security plan to be able to deal with any incoming online threats and attacks. Most hackers will start with and end user on a network since they are the leased experienced in technical security measures. An outside attack will typically come from some sort of email sent to the end user attempting to get them to click on some sort of link and have them enter login information or some other security details. We can typically setup security protocols for these employees such as password changes every 30 days and increased password strength techniques. This will prevent attackers from being able to log onto employee accounts. Next we can move to the gateway that is the networks first line of defense. This defense will consist of......

Words: 367 - Pages: 2

Project Part 1: Multi-Layered Security Plan

...Project Part 1: Multi-Layered Security Plan Introduction The components that make up cyberspace are not automatically secure. This includes cabling, physical networks, operating systems, and software applications that computers use to connect to the Internet. There is a raging information security war. The goal is to protect national security and business information. Therefore, information technology (IT) is in great need of proper security controls. Scenario Richman Investments is a mid-level financial investment and consulting firm. The Richman corporate headquarters is located in Phoenix, Arizona. Currently, there are eight branch offices in:  Atlanta, Georgia  Chicago, Illinois  Cincinnati, Ohio  Denver, Colorado  Los Angeles, California  Montreal, Canada  New York City, New York  Washington, D.C. Tasks You are a networking intern at Richman Investments. This morning, you received an e-mail from your supervisor stating that you need to create an outline of the general security solutions planned for the safety of data and information that belongs to the organization. You are told that every month, the networking division needs to submit a report to the senior management about the security plan for the month, and this time, your outline will become a part of that report. Therefore, you need to research the elements of a multi-layered security plan and to create an outline. Your outline should indicate one or more general security solutions......

Words: 349 - Pages: 2

Multi Layered Security Plan

...Poppa Smurf IT255 Friday, 6pm Mrs.Creighton 7/12/13 Multi-Layered Security Plan When developing a multi-layered security plan, you must look at each of the seven domains of the IT infrastructure and increase security on each of those domains. The seven domains are user domain, workstation domain, LAN domain, LAN to WAN domain, WAN domain, and remote access domain. Increasing the security on each of those seven domains will increase the overall security of the system and create a multi-layered security plan. In the user domain, one of the easiest ways for the system to be compromised is through the users. Easiness of user’s passwords can be a major problem so we need to implement complex passwords including eight or more characters, both upper and lower case, and use of at least one special character. Passwords will need to be changed every three months and the same password cannot be used again for one calendar year. In the workstation domain, we need to make sure that each of the workstations, whether desktop or laptop, has to have antivirus and malware protection installed on them. Express strict access control polices and standards. And mandate annual security awareness training for all employees For the LAN domain, Make sure wiring closets, data centers, and computer room are secure. Use a WLAN network keys that require a password for wireless access. And implement encryption between workstation and WAP to maintain confidentiality. In the LAN-to-WAN domain,......

Words: 386 - Pages: 2

Multi-Layered Security Plan

...NT2580 Introduction to information security | 7 Domain of IT Infrastructure Security Plan | Project Part 1 | | | [Pick the date] | As described by Tipton and Henry, information security management establishes the foundation for a comprehensive security program to ensure the protection of an organization's information assets. Security management encompasses the administrative, technical, and physical controls necessary to adequately protect the confidentiality, integrity, and availability of the information assets in the IT Infrastructure. Each one of the domain of the typical IT Infrastructure needs a proper security controls to ensure the confidentiality, integrity, and availability (CIA Triad). The following are the overview of the seven Domains: User Domain This is the domain of users that access systems, application, and data. It is the information asset of the organization that will be available to a rightful user by authenticating the user by the acceptable use policy (AUP). It is also define that the user is the weakest link in an IT infrastructure, but by educating user of the sensitivity of the IT infrastructure in the security awareness, security control shall be enforced. Security control to this domain can also be enforced by defining and implement the user policy of the IT infrastructure. Workstation Domain This is the domain where users first connect to the IT infrastructure. Because of numerous threats, it is necessary to......

Words: 889 - Pages: 4

Multi-Layered Security Plan

...Earlier today, I was instructed to create a general purpose outline for our company’s multi-layered security plan. There are seven (7) domains in a typical IT infrastructure: User Domain, Workstation Domain, LAN Domain, LAN-to-WAN Domain, WAN Domain, Remote Access Domain, and System/Application Domain. Each domain has their own unique risks, threats, and vulnerabilities that need to be mitigated in order to ensure our company’s security. In the User Domain the first thing that should be done is create an acceptable use policy (AUP). An AUP defines what users are allowed to do with organization-owned IT assets. Violation of the terms defined in the AUP can be grounds for dismissal. We will require staff and other 3rd parties to sign a confidentiality agreement to keep private data confidential. In addition to signing a confidentiality agreement, some positions may require criminal background checks to help ensure security. Here at Richman Investments we need to conduct security awareness training, insert reminders in banner greetings, and send email reminders to employees with security related tips. Disabling internal CD drives and USB ports will help keep employees from accessing personal photos, music, and videos at work. Also enabling automatic virus scans for email attachments and all new files that reach the workstation. The Workstation Domain is where most users connect to the IT infrastructure. A Workstation can include a computer, smartphone or any other device......

Words: 807 - Pages: 4

Nt2580 Project 1 Multi Layered Security Plan

...Nt2580 Project 1 Multi Layered Security Plan Keeping information assets secure is challenging for any business, regardless of its size. It seems there's no limit to the ingenuity and maliciousness of today's cybercriminals, hackers and identity thieves. In fact, hackers have become so sophisticated and organized that their operational methods are similar to those of traditional software development and business practices. When developing a multi-layered security plan, you must look at each of the seven domains of the IT infrastructure and increase security on each of those domains. Increasing the security on each of those seven domains will increase the overall security of the system and create a multi-layered security plan. In the user domain, one of the easiest ways for the system to be compromised is through the users. Simplicity of user’s passwords can be a major problem so we need to implement complex passwords including eight or more characters, both upper and lower case, and use of at least one special character. Passwords will need to be changed every three months and the same password cannot be used again for one calendar year. Project Part 1 Multi Layered Security Plan Richman Investments 1) General This MLS plan will give a brief overview of the security strategies that will be implemented at each level of the IT infrastructure. 2) User Domain a. The usage of security awareness training to instruct employees of Richman Investments security policies b.......

Words: 489 - Pages: 2

Multi-Layered Security Outline Plan

...INVESTMENTAND CONSULTING FIRM Multi-Layered Security Outline Plan IT Infrastructure Security Daniel Satterfield 7/1/2014 Identification of Risks, Threats, and Vulnerabilities along with proposed Security measures and controls   MULTI-LAYER SECURITY PLAN (OUTLINE) FOR RICHMAN INVESTMEN The following Multi-Layered Security Plan outline I am submitting for approval and implementation for Richman Investments, will provide a sound security plan for the firms most important mission critical assets, identifying and reducing vulnerabilities, Risks and threats to the firms confidential proprietary intelligence, sensitive customer data and other important assets within each of the Seven Domains that make up the core for the IT infrastructure as a whole. An aggressive approach should be mapped out in a 3-5 year progressive implementation achievement plan starting with one or two security initiatives where success can be clearly demonstrated and evaluated. The FFIEC now has mandated financial institutions mitigate online threats by intergrading endpoint encryption pushing it out to all users in a non pre-boot fashion then using the console to migrate users to pre-boot encryption which would provide immediate protection and increased visibility and control of our overall risk posture. First, indentifying Risk, Threat and Vulnerabilities within each of the seven Domains that make-up the firms IT infrastructure. Secondly, proposed security measures and......

Words: 751 - Pages: 4

Multi-Level Security Plan

...Project Part 1: Multi-Layered Security Plan When creating a multi-layered security plan, I would look at all seven domains of the IT infrastructure and then increase the security on each of those domains because that will increase the security for the whole plan. In the user domain, this is the quickest way for the system to be compromised the users. So I would implement complex passwords including eight or more characters, both upper and lower case, and use of at least one special character. Passwords will also need to be changed every 90 days and the same password cannot be used again for three calendar years. In the workstation domain, I would make sure that each workstations, whether desktop or laptop has some security on it like antivirus and malware protection installed. Laptops can be very vulnerable for loss or theft, which would make me install an encrypted hard drive so if it is stolen the data can only be retrieved by the owner. For the LAN domain, just train all users about email scams. I would guess that most users know not to access suspicious emails when on our system but I would still implement to the users a quick training course. Then I we should add spam filters this will help get rid of most of the junk email. In the LAN-to-WAN domain, we need to shut down the File Transfer Protocol (FTP) server we have running and switch it over to use secure FTP so that only users allowed on our system can access our FTP server. In the WAN domain, we...

Words: 461 - Pages: 2

Multi-Layer Security

...For a multi-layered security plan one should start off at the weakest point in the system, this point would be the User Domain, "Employees are responsible For their use of IT assests". This domain is only as strong as its weakest user, meaning one person could possibly cause havoc for the system. The IT department has better things to do than sit and baby sit end users on their machines, so measures should be taken to reduce the chance that a users activity can pull down a system unknowingly or otherwise. The first thing that should be implemented is a mandatory Computer Security training session to educate the users on the proper use of work computers. Teach users to utilize their machine properly and you can effectively cut down on simple mistakes that leave the system open to attacks. Another point of security to look at is the user's ability to bring in and corrupt data using CDs, DVDs and USB drives. Automated virus scanning for files transferred from one of these devices or banning these items and disabling the use of them on the individual computers will fix most occurrences of this type of attack. Aside from the User domain another possible weak point is the Remote Access Domain, Being that the users are off site it is hard to say that the users password information has not been compromised. In such cases when abnormalities are spotted or data is accessed without proper authorization, data should be completely encrypted to prevent any sensitive materials from......

Words: 474 - Pages: 2

Multi Layered Security Plan

...Multi Layered Security Plan Richman Investments 1) General This MLS plan will give a brief overview of the security strategies that will be implemented at each level of the IT infrastructure. 2) User Domain a. The usage of security awareness training to instruct employees of Richman Investments security policies b. Auditing of user activity 3) Workstation Domain a. The usage of antivirus and anti malware programs on each user computer b. Strict access privileges to corporate data c. Deactivation of media ports 4) LAN Domain a. Utilizing network switches b. WPA 2 encryption to wireless access points c. Securing server rooms from unauthorized access 5) LAN to WAN Domain a. Closing off unused ports via a firewall to reduce the chance of unwanted network access b. Monitor inbound IP traffic, more specifically looking for inbound transmissions that show signs of malicious intent c. Run all networking hardware with up to date security patches, and operating systems 6) WAN Domain a. Enforce encryption, and VPN tunneling for remote connections b. Configure routers, and network firewalls to block Ping requests to reduce chance of Denial of Service attacks c. Enforce anti virus scanning of email attachments i. Isolate found malicious software (virus, Trojans, etc.) when found ...

Words: 298 - Pages: 2