Network Security For Lucent Pharma: Devices, Segmentation And Policies

Devices for Ensuring Network Security

In regular day-to-day life, under unauthorized access, malfunctions are used to protect physical and digital information has been taken several steps to protect the information. Network security is one of the main securities for protecting much information. In country of Australia, a large city is known as ‘Perth’. In that city the Lucent pharma is presented which is a firm of pharmacy. It has no strong security control, but it implements network topologies. In the Lucent pharma of current topology network, in which many problems has occurred. In the topology network to raise the security and performance the sensible security devices are present with vulnerability low. By locating the network the security devices has placed. For improving the security a software tool of ‘Firewall’ is used. It has contained codes and policies, which will create and implemented in networks by the administrator. There are two security devices of network and monitoring which is to increase the security level. The first one is IDS stands for Intrusion Detection System and the second one is IPS stands for Intrusion Prevention System. The software’s encloses the cyber-security. For protecting computers and networks leading technologies of Cyber security is used. In the network of Lucent pharma, there are several security policies are present. Proposed Secure Network Design will be designed for the pharmaceutical firm. For scanning an Nmap tool is used for this network security. In this network to gather some information of data packets software used is Wire shark which is a Linux distribution. The IP address and ports of targets are the commands used for scanning. In the network the complete incoming and outgoing are controlled using Filters by complete monitoring of data packets. Capture filter and Display filter are two types of Filters are used. These filters have some variations on their accessing. The network security and devices has been discussed above.        

The present build network used in Lucent pharma planning will be done. There are many affects present in the network and main five faults that reduce the effect of pharmacy will be identified. The knowledge for choosing the affects are clearly will be explained. By referring many protect machine, good protect machine will be taken to increase the protect machine and performance. The machine placed in the network location will be confidentially. Lucent pharma network needs any partiality into group of platforms will plan and there is any need, sub-network for that purpose will be added. Firewall policies and rules will be created to executed in the network consist of firewall by the administrator of network. IDS/IPS policies and rules also will be generated and network administrator will execute the policies in network. The policies and rules for twice firewall and IDS/IPS will be covered the cyber-security of the network. For Lucent pharma network, ten additional security policies will be devised. The design for ‘Proposed security network’ will be created for the pharmaceutical firm in Microsoft Visio Nmap tool will be help for scanning purpose. Using wire shark tool the error will be recorded. Commands used scanning the target server. IP address of the target server, port which used for the target server, web server will be reported in the form of table. The filter used to display and exclude the ‘HTTP’ traffic will be analyzed. The major difference between the ‘capture filter’ and a ‘Display Filter’ will be explained.

1. Analyze the current network topology implemented at ‘Lucent pharma’ and identify five major vulnerabilities that exit in the network. You are also required to provide sound reasoning behind these identified vulnerabilities

• The internet is used expose the intranet server. Because the attack is possible in many ways.  The attack is created in no of choices.
• We need to protect the web servers in the environment. Intrusion prevention system is used to protect the web server.
• In this environment antivirus servers are not applicable. So using this operation we can easily protect the environment from virus out breakers.
• The business critical environment is protected by the user. The users have an ability to access the environment in unlimited times.
• By using this operation the security risks are easily handled and managed
• Direct internet access is possible in these users. Users are in direct internet connection, no restrictions are demanded.
• The whole environment is vulnerable by the above user.

• In company network router is the most important resource. Router is act like an entry point in the company network
• Different types of public facing servers are used. The public facing servers are used to perform DMZ zone.
• In the DMZ zone they have a DMZ IPS. The DMZ IPS are used to place the firewall in DMZ zone.

• The DMZ zone is protected by the firewall. And also VON services are used to protect the DMZ zone
• The entire internal network from the external world is protected by the internal firewalls. So the internal firewalls are used to protect the internal networks.
• Public facing servers are access by the end users. And also send the external request through the switches.
• The wired switch is given by the wireless access point. The wireless access point is used to give more additional functionalities.
• In DMZ zone the proxy servers are applicable. All public facing servers are connected by the standard switch.
• Web servers, email server, application server, and database server are the types public facing server.
• The company has a site office. Another router is applicable in this site office.
• This router is connected by one standard switch and also a wireless access point.
• The internet is access by the entire user. This operation is done by this wire switch and wireless point

Proposed Secure Network Design and Cyber-security Policies

Below are the devices are added in the existing network to compliance the security

Firewall

The perimeter and internbelowet network is used to install the firewall. The perimeter is the firewall protection. The perimeter firewall protection is used to avoid the external attack in the environment. And also provide permission for access the mission critical application in DMZ zone. If you want to access the internet, DMZ servers are used.

Between the remote site and server environment the internal firewall is deployed. The remote sites are used to access the server in the DMZ zone. For this operation some specific services are used. These services protect the environment from the external and internal threads.

IDS/IPS

IDE/IPS devices are used to deploy in inline mode and also close perimeter environment. In perimeter IPS are used to get the resources between the perimeter firewall and the DMZ server. The traffic between the internet and DMZ environment is similar to the DMZ server traffic. We need to through IPS and first run the IPs scanning; the IPS scanning is fully against the threats.

• Alerts are used to send the application for evaluation and mitigation
• The malicious code is detected by the traffic code. And also the IP will drop their packet
• IPS are used to block the traffic from source address
• If we want to reset the connection the IPS are used. And also is used to initiate the attacker.

Router

In main office the additional routers are installed. These additional routers are used to connect the MPLS links. The main office server is reached by the remote site. MPLS router is used to find the solution.

VPN Service:

 Services are mostly used in perimeter firewall. The VPN service is applicable in the perimeter firewall. The corporate user access the corporate network security done by the VPN service. The user system and corporate servers are encrypted by the VPN services. To identify the traffic content don’t use ISP. ISP is not applicable for traffic detection.

Yes lucent pharma requires network segmentation. In lucent pharma environment multiple domains are used. Each and every domain is used to protect the resources. Below table represent the topology and network segmentation.

Network Segmentation
Zone Name	Description
App Zone	Application server
DP Zone	Data Base servers
Web Zone	Web servers
Extranet	Email & Proxy servers
Intranet	Remote Offices

In lucent pharma environment are implemented by the robust firewall routers. The cyber security threads are protected by these firewall routes.

Rule#	Source Zone	Source IP address/Network	Destination Zone	Destination IP address/network	Service/Ports	Allow /Deny
1	Intranet	10.0.0.0/22	Web Zone	Web servers	http/https	allow
2	Un-trust	any	Web Zone	Web servers	http/https	allow
3	Web Zone	Web servers	App Zone	App servers	ssh/ftp	allow
4	App Zone	App servers	DB Zone	Database servers	sql tcp/1433	allow
5	App Zone	App servers	Un-trust	any	http/https	allow
6	Extranet	email server	Un-trust	any	pop3/smtp	allow
7	Un-trust	any	Extranet	email server	pop3/smtp	allow
8	Extranet	Proxy server	Un-trust	any	http/https	allow
9	Intranet	10.0.0.0/22	Extranet	Proxy server	tcp/8080	allow
10	any	any	Any	any	any	deny

There are different types of configuration methods are used.

• Critical
• High
• Medium
• Low
• Information

IPS Profile	Critical	High	Medium	Low	Informational
DMZ Servers	Drop / Alert	Drop / Alert	Drop / Alert		Log / alert
Client – Servers	Drop / Alert	Drop / Alert	Drop / Alert		Log / alert

The cyber securities are enforcing by the following polices

• Specific user account in the computer system
• In the comport system business activities are conducting and also running
• The system usage are not the best one for the personal activities
• Proper permission is needed for accept the usage otherwise its illegal
• Theft is also known as illegal usage
• Usages polices consider the civil and criminal causes
• The outsiders are not permit for access the official system
• The permitted user should not make a multiple copies.

Internet Usage Policy

• give internet facilities to the employee
• give internet facilities to the contractor
• the user deliver the service, need internet facilities
• The internet permission is given by the security administrator. Security administrator give the internet  to the employees and contractors
• The supervisors allocate the job to the employees
• The internet access is  come through the supervisor
• In the company business tool is used for access the internet
• Using this tool we can approve the activities like sending the message, receiving the message, or emails, and also running the business details

• The end user is used to monitor the end usage
• The end user allow the company for data transfer
• The company is used to monitor email usage
• the internet usage is also monitored by the company
• each and every activity of the end user it’s not a company responsibilities
• company have an ability to check the limited activities only, such as web site access, and from the email address
• sharing files are monitored by the company through electronic facilities, using electronic facilities the files are not theft easily

WSN and Guest Access Policy

• the guest access of the internet is use the wireless access polices
• Prepare risk list, so first we need to prepare the list of risk. Using this way easily find out the solution
• The guest is provided by the wireless internet access, these guest consider all the risks
• The business permissions are provided by the guest
• The guest access should not give all the shared resources. The restrictions are followed for some of the devices and resources

• Confidential data means valuable information about the company or important data about the company
• To enforce the user lot of rules are followed, using these series of rules use the confidential data
• The usage of the confidential data is folwe4d by lot of security standers
• The business competitors are misused the confidential data. The confidential data is stored in secure environment

Usage of Mobile Devices

• Mobile workforces are very flexible and also very protective
• In every market mobile device usage is increased
• In the mobile device use much more sensitive data’s
• In the mobile device usage lot of risks are associated
• The mobile device usage is increased

Incident Response Policy

• An security incident can considered the malicious attacker
• In security incident no of attacks are possible such as virus, adware attack, malicious attack
• Company laptop is steel by someone is known as security incident
• The incident report should standardized
• The escalation matrix is managed and also formed using this method
• Only the effective  response values are allowed
• All the security devices and the systems are controlled by incident response police

• The internet is well secure and also only the well secured internet should provide the end user
• Well planned security devices and also security controllers are used well draft
• We need to provide the well planned security control and well prepared
• The polices are used to control the following polices such as password, logs, firewalls, hardware, network, and testing

In DMZ zone proxy servers are used. All public facing servers are connected by the standard switch like web server, email server, application server, and database server

At the site office of the company use another route also. This router is concern by single standard switch and wireless point, the user access the internet using two methods one is wired switch another one is wireless access point.  

Enforcing Cyber-security Policies through Configuration Methods

Nmap is a tool and it is used in the kali Linux and it works as to obtain the information about the scanning reports. And many IT industries use this gathering nmap tool. Nmap is the process of steps to get the information about the concepts of networks. And nmap tool has the benefit of to collect the information about device and network related peripherals. And generally Kali Linux used for gathering the information using penetration testing tool and this nmap tool is pre-defined installation in kali Linux and it is used to collect the information and this nmap tool is very easy to use and much effective.

Representation of scanning reports using nmap tool

1. Scanme.nmap.org

     The above screenshot mentioned the example of scanme.nmap.org and it include server name and port and ip configuration.

1. Nmap scan techniques and target specification

In the figure explained about the how the scanning techniques and target specification will be and also the host discovery. In that the host discovery commands is used to identify the hosts and their configuration and in that target specification many commands are displayed for the user convenient.

1. Port specification and script scan

In the above screenshot the port specification and what are the scan scripts are examined and the port details such as tcp and udp port specification also displayed.

1. dig google.com

And in this above screenshot the example domain is examined and their server address and the time and the ip address and it shows the target address specification. And the query and answer section are also displayed in this screenshot.

1. Trace route using port configuration

In the below screenshot the trace route of tcp and udp are given by the detailed explanation and also the port configuration in that the port name and the service and also the version specified.

Kali Linux

Kali Linux is one of the open source operating system in the Linux version. And it also has a penetration testing and the user can access it easily and the kali Linux is used for the security research and the reverse engineering and also the computer forensics and in this Linux version the user can identify the support files and also the libraries and it supports many wireless device. Backtrak is the old version of kali Linux and it is more vulnerable to against the security crackers rather than other Linux.

Wire shark

Wire shark is free software and it is available for multiple platforms. It used to get details about the packet information and it is used in more Linux distributions. Wire shark is one of the popular network analyzer and it is used for troubleshooting and used to monitoring the network and it is available for all kind of operating system and it is easy to operate. Wire shark is also the open source software and the network packet analyzer is the kind of measuring device and in that some features are used to create different statistics and captured the saved packet data and it can gather the information from the network and the wire shark is mainly used for communication protocol development and the software analysis.

Nmap and Kali Linux for Gathering Network Information

Step 1

In the above one the wire shark initial installation and packets are displayed and using this wire shark network analyzer used to capture and display the packets.

Step 2- Analyze the packets

In above diagram it shows what the packets are captured and filtered and protocol length and which kind of protocol is used and source these details are displayed and also the frame and source is displayed.

Step 3-Ping statistics

In below screenshot the ping statistics which means the outputs by the ping command and it shows sending and receiving packets and it displayed the bytes used to the transmission.

Step 4- ARP protocol

Step 5-ifconfig

In the above diagram the ifconfig command is used and the results are displayed and the Ethernet configuration is displayed and the packet configuration and using nbtscan command the ip address and mac address are displayed.

Step 6-Packets

In the diagram the wire shark filter configuration and shown the details about the packets and the packet analysis. And the ipv4 and ipv6 details and Ethernet broadcast delivery are showed below.

Step 7-Display the filters

1. TCP SYN scan

        Synchronization scanning is malicious hacker and it is used to describe the state of communication and the synchronization without the port connection is not established completely and so the port is mainly used for establish the full connection and this synchronization scanning is the old method and it is used to perform the denial of software attack. And DOS is known as denial of software. And the synchronization scanning is also called as half open scanning.

1. OS detection

      It is used to identify the network host and also used for find the corresponding operating system. And in os detection the commands are used to what the os is currently installed.

             o – Enable os detection

      -osscan-limit – limit os detection

      -osscan-guess – guess the os

    Version detection:

       -sV – intensity

    –Version light – most likely probes

   — version-all – try every single probes

1. Quick scan

     This kind of scan is used to scan 100 ports at a time and using this quick scan we can easily find out the potential host and have to give the direct command using this scan.

1. Scan a single port

     In below diagram represent the commands to describe the scanning of the single port.

          nmap –p 22 192.168.1.1

1. Scan a range of port

      This figure represent the range of port. To scan the range of port use below command

                nmap –p 1-100 192.168.1.1

1. Scan all ports

      It is about the scanning of all port. To scan the all ports use following command

              nmap –p 192.168.1.1

         The following command is used to scan the target server

1. Nmap 192.168.1.1 – used to scan a single ip
2. Nmap testhostname.com– scan a host
3. Nmap 192.168. 1.1-20 – scan the range of ips
4. Nmap 192.168.1.1.0/24 – scan the subnet
5. Nmap iL list-of-ips-.txt – scan target from a text file
6. Nmap 192.168.1.1.192.168.1.2 192.168.1.3 – scan multiple ip address

1. IP address of the target server

  To scan the ip address of the target server the following command is used

         nmap –sL  -n 192.168.1.0

      After the execution of the command start the nmap and finally the ip address of the namp is displayed. And it is also used to scan the multiple ip address or host address

        $ nmap server1 server2 server3.nixcraft.net.in

        $ nmap 192.168.1.2

1. Ports open on the target server

 For this first we need to scan the report and the below command is used to scan the server.

      $ nmap router

   The the ports and the state services are displayed and also open the target server port and the port open on the target server is done below command

     Sudo netstat –plunt

1. Is the target server running any web server

       Web server is used here to describe the target ip address and normally apache latest version is supporting to the target server.

1. Latest stable version of web server

         The apache HTTP server is used to develop and maintain an open source HTTP server and it include the modern operating system such as UNIX and windows and providing security is goal of this project. This apache server launched in 1995 and this latest version released by apache software foundation. Version 2.4.33 is the latest version of the apache HTTP server.

1. Capturing the filters

1. Displaying the filters

Conclusion

In Lucent pharma, the network topology is presented and analysis of pharmaceutical firm has completed. In the network topology, identifications of vulnerabilities have identified and security effect of reasoning was completed. The reasons of choosing the vulnerabilities had explained. By improving the performance of the network and security device, analysis and determination of best security device has secured. The devices are explained clearly. The IDS/IPS security device and firewall software tool was implemented. The software tools of rules and policies are created. To get the information the Wire shark tool and Nmap tool is used for scanning. The various types of filters and their differences are explained clearly.

References 

Babincev, I., & Vuletic, D. (2016). Web application security analysis using the Kali Linux operating system. Vojnotehnicki Glasnik, 64(2), 513-531. doi: 10.5937/vojtehg64-9231

Cui, Y., & Zhang, Y. (2014). The Network Security Analysis of Linux Operating System. Advanced Materials Research, 998-999, 1274-1277. doi: 10.4028/www.scientific.net/amr.998-999.1274

Industrial Network Security. (2015). Network Security, 2015(3), 4. doi: 10.1016/s1353-4858(15)30014-3

Kali Linux – Assuring Security by Penetration Testing. (2014). Network Security, 2014(8), 4. doi: 10.1016/s1353-4858(14)70077-7

Linux hit by another long-term flaw. (2015). Network Security, 2015(2), 2. doi: 10.1016/s1353-4858(15)30002-7

Patel, A. (2015). Network performance without compromising security. Network Security, 2015(1), 9-12. doi: 10.1016/s1353-4858(15)70008-5

The Practice of Network Security Monitoring. (2014). Network Security, 2014(10), 4. doi: 10.1016/s1353-4858(14)70099-6

Kadafi, M. and Khusnawi, K. (2015). Analisis Rogue DHCP Packets Menggunakan Wireshark Network Protocol Analyzer. Creative Information Technology Journal, 2(2), p.165.

Knipp, E. and Danielyan, E. (2002). Managing Cisco network security. Rockland, MA: Syngress.

Kranakis, E., Haroutunian, E. and Shahbazian, E. (2008). Aspects of network and information security. Amsterdam: IOS Press.

Kumar, A. and Yadav, J. (2016). Comparison: Wireshark on different parameters. International Journal Of Engineering And Computer Science.

Oppenheimer, P. (2011). Top-down network design. Indianapolis, Ind.: Cisco Press.

Practical Packet Analysis: using Wireshark to solve real-world network problems. (2011). Network Security, 2011(8), p.4.

Sawant, U., Pelz, O., Hobson, J. and Leemans, W. (2017). Linux. Birmingham: Packt Publishing.

Web application security analysis using the Kali Linux operating system. (2016). ??????, ???????: ?????? ???????? ??????????.

Fan, Z. (2002). Fundamentals of Network Security. Computer Communications, 25(17), 1698. doi: 10.1016/s0140-3664(02)00084-1

Industrial Network Security. (2015). Network Security, 2015(3), 4. doi: 10.1016/s1353-4858(15)30014-3

Kemp, M. (2004). Basic incident response for system administrators. Network Security, 2004(10), 16-18. doi: 10.1016/s1353-4858(04)00145-x

Monitor, I. (2000). Network Security Fundamentals. Information & Security: An International Journal, 4, 121-122. doi: 10.11610/isij.0411

Wireless Network Security Fundamentals and Technologies. (2017). International Journal Of Recent Trends In Engineering And Research, 3(4), 438-443. doi: 10.23883/ijrter.2017.3167.inazm