Network Security

Linda Real Estate (LRE) is a medium-sized organization operating in the real estate industry
having 5 offices in the metropolitan and regional areas. The organization stores all its data on a
single device and all the offices use a single website to carry out their daily tasks which can
impose a grave security threat. In addition, all the employees are operating remotely with their
portable devices with personal administration rights not managed by the organization but by the
individuals. The above mentioned scenario can lead to a severe security breach which can create
a catastrophic situation for company beginning with the break-in in the organization’s server,
thievery of data, leak of confidential information to harmful organizations bringing harm to the
customers, ultimately the windup of the organization while facing severe law suits.
By exploring the case study, I have identified the following loop holes which can lead to security
breach.

Impact

1. The employees are using simple passwords to manage their accounts.

2. All five offices of the organization use a single website for all its operations.
3. Each employee has administrative rights to his/her portable device.
4. Hardware, firewall and intrusion detection system (IDE) are vulnerable against zero day
attacks.
5. No patch management policy.
6. Every person has access to Linda Real Estate’s website.

Solution
Instead of hiring individuals for the security, administrative rights and user authentication issues
the organization can simply hire a competitive IT company for this purpose. As the company
hardware, firewall and IDE is vulnerable to zero attacks it means that the overall system of Linda
Real Estate is helpless against a hack and the venders will not be able to release a patch in time
to protect it users. In order to avoid this situation Linda Real Estate should use an exhaustive
security software and not delay the updating of the software, but in a fact, update the software as
soon as an update is released. The employees should use complex passwords which may consist
of a pattern as now different applications compel you to follow a particular pattern for the
password. The organization can also compel its employees to use a specific pattern for their
passwords. The organization should make patch management policy fundamentally based on a
building a patch process and automating the patching process and its deployment.
Alternative
In order to prevent a security breach, the organization must use a distributed network in order to
handle the five offices separately with each office having an IT and System team to handle the
security, encryption, storing and retrieval of data. The organization must manage all
administration rights for the portable devices through a system team so that harmful and vicious
software’s are not installed on devices which can lead to a security threat. Moreover, this method
will ensure that the software’s on the devices are secure and will not facilitate in any breach but
may help in breach detection. In order to avoid zero day attacks, the organization must maintain
a strict security patching schedule and slightly change the operating system and other programs
on their network.

Reason

Solution is better than the alternative because the alternative is expensive and quite exhaustive to
implement, will increase company’s liability and is time consuming. In addition, the company
will have to staff, recruit and manage five different IT teams at five different offices which will
only put a strain on the organization’s resources and will complicate the company’s work
processes. While putting the responsibility on a trusted reliable effective and competitive IT
company will free the organization from any of the above mentioned loads and allocate resources
to other initiatives or in reinforcing work processes.

Implementation

Hardware Latest hardware will be needed to support the organization against any zero
attack along with continuous upgradation.
Software The organization will have to buy a comprehensive security software from a
reliable vendor and update in real time.

Training No training will be required for the employees because all the upgradations,
updates, automation and deployment will be handled by the vendors.

The use of this solution will take the administrative rights from each employee of his portable
device and restrict them and provide the organization with network segmentation to improve its
effectiveness and efficiency and will implement a Network-based intrusion detection/ prevention
system.
Physical Security

Linda Real Estate has ignored the crucial factor of physical security which holds it due
significance in maintaining confidentiality, integrity and availability. The organization has not
installed or implemented any security measure for the protection of its sites especially the central
site. The company is using only a single device for them storage of data. Moreover, the
environment is not favorable for the host servers and the storage device.

Impact

1. The company is using a single storage device for the storage of data.
2. The Linda Real Estate central site has no physical security measures.
3. Unfavorable environment for the hosting servers or the storage device which causes
regular power surges.
4. Unauthorized access to the QNAP QTS 4.2 (NAS) potentially disrupting business
operations

Solution
In order to secure the data, the organization must implant at least 2 more storage devices to make
the backup of the primary data installed at separate locations. In order to protect the storage
devices from power surges the company can use surge protectors. Last but not the least the
organization must make sure the presence of a physical personal who checks that only authorized
individuals have access to the central site only and rings an alarm in case of violation of physical
security protocol.

Alternative

Instead of purchasing storage devices the company can make a local cloud for storing the
backup. Since the storage device or the hosting servers reside in an unfavorable environment that
is prone to electrical surges the company can move their central site to a more favorable
environment which prevents the risk of electrical surges. The organization can implement a
security system that uses pin codes, user identification cards along with imprinted barcodes to
allow access only authorized users to the central site and securing any unauthorized personal in
case of violation of security protocol.
Reason

The solution is better than the alternative because the development or the purchase of a local
cloud is expensive and requires experts to maintain the cloud. Moreover, moving the storage
device or the host servers from the central site to another favorable environment and then
allocating it the status of the central site is a very exhaustive task which requires adequate
/appropriate measures and resources which is a very costly process for a medium-sized
organization such as Linda Real Estate. Implementing a comprehensive security as mentioned
above in alternative is also an uphill task for an organization such as Linda Real Estate.

Implementation
Hardware 2 separate Storage devices, surge protector
Software No software changes will be needed -
Training No training will be required for the employees as we are just implanting 2 more
storage devices and a surge protector.

This method will correspond to the server application hardening and operating system hardening
allowing only authorized programs to functions while disabling all other unneeded applications
and facilitate Business continuity and disaster recovery plans.

Malware Threat Protection

Malware can disrupt business operations, from hindering daily operations to stealing confidential
data to massive organizational reputational damage. Linda Real Estate is still practicing some
obsolete methods that can lead to malware transmission in Linda Real Estate’s computer
systems.

Impact
1. The systems in the portable devices of all the employees are running on default settings.
2. The hardware firewall and IDS are helpless against a zero attack
3. No password policy
4. Organization’s data is stored on QNAP QTS 4.5 (NAS)
5. No patch management policy
6. Anti-virus solutions which need to update the latest virus definitions
7. No physical security mechanism at Linda Real Estate’s central site.
8. Every person has access to Linda Real Estate’s website.
Solution
Malwares can be avoided by restricting the administration rights, patching, applying GPO
restrictions, using a trusted channel, timely updates, data encryption, hardware protection,
developing an emergency plan and using a secure network. Malwares can be prevented by
keeping wary of website defacements, website redirects, SEO attacks. Purchasing a malware
detection and protection software can also help in this regard. Keeping a backup, developing and
investing in insurance policies can also help in an incident of a malware attack.

Alternative
Another approach to malware protection is to ignore all other prevention tricks and techniques
and only install an anti-malware software.

Reason
Solution is better than the alternative because ignoring all other prevention measures and
focusing only on the anti-malware software will put the entire organizations computer system on
a high risk of malware attack with little or no contingency plan at all.

Implementation

Hardware No need to make any changes to the hardware

Software Installing and updating anti-malware software, detection software , termination
software.
Training The employees will have to be trained in such a way that they keep themselves
wary of malwares and avoid actions that can cause a malware transmission

This approach will ensure Antivirus software using heuristics and reputation ratings, user
application hardening and web content filtering which will keep the network secure keeping data
and hardware safe, will implement a Network-based intrusion detection/ prevention system and
facilitate Business continuity and disaster recovery plans.

User Authentication
Linda Real Estate, despite being a medium-sized organization has not put any significant inputs
towards a strong user authentication culture which can create multifaceted disasters for the
organization. The organization is still using a simple user authentication mechanism which can
be easily breached and give access to any unauthorized personal who can use the data as he/she
pleases and can use this data by inducing it in any means at his disposal to achieve his/her
vicious goals. The individual will able to achieve his/her goal but the company will have to take
responsibility for any calamity that arises due to this neglect.

Impact

1. No password policy
2. The employees are using simple passwords that are easy to remember for their daily
operations.
3. Each employee has administrative rights to their individual devices
4. Employees are using simple passwords to access the company website and the QNAP
QTS 4.2 (NAS).
5. The central site of the organization has no physical security mechanism.
6. Every person has access to Linda Real Estate’s website.

Solution

The company must take administrative rights from the employees of their portable devices and
manage these administrative rights through an IT team. The company can implement physical
security measure as discussed in the Physical Security critical cyber security issue. The company
can make a password policy that depends on multi-level authentication process comprising of:
 One time use passwords which are created by completely randomizing a 16-digit code
without any traceable pattern and are given to the employees physically or through the
automation of a machine.
 Using smart cards to keep an account of the access by authorized users.
 Biometric Identification
 SMS or email verifications for authorized access

Alternative

The can generate username and passwords for each employee based on a specific pattern. In
addition to this the company will have to change the specific pattern for making the usernames
and the passwords after random time intervals and will have to ensure the timely provision of
these passwords and usernames to the employees so the business operations are not hindered.
Reason

Solution is better than the alternative because it provides with multi-factor authentication
whereas the alternative provides with single-factor authentication. In the implementation of the
alternative whole responsibility will lie with the users, they will have to take precautions to keep
their passwords safe and immediately logging out when their work is done. The single-factor
authentication can be easily guessed or cracked and can provide a gateway to the hacker to put
the company’s whole computer system at risk.

Implementation

Hardware Hardware required for the automation of the machine for the provision of one
time passwords along with the biometric identification hardware and machines
that read the smart cards.
Software The program for generating one time use passwords, a software that manages
employee data base and provides with accurate biometric identifications. The
employees may have to download the authentication software on their cellular
devices.
Training Provide the employees with minimal knowledge to help them understand and use
the chosen authentication methods effectively.

The solutions to this critical factor will result in the application whitelisting of approved/ trusted
applications, implementation of a Network-based intrusion detection/ prevention system. and
will Disable local administrator account.

The Principle of least privilege

Linda Real Estate is continuing at least two practices that can lead to the failure in the
implementation of the principle of least privilege which is one of the six critical cyber security
issues and holds its due significance in this regard. If these two access points remain unobserved
and if no compulsory and appropriate measures are taken to keep check on these two access
points, these access points can become a liability for the organization and can result in the
copying, modifying and permanent removal of confidential data or sharing it with unintended
recipients deliberately or accidently which can cause severe problems for the organization.
Impact

1. Every person has access to Linda Real Estate’s website.

2. The central site of the organization has no physical security mechanism.

Solution

It is advisable to limit the access privilege of each employee to limited data, resources and
information. The implementation of physical security mechanism has already been discussed in
Physical Security critical factor of cyber security issue. Since every person has access to LRE’s
website the only way or the pass point at which the access level of every individual accessing the
site can be determined and differentiation can be made POLP process, in addition to this, the
application of networking securing techniques will help in restricting the access of each person.
In this way each individual will get the amount of access they require to perform their specific
task.

Alternative
There is no immediate option in contrast to actualizing the POLP; notwithstanding, there are
various degrees of review, observing and control that can be custom fitted to suit the size of the
organization and number of representatives. As Ace Hardware develops and builds their labor
force, more assets will be needed to oversee access control.

Implementation

Hardware No extra equipment is required, in spite of the fact that adjustments to existing
equipment might be required.
Software Additional programming might be needed to oversee clients and access in all
actuality, and to direct reviews
Training Train the inward staff to execute and deal with the entrance control technique and
reviews.
The principle of least privilege will ensure the implementation of a Network-based intrusion
detection/ prevention system, Protect authentication credentials mitigation strategies in Linda
Real Estate’s overall computer system.

Protection of confidential data

Unfortunately, Linda Real Estate has no appropriate measures firstly to ensure the protection of
its confidential data, secondly no measures for intrusion detection and timely termination of any
unauthorized intrusion which can also prevent the loss of confidential data in time.

Impact

1. The systems in the portable devices of all the employees are running on default settings.
2. The hardware firewall and IDS are helpless against a zero attack
3. No password policy
4. Organization’s data is stored on QNAP QTS 4.5 (NAS)
5. No patch management policy
6. Anti-virus solutions which need to update the latest virus definitions
7. No physical security mechanism at Linda Real Estate’s central site.
8. Every person has access to Linda Real Estate’s website.

Solution

So as to keep the secret information from interior dangers and assaults the organization should
impair unique advantaged accounts that are not, at this point utilized and the records of the
representatives who have left the association. Next, the association ought to intently screen,
control and oversee advantaged qualifications to forestall misuse. At last, organizations should
actualize important conventions and foundation to track, log and record special record action,
make alarms to take into account a snappy reaction to malevolent action and ensure the
information from the get-go in the assault cycle. Train representatives on network safety best
practices and offer continuous help. To be additional sheltered, execute multifaceted validation,
to guarantee that clients are in truth who you accept they are. The best safeguard against a cloud-
based threat is to shield at the information level utilizing solid encryption. To limit the effect of a
security, break and hole, lead a danger appraisal to recognize where your significant information
lives and what controls or methodology are set up to ensure it, work out a complete episode
reaction and calamity recuperation/business progression plan and continuous reinforcements of
information on a cloud or elsewhere.

Alternative
Give some portion of your yearly spending plan to security, control, screen and update, observe
who approaches what information. Control and check as much of the time as conceivable that
your IT climate has been refreshed to the most recent LTS variant (long haul uphold ensure),
Install, empower, and update against infection and hostile to malwares on each worker's PC,
utilize a VPN (Virtual Private Network) to ensure your association inside or outside your office
is secure, limit your IT climate to just be open from a committed IP, set up a sufficient protection
strategy.

Reason

Solution is more comprehensive, detailed and exhaustive than the alternative.

Implementation

Hardware Needed for the implementation of multifactor authentication such as One Time
Password (OTP), RFID, smart card, fingerprint reader or retina scanning
adjustments to existing and recently purchased equipment might be required,
surge protector
Software Comprehensive security software, Installing and updating anti-malware software,
detection software, termination software. Additional programming might be
needed to oversee clients and access in all actuality, and to direct reviews
Training Train representatives on network safety best practices Provide the employees
with minimal knowledge to help them understand and use the chosen
authentication methods effectively. Train the inward staff to execute and deal
with the entrance control technique and reviews.

This approach will correspond with the implementation of a Network-based intrusion detection/
prevention system, server application hardening and operating system hardening, facilitate
Business continuity and disaster recovery plans, ensure Antivirus software using heuristics and
reputation ratings, user application hardening and web content filtering.
The solutions to this critical factor will result in the application whitelisting of approved/ trusted
applications, will Disable local administrator account and protect authentication
credentials mitigation strategies in Linda Real Estate’s overall computer system.