...Leonardo Journal of Sciences ISSN 1583-0233 Issue 13, July-December 2008 p. 7-21 Network Security: Policies and Guidelines for Effective Network Management Jonathan Gana KOLO, Umar Suleiman DAUDA Department of Electrical and Computer Engineering, Federal University of Technology, Minna, Nigeria. jgkolo@gmail.com, usdauda@gmail.com Abstract Network security and management in Information and Communication Technology (ICT) is the ability to maintain the integrity of a system or network, its data and its immediate environment. The various innovations and uses to which networks are being put are growing by the day and hence are becoming complex and invariably more difficult to manage by the day. Computers are found in every business such as banking, insurance, hospital, education, manufacturing, etc. The widespread use of these systems implies crime and insecurity on a global scale. In addition, the tremendous benefits brought about by Internet have also widened the scope of crime and insecurity at an alarming rate. Also, ICT has fast become a primary differentiator for institution/organization leaders as it offers effective and convenient means of interaction with each other across the globe. This upsurge in the population of organizations depending on ICT for business transaction has brought with it a growing number of security threats and attacks on poorly managed and secured networks primarily to steal personal data, particularly financial information and password...
Words: 3892 - Pages: 16
...Riordan Manufacturing uses a Wide Area Network (WAN) that allow the three locations to be connected to the corporate headquarters in San Jose, California. Along with the Wide Area Network to connect the locations to the Corporate Headquarters of Riordan Manufacturing, each location has its own Local Area Network (LAN). Network Architecture. The topology of the networks varies from site to site. The network of the Corporate Headquarters and the location in China both use a bus topology in both networks there is a single 100BaseT line that is either connected to a server or an interface device. The other two site Albany, Georgia and Pontiac, Michigan both use what seems to be a partial mesh topology or a hybrid topology. The servers on these networks are all connected together , the interface devices are connected to the server, and the clients and printers are then connected to only the interface devices. All of the locations have their own local area network which is connected to the Corporate Headquarter though a point to point connection which is a star topology. The China location has a point to point connection with the use of a satellite. . The networks of Riordan Manufacturing are all connected to the internet by VoIP/Data routers. _______ Communication Protocols Communication protocols are primarily standards for the process of transferring, sending, and receiving data and information. Without the use of communication protocol there will not be the possibility...
Words: 2198 - Pages: 9
...competitors in the business-to-consumer segment, the company was able to survive by streamlining and focusing its business to achieve profitability. In January 2007, iPremier experienced a denial of service ("DoS") attack, which prevented access to the website and the internal web server. It was unclear at the time whether this was a DoS attack, or something deliberate. Though the attack appeared to be harmless in the end, the incident brought to light the fact that iPremier was ill-equipped to deal with breaches of network security. The incident highlighted three major shortcomings of the company's existing network security infrastructure: (1) a third party was responsible for the company's internal network security, (2) iPremier's information technology was outdated, and (3) iPremier's standards and procedures for dealing with security issues were out-of-date and poorly defined. Information security is necessary for protecting valuable information. Inadequate security could lead to a loss in confidence from shareholders and from customers all impacting future profits. Companies that collect financial information have a higher incentive to protect this information because of...
Words: 2896 - Pages: 12
...For the integrative network design project, we were to choose from the virtual organizations given on how to upgrade their networks to meet their specific needs. The virtual organization that has been chosen to look at is Kudler Fine Foods, who wanted a Wan to tie all three locations together, to make the internal network configuration in each store a WAN, add VOIP to the multi-store network, figure out which store will house the central servers, and make sure the network is expandable beyond the existing stores. We will be giving a final network design. Specifically in the final network design, we are going to give a timeline for the project, explain the design approach and rationale, analyze the detailed design, prove the design meets the requirements set by Kudler Fine Foods, analyze the current security situation, identify electronic and physical threats to the network, describe potential threat detections and protection techniques, explain the importance of explicit enterprise security policies and procedures, describe how firewalls mitigate some network attack scenarios, describe common security concerns inherent to wired, wireless, and mobile network and design a security hardware and software environment that will protect the organization. The first area we will look at is the design of the new network. The new network will have an overall network architecture of a star network in a WAN or wide area network. Both of these network architecture allow for easy expansion...
Words: 1975 - Pages: 8
...IT Audit Seminar organized by National Audit Office, China 1 to 4 September 2004 Paper on “Formulation of IT Auditing Standards” By -- Ms.Puja S Mandol and Ms. Monika Verma Supreme Audit Institution of India Introduction The use of computers and computer based information systems have pervaded deep and wide in every modern day organization. An organization must exercise control over these computer based information systems because the cost of errors and irregularities that may arise in these systems can be high and can even challenge the very existence of the organization. An organizations ability to survive can be severely undermined through corruption or destruction of its database; decision making errors caused by poor-quality information systems; losses incurred through computer abuses; loss of computer assets and their control on how the computers are used within the organization. Therefore managements across the world have deployed specialized auditors to audit their information systems to find out gaps between declared policies and actual use and shortcomings in the information system design and usage. Information Systems Audit is the process of collecting and evaluating evidence to determine whether a computer system has been designed to maintain data integrity, safeguard assets, allows organizational goals to be achieved effectively and uses the resources efficiently. The IS Auditor should see that not only adequate internal controls exist...
Words: 6839 - Pages: 28
...rotation, the Regiment communications Soldiers conducted over 9 field exercises to configure and optimize the Regiment’s communication Equipment. The RS6 focused on establishing and maintaining the network components and refining the TTPs and the SOPs for the NETOPS. The S6 attended JMRC planning events * CPX. (D1-D6) The S6 coordinated and worked with the HICON to establish interoperability to ensure the data flow passed both ways. Due to challenges on HICONs part, the Regiment was unable to establish the digital COP they had developed prior to the Rotation. * Force-on-force. Offence (X1- X6). The S6 faced challenges of integrating staff cells that had not participated in previous exercises. Based on the commander’s intent for analog communications and battle tracking, the S6 faced many challenges with the terrain in the MRA. By tasking his RTNS units to be TACON to the Maneuver Squadrons, the S6 had a hard time refining the RTNS teams and adjusting their locations for optimal comms. Significant challenges for jumping the Regimental TOC were identified and captured in SOPs and Battle drills. * Defense (X8-X11) During the defense the S6 planned optimal RTNS locations, established 3 RTNS, and maintained control of the RTNS. Again the MRA terrain challenged the FM communication between the maneuver Squadrons and RTOC, however met the CDRs intent by providing FM Comms to the TAC. During the Defense the Regiment came under Network Degradation and Cyber...
Words: 1488 - Pages: 6
...State of North Carolina Statewide Information Security Manual Prepared by the Enterprise Security and Risk Management Office Publication Date: April 20, 2012 INTRODUCTION FOR STATEWIDE INFORMATION SECURITY MANUAL ...... 1 GUIDANCE FOR AGENCIES .............................................................................. 1 CHAPTER 1 – CLASSIFYING INFORMATION AND DATA ................................ 2 CHAPTER 2 – CONTROLLING ACCESS TO INFORMATION AND SYSTEMS. 7 CHAPTER 3 – PROCESSING INFORMATION AND DOCUMENTS ................. 32 CHAPTER 4 – PURCHASING AND MAINTAINING COMMERCIAL SOFTWARE ..................................................................................................... 107 CHAPTER 5 – SECURING HARDWARE, PERIPHERALS AND OTHER EQUIPMENT .................................................................................................... 122 CHAPTER 6 – COMBATING CYBER CRIME ................................................. 146 CHAPTER 7 – CONTROLLING E-COMMERCE INFORMATION SECURITY 153 CHAPTER 9 – DEALING WITH PREMISES RELATED CONSIDERATIONS . 173 CHAPTER 10 – ADDRESSING PERSONNEL ISSUES RELATING TO SECURITY ........................................................................................................ 185 CHAPTER 11 – DELIVERING TRAINING AND STAFF AWARENESS .......... 192 CHAPTER 12 – COMPLYING WITH LEGAL AND POLICY REQUIREMENTS ......................................................................................................................
Words: 65255 - Pages: 262
...Subject: Management Information Systems Assignment: Security Poli Cooney Hardware Ltd Security Policy Table Of Contents * Introduction * Purpose * Why do we need a Security Policy * What is a Security Policy * Building Issues * IT Policy * Risk Analysis (Identifying The Assets) * Risk Management(Identifying The Threats) * Personal Security * Health And Safety * Auditing * Security Threats * Network Policy * Delivery Of Goods * Conclusion * Introduction Information Security has come to play an extremely vital role in today’s fast moving but invariably technically fragile business environment. Consequently, secured communications and business are needed in order for both Cooney Hardware Ltd. and our customers to benefit from the advancements the internet has given us. The importance of this fact needs to be clearly highlighted, not only to enhance the company’s daily business procedures and transactions, but also to ensure that the much needed security measures are implemented with an acceptable level of security. It’s sad to see that the possibility of having our data exposed to a malicious attacker is constantly increasing everyday due to the high number of ‘security illiterate’ staff also having access to sensitive and sometime even secret business information. * Purpose The purpose of this policy is to secure and protect the assets owned by Cooney Hardware Ltd, one of the biggest hardware...
Words: 2252 - Pages: 10
...Cellular Debate Name Course Date Tutor Network Security Issues on Cellular Network One major advantage of Cellular network security is the ability of communication to be done “Wirelessly” (Xiao et al, 2007). This means that the signals do not follow a specific assigned signal path which may be destroyed by vandals or even by nature, as in case of copper conductors or other physical media such as fiber optic. In addition, data security is enhanced by used of packed switched data in which data is send in form of packets and at no particular order only to be reconstructed at the receiver which makes intercepting such messages cumbersome. In addition, user authentication allows only specific users registered to a specific cellular service provider to use their resources thus allow proper billing to be charged according to the usage of the network(Xiao et al, 2007). A security issue that arises from the use of the cellular networks is subscriber authentication. These systems consist of a large number of subscribers who need to be identified and verified before they can enjoy the services offered by the provider. If authentication is not properly done, then the network is vulnerable to misuse by subscribers not entitled to use the network leading to the service provider incurring losses. Confidentiality is another security issue that can be noted in cellular network (Ciampa, 2009). This is because the ‘air’ channel can be intercepted by malicious people and...
Words: 785 - Pages: 4
...Management Services, Part 1 CIS 505 Communication Technologies Professor’s name May 5, 2013 Analyze the security mechanisms needed to protect the DMS systems from both state employees and users accessing over the internet: Department of Management Services (DMS) has chosen to expand their applications and services via TCP/IP and Internet access. DMS uses a widely used proprietary scheme: IBM’s Systems Network Architecture (SNA) which provides support for TCP/IP (Transmission Control Protocol/Internet Protocol). SNA architecture is projected to remain important for some years to come. Implementing standardized protocol architectures allow DMS ongoing communication with suppliers, vendors, customers, and employees across the state, thereby improving overall productivity. Two protocols architectures have served as the basis for the development of interoperable protocol standards: the TCP/IP protocol suite and the OSI (Open Systems Interconnection) reference model which organizes the communication task in relatively five independent layers: Application layer, Host–to-host, or transport layer, Internet layer, Network access layer, and physical layer as each layer provides a portion of the total communications function required for distributed applications. (Stallings, 2009). Furthermore, TCP/IP operates in a packet-switched format as it seeks to transmit in the most efficient manner at high rates of speed. The packet-switching network and its interfaces can buffer backed-up...
Words: 1800 - Pages: 8
...Unit-4 (ICS -305) Information security Information security (ISec) describes activities that relate to the protection of information and information infrastructure assets against the risks of loss, misuse, disclosure or damage. Standards that are available to assist organizations implement the appropriate programs and controls to mitigate these risks are for example BS7799/ISO 17799, Information Technology Infrastructure Library and COBIT. Information security management (ISM) describes controls that an organization needs to implement to ensure that it is sensibly managing these risks. Security Challenges The risks to these assets can be calculated by analysis of the following issues: Threats to your assets. These are unwanted events that could cause the intentional or accidental loss, damage or misuse of the assets Vulnerabilities. How vulnerable (prone or weak) your assets are to attack Impact. The magnitude of the potential loss or the seriousness of the event. Security services Information Security Governance, Information Security Governance or ISG, is a subset discipline of Corporate Governance focused on information Security systems and their performance and risk management. Establish and maintain a framework to provide assurance that information security strategies are aligned with business objectives and consistent with applicable laws and regulations Develop the information security strategy in support of business strategy and...
Words: 1808 - Pages: 8
...Huffman Trucking Service Request SR-ht-010 NTC/361 Huffman Trucking Service Request SR-ht-010 Huffman Trucking is a national transportation company that provides carrier services for various vendors, including the United States Government. At present the company has a main office in Cleveland Ohio and hubs located in California, Missouri, and New Jersey (Apollo Group, Inc., 2012) . The ability to remain competitive relies on capable employees and efficient systems that operate at full capacity. The company is in the midst of developing the yearly budget and is examining all of the current systems in place. The Chief Information Officer (CIO) has requested a full review of all the current telephone and data network systems in all locations. Along with the review, recommendations for changes are also required. This document will outline Huffman Trucking’s systems and identify areas for improvement to maintain the company’s high level of service. Telephone Systems Looking at the current systems in the four plants and offices one can see that all four of the offices and plants have different telecommunication systems. Huffman Trucking has locations in four states with offices and plants located in California, Missouri, New Jersey, and Ohio. Many of the locations are using wiring that is not adequate for the system to have the capabilities to function in a business capacity. The California and New Jersey locations use a plain old telephone system (POTS), Private Branch Exchange...
Words: 3605 - Pages: 15
...INDP Final Kudler Fine Foods Network Design Project NTC 362 March 17, 2014 Introduction This paper will present the Final Integrative Network Design outlining the cumulative plan that Kudler Fine Foods has accepted and agreed on for implementation of the following: Final Network Design The integrative network design project for Kudler Fine Foods will include Transmission Control Protocol/ Internet Protocol (TCP/IP) will be used as a means of communication within a private network or the internet for Kudler Fine Foods network devices. Hypertext Transfer Protocol (HTTP) is used for transfer of multimedia files, video, sound, and text over the internet. Kudler Fine Foods will implement File Transfer Protocol (FTP) to download files, transfer files, delete files, copy and rename files from the internet as needed. Mesh Protocol will be used to connect all devices such as printers, computers, and scanners on the network. In a true mesh topology every node has a connection to every other node in the network ("Common Physical Network Topologies ", 2014). The network will consist of a hardware firewall blocking unwanted access from outside of the location. The next step is to set up a hub or switch that will connect all of the stores terminals. All of these terminals such as registers and remote locations such as warehouse will be hardwired with twisted pair CAT 5 Ethernet cable. The server will be located in a room in each store with the hub or switch. A wireless...
Words: 4817 - Pages: 20
...Information Security for Managers Submitted By: Student Number: Submitted Date: January 22, 2009 Table of Contents 1. Information Security Policy (Word Count = approx. 1000) 3 1.1 Security: 3 1.2 Policy: 3 1.3 Information Security Policy and its importance: 4 1.4 Policies, Procedures, Practices, Guidelines 5 1.5 Example of good policy statement 6 1.6 Possible structure of information security policy documents 7 1.7 Strategies and techniques to implement information security policies 8 2. Developing the Security Program(Word Count = approx. 500) 9 3. Security Management Models and Practices (Word Count = approx. 500) 11 A. ISO/IEC Model 11 B. NIST Security Model 11 C. RFC 2196 11 D. COBIT 11 E. COSO 12 4. List of References: 13 1. Information Security Policy 1.1 Security: Security has been a real issue for this century. Due to the new emerging technology like RFID and wireless devices there have been various issues regarding privacy and security of person and an enterprise. Security can be understood as a condition to protect against unauthorized access. In terms of IT, security can be categorized into application security, computing security, data security, information security, and network security. Source: (Whitman & Mattord 2007, p.5) Even though all of these security fields need to be monitored in an enterprise, for instance in this document we are concerned only with information security. Information security is responsible...
Words: 2401 - Pages: 10
...[pic] Defense Security Service Electronic Communications Plan Sample Date: 02/01/2012 Company: |XYZ, Inc. | Address: |12345 West Broad Way, New York, NY. 54321 | Cage Code: |89PGK | ODAA Unique Identifier: |89PGK-20111119-00009-00019 | Table of Contents 1. INTRODUCTION 5 2. PURPOSE 5 3. ROLES/PERSONNEL SECURITY 6 4. DETAILED SYSTEM DESCRIPTION/TECHNICAL OVERVIEW 8 5. IDENTIFICATION AND AUTHENTICATION POLICY AND PROCEDURES 9 5.1 USER IDENTIFICATION AND AUTHENTICATION 9 5.2 DEVICE IDENTIFICATION AND AUTHENTICATION 10 5.3 IDENTIFIER MANAGEMENT 10 5.4 AUTHENTICATOR MANAGEMENT 10 5.5 ACCESS CONTROL POLICY AND PROCEDURES 11 5.7 ACCESS ENFORCEMENT 12 5.8 INFORMATION FLOW ENFORCEMENT 13 5.9 SEPARATION OF DUTIES 13 5.10 LEAST PRIVILEGE 14 5.11 UNSUCCESSFUL LOGIN ATTEMPTS 14 5.12 SYSTEM USE NOTIFICATION 14 5.13 SESSION LOCK 15 5.15 SUPERVISION AND REVIEW — ACCESS CONTROL 16 ...
Words: 19387 - Pages: 78
