Read the scenario below, and complete the tasks at the end of the scenario. You should consult your learning topic Implementing a Network Security Plan and Security Workbook (both in your Learner Resources)
Scenario
You have been asked to design a network security plan for a small e-commerce web site run by the BuyThisShoecompany. The website will be hosted on the company's internal network (as the site needs to access internal databases for prices etc). The company is a bit nervous about hackers, but it also wants a costeffective solution, so you need to come up with a plan that is both effective and economical.
Interviewing the owners of the business, you have uncovered the following facts:
The company will be taking credit card payments, so needs to comply with any relevant legislation
The company is most worried about hackers who may want to gain the credit card details of its customers. They want to ensure that the database server that will be storing the credit card details is on the most secure part of the network.
The company is also worried about ‘for play' hackers who may want to compromise their website for ‘fun', so your network security needs to cater for this.
The company has employed an information auditor as a consultant, who has prepared the following table showing the asset, threat, single loss occurrence, and annual rate of occurrence
|
Asset
|
|
Threat
|
SLO
|
ARO
|
|
1.
|
Network server
|
Fun hackers
|
400
|
5
|
|
2.
|
Credit card details on database server
|
For profit hackers
|
20,000
|
.5
|
|
3.
|
Router
|
Fun hackers
|
1000
|
.25
|
|
4.
|
Web server
|
both
|
2000
|
3
|
|
5.
|
Malware/trojans
|
both
|
1000
|
15
|
The company wants to allow web site traffic (HTTP and HTTPS), email traffic (SMTP), remote desktop traffic (RDP), and network support (via SSH) into its network from the internet. The only traffic it wants to allow out of the network is HTTP/HTTPS and SMTP.
The company is also very concerned that, if any security breach does occur, that they are notified immediately. They are suggesting that every Friday the owner of the company meet with the IT manager to review any security breaches that have occurred, and what has been done in response to those breaches.
Answer the following questions.
1. What is the name of the security standard that applies to BuyThisShoe because they want to take credit card payments from customers?
2. The owner of BuyThatShoe is nervous about customers sending their credit card details across the Internet. What is the name of the protocol that can secure these details in transit?
3. Classify the following countermeasures as to whether they represent risk acceptance, risk avoidance, risk mitigation or risk transferrance
a. The company wants to take out insurance against hackers
b. The company wants to deploy a state of the art firewall
c. The company does not want to deploy countermeasures against State-sponsored hackers
d. The company does not plan to store credit card details for returning customers, i.e. customers will need to re-enter their credit card details for every new purchase
4. Use the information provided by the information auditor to calculate the ALE (Annual Loss Expectancy) for each of the five threats. (your answer should list the five threats, and the ALE for each)
5. Based on these ALE figures, which is the bigger threat: for fun hackers, or for profit hackers?
6. Based on these ALE figures, what is the maximum amount of money you would advise BuyThisShoe to spend each year defending their website against ‘for fun' hackers? Give a brief reason for your advice.
7. Use the information about the required incoming/outgoing network traffic to make a table showing all the traffic allowed into/out of the company's network e.g.
|
Traffic description
|
Type
|
Port
|
|
HTTP
|
In
|
80
|
|
etc
|
|
|
Note: You should complete this table with all the required details for your answer
8. How could you implement these traffic rules in your network (i.e. what device(s) would you configure)?
9. Draw a network security diagram to show an example network for BuyThisShoe. Make sure your network design has the following features
- Clearly shows network zones (trusted, untrusted, DMZ)
- Has both perimeter firewall and internal firewall
- Only web server is in DMZ
- Application and database server are on trusted network
- One server shown running incident detection/prevention software - Mail server also shown on trusted network
(Note: you need to print out your network security diagram and submit it as part of your assessment)
10.List five pieces of information you should capture in every incident response report for BuyThisShoe