Reference no: EM133239008
Case: Your manufacturing organization was recently attacked due to outdated technologies. The attack originated from an Operating System based vulnerability on legacy Windows machines (XP and 7). These machines are responsible for specific functions within your plants, such as cutting metal and laser cutting. These machines cost millions of dollars each, so they cannot easily be replaced. As well, the certification periods for the machines still have several years until they are not supported by the company who created them, and it is written in a contract that you cannot patch them or replace them yet. It is not clear as to where the attack originated from because as you dig further, the network becomes much more difficult to understand why it was built this way.
You have narrowed down the points of penetration (The network security flaws), and have distinguished that for some reason everything is in the same subnet! As well, you have a strong wireless Access Point with weak encryption directly on the network with no firewall protections. Additionally, you have a web server that is not contained in a DMZ. To make matters even more tragic, you have multiple modems with different public IP addresses, and one of them does not have a firewall. Also, the VOIP systems are located in the same network, yikes. After a long time considering if you want to keep your job, or just resign, you decide to develop a patch management proposal. Luckily, all the work that needs to be done to provide network defense can be designed within a quite simple manageable network plan architecture proposal.
The questions for the proposal are:
Q 1: Does the wireless access point need to be here (seems unlikely), and if so what kind of control needs to be implemented?
Q 2: What should be done about the web server and the second public IP with no firewall?
Q 3: Should we segment the network using VLANs, air gaps, and DMZs? If so, where in the network?
Q 4: Why is the VOIP network not isolated, it has an independent PBX controller (Like a router/modem depending on the brand) which can be attacked easily.
Tip: Remember, the XP and Win 7 Machines cannot be replaced, what kind of network control helps Isolate them from the internet?
Assignment requirements:
Design a topological network architecture diagram like the one above, using your knowledge from Module 4 around secure isolation of networks. Feel free to add in controls (I.E., air gaps, vlans, DMZs, Faraday Cages, etcetera). After reconstructing a proposed more secure (isolated) network. List the controls you would implement and why you would implement them.