COMP2221 Networks in Organisations Richard Henson March 2012

Protecting Organisational Data By the end of this session you should be able to: explain why the internal network user is potentially a threat explain the importance of protecting entry to the network by outsiders suggest ways to identify vulnerabilities of the network, so action can be taken to reduce the risk

Network Management The network manager has two (conflicting?) responsibilities provide facilities and services that users need to do their jobs protect the network against abuse by naïve or malign users General perception (by users!)… network managers are more concerned with “protecting the network” than servicing the needs of its users

The “good insider”.. Threat (?) Users: employees, who (generally) want to do their job, and do it well… Possible conflict with the “security-orientated” or “nanny-state” approach to network management Personal opinion: needs balance the network IS there for the benefit of the users… fulfill business objectives the network MUST be as secure as reasonably possible protect valuable company data

NOT Getting the balance right… Worrying web page (BBC, 19/11/10): http://www.bbc.co.uk/news/business-11793436 BBC’s own network users so frustrated about IT restrictions stopping them doing their jobs that many (typically 41% according to a CISCO survey) ignore the rules!

“unthinking” insiders Employees who do stupid things on the network bring in viruses spread passwords around forward email inappropriately engage with phishing emails… etc…

Bad Insiders Could be disillusioned Could cause real damage just plain corrupt maybe a temp? Could cause real damage bring network down put company out of business…

What to do about the Insider Threat? A matter for organisational management Establish policy negotiated with users… Educate/train users Enable breaches of policy to be detected… Enforce policy!

What about Outsiders? Two types: employees working “in the field” the rest of the world… Organisational management can’t enforce policy on the latter… network only protected through good, well-resourced network management

Firewalls: checking/blocking data coming in and out… INTERNET Firewall Internal Network ...

Do we have a problem? Perceptions “from the inside” quite different from “outside looking in”

Should we find out…? Almost impossible to tell if the network is secure from within… could just hope so (!) could go outside, and try to penetrate defences better still, the organisation could get a benign expert to do it for them…

Here is one such expert… Campbell Murray Highly experienced Penetration Tester