Richman Investment Remote Access Security Policy

In: Science

Submitted By weshead32
Words 349
Pages 2
Richman Investment’s Remote Access Security Policy
1) Wireless Access
At Richman Investment’s when the network is accessed remotely via wireless appropriate wireless security
standards will be used.
• Wired Equivalency Protocol (WEP) will be used as standard on Wi-Fi
connections.
• A WEP encryption key will be used.
• The network will be configured not to advertise its presence.
• The power of access points will be turned down to a minimum that still allows
the access point to function.
• Due to the possibility of cracking Wireless Encryption Protocol using sniffing
software such as AirSnort all wireless access points will be outside the
firewall.
• Wi-Fi Protected Access (WPA) will be used where it is available.
2) Secure Access via VPN
Access from remote users to the corporate network will be via secure IPSEC VPN
or SSL VPN connections only. This is necessary to secure the connection from the
remote device to the corporate network.
3) Prevention of Data Loss
All laptops and PDA’s that are taken off site will have the following security
configured, to prevent data loss in the event of theft.
• The hardware password will be enabled if available.
• All corporate data on the laptop or PDA will be encrypted using appropriate
encryption software.
• Sensitive documents will be accessed remotely and not downloaded to the
laptop or PDA.
4) Remote Device Protection
To prevent remote PC’s, laptops, PDA’s etc from compromising the corporate
network, security software will be installed on the devices.
• Firewall software will be installed on the devices to prevent them from being
compromised by trojans and back door software.
• Anti-virus software configured to automatically download the latest virus
signatures will be installed and utilised.
5) Blue Tooth
To prevent Bluetooth enabled devices from being…...

Similar Documents

Richman Investment

... this layer you may want to apply file transfer monitoring, scanning for unknown files. Wan security connects systems to a remote location. URL filtering is a way to implement and enforce internet usage policy for a network. Most companies are moving from leased lines or frame relay for cost saving and increased performance. Remote Access Domain connects users to the organization’s IT infrastructure. To secure connections to the corporate network, you can configure properties that either allow remote access or deny remote access. There are several ways that one can use to secure remote access domain. Control access through the Dial-IN Properties of an individual user account. One can also create and configure remote access policies and profiles. Last layer in IT security infrastructure is the System/Application Domain. This is where all the variable data is held. This can be anything from human resources, payroll and accounting. This is where you will like to keep your best security placed. It is always good to implement virtual firewalls and server segmentation on separate VLANS. Design a disaster recovery plan just in case the system goes down during a disaster....

Words: 437 - Pages: 2

Richman Investments Remote Access Control Policy

...Russell Nelson RNelson-IT255-Project-Part 1 5/26/2012 Multi Layered Security Plan Richman Investments 1) General       This plan will give an overview of the security strategies that will be implemented at each level of the IT infrastructure for Richman Investments. 2) User Domain   a. Use security awareness training to instruct employees of Richman Investments security policies.   b. Audit user activity. 3) Workstation Domain   a. The usage of antivirus and anti malware programs on each user computer.   b. Implement strict access privileges to corporate data.   c. Deactivation of media ports. 4) LAN Domain   a. Utilizing network switches.   b. Utilize encryption to wireless access points.   c. Secure server rooms from unauthorized access.   5) LAN to WAN Domain   a. Closing off unused ports via a firewall to reduce the chance of unwanted network access.   b. Monitor inbound IP traffic, more specifically looking for inbound transmissions that show signs of malicious intent. c. Run all networking hardware with up to date security patches, and operating systems. 6) WAN Domain   a. Enforce encryption, and VPN tunneling for remote connections.   b. Configure routers, and network firewalls to block Ping requests to reduce chance of Denial of Service attacks.   c. Enforce anti virus scanning of email attachments.   d. Isolate malicious software (virus, Trojans, etc.) when found.   e. Deployment of......

Words: 280 - Pages: 2

Richman Investment Remote Access Security Policy

...Richman Investment’s Remote Access Security Policy 1) Wireless Access At Richman Investment’s when the network is accessed remotely via wireless appropriate wireless security standards will be used. • Wired Equivalency Protocol (WEP) will be used as standard on Wi-Fi connections. • A WEP encryption key will be used. • The network will be configured not to advertise its presence. • The power of access points will be turned down to a minimum that still allows the access point to function. • Due to the possibility of cracking Wireless Encryption Protocol using sniffing software such as AirSnort all wireless access points will be outside the firewall. • Wi-Fi Protected Access (WPA) will be used where it is available. 2) Secure Access via VPN Access from remote users to the corporate network will be via secure IPSEC VPN or SSL VPN connections only. This is necessary to secure the connection from the remote device to the corporate network. 3) Prevention of Data Loss All laptops and PDA’s that are taken off site will have the following security configured, to prevent data loss in the event of theft. • The hardware password will be enabled if available. • All corporate data on the laptop or PDA will be encrypted using appropriate encryption software. • Sensitive documents will be accessed remotely and not downloaded to the laptop or PDA. 4) Remote Device Protection To prevent remote PC’s, laptops, PDA’s etc from...

Words: 349 - Pages: 2

Remote Access Control Policy for Richman Investments

...Authorization- Richman Investments must define rules as to who has access to which computer and network resources. My suggestion is that RI implements either a group membership policy or an authority-level policy to achieve this. Group policy would allow the administrator to assign different privileges to different groups. The admin would then assign different individual users to those different groups. So the users permissions would depend on the permissions of the group they were a member of. With authority-level policy the admin would assign different permissions to individual users based on their position and authority level within the company and what access that position requires. Identification- Richman Investments needs to assign a unique identifier to each user in order to have accurate records of who is accessing, or trying to access, what applications, which network resource, and what data. The most common ID is the username, account number, or PIN Authentication- In order to keep the remote access to Richman Investments secure, there must be proof that the person trying to gain access to the network remotely is the same person who has been granted access by identification. To do this RI can choose one of the following knowledge type authentications: PIN, password, or passphrase along with one of the following ownership type of authentication: smart card, key, badge, or token. Using a combination of ownership authentication and knowledge authentication......

Words: 298 - Pages: 2

Richman Investment

...Richman Investments To: Senior Manager Mr. Hagood Hello, I was asked to draft a brief report concerning the (IT infrastructure domain). The purpose of the report is to describe the “Internal Use Only “ data classification standards set by the company the information obtained in the report consist of a study done on all seven layers of the IT infrastructure. At the conclusion of this study I will establish that three of the seven layers of the IT infrastructure that are affected by the “Internal Use Only “data standards and how affect domain and their security. The User Domain. This defines the people who access the organization’s information. Personal information is created in this domain that is obtained for internal use only. The Work Station Domain (WSD). This is where most users connect to the IT Infrastructure. It can be any device that connects to network. This layer requires a login and password authentication before access is allowed to view information. The LAN-to-WAN Domain. This is where the IT infrastructure links to a wide area network and the Internet. A firewall control prevents and monitors incoming and outgoing network access. The TCP and UDP are compromised due the fact these are entry and exit point to the wide area network and making private information easily accessible to anyone. I have determined the layers discussed in this brief report explains the affects that “Internal Use Only” data standards has on the IT Infrastructure......

Words: 270 - Pages: 2

Richman Investments Remote Access Control Policy

...SHAUN PARE 4/9/12 ESSAY 2/ 500 WORD What is the OSI model the 7 layers The Open Systems Interconnection or (OSI model) “Is an architectural model that represents networking communication. It was introduced in 1978 by the International Organization for Standards to standardize the level of services and types of interactions for computers communicating over a network” (Emdad). The OSI is the standard that sets the path that data must travel through from one computer to another through a network. The OSI does this by the sending the through seven different layers almost like sending the data through checkpoints and at each checkpoint the data must be cleared so it is able to move on to the next stop. This is what the seven layers of OSI do. The data must go each layer, each layer performs a specific task in order to pass the data through to the next layer, and these layers also communicate to the layer above and below to make sure that everything in order. There are seven layers and each one has a specific function that prepares it for next layer the data must pass through all seven layers. The layers are separated into two sets the first is the application set • Application layer 7- This is the layer that provides the interface between the network protocol and the software running on the computer. This layer handles anything that communicates with the internet; this layer also handles any network related activity such as file transfers or reading and sending email...

Words: 606 - Pages: 3

Richman Investment Remote Access Control Policy

...Richman Investment Richman Investment Remote Access Control Policy Document Remote Access Control Policy Document 01/14/14 01/14/14 Contents 1 Policy Statement 4 2 Purpose 4 3 Scope 4 4 Definition 4 5 Risks 4 6 Applying the Policy - Passwords 5 6.1 Choosing Passwords 5 6.1.1 Weak and strong passwords 5 6.2 Protecting Passwords 5 6.3 Changing Passwords 5 6.4 System Administration Standards 6 7 Applying the Policy – Employee Access 6 7.1 User Access Management 6 7.2 User Registration 6 7.3 User Responsibilities 6 7.4 Network Access Control 7 7.5 User Authentication for External Connections 7 7.6 Supplier’s Remote Access to the Council Network 7 7.7 Operating System Access Control 7 7.8 Application and Information Access 8 8 Policy Compliance 8 9 Policy Governance 8 10 Review and Revision 9 11 References 9 12 Key Messages 9 13 Appendix 1 10 Policy Statement Richman Investments will establish specific requirements for protecting information and information systems against unauthorised access. Richman Investments will effectively communicate the need for information and information system access control. Purpose Information security is the protection of information against accidental or malicious disclosure, modification or destruction. Information is an important, valuable asset of Richman Investments which must be managed with care. All information has a value to the Council. However, not all of this information has an...

Words: 2211 - Pages: 9

Remote Access Control Policy Definition

...Remote Access Control Policy Definition Introduction to Information Security Remote access is the ability to log onto a network from a distant location. Generally, this implies a computer, a modem, and some remote access software to connect to the network. Whereas remote control refers to taking control of another computer, remote access means that the remote computer actually becomes a full-fledged host on the network. The remote access software dials in directly to the network server. The only difference between a remote host and workstations connected directly to the network is slower data transfer speeds. The purpose of a remote access policy is to define the standard connection to the company’s network from any remote host, untrusted host and remote network, including untrusted hosts on the company’s intranet. These standards are designed to minimize the potential exposure to the company’s from damages, which may result from unauthorized use of the company’s resources. At the main location, a set switches and routers are interconnected to from a Wide Area Network. The switches can be connected in different topologies. All remote users must follow the security requirements set forth in the standard for the company’s remote host accessing Information Technology Resources prior to such access, as well as any guidelines, procedures or other requirements issued by the Information Technology Department. Within the virtual private network multiple Virtual Private Network...

Words: 660 - Pages: 3

Remote Access Control Policy for Richman Investments

...Remote Access Control Policy for Richman Investments 1.0 Overview This remote access policy defines standards for connecting to the organizational network and security standards for computers that are allowed to connect to the organizational network. This remote access policy specifies how remote users can connect to the main organizational network and the requirements for each of their systems before they are allowed to connect. This will specify: 1. The anti-virus program remote users must use and how often it must be updated. 2. What personal firewalls they are required to run. 3. Other protection against spyware or other malware. The remote access policy defines the methods users can use to connect remotely such as dial up or VPN. It will specify how the dial up will work such as whether the system will call the remote user back, and the authentication method. If using VPN, the VPN protocols used will be defined. Methods to deal with attacks should be considered in the design of the VPN system. 2.0 Purpose The purpose of this policy is to define standards for connecting to department’s network from any host. These standards are designed to minimize the potential exposure to department from damages that may result from unauthorized use of department resources. Damages include the loss of sensitive or confidential data, intellectual property, damage to public image, damage to critical internal systems, etc. 3.0 Scope This policy applies...

Words: 1336 - Pages: 6

Remote Access Control Policy Definition

...The following are types of Remote Access Control Policy I would like to put into place to make sure our company’s data is secure. We need to get the right security measures so the correct people can have access to the data they need to do their job. I would start by setting up a Remote Authentication Dial-In User Service (RADIUS), a VPN, Firewall, Local Biometrics, RSA – F.O.B. by using a security key carried by the employee or set it up on the local server. I would start in the Main office that is located in Phoenix, AZ by install a RADUIS, this is a client/server protocol that runs in the application layer and will connect all the employee and visitor to the server. In the main office, we need to set up a database with all username and passwords for the employees’. At all the satellite facilities, we need to set up the proper VPN, Firewall protection as well as setting up some type of biometric logon system or a random number generator where a user will be given a security key and they will need to input that when they log on to the system. We need to set up the password system to reset every 3 months and set up a password remembrance. For the mobile devices that the sales department will need, I would suggest to encrypt the local hard drives if stolen and set up biometric thumb scanner as well as a security key require to log on to their systems....

Words: 261 - Pages: 2

Richmam Corporation Remote Access Policy

... equipment for the purpose of split-tunneling or dual homing is not permitted at any time. 7. Frame Relay must meet minimum authentication requirements of DLCI standards. 8. Non-standard hardware configurations must be approved by Remote Access Services, and InfoSec must approve security configurations for access to hardware. 9. All hosts that are connected to Richman internal networks via remote access technologies must use the most up-to-date anti-virus software, this includes personal computers. Third party connections must comply with requirements as stated in the Third Party Agreement and will have limited access. 10. Personal equipment that is used to connect to Richman's networks must meet the requirements of Richman-owned equipment for remote access. 11. Organizations or individuals who wish to implement non-standard Remote Access solutions to the Richman production network must obtain prior approval from Remote Access Services and InfoSec. Enforcement Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. Definitions Term Definition -Cable Modem Cable companies such as AT&T Broadband provide Internet access over Cable TV coaxial cable. A cable modem accepts this coaxial cable and can receive data from the Internet at over 1.5 Mbps. Cable is currently available only in certain communities. -CHAP Challenge Handshake Authentication Protocol is an authentication method...

Words: 1052 - Pages: 5

Remote Access Control Policy

.... This adds to the security of protecting the user, company’s data, and network. In addition to having each user have a unique username and password, the users will be grouped into group policies depending on the type of job or their job title. The group policies will define where the permission assigned to the user or users located in the group policy. Instead of all this we could use Single Sign-On (SSO) for each user. Examples of SSO are Log-in with Facebook and Log-in with Twitter. The advantage of a single sign-on is that it saves lots of time and money. The user does not have to remember the password, which will result in less cost in the IT department for reassigning a new password or resetting the password for the user to create a new one. The setback for having a single sign-on it that it is vulnerable. It lacks the authentication process which a username and password provided adding to the security features in protecting the company’s data and network. If the SSO is hacked then the hacker has access to all the sites and data linked to that SSO meaning the company’s data and network as well. Single sign-on is not useful when there is a multi-user computer or when the user is logged in all the time because other users can access the computer even if the original user has left their workstation. References 1. "Remote Access Policy." Remote Access Policy. Comptechdoc. Web. 7 Nov. 2014.......

Words: 889 - Pages: 4

Nt2580 Remote Access Policies

...NT2580 Week 2 Essay Create a Remote Access Policy Definition NT2580 The requirements for establishing a secure connection between remote locations vary between organizations. The needs of the organization are based on the type of information and data being transferred, as well as the sensitivity of the information. There are several options available to networks to get their data sent securely and reliably. All seven layers of the OSI model must be taken into account when designing secure Remote Access Control Policies. In order to create a secure remote connection between offices in Atlanta, San Francisco, Chicago, and Dallas, a WAN link would be the best type of connection. A dedicated WAN link would offer the organization a secure, reliable, dedicated P2P type of connection. Wide Area Network links would be monitored by the owners of the lines that connect each location. Leased lines from the providers will allow for scalability with potential growth. The downside to this type of connection is the expense and an internet connection is not necessarily provided by the link. In order to add to the security of the network physical and logical access controls are necessary. Logical implementations added to the network will be Acceptable, Email, and Wireless Use policies, Antivirus and firewall software, as well as Extranet, Interconnection, and Host Security. In order to ensure the physical assets, as well as employees, physical security must also be considered...

Words: 704 - Pages: 3

Remote Access

...Purpose This remote access policy is designed to prevent damage to the organizational network or computer systems and to prevent compromise or loss of data. Approval Any remote access using either dial-in, VPN, or any other remote access to the organizational network must be reviewed and approved by the appropriate supervisor. All employees by default will have account settings set to deny remote access. Only upon approval will the account settings be changed to allow remote access. Remote Computer Requirements 1. The anti-virus product is required to be operating on the computer at all times in real time protection mode. 2. The anti-virus library definitions shall be updated at least once per day. 3. Anti-virus scans shall be done a minimum of once per week. No one should be able to stop anti-virus definition updates and anti-virus scans except for domain administrators. 2. The computer must be protected by a firewall at all times when it is connected to the internet. Several popular choices include Zone Alarm, the Windows XP firewall, and Norton Personal firewall. Remote Connection Requirements The remote user shall use either dial-In or virtual private networking (VPN). Dial-In is typically used when the user in in a local calling area. VPN is typically used when the user would need to dial a long distance number to connect with a dial-in connection. VPN uses a local connection to an internet service provider (ISP) and creates a tunnel through the...

Words: 569 - Pages: 3

Remote Access Control Policy Definition

...Remote access security policy involves the policies and conditions that are in place that allow users to connect to servers when out of the network. In the case of Richman industries, they are interested in maintaining connections with their users, and sharing app data that is on a server for their day to day operations. In their case, I would have access policy that is based on Explicit Allow policies. This means that the policy grants “Permission” to access the servers remotely if the connection attempt matches the policy conditions. Some of the requirements would include strict control enforced via one-time password authentication or public keys with strong pass-phrases. Also, anyone trying to gain access must not be connected to any other network at the same time, aside from personal home networks under the user's complete control. Further, employees with access must not use email accounts other than the company's standards, so that personal use won't be confused with business. Users must have approved virus control and spyware protection in place on all devices accessing the company network. Remote access will be limited in certain areas, while at least Applications will be approved for access (Shared application data is an important part of Richman’s network). Systems and system settings will not be accessible from remote, out of network connections, to protect from outside alterations of systems or system settings, and any Data access will be read only, with......

Words: 300 - Pages: 2