Reference no: EM133571283

Homework: Project Guidelines

Overview

You work for Strategic Security Consulting Group (SSCG). Recently, one of your clients located in Los Angeles, North Star Software Developers (NSSD), called with a big problem. NSSD's strategic security goals include protecting the software development process and code as well as sensitive client information from internal and external breaches. Some of its network servers were compromised, resulting in the possible loss of personal information and credit card numbers of purchasers of the company's software products. It is not presently known whether this attack came from inside or outside of the company. NSSD is currently dealing with this problem as best as it can, but it needs your company to help prevent this from happening again in the future.

You have been assigned to create a training manual for NSSD's IT personnel in which you test, describe, and recommend a variety of network security tools that, when used properly, will mitigate both the risk of future breaches and the effects of a breach when it takes place.

Given the above scenario, you will also create an executive overview that describes the appropriate areas of concern from your research in this course. This should be written in language that can be understood by a nontechnical audience of company management and stakeholders.

In this homework, you will demonstrate your mastery of the following course outcomes:

I. Interpret results of network and vulnerability scans for identifying security vulnerabilities

II. Implement appropriate methods that protect against and address network threats and vulnerabilities using appropriate risk mitigation techniques

III. Categorize the severity of security incidents using industry best practices for determining the appropriate immediate response

IV. Recommend timely countermeasures that minimize the consequences of current security incidents

V. Communicate response and mitigation strategies that align with an organization's strategic goals

Prompt

Specifically, the following critical elements must be addressed:

Network Assessment and Defense Training Manual:

I. Executive Overview

A. Create a brief description of the purpose of the manual that is in consumable terms for the stakeholders. Be sure you address the company's strategic security goals and the value of the policy changes or updates.

B. Assess the role of network defense methods and strategies for securing the network. Support your findings with research and experience from the lab exercises.

C. Evaluate the role of mitigation methods and strategies in reducing security risk. Support your findings with research and experience from the lab exercises.

D. Summarize the role of incident response methods and strategies in minimizing the impact of breaches. Support your findings with research and experience from the lab exercises.

II. Training Manual: For each section of the training manual, develop guidelines for employees to select and employ specific software, tools, and methods to address the elements of the section topic. Your guidelines serve as recommendations of specific tools and criteria for determining when to use these tools. Each section should include relevant screenshots to support the instructions.

A. Traffic Analysis: Based on the labs used for traffic analysis, address the tools, methods, and techniques related to traffic analysis. Be sure to provide screenshots for the output elements that support the following areas:

a. Create guide materials for identifying vulnerabilities and potential threats through interpreting output from packet capturing tools.

b. Recommend the alert response procedures required for traffic anomalies identified through monitoring network traffic and examining logs.

B. Firewalls: Based on the labs associated with firewalls, address the tools, methods, and techniques related to perimeter defense using firewalls. Be sure to provide screenshots for the output elements that support the following areas:

a. Illustrate the process of rule creation and firewall configuration.

b. Outline the steps for segmenting networks. Be sure to describe the benefits of the segmenting strategies.

c. Explain the process and criteria for blocking, allowing, and filtering traffic.

d. Create guidelines for the implementation of methods for detecting attacks.

C. Intrusion Detection: Describe the configuration of intrusion detection systems, specifically addressing the following:

a. Whitelisting and blacklisting

b. IDS placement

c. Summarize the key aspects of monitoring, logging (auditing), and alerting using intrusion detection systems

D. Vulnerability Assessment

a. Illustrate the proper implementation of port scanning, device scanning, and penetration testing and detection for conducting vulnerability assessments.

b. Explain how to interpret the output of a vulnerability scan to identify weaknesses.

E. Network Assessment

a. Illustrate the processes of detecting rogue devices, detecting malicious connections, and viewing network topologies to identify network weakness.

b. Explain how to interpret the output of network scans to identify weaknesses.

F. Auditing and Log Collection

a. Recommend appropriate company-approved tools that minimize the consequences of incident events, and include appropriate rationale and justification.

G. Tools Overview: Provide a brief summary of the key company-approved tools, represented by those used in the lab exercises. In your summary, identify the importance of and rationale for selecting these tools.