BD&F Information Security

Network Defence

If there is more than one computer used by a business chances are that they are networked to make sharing of information and resources such as printers easier.

To protect the network both the hardware and software that make up the system have to considered. Servers, routers, user machines must be protected from physical damage by placing in dry, elevated, fireproof locations.

Think about where the office is located, the natural disasters that can happen and what best can be dome to alleviate the risk of losing use of the machine when the worst happens.

The linking mechanisms such as cables and wireless transmitters must be protected from unauthorised access. The cables not be run through conduits or covered where they cross high traffic areas of the floor. The wireless router must be configured to stop free access to the network and the information transmitted has to be encrypted.

On a network there may be many different services installed on different machines. If one of those services has a weak entry point a hacker can compromise the entire network. Segmenting a network through the use of switches limits access to the entire network from any one point.

When a small company is networked all machines are usually linked to the printer. This saves having to purchase multiple printers and the costs associated. With this type of setup the recommended practise is for users to remove printed documents as soon as they are printed and not left there for others to read freely.

The IPSec port filtering must be implemented to restrict the web traffic that can come to the servers. Only the specific ports that are required to support a server’s role must be open and all other default and unnecessary ports must be blocked.

The network is the largest and most dispersed part of an information system’s infrastructure. All parts have to be audited for weaknesses and defences beefed up to raise the average strength of the entire network.

Photo by pascal.charest

System Security

The systems that process data for businesses need to be protected before we go on to defend the data that is held within these systems.

Your wallet is a good example of a place you keep items of varying values. Even when it is empty your wallet is an item you will secure for its cost, convenience and perhaps sentimental value.

A business’s information system is similar to a wallet in that it holds valuable contents and even if empty it still has value for its use as a business tool. The first level of security for the information systems can be placing the machines in controlled areas.

If your information system runs on a single computer you should limit physical access to that machine. It should be secured against theft and accidental damage from other users of the office space such as visitors or family. A business with a server system should use a locked server cabinet or a separate room. The individual machines would still need to be protected.

The machine’s location should help protect it in times of natural disasters and fires. It should be protected from extremes of temperature and kept in a dry location. A UPS power backup allows the system to keep running after a power supply failure and gives the business control of the shut down process if needed.

Many businesses start as table top enterprises, being part of the home furniture until a separate area for working can be afforded. During those early days the machines holding the business’ information are most likely shared among family members.

The business should use a separate password protected account on the computer. When the owner logs onto that account all work done will be regarding the business. Log off the account when the work is done and the computer can be used by others without fear of losing valuable business information.

The account should be locked whenever the machine is left unattended for a length of time. The screen saver can be set to automatically lock access to the account or it can be done via the keyboard or a desktop icon.

Laptops and PDAs are also common among SMEs and care should be taken to limit access to authorised users only. If all your business data is held on a laptop it should be kept close and high risk areas should be avoided. Newer laptops have the ability to encrypt the entire drive.

If your data is lost your business would face a tough challenge getting up to speed again. Your information should be regularly backed up on an external storage drive which is kept separately from the main machine.

Photo by shareski

Defending your Network Perimeter

Business information systems are usually linked to external networks. This is to facilitate communication and data exchange with customers, suppliers and business partners. The system under your control links with these other systems at the perimeter point.

The security measures you use to protect your system are unique to your business. The systems out of your influence can be less protected and possibly act as an entry point for attackers who aim to compromise your network. Perimeter security is used to defend against attacks originating in those external systems.

A computer connected to the Internet has its perimeter at the router or Firewall. Larger systems can have their perimeters defined as the servers that host company websites and those that handle email. Knowing where the boundary of your control ends is important if you want to maximise the steps you take to secure your information system.

The connection to the Internet is a common security focus because of the use of the Internet as an attack conduit. All types of malicious software can enter a system via the Internet if the entry points are not protected. A Firewall is configured to allow only desired types of traffic into a network. Fine tuning a Firewall is a technical challenge and the steps depend a lot on the type, make and model. Business owners must be aware of what resources they want from the Internet and set their Firewalls to allow those types of communication only.

Tuning a Firewall does not end your security woes because you may allow http traffic, web pages, and still need anti-virus to check the http content coming through. Firewalls can also inspect traffic leaving your network and protect against your machines being used by a hacker to send malicious messages to other systems.

Your machines must be protected from direct access to attackers. You can hide the IP addresses of your network machine through the use of Network Address Translation (NAT) which assigns new addresses to the machines rather than what they’d be known as if directly linked to the Internet. If your network is hosting a software service, you can conceal the address of the host machine.

When you export data to an external partner you must protect that data whilst in it is in transit by either providing secure channels such as VPN or encryption. Microsoft Office has an encryption facility for documents in the Save As dialog window. For email you can use PGP or send the sensitive document as an encrypted attachment.

A business owner is responsible for the safety of the information the company uses. The measures used to protect the system should be complemented by perimeter security. Always keep in mind that external systems are not under your control and may employ weaker security. It is very easy to link systems with today’s technology so it is vital that your perimeter security is maximised to shield your internal network.

Photo by Sanctu