Introduction to Firewalls
Firewalls are devices, systems or component collection that regulate and manage the flow of data between various networks that vary with the various trust levels through denying, permitting or proxying data. These firewalls can be placed as a barrier in between the external and internal entrusted networks that include the internet and they can also be implemented in creating different subnets in the network of the organization. Firewalls have the function of allowing or blocking traffic that is categorized as dynamic or static. Static procedures involve pre-configuration whereas dynamic involves coordinated automation between the system’s intrusion detection and the firewall itself (Theo, 2016). Also, the outgoing and incoming traffic rules, changes in the firewall configuration and the continuing management need to cover the following rules (Robert & Gabi, 2016);
- State the type of firewall, architecture and its topology.
- Should have functional requirements such as baseline configurations, authentication details, and access controls.
- List of ports and services required.
- Maintenance and management.
- Traffic monitoring.
- Procedures that can address request to bypassing the firewall for particular protocols.
This involves a control mechanism that disallows or allow access depending on the analysis of traffic data. Event in the network is monitored, analyzed for the possibility of unauthorized access or any imminent threats leading to violation of policy (Raymond, 2016). Such actions can be done by firewall reconfiguration or adjusting changes environment’s security. The systems of intrusion detection need to be placed at various locations with paths of entry to private networks. Any host-based method of intrusion detection should be on any system that is sensitive. Administrators need to regularly analyze its logs and the features of the intrusion detection systems regularly updated (Timothy, 2016).
Penetration testing involves evaluation of the system security, database or network by attack simulation by any malicious users. Potential vulnerabilities can, therefore, be determined which could be resulting from technical flaws, improper configuration or process, and operational weaknesses. These issues then need to be assessed with a remedial plan being developed afterward. Test planning should include the procedure and scope in the given context depending on various test objectives whose results may include (Kuinam & Nikolai, 2016);
- Strategic and long-term recommendation.
- Tactical and short-term recommendations.
- Improvement of security data action plan.
- The result of the test to the risk terms of the organization.
- System and data vulnerability technical report.
The frequency of the testing needs to be determined when changes are implemented or from the risk analysis (Todd, 2016).
- Patches and antivirus
Workstations and servers should have antivirus software configuration that is automatically updated at least daily. Persistent protection should also involve a complete scan of the system regularly. The workstations in the organization should be prevented from disabling the local antivirus updating or the software. In case of a virus infection, the organization needs to have an automated cleaning ability. The cleaning process may include; isolation of the area of infection, the attempt of manual virus removal or complete reconfiguration or reinstallation. The configuration needs to be done on all operating software in the organization with latest patches and antivirus upgrades automatically received. Central files of configuration with identical policy groups are the ones used in configuring (Denny, 2012).
- Minimization and Isolation
Roles of Firewalls in Network Protection
Restricting the system of the host to separate host leads to limited compromise to any service or system in the organization with limiting any critical impacts. A defense-in-depth strategy of protection would ensure consideration of system data partitioning into various environments or domains. Connection facilitation occurs by the management of interfaces with appropriate protection of boundaries in devices using effective architecture. Generally, users operating in various security zones need to be isolated, controlled and monitored at internal and external boundaries but in an interconnected way. Minimization helps in protocol, service or software configuration by disabling or uninstalling to remove possible threats (Jean, 2016).
- Physical Measures
For one to access data in the organization, the access needs to be controlled by processes that ensure the user rights are documented and defined in the job and needs requirement before the access (The, 2016). These persons need to have a unique identification with job requirement having assigned access privileges.
- Access Provisioning.
The company needs to be effective in processing the identification of users and have records, approval and administrator access. Any new access to the system has to be approved and processed before provision of access (Rao, 2015). Assignment of these user rights is to be established from the role of the employee or the membership group with management being done by the authorized pre-established group members. Contractors or vendors are also provided access considering the relationship they have with the organization (Hans, Jule, André, & Kees,, 2016). Access approval is configured by system administrators or data custodians. When the user leaves or is terminated, the privileged access should be revoked accordingly (Sean-Philip, 2016).
This is the identity verification using a database or system based on presented credentials to the respective system. Authentication leads to confidential data storage and access to accountable actions recorded on the system with the use of the unique user identities. Primary authentication methods include the use of passwords while other methods can be employed are biometrics or token mechanism. The need for such an approach is used after conducting a risk assessment to system access. There need to be proper practices that are to be adhered to during access. Such practices include (Tanya & Virginia, 2016);
- Adhering to any complex requirement for access.
- Avoidance of usage of identical authenticating methods for different organization levels.
- Prohibited sharing of authentication identification.
- Prohibited reuse of method of authentication for numerous generations.
- An easy method of changing the authentication method at any time.
- Clear stipulated guidance in handling compromised or lost authentication identities.
Any access accounts should also have the ability to log out after a stipulated inactive time after logging in. another measure is to implement locking out an account once numerous unsuccessful logging in occurring. Securing an assigned entry entail restricting the level of security to a high level. This can be done by ensuring strong identification entries. Also, one could use the various mechanism of authentication that can increase the security level. Assigned entry credentials need to have protection from unauthorized personnel or modification. The installed administrative accounts are not to be implemented in performing end-user functions. All documents and files that are having any authentication information must have encryption (David, David, & Bryan, 2016).
- Entitlement reviews.
Intrusion Detection Systems and Penetration Testing
Entitlement reviews are a periodic assessment of the actual privileges of entitlement with systems and data ensuring access to some information is limited and proper with respect to assigned personnel job description. Reviews should also determine if all accounts are activated and analyze and read the state of the management authority to determine if it is current. Such security reviews have to be performed regularly, with the frequency being determined by the assessment risk information. If a change in any user status is changed, a review has to be performed such as transfer of an individual or reassignment to a different business level (Eric, 2017).
- Physical Access
Safeguards concerning procedures and policies limit the physical access to any sensitive documents equipment or facilities from any unauthorized intrusion. The safeguard also protects the organization from environmental and natural hazards. The security risks involved in physical risks are mitigated by means of zone-orientation whereby information having sensitive data can only be accessed via the specific zones. Each zone has to have the requirements warranting high-security levels, this being assessed by risk assessment methods. Procedures required during access that are visitor controls which include visitor badges, authorized personnel escorts, and access login. in cases that involve access to sensitive data, there need to be present physical safeguards at all times. Some other physical safeguards are to be applied to the power supply. Fire suppression systems need to be in place that can detect and suppress systems and devices which have automatic activation if a fire occurs. The organization should have protection from water damage to ensure that master valves are working properly and are known.
- Administrative Measures
For security purposes, the administrators need to apply active monitoring and activity logging. This will help in assessing the policy compliance, identification of intrusion. Together with breaches and facilitating support of the effective program. The intensity of conducting the active monitoring and activity monitoring would henceforth increase with the increase in sensitive data.
- Activity monitoring.
Databases and systems should monitor and log user activity that is being performed. The audit level and scope of logging together with analysis depend on the risk and sensitivity that is associated with particular system or data and needs to be expanded so as to accommodate any increase in risk to assets once indicated. The capture of logs and processing of events in the entry logs having information that includes times of log off and log on, the individuals using or having access to data that is sensitive, change or access in occurrences having their time and date stamps, and any failure or succession in indicating security issues. Not only does the administration analyze and review, some loggings can have the ability to develop profile statistics of the individuals using their accounts continuously so as to predetermine any future anomalous activity.
- Base logging
Antivirus and Malware Protection
Administrators need to have the ability to implement some baseline logging level in every system of the organization and its database activity. A Higher level of baseline control should, therefore, be implemented in the security of the administration. Such levels of security need to include activities involving the high risk that are privileged accounts together with the behavior of administrative-level, access to any sensitive data storage directly, privilege escalation, noting failed attempts in logging in and failed operation of the database. There also need to be an automated system that can alert the administration of any unusual personnel activities that might compromise the security of the organization. All the sensitive databases and systems have to be checked regularly so that the logging function of the system is in proper operation and sticks to the intended standards.
- Centralized management.
In order for one to be able to conduct analysis and review of the company logs, get a copy of the information audit from the many devices, databases, and systems in use, there has to be a central log management. This management can hence make an aggregate, provide reports, normalize and provide queries. This is possible due to the availability of all the log entries in a single place. Such centralized logging enables great facilitation of correlating events.
- Storage
The policies in the organization storage system should be defined. Defining the storage policy manage overwriting or maintenance of any logging event. Such capability allows subsequent investigation of data in case of any incident involving security. There will be sufficient auditing of the storage capacity of records allowing audit configuration reducing the likelihood of exceeding storage capacity (Jean, 2016). Storage management also will ensure prevention of overwriting logging information with retention of audit logs for required consistent periods of time in the organization. There will also be a legal recording of retention policies with regulatory. Adding to the capability of secure storage is the ability to retain logs that can facilitate analysis of older entries in logs. This will be crucial in determining the previous situation concerning security that could be similar to an occurring situation (Denny, 2012).
- Counter Measures.
There may occur incidences of a security breach due to individuals who may be there to financially gain or due to compromise of these organization employees. The security breaches include;
- Compromised security in the organization can be due to sabotage that is done by persons who may be a current employee or a former employee with the intention of misusing or exceeding the level of authorization access to harm specific group, organization or individual. They are motivated by revenge or negative occurrence of events such as contract termination or salary dissatisfaction(Timothy, 2016).
- Fraudsters are those individuals with intentions of deceiving the organization to gain something. Mostly such behavior is fueled by the need for additional salary or returning previous payment from a different party.
- Compromise coming from negligence or carelessness. Security breaches that come from such instances are possible due to the existence of users who lack proper training or awareness of the level of the job requirement. These users may miss exercising proper care and cold share such information with unauthorized personnel. Such cases may not lead to grievous incidences but when this occurs regularly there may occur losses.
The discussed incidences of security breach warranty some countermeasures in the security system that include (Timothy, 2016);
- Duty segregation. When there is separated responsibly n critical function of the organization, there is reduced opportunity for unauthorized data access or misuse thus limiting instances of individuals committing such offenses. Segregating duties minimizes the risk of combining responsibility leading to a security breach.
- Duty rotation. This has a similar effect as duty segregation but entails added minimization of over-dependence on one staff member thereby increases detection of any personnel policy violation.
- Least Privilege. The organization has to avail a reduced privilege in access of information in that reducing this limits the possibility of security breach once compromise occurs.
- Log monitoring. Database monitoring of system logs helps in detection of unauthorized access.
- Additional Risk to Cover
Additional risks that the security proposed needs to cover after implementation include the following.
- This strategy controls risk that may come up and needs to be put in place in ways that prevent any kind of exploitation or vulnerability in the system security. Avoidance is implementable through policy application, taking the staff through education and training of the security put in place. Also, threats need to be countered with more implementation of technical security safeguards and controls.
- Transference control adds to the approach in controlling risk shifting to different assets or any other group system. Rethinking the way of service offering, revising the deployment of models or outsourcing different organizations and implementation of service contracts that come with providers solves this.
- Once the system is implemented, there needs to be reducing any vulnerability exploitation by preparation and planning either by using recovery planning in the occurrence of disasters or planning the response immediately an incident occurs.
References
David, D., David, A., & Bryan, E. (2016). CWSP Certified Wireless Security Professional Study Guide: Exam CWSP-205. San Jose: John Wiley & Sons.
Denny, C. (2012). Securing SQL Server: Protecting Your Database from Attackers. Phoenix: Elsevier.
Eric, C. (2017). Building a HIPAA-Compliant Cybersecurity Program: Using NIST 800-30 and CSF to Secure Protected Health Information. San Jose: Apress.
Hans, B., Jule, H., André, S., & K. H. (2016). Information Security Foundation based on ISO/IEC 27002 Courseware. Fort Worth: Van Haren.
Jean, M. (2016). Privacy Compliance and Litigation in California: 2016 Update. Columbus: CEB.
Kuinam, J., & Nikolai, J. (2016). Information Science and Applications (ICISA) 2016. San Antonio: Springer.
Rao, V. (2015). Wiley CIAexcel Exam Review 2016: Part 3, Internal Audit Knowledge Elements. Seattle: John Wiley & Sons.
Raymond, P. (2016). IT Security Risk Control Management: An Audit Preparation Plan. New York City: Apress.
Robert, K., & Gabi, R. (2016). ECCWS2016-Proceedings fo the 15th European Conference on Cyber Warfare and Security. Chicago: Ilustrated.
Sean-Philip, O. (2016). Penetration Testing Essentials. Chicago: John Wiley & Sons.
Tanya, Z., & Virginia, G. (2016). 11th International Conference on Cyber Warfare and Security: ICCWS2016. Los Angeles: Academic Conferences and publishing limited.
The, B. G. (2016). Mandated Benefits Compliance Guide 2016 W/ Cd. Houston: Wolters Kluwer Law & Business.
Theo, T. (2016). Human Aspects of Information Security, Privacy, and Trust: 4th International Conference, HAS 2016, Held as Part of HCI International 2016, Toronto, ON, Canada, July 17-22, 2016, Proceedings. Atlanta: Springer.
Timothy, P. (2016). Information Security: Design, Implementation, Measurement, and Compliance. Texas: CRC Press.
Todd, F. (2016). Information Security Governance Simplified: From the Boardroom to the Keyboard. Los Angeles: CRC Press.
Order an Essay Now & Get These Features For Free:
Turnitin Report
Formatting
Title Page
Citation
Outline
