Security

Ask something
Discussion Locked

security management

0 helpful
4 replies

by aqeel_164

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Volt-A-Lot Electrical Supplies is a small electrical retail outlet that is considering starting an online
presence with e-Commerce facilities. They are planning on connecting their small internal
network to the Internet via an ADSL connection to provide email, web access and allow its
customers to place orders directly via the company web site. The IT Director has expressed
concerns about the security risks to the network.
Write a report addressing the following aspects:
• What security risks are posed by connecting the internal LAN to the Internet and how can
they be addressed?
• Whilst the use of a firewall will offer a high level of protection, what other issues need to
be considered as part of a company wide network security policy?
• What specific issues does the company need to consider when using the Internet for e-commerce?

4 replies

by ccollins

Never connect your internal LAN directly to the internet. Always use NAT. Always use a firewall. Use a DMZ for e-commerce. Don't keep your database exposed to the outside. Don't let users install things onto your machines.

by aqeel_164

i got a project so please give me report on that if anyone could the report is:
Volt-A-Lot Electrical Supplies is a small electrical retail outlet that is considering starting an online
presence with e-Commerce facilities. They are planning on connecting their small internal
network to the Internet via an ADSL connection to provide email, web access and allow its
customers to place orders directly via the company web site. The IT Director has expressed
concerns about the security risks to the network.
Write a report addressing the following aspects:
• What security risks are posed by connecting the internal LAN to the Internet and how can
they be addressed?
• Whilst the use of a firewall will offer a high level of protection, what other issues need to
be considered as part of a company wide network security policy?
• What specific issues does the company need to consider when using the Internet for e-coomerce?

by erich1010

What security risks are posed by connecting the internal LAN to the Internet and how can
they be addressed?

This question is ultimately connected to what is on your LAN and how valuable it is. If something is not valuable, there is not that much risk in exposing it. You have to take inventory of what is on your LAN and how important it is to protect. That will help you determine what needs to be done to protect it.

Whilst the use of a firewall will offer a high level of protection, what other issues need to
be considered as part of a company wide network security policy?

A firewall acts like an eggshell. It is a wall that just protects the outside of your network. If someone is able to get past that firewall, your internal network is all nice and soft and easy to exploit. Therefore, any security plan should include how to protect your network at various levels: Firewalls at the Internet boundary, Intrusion detection (inside and outside that firewall, so you know what attempts are being made and if any are successful), workstation firewalls, access controls, separation of function (preventing outsiders from accessing your SQL database might not prevent them from attacking it from your web server), virus filters and spam filters, encryption, VPNs, authentication systems.

You have to figure out how much of this your company needs by weighing their cost to the value of the information.

What specific issues does the company need to consider when using the Internet for e-coomerce?

On top of the above, you'll have to consider customer privacy issues and terms of use statements. There may be other Federal laws that dictate how user information is handled, like HIPAA if the users are healthcare customers.

Also, depending on the service level agreements you have with customers, you might have to consider network availability, data backup issues, and disaster recovery. Denial of service is a security issue that might cost major bucks and legal issues.

by cg it

First off security risks to computer networks tend to come in 2 flavors. That which is real. That which is made to appear real as a method of selling products or services. Determining the line between the 2 is very often very difficult to distinguish. Sales and marketing people can be pretty crafty and devious. take this example, if someone shouts fire in a crowd, people look about fearful. If no one sees fire or smoke e.g. no threat then the crowd settles down. If 2 or more shouts fire, people tend to begin to panic even when they see no fire or smoke. If more than that shouts fire, regardless of whether there is tangible proof, you have crowd/mob hysteria. How do you determine if the first is playing a joke. The second in on it and maybe 3rd possibly 4th do it on purpose to take advantage of the situation? Often the only way to know where the line is, is when the those that say there is a threat, offer a product or service to mitigate that threat.

There are threats to being online via the Internet without adequate protection. Those threats come from programs that a) a user unwittingly clicks on a link and installs exploits. b) exploit programs that search for naked computers by a variety of methods. Many of those exploits are in reality network administration tools readily available and have been enhanced by programmers. Many exploits no longer pose a significant threat to properly patched computers and networks.

Still it is those 2, a, user unknowingly causes a security breach, or b, someone activily looks for a way to breach is where you begin to design methods to eliminate the risks. How do you provide a non technophyte a report on network security in a method they can understand? Damn near impossible without prior background information. Heres a link to Cisco and 100 top questions and answers for internet threats. Note sales pitch http://www.cisco.com/offer/worm/blasterworm_lp_hard.html?sid=124013_32

Side Note: E-commerce falls into both need for security and also need to meet federal, state, local regulations. You fail to mention which issues you must address.

This discussion is closed to new replies.