To: | The executive management team of Advanced Research (AR), Reston, VA | From: | Samuel Majekodunmi, IT Manager. | Date: | Aug. 30th 2015 | Subject: | The Reasons Advanced Research needs Kali Linux to Enhance and Test Security. | | Purpose | |

The purpose of this proposal is the present the executive team of Advance Research (AR) a solution to recent strings of security breaches. The goal of the proposal is to persuade the executive team of Advanced Research to invest personal for the sole purpose of constant testing of network security and vulnerability; therefore ensure AR’s safety of intellectual property. Table of Contents Executive Summary……………………………………………………………………….2 Introduction………………………………………………………………………………..2 Recommendations…………………………………………………………………………3 Budget……………………………………………………………………………………...4 References………………………………………………………………………………….4

Executive Summary

Advanced Research (AR) is on its way to becoming a major player in the medical research and development industry. However, suspicion that the corporate network infiltrated from unauthorized sources more than once, indicated the lack of solid security measures. The false allegations of unethical research and development practices are proof of such accesses. Despite the security troubles and false allegations, AR has experienced a 40% increase in business and as result of the increase AR has hires more stuff. The increase traffic is another indication that AR needs a sure and effective method to securing employee’s credential and devices. AR’s innovative research and development information is paramount to its continued success as a company. AR must enhance every security measure to meet the increase in business and procurement of new tools, personal and advance software for the sole purpose of testing the vulnerabilities in our network. The software should be able to test for the following attacks: * Denial of Service (DoS) * Cross Site Scripting (XSS) * Authentication Bypass * Directory Traversal * Session Management * SQL injection * Database Attacks * Password Attacks * Firewall/Router Attacks * Operating System Attacks
Introduction
Advanced Research has been the victim of cybercrime by hackers, whom have attempted to ruin the reputation of AR. The recent strings of breaches propagated against our network, is indication of our network vulnerabilities. In order for continual to succeed in the area of research, AR must continue testing for vulnerabilities that make access to intellectual properties possible. In other to test the vulnerabilities of the network, we must attempt to hack and penetrate our network. For security, professionals around the world will recommend Kali Linux because it comes with slew of robust tools to conduct a number of assessments and tests for the purpose to enhance security, reduce, and pinpointing vulnerabilities. Perhaps, the most important tool available is Metasploit Framework, which is an open-source development platform for creating security tools and exploits. The Metasploit framework “is the gold standard in the penetration testing tools industry. Metasploit earned a reputation as one of the most advanced frameworks on the market and the worlds most used software for this purpose. Metasploit is a collaboration of the open source community and Rapid 7; one outcome of this is the Metasploit Project, which is a security project focused on delivering information about security vulnerabilities and helps penetration testing and Intrusion detection.” (Walker, 2015) The framework allows users to configure exploit modules and test systems against attack. If the attack succeeds, a shell script opens, allowing the user to interact with the payload. The Metasploit framework written in the Ruby programming language and includes components written in C and assembler, which is ideal when applying script, develop to perform particular tasks.
Recommendations
In order to meet our security threats head on, recommendation is to use open source Software call Kali Linux. Kali Linux formally known as Backtracks 5 r3 comes with more updated tools that conduct a number of assessments and tests for the purpose to enhance security and finding vulnerabilities. Kali Linux is fully equipped with open source programs that are free to use. Exploitation are Advance Research number 1 problem, with the Exploitation tool at our disposal with can conduct Network, web, database, wireless, social, physical, open source exploitation to assess if our infrastructure or network is vulnerable and implement changes. One of the biggest attacks are on the network and under the Network Exploitation Tools is the Cisco Attacks which allows us to check for vulnerabilities on routers, Netgear-telnet-enable which target Netgear router set to listen on the network and Metasploit Framework to run while in the Backtrack module. We are able to conduct Vulnerability Assessment on networks, web applications, and databases. In addition to conducting all the previously mentioned assessment, the vulnerability assessment come with automated programs such as OpenVAS (The Open Vulnerability Assessment System) is a framework of several services and tools offering a comprehensive and powerful vulnerability scanning and vulnerability management solution. The actual security scanner accompanied with a daily updated feed of Network Vulnerability Tests (NVTs) for services and open port that do not need to run. Exploitation Tools will allow for the conduct of exploitation test on service and ports. Therefore, identifying which service is vulnerable to attacks. Kali Linux will allow monitoring right and privileges a breeze and issues access controls to personnel with the appropriate authority. Reverse Engineering allows us to investigate were an attack was propagated so as to take the appropriate action against theft or intellectual properties. “Stress Testing tools are used to evaluate how much data a system can handle. Undesired outcomes could be obtained from overloading systems such as causing a device controlling network communication to open all communication channels or a system shutting down (also known as a Denial of Service attack).” (Lakhami, 2013) Network, VOIP, and WLAN are a few Stress Testing tools that allow an examination of the network both wired and wireless in an event where there is increased traffic. Under the stress test, we are able to stimulate a number of attacks that rick havoc on networks (i.e. ping flood, and denial of service attacks etc.). Anti-virus Forensics and Network Forensics are a few tool that are under the Forensics tool, which are there to find violators and hacker activity were virus are deployed to create backdoors in the system.

Budget

Kali Linux is a great tool and it is essential to implementing a well-rounded security program. Since Kali Linux is open-source, it cost nothing to install which will save AR a substantial amount of money. In addition, Kali Linux runs off the Debian platform, which means it is very solid once installed with low maintenance. AR will need to hire talented Kali Linux administrators to conduct daily and weekly security tasks and as a result will pay those administrators salary. The average for a Linux administrator is $79,000 to $100,000 per year, with minimal in compare contracting to a security firm, who annual fees range from $600,000 to $1,000,000 depending on the size of the client.

References
Lakhami, A. (2013, Nov 26). The Ultimate Installation Guide for Kali Linux. Retrieved from www.drchaos.com: http://www.drchaos.com/the-ultimate-installation-guide-for-kali-linux/
N/A. (2015, Aug 30). Metasploit Unleashed. Retrieved from https://www.offensive-security.com/: https://www.offensive-security.com/metasploit-unleashed/introduction/
Walker, J. (2015, May 15 ). blog.monitor.us. Retrieved from Top 7 penetration testing tools for the small business.: http://blog.monitor.us/2015/05/top-7-penetration-testing-tools-for-the-small-business/