Title: MSAT Example
Course: IN 2005 Digital Forensics > Section: Module 12: Chapter 12 -E-mail Investigations

Name

Date

IN 2003 MSAT Risk Assessment Project

This is a network design of "ALL IS FUN" company, Wichita KS, USA.

This facility diagram consists of a 5,000SF building, which has a main entry in front, a main exit in the back, and 6 emergency exits.

This facility will have cameras on all the entry and exit points.  All employees are required to have a badge to enter the building with a 5 digit security code.  And this badge also allows employees to log in work hours.

Now, to begin, we must document all the hardware and software and assets for this "ALL IS FUN" company.

Each Hardware Tag includes:

Hardware (CPU, Monitor, Printer, Keyboard, Mouse)

Hardware Size

RAM & CPU Capacity:

Model:

Purchased date:

Serial Number:

Date:

Purchased Cost:

Each software purchased will need to have the following:

Date of purchase:

Company support number:

Price:

License Number:

Other assets:

UPS

Back-up generators:

Batteries:

Fans:

Tools:

Since we have the Cisco Switch's function of VLAN. We can assign the

Accounting/Payroll to VLAN 10

Research/Development to VLAN 20

Sales/Marketing to VLAN 30

Office Staff to VLAN 40

Management to VLAN 50

Customer Support to VLAN 60

Technology Support to VLAN 70

if in the future the company grows we still have enough space for more.

Now, this is how the company will manage internal network and a connection to the outside world via the Full T-1 Internet connection

All employees are required to have a password on all systems of the company.

IT staff will make sure that passwords are enforced according to company's policy.

We'll have internal trusted network switches and routers for the LAN network.

The Payroll server will be placed within the trusted network.

Then we'll create a DMZ. The DMZ’s purpose is to allow Internet users coming in without compromising the internal network.

It has 2 features:    1. It has a different network ID from the internal network

2. It is separated from both the Internet and the internal network by a firewall (1)

We can use a "three legged firewall" which has 3 interfaces, one for the external interface facing the public, one facing the internal network. Below is an illustration of a three legged firewall.

Now we have our network set-up.  We need to make sure that the security measures are intact and work and that the network is secured.  Besides having firewalls we could also use Host Intrusion Prevention agents (McAfee HIP) for each workstation and systems.

Risk Assessment of “ALL IS FUN” company:

We need to identify what is most important in our company, so that we can give it the highest level of protection.  We do this by using risk management, “risk management is the process used by managers, auditors, and other professionals to identify vulnerabilities in an organization’s information systems and to assure the confidentiality, integrity, and availability of all the components in the organization’s information systems” (Whitman 306).

1. Intellectual property.

2. Servers

3. Workstations

4. Physical Property

Intellectual properties of the “ALL IS FUN” company must be top priority.  And to protect this asset, it has to be on an off-line and off the network system, and it will have password protection and anyone need to access this jewel will need the CEO’s approval.

And the intellectual properties will have at least one back-up to it.

The next item on the list are the servers, they are the money maker and the backbone of the company.  There will be firewalls, IDPS and physically locked down.  Again, all the critical servers will have back-up servers in case such services fail.  The cost of extra routers, firewalls, and back-up servers are less compared to the actual loss of availability, integrity and profits of these systems.

Breakdown of our servers:

Web server $10,000/hr   ---  back-up web server costs $3,000

Denial of service attacks and malware $5,000 or more --- IDPS costs $4,000/yr

Also, we’d also use our own DNS server so that spoofing is minimized.  “The DNS translates the hierarchical, human-readable names into the four-number IP addresses”. (Snyder p. 120).  All employees are required to use strong passwords, with a smart card to log on to the network.

In the physical property, we can pull the crime statistics and see that the area is safe and that intrusion, vandalisms and theft is unlikely due to having alarms, locks and cameras.  So there shouldn’t be any guard posted 24/7 because this ALL IS FUN company work 24 hours anyways.

In case of tornadoes, there is a basement fully equipped with running critical systems. For fire, there is insurance policy. As stated in this website, “another option is to transfer the potential loss associated with a threat to another party. Insurance policies can be taken out insuring the asset, so that if any loss occurs the company can be reimbursed through the policy.” (Windowsecurity3). There would be fire alarms, fire extinguishers and backup generator and UPS for the critical systems.

Finally, there is an annual network assessment and vulnerability assessment conducted by the head of the IT department to make sure that company data, firewalls, IPS, routers, servers are up-to-date and harden against malicious attacks.  And besides all these measures, I’d recommend frequent training on all employees.

Sources:

1. Articles at Techrepublic
2. Whitman, Michael and Mattord, Herbert.  Management of Information Security, Second Edition, 2008.
3. Risk Assessment and Threat Identification
4. Network Risk Assessment
5. Snyder, Lawrence.  Fluency4 with information technology. 4^th Edition.  2008.