Aircraft Solutions Security Assessment
Phase 2

Table of Contents

Executive Summary ……………………………………………………………………..1
Company Overview ……………………………………………………………………..1
Assessment ……………………………………………………………………………….2
Security Vulnerabilities …………………………………………………………............2
A Hardware Firewall Vulnerability …………………………………………………....2
A Software Policy Vulnerability ………………………………………………………..3
Recommended Solutions ………………………………………………………………..5
A Hardware Firewall Solution …………………………………………………...........5
A Software Policy Solution …………………………………………………………….6 Impact on Business Processes …………………………………………………………6
Budget …………………………………………………………………………………....7
Summary ………………………………………………………………………………....9
References ………………………………………………………………………………10

Aircraft Solutions

Executive Summary

Aircraft Solutions (AS) desired a security assessment to highlight the company’s vulnerabilities. AS is a highly esteemed leader in the design and component manufacturing enterprise those solutions can be used within the business applicability of the electronics, commercial, defense and aerospace industries. There were discovered hardware and software vulnerability of non-firewall at the commercial division and software policy updates. The solutions that will be presented are to purchase a firewall system and update the policy update timeframe within the standards that will be introduced from the company that will be recommended to purchase the firewall system from.
Company Overview

AS is a highly esteemed leader in the design and component manufacturing enterprise those solutions can be used within the business applicability of the electronics, commercial, defense and aerospace industries. AS has a wide range of employees who are highly trained and equipped to accomplish the desired customer outcome and complete the specifications on time and within the desired customer requirements. AS desires to assist the customer through all phases of the development process with low-cost designs and central processing device that aids in simulation processes that reduce their initial project costs. This security examination will highlight the vulnerabilities that were discovered within the framework of the company. A calculation of these issues will be displayed and the possibilities of the negative ramifications to the business process and standing within the enterprise will be discussed.
Aircraft Solutions
Assessment
During this examination of AS, there will be two vulnerabilities that will be further examined. The first is the Defense Division is going through the Headquarters, through a firewall and then into the internet. There are several lines of protections in that structure. However, the Commercial Division has a connection that is not routed through anything, which is a direct connection into the internet. The second assessment is about the policy and procedures about the router and firewall updates that are accomplished in a two year cycle. There are instances that most router and firewall updates occur very rapidly and not in a definable time frame. So waiting for two years would further expose the company to possible proprietary information being lost or stolen.

Two Security Vulnerabilities

The first vulnerability is a noticeable hardware vulnerability. There is no firewall between the commercial division and the internet connection. As depicted by the arrow in the picture below, it is an easily exploitable issue that needs to be corrected. Although there is a connection into the Headquarters, which has a firewall protection, it is only through the Headquarters. That the commercial division has a direct connection into the internet is a fully exploitable problem that should be corrected. There is no filter to go through the communications that can come from the internet into this division. So
Aircraft Solutions there should be the use of a communication risk analysis tool much like shown as shown below (ERPANET, 2003): This vulnerability could allow for many consequences that could leave the company with exposures of customer information, thoughts and designs that could be used by competitors for both companies and exposure to further legal actions and other possible data leakage into the defense division and Headquarters. For the customers, their designs could be exploited by rival companies or used as a template to change or create other competitors. There could have be manipulation of the designs that could make your company use resources in a direction that the customer would not like for their project. The second vulnerability that will be briefly discussed is about the software policy updates. The current policy stated requirements are that all rule sets and software updates are done in a two year update for the routers and firewalls. Without much consideration, there are always patches and updates that are being done in non-specific time frames by Cisco routers and other firewall companies as risks, threats and vulnerabilities are noted. A bigger consequence to this updating problem is that the possibility of an unscrupulous individual, or even an insider, could exploit the vulnerability and basically go undetected using something that had not been updated. New variants are always around the corner,
Aircraft Solutions or so it seems. Without more frequent updates, an issue could be introduced, exploited and used for whatever means. The consequences could lead to disaster in regards to lost revenue for your company, manipulated responses to projects, misuse of your companies resources, lost contracts or worse yet, disclosure of Headquarters direction or loss of government division documents. Although there are server and host detection software packages on the Headquarters’ computers. However, this direct avenue can be exploited without any firewall coming into the commercial division. There are multiple ways that these detection programs can be overwhelmed. This coupled lack of firewall and the information that an insider could use, could then devastate the company and its standing within this industry. But there are also problems with the company image within the community and industry. This could possible also lead to other legal ramifications and issues with former contractual customers. In short, it could involve more time and money to defend the discoveries, notifications and public acknowledgement that is necessary when a breach of information is discovered. Some can argue that some of this discovery and other acknowledgement may not be necessary, but there is communication of a discovered fault and being ahead of the problem makes good business sense. There is one constant in software policy, and it is all about change. There needs to be further documentation and policy updates to reflect that things occur more frequently than just every two years. Although Microsoft had a stance of "the only periodic maintenance required is the replacement of the licenses for the firewall engines on the management station every 12 months, depending on the environmental conditions within the data

Aircraft Solutions center" (Northrup, 2014) or as soon as a new patch is released by the software manufacturer, which is Nortelworks for their firewall system. This is not sufficient.
Recommended Solutions

The recommendation to provide the hardware vulnerability firewall solution can be fulfilled with a Cisco product line within ASA Next-Generation Firewall Services. It is a modular security services system that runs on the Cisco ASA 5500-X Series Next-Generation Firewalls that includes a Security Services Processor (Cisco, 2013). This system provides network awareness, which includes the users connecting to the network, what devices are being used, the applications being used and what websites that are being accessed. In short, it provides the necessary business protection and safety from outside websites and the increasing blurred lines between business communication and employee uses. It will also maintain an intrusion alert system to provide awareness of outside attempts to access the business computer network. The very interesting aspect of this series is that it can also allow connections into the cloud computing network without additional hardware needs (Cisco, 2013). The software vulnerability closure would fit nicely with the mentioned Cisco solution. Cisco has more robust timeline to provide many services and updates for their products. Cisco has a 24 hour a day security incident response team for their products. The company produces advisories with the machine-readable attachment to correct issues noted in the advisories. These advisories will be generally disseminated at 1600 GMT (Greenwich Mean Time) on any given Wednesday (Cisco 2013). For GMT breakdown, refer to http://wwp.greenwichmeantime.com for conversion to local time.
Aircraft Solutions
The following table is how Cisco would communicate updates for their systems. You can access the portal at any time your company would like and can set your timeframe that your company’s security intelligence operations (SIO) or information technology cadre would be directed to check the portal for any updated information and feedback. E-mail SIO Portal RSS CNS Bug Search Tool
Cisco Security Advisory Yes Yes Yes Yes Yes
Cisco Security Notice No Yes Yes No Yes
Cisco Security Response Yes Yes Yes No Yes
Cisco Event Response No Yes Yes No No
Cisco Applied Mitigation Bulletin No Yes Yes No No
Threat Outbreak Alert No Yes Yes No No
Release Note Enclosure No No No No Yes
(Security Vulnerability Policy, 2013)
Impact on Business Processes The first thing would be that you have purchased a state of the art firewall and detection system for your company. As will be shown, there are many advantages to this system beyond its module nature. It will provide a confidence for your information technology department that will allow the usage and monitoring of the system that everyone would like access to. It will allow the company and outside user’s access into the desired location or sites, but would allow the system administrators to control the access and may provide less policies and procedures that need to be trained and maintained. The authentication process would still be robust enough to changes to administrative actions to include password changes, password complexity and various logging functions and checks as needed. It also can incorporate what is termed as the “DMZ” zone (Cisco, 2013) which allows the external user access to only the internal departments that they need to be in for whatever reason. As a matter of fact, there are
Aircraft Solutions other vulnerabilities that this system could be used to route all traffic through the headquarters and provide even more security for your computer system. But to stay within the scope of this observation paper, it could easily handle the traffic that could be generated with the commercial division of your company.
BUDGET
The cost analysis of the ASA5555-2SSD120-K9 used computer system at the following website: http://www.nextwarehouse.com/item/?1376376_g10e, is $18,495.46 with a 45 day warranty (that can be expanded if needed). This is one of the better used ones with 14 port access points and is equipped with the ASA 5555-X Firewall Edition. Further specifications can be noted at the website. At New Egg, there was a 5525-X Firewall System (http://www.newegg.com/Product/Product.aspx?gclid=CMO3N_Cz7wCFcY7MgodOlIAfg&Item=N82E16833420489&nm_mc=KNC-GoogleAdwords&cm_mmc=KNC GoogleAdwords-_-pla-_-Firewalls+%2f+Security+Appliances N82E16833420489&ef_id=UwAX2gAABCVUObCe:20140216014354:s) for $5,228. But this unit has only eight port access points and their 30 day return policy. But the firewall program was already installed into the system also. Another website claims to have systems on hand at http://www.mdsiinc.com/hardware/networking/cisco-switches-routers-security/?gclid=CLf5h5TCz7wCFSISMwodl00AWQ. But I was unable to get a quote, much like the actual Cisco website (www.cisco.com) without a company user account and password.
Aircraft Solutions There are some on-line training documentation and videos that are no cost. They also have some other live video training that is $120, hardcopy book for $28 with an eBook option of $22.40. When you register your purchased product, more training materials are offered for a nominal cost from what I could glean from their sites and the short interactions that I had with Cisco. The picture provides their continuing planning and designing migration services that are provided by Cisco. They can assist in helping with your strategy and assessment for future needs. The cost again was not accessible to me, but would be minimal at best. The one thing will be that they will need to access and analyze your business service to provide the most accurate architecture for your company (Cisco, 2012). But within the gist of the collaborative nature of the company, that is how they will best serve your company and keep your company and business associates information secure. Aircraft Solutions
SUMMARY
In summary, there are several identified vulnerabilities that need to be addressed and the proposed solutions will ensure the vulnerabilities are alleviated with the minimum time and costs needed to rectify the issues before they become possibly huge problems for your company and business associates.

References

ERPANET., (2003, September). ERPATOOLS Risk Communication Tool. Retrieved on January 20, 2014 from http://www.erpanet.org/guidance/docs/ERPANETRiskTool.pdf .