Running head: RIORDAN MANUFACTURING PHYSICAL LAYOUT AND NETWORK

Riordan Manufacturing Physical Layout and Network Security Nadja Marava, Russell Elder, Roman Silva, and Logan Pickels
University Of Phoenix
CMGT 441 Introduction to Information Security Management

Jude Bowman
September 3, 2012

Riordan Manufacturing Physical Layout and Network Security
As can be seen on the Intranet Website, Riordan currently operates four manufacturing plants; three located in the United States (San Jose, California; Pontiac, Michigan; and Albany, Georgia) and one overseas (Hang Zhou, China). Each plant contains the same basic departments, to include Sales and Marketing, Operations, Finance and Accounting, Information Technology (IT), Legal, and Human Resources. The problem; however, lies in all four plants Sales and Marketing, Operations, Finance and Accounting, and Human Resources departments, which have outdated and unconsolidated systems.
China Physical Layout
One location is China. The Wide Area Network being used has three T1 connections in the United States and a Satellite connection in China. This paper is used for determining the architecture for the Riordan WAN and then research what possible security measures can be taken to reduce Vulnerabilities.
The Layout is below:
• Ethernet Backbone 1G
• Windows Exchange server Email
• Windows Network server Domain controller
• Unix Server for ERP/MRP Customer and Vendor Relations
• Linksys Wireless Router
• VOIP Satellite Connection
• 35 Dell Optiflex Desktops with windows 2000
• T1 Connection

Immediate recommendations that stick out would be several things such as encryption, firewall, and outdated operating systems. The firewalls could be set up in multiple facets like Stateful Inspection, Application filtering, IP filtering, Protocols filtering and whatever access control setup is decided for the WAN. It would also be a good idea to implement some form of Kerberos or encryption such as AES128 which is compatible with wireless and does not slow down the network. The outdated operating systems are not suited for today’s advanced security provisions in regards to the desktops. The operating systems are Legacy which reduce compatibility and with the Low memory and small hard drives will slow down the network. A network is only as fast as its weakest link and communications and data processing with these machines will hinder bandwidth.
San Jose, CA Physical Layout
The next location is the main headquarters in San Jose, CA.

Immediate recommendations that stick out would be several things such as encryption, firewall, and outdated operating systems. As well CA is lucky not to have any virus attacks from out dated systems or software. The operating systems are functioning fine but since Microsoft has stopped security updates on Windows XP which is a higher system than Windows 2000 you know that they are in trouble. All systems should be updated to windows 7. There still is no hardware firewall which makes the network week and vulnerable to hacking. The firewalls could be set up in multiple facets like Stateful Inspection, Application filtering, IP filtering, Protocols filtering and whatever access control setup is decided for the WAN. There should be network software that helps with network intrusion As well since this location is the main hub it should be the most up to date and the most supported. Without support and proper security protocols things could become a mess.
Data Security Issues/Concerns for San Jose goes for the biggest concern is that there is not much to protect the information on the network from outside hacking or manipulation. The first thing that needs to be done it is setup a firewall next to the T1 Line. A major software issue for data security is the windows 2000 boxes that the network has on this. Windows stopped supporting this many years ago and have not set out updates for this since then. A smart option would be to upgrade the Operating systems to Windows 7 so that the network and data on it are more secure. According to ecampus.phoenizx.edu “Each member of the sales force maintains his/her own set of customer records using a variety of tools. Some sales team members use paper and pencil, others sales management software such as Act, and others a hybrid” This can be another issue since files may not be under lock and key, files on laptops might not have proper security or proper updates. This is a major risk that is being taken. The software package that is used in many locations uses Excel. This does not have any security features and would need to have proper software to protect it on each computer as well as the network. As well as network intrusion software should be implemented. This will guard and monitor the network for any intrusions and allow the IS team to shut down the port that allowed the traffic inside the network. As well it will help protect the data and tell the IS team where the vulnerabilities are so that they can be managed.
Pontiac Physical Layout The network that is being used at Riordan Manufacturing in Pontiac, Michigan, has 45 Compaq desktops all using Windows 98 and MS Office which all are connected with CAT3 cabling for T-1 connection, 3 24 port Patch Panel which are connected to Nortel Baystack 107 10BT 24 port 10mbps hub with bridge module each, and 5 network printers. There are two Proliant Servers used as Windows NT file/print server and Windows NT Exchange Server. There is also an HP UX Server with UNIX – ERP and a RS6000 IBM – AIX with UNIX – MRP II connected to another 24 port hub that links to the manufacturing floor. An APC Back – UPS 500 Clear is also in place for backup power supply.
An issue that this location will be vulnerable to is network attacks, since the 45 computers that are used in this location are setup with Windows 98 and it is no longer supported, the company will have to upgrade its operating system to an OS that will be supported to receive updates. Upgrading this network to Windows 7 Enterprise will allow them to have firewall included with the operating system and it will be supported until January 2020. An eventual upgrade to Cat 5 cabling allowing VOIP and faster connectivity throughout the site and an upgrade to the hardware used within the plant will need upgrading as well.
Internet Access
The current security issues at Riordan Manufacturing plant in Pontiac, Michigan are that the employees using the Internet throughout the company should be authorized to do so only by the company. Computers being used by the employees should have the latest antivirus software that intercepts messages being sent to and from the organization and that they are being scanned for viruses and worms to avoid the vulnerability of information being leaked. Employees should log off the internet and lock their computers when stepping away from their workstations for a long length of time. All third party files need to be reviewed to make sure that they do not contain harmful information to Riordan’s computer systems.
Email and Browsing
An Internet Use Policy should be implemented throughout Riordan Manufacturing explaining what types of access are permitted in the company; that of which addresses the limited use of personal research on the company’s Internet network. The employees should not open emails or attachments within those emails whose recipients are unknown. Program to filter Websites visited should be implemented at Riordan’s plants so that it controls what employees see. GFI Web Monitor is a Web security and Internet usage monitoring software that will improve productivity, reduce security risk, and maximizing bandwidth.

APPENDIX A
Figure 1: Employee and Product Development Diagram

APPENDIX B
Figure 2: Inline Network-Based IDPS Architecture Figure 2: Inline network-based IDPS architecture. Image retrieved January 17, 2011, from Scarfone & Mell, 2007, p. 4-5. APPENDIX C Figure 3: SWOT Analysis Examples

Data Security Issues/Concerns
Data security is data protected from corruption and unauthorized access with the main goal being the safeguard of personal and corporate data through confidentiality. Due to the internet and E-commerce, data security is even more important due to the possibility of hackers, viruses, and malware.
Current Specifications
By examining data security in regards to Riordan, it is apparent that very little exists. Riordan`s data security contains an assortment of random and disorganized systems that contain sensitive data, however none of these systems are linked, nor are any of them current with respect to memory, speed, and processing power. Additionally, employee information such as payroll records, completed training, and incidents involving complaints and harassment, are cataloged using Microsoft Excel, which has no real security measures other than a password protection option.
Recommendations
Due to the lack in data security elements, the following recommendations are suggested: strategy and risk assessment. Overall data security begins with the identification of risks and the strategy on the solution to those risks. This can be accomplished through a Strength Opportunities, and Threats (SWOT) analysis. Strengths and weaknesses are derived from internal factors, such as employees, while opportunities and threats are derived from external factors, such as hackers (Value Based Management, 2011).
China Security Issues and Concerns

The network portion of the WAN set up in China has several features that are a cause for concern more what could be discovered at a granular level. These compone3nts of the Network are critical to fluid communications but also endanger the network as a whole. The areas are:

• ERP/MRP Server
• Satellite Base Station
• Wireless Router The Enterprise Resolution Planning Server Has connections to networks outside that of Riordan so research should be done to find out what types of security are in provision at connecting networks. There are some key areas that should be looked at for ERP such as document exchange and how the data channels are set up. It may be necessary to set up VPN or provide some type of KEY infrastructure with encryption. The companies that are being used as vendors or clients should have some type of Authentication used to control access. The Web services for the company provide a portal into the company so the Web server is also of concern. It should not have the HTML files for the company site stored on it. Also a firewall and a proxy server would be another avenue to pursue for tightening security.
The next subject would be wireless routing which leaves plenty of room for a hacker or some social engineering to take place. Access control can be monitored and established for the network and wireless routers. The Access points may use NAT which will automatically give an address to any device that can provide the necessary authentication to the router so address filtering may be required. A firewall can eliminate unwanted traffic to the router in other ways as well using application filtering and stateful inspection. The SSID broadcasting should be turned off after connections are made to necessary computers and devices to avoid advertizing. The wireless devices should be carefully placed in the building so outsiders with high powered antennas cannot get a signal. The power level on the device can also be turned down for signal strength.
The satellite used in China for connecting to other parts of the WAN and ERP clients and Vendors should be considered a security risk as well. A common way to do this is to set up VPN channels so that an attacker will not be able to easily pick up the signal. Depending on location of the satellite from the ISP provider Kerberos or encryption does not always work well with a satellite connection due to timing delays from speed of light. Lastly whoever possible uses HTTPS rather than HTTP as the S signifies a secure channel. Web Security
The Riordan WAN is connected to the Internet thus creating concern for the Network. The biggest concern is the Web server it self as it acts as an access point over the Internet and some security issues need to be addressed. There are different aspects to having a Web server connected to the internet because users or really anybody can gain access to the interface just by typing in the URL.
The first consideration is to make sure that we have a good backup of the Website itself (Whitney, 2012). In case of contamination as it takes time and skill to build a good Website and it is an asset to the company that needs protecting. At the basic level of protection our administrators are required to use a 10 character password with one number and a punctuation character. The password is only shared with the company CEO and the Website administrator. It is also required to change password annually or in the event that CEO or administrator jobs change. Riordan also employs the best practices for Internet Explorer and uses the No script add-on with Firefox depending on what browser it is loaded to the host provider.
Also because we use a windows system Riordan has to keep the latest security patches uploaded for the Web connection. The permission settings open the Server are strong as nobody besides the Web administrator has the write permissions for changing the site except the company CEO. Some other factors for Riordan is SSH are enabled for remote administration so it is possible for IT staff to have more mobility. Secure Shell SSH allows Command prompt to be used from remote locations. Web servers also have a logging file so if anyone ever has logged in wrongfully, the suspicious IP addresses can be found and blocked. It should also be considered that database connections are password protected so password strength and a strong policy of changing and keeping strong passwords be implemented.
Riordan has less Web security concerns than other business operators, mainly because of the lack of an online store. However, having strong Web uptime can effectively increase Web created orders or the use of contact information. In moving forward, Riordan would like an online order entry for its customers. This has to be secure at all times and customer information must be protected from Denial of Service (DOS) attacks or potential threats to the customer database. Currently, the Georgia plant is running a Web server at its location. The Web server is running internally with default rules and no firewall. From an investigation standpoint, the Web server has been set up by different people without continuity to content or security. If a client needs to contact a manufacturing facility, a simple text form allows the client to setup communications. Other contact information is listed on the individual Websites from phone numbers to mailing addresses.
Riordan must consolidate its Web services into a single location. Once consolidated, the Web server will be hosted on an external proxy server. This proxy server allows incoming traffic, but cannot talk to the Intranet itself. This one-way communication will help keep Riordan data assets secure. Additional suggestions for Riordan’s Web upgrades include implementation of a customer database, the Total Defense Security Suite, an Identity Protection and Verification Suite, and a Secure Socket Layer (SSL) certificate.
Moving forward, Riordan should design and setup a customer sign-on and order portion to their Website. The customers will create account information which will include shipping and payment information for order expediting. This information will be stored on the proxy until a Structured Query Language (SQL) job runs and pulls the information to an Intranet source. This will allow Riordan customers to contact, setup accounts, or place orders from the Website while maintaining internal security.
The Cisco ASA solution is the reasonable choice, but should also be combined with the IDPS to expand Riordan’s Web security further by identifying and stopping possible security breaches automatically. Computer Associates’ (CA) Total Defense Security (TDS) suite offers an assortment of Web security features for corporations by combining the finest in anti-virus, anti-spyware, access security, and intrusion/prevention systems that “enable detection, analysis, blocking, and removal of blended threats to minimize risk and confidentiality breaches, reduce system downtime and decrease lost productivity” (CA Technologies, 2010).
A durable user verification technique is needed for all Web-based applications due to data that is stored and can be accessed by employees and customers. Because of this, tokens and appliances that offer two-factor confirmation are recommended. The Identity Protection and Verification (IPV) suite offered by Rivest, Shamir, and Adleman (RSA) provides the additional level needed, as well as the means to manage a large risk factor by “reducing fraud losses and related costs, increasing adoption of online channel usage, and inspiring user confidence” (RSA, 2011).
In order to make sure that Riordan’s Website is secure and dependable, a Secure Socket Layer (SSL) certificate is needed. This will inform the user that not only is the Website trustable, but that Riordan cares about the protection of their information. Additionally, data that is transmitted between the user and Riordan will be safeguarded with the use of an SSL certificate due to its ability to code data movement. There are many vendors to choose from (GoDaddy, Comodo, and VeriSign); however, it is important that whichever one is chosen, proper installation, consistent updates, and vendor trustworthiness be among the major factors in determining which vendor to use. Riordan has been privileged not to have had any breaches in security, virus attacks, or network outages; however, the probability that such actions will occur in the near future is high if the recommendations mentioned above are not taken, or at a minimum, are not considered. The effect on client and employee accounts, as well as the cost for reparations would be substantial, even if just one of the above listed actions occurred. Enhancing the inefficiencies and decreasing risk will not only streamline day-to-day functions and minimize reporting response times, but will also provide continuing advantages to Riordan management, its employees, and investors.

References
Bott, E. (2010). How long will Microsoft support XP, Vista, and Windows 7? Retrieved August 20, 2012 from http://www.zdnet.com/blog/bott/how-long-will-microsoft-support-xp-vista-and-windows-7/2304
GFI WebMonitor Retrieved August 27, 2012 from http://www.gfi.com/internet-monitoring-software/internet-usage-policy Image retrieved January 17, 2011, from Scarfone & Mell, 2007, p. 4-5.CA Technologies (2010). CA Total Defense Product. Retrieved January 24, 2011, from http://home3.ca.com/partnerportal/business/BusinessProducts/totaldefense.aspx.
Riordan Manufacturing Intranet Information Technology Retrieved August 13, 2012 from https://ecampus.phoenix.edu/secure/aapd/cist/vop/Business/Riordan/IT/Networks.asp?pontiac
RSA (2011). RSA Identity Protection and Verification Suite: Protect Against Online Fraud. Retrieved January 25, 2011, from http://www.rsa.com/node.aspx?id=3017.
She, W., & Thuraisingham, B. (2007). Security for Enterprise Resolution Planning Systems. , (). Value Based Management (2011). SWOT Analysis. Retrieved January 20, 2011 from http://www.valuebasedmanagement.net/methods_swot_analysis.html.
Whitney, S. (2012). 25 years of programming. Retrieved from http://25 years of programming.com