ARAMCO Internship Program Abdullah Al-Nafisi 200700679 Advisor: Dr. Abul Bashar Prince Mohammed Bin Fahd University College Of Computer Engineering & Science.

Outline Introduction Communication Protection Group Company Background Job History Courses Acknowledgment Conceptual Framework Technical Work SWOT Analysis Findings and Recommendations Conclusion References

Introduction information protection and planning department in ARAMCO Al-Medra Tower. The department include 5 different groups. Communication Protection group. The Internship Period: 12 Week. Communication protection group, Windows protection group, UNIX & database protection group, protection monitoring & incident management group and protection support & log management group

Communication Protection Communications protection group (CPG) is responsible for securing Saudi Aramco network devices. The overall objective is to: - Make sure all network devices are in line with the corporate information protection security standards and guidelines. (routers, switches, proxies, firewalls, wireless, modem, etc.) through conducting a comprehensive vulnerability and compliance assessment, security risk analysis, security patch management, access control management, and unauthorized modem and wireless access points detection. CPG produces periodic reports of vulnerable, non-compliant, or unauthorized systems to proponents for remediation.

CPG Functions: A. Access Management: -Manages access to corporate communications devices such as Routers, switches, and Firewall, Proxy, Telephone switches, and transmission devices.   B. Security Vulnerability Assessment: - Conducts and reports vulnerability assessment on network devices and follows up on them. The primary functions and tasks associated with CPG include:

CPG Functions: C. Security Compliance Management: - Reviews security changes of network and security systems. D. Security Patching Management: - Reviews and reports in network security patches.

CPG Functions: E. Security Assurance: - Assesses the Network Access to assure secure interconnectivity of servers, computers, and network devices.

Company Background Saudi ARAMCO is the national oil company of Saudi Arabia. The origins of Saudi Aramco can be traced back to 29 May 1933. It managed over 100 oil and gas fields in Saudi Arabia. The company name was changed in 1944 from California-Arabian Standard Oil Company to Arabian American Oil Company (or Aramco)

Company Mission & Vision Saudi ARAMCO mission is: Maximize downstream investment revenue and to take their maximum sustained crude oil production capacity to 12 million barrels per day. Saudi ARAMCO vision is: - Remain the world leader in the production of petroleum-based energy.

Job History Group Duration Three Weeks Two Weeks One Week Network Access Management Three Weeks Network Vulnerability Management Two Weeks Network Compliance Assessment One Week Network Access detection Unauthorized network access detection Security Patch management

Courses SAP Starter Package. (UIP) Understanding and Improving Process. IP&TPD Safety Orientation. Telecommunication and Network Security.

Acknowledgment Mr. Fahad Sabeela, my site supervisor for the third month, who helped me in the Safety orientation and assigned to me some e-learning courses: Safety Handbook-Basic and Telecommunication and network security. Mr. Abdullah Garieshah, my site supervisor for the second month, who helped me with the development plan, and assigned to me a research project to work on. The internship experience would not have been possible without the guidance and the help of several individuals who in one way or another contributed and extended their valuable assistance in the preparation and completion of my ARAMCO development plan.

Acknowledgment Mr. Abdurrahman Al-Meniea, my site supervisor for the first month, who introduced me to the department tasks, co workers and the tasked handled by each one of them. Mr. Yazeed Al-Thobayti, The responsible person of the access control task. Mr. Tariq Khushaim, The responsible person of unauthorized networks access detection tasks.

Acknowledgment Mr. Bandar Al-Harbi, The responsible person of patch management task. Mr. Hussain Haddad, The responsible person of network vulnerability management. Mr. Mohammed Al-Otaibi, the employment office supervisor. He helped us in the orientation week and explained to us some major safety tips.

Conceptual Framework Communication Access Control Task:

Conceptual Framework ACS (Cisco Secure Access Control Server) is used in Aramco corporate network to provide AAA Service for the network devices and authorizes the user in a specified privilege depending on which group he is belongs to in the ACS. Below are the Network devices models on ACS: All Cisco Routers/Switches/FW TACACS+ (Cisco IOS): Routers/Switches & Huawei Routers - RADIUS (juniper FW) Netscreen - RADIUS (Alcatel) 7670 - RADIUS (Foundry) Switches - RADIUS (Marconi BXR) Routers RADIUS (Marconi ) Switches RADIUS (Cisco Aironet) Cisco Access Point (For User’s Access)

Conceptual Framework Steel Belted Radius (SBR) is used in Aramco corporate network to provide AAA Service for more network devices and it authorizes the user in a specified privilege depending on which group he is belongs to on this server. Below are the Network devices types/models on SBR:   - All Alcatel Switches Models except 7670 - Aruba Wireless Networks: Switches - BelAir Access Points - Cisco Aironet Access Point (For Admin’s Access)

Conceptual Framework: Granting user’s access And privileges:

Dealing with expired Users’ access:

Technical work Communication Access Control Task: 1. Granting User’s Access to Cisco Secure - Access Control Server (ACS) Server.

Access Privileges Mapped to Groups in the Active Directory for the ACS server:

How to Add/Remove a User to the Corresponding group in the Active Directory?

Technical work Communication Access Control Task: 2. Granting User’s Access Privileges to the Steel Belted Radius (SBR) Server:

Access Privileges Authorization in the SBR server:

How to Add Users Privileges?

SWOT Analysis Strengths? Weakness? Opportunity? Threats?

Findings and Recommendations The Findings: 1. Communication protection group is the most important group. 2. Some major issues and require bringing different employees from different departments. 3. There are many projects that information protection department work on yearly. 4. they provided well-written manuals to guide any new comers to the department. Communication protection group is the most important group in the Information protection and planning department duo to the different tasks that they handle and the importance of them to ARAMCO.

Findings and Recommendations The Recommendations: 1. Some tasks that the CPG handles need to be separated and divided to other departments own IT group. 2. Some employees should be aware of other tasks that he is not responsible for in the same department. 3. Most of the department employees were computer science major, and some tasks required a deep technical understanding in network security behaviors.

Conclusion It was a great and gainful experience to work as an intern in Saudi Aramco. learned by practice the: discipline, time importance, communication skills, and to be an organizing and helpful team member. Working in Saudi ARAMCO will make you find: - A wide range of roles. Top notch team. Room to grow. A wide range of roles They offer a wide variety of jobs in different fields, such as engineering, geology, information technology, medicine, nursing and many more. A top-notch team They value teamwork as well as contributions from individuals. You’ll be working alongside a diverse group of professionals with different skills and experience, but all working toward the same goal. Room to grow A company is only as good as its people. That’s why they invest in you with world-class training and development at 24 centers across Saudi Arabia and over 3,000 online courses. We’ll encourage you to pursue knowledge and grow your expertise.

References Khalid T. Al-Thinyan Head of Information protection and planning department 03-876-7240 thinyakt@aramco.com   Fahad S. Al-Sabeela Communication protection group leader Site supervisor 03-872-4545 Sabeelfs@aramco.com Abdullah Al-Garieshah Security Posture management Site supervisor for 1 month 03-872-2070 gheraias@aramco.com

References Abdulrahman Al-Meniea Security Posture management 03-872-1086 menieaaa@aramco.com   Yazeed Al-Thobayti Network Access management 03-876-2859 thobayyg@aramco.com Tariq Khushaim Unauthorized network access detection 03-872-6817 khushatm@aramco.com