1. SemiCorp Inc. Presented by Danu Hunskunatai GGU ID # 0435738

2. Table Contents SemiCorp Business and Security Analysis. Recommendation Security Architecture needed emphasis. Implementation plan Management Architecture Access Control Architecture Infrastructure Architecture Policies Conclusion

3. About Company SemiCorp Inc. is a defense contractor. They build missiles (air-to-air, air-to-surface) They have a semiconductor group to make a analog phone devices. They want to sell their businesses completely which in 2 years.

4. Business Analysis Company have on security policies and procedure. We can device company in 2 major parts are Missiles business and Semi-conductor Business. For Missiles business have 2 zones are restriction zone and non-restriction zone.

5. Security weakness list No access control card. All doors are kept open. Never audit of the access control level or privileges. No access control guide line. No Firewall. No virus protection on systems. Employees are take computers home. No Backup site. Network is made up of Netware 4.11.

6. Security Analysis Company have 3 major security crisis.  No Security policies and procedure  Company doesn’t have any security policies.  No Access Control requirements  Management have abandon security system.  IT has never audited computer security system.  Networking and software  No Hardware and software prevent attacker and virus.

7. Recommended Course of Action Created security policies. Management policy (classification, audition) Access control policy (access card, zone, data) Infrastructure policy (firewall, mobile computer) Buy Firewall and Anti-virus software Using Freeware for improving network security system and keep updating software patch and hardware drivers from vendors.

8. Implementation plan Management Architecture Created Security Policy and standard. While DOD is auditing our company, We must have to show that we have a policies to protect our system. Classification control (employees access level). For the security reason, employees have to limited access data and zone. Revise Roles & Responsibility policies. Company and employees have to responsibility for all data and all equipment under their control.

9. Implementation plan Management Architecture Audition planning. We must have audition planning. Show that we always update our security system. Manage & monitor logging & reporting. For security reason, we have to manage log of system and look through the alert flag. Reporting alert to Security department.

10. Implementation plan Access Control Architecture Everyone must use access control card and all door have to close. Employee have to authorize to access data or working area. Encryption Users must use encryption for sensitive information. We can use freeware encryption version. Password must change every 60 days. For higher security system, users would change password every 60 days.

11. Implementation plan Infrastructure Architecture Buy Firewall and Anti-virus software. Scanning all system for find virus and spy ware. Configuration Firewall block unused port. Used IDS software and NMap for analysis and monitoring network. (Freeware version) Laptop computer. Need a policy for laptop computer. (using and taking home) Laptop might have confidential data. We have to keep task on it. Setup location to save log files away from server and firewall to another machine. Because we can protect log files from attacker and system down.

12. Implementation plan Infrastructure Architecture Firewall system “Screened Host Architecture Firewall” I recommend “Screened Host Architecture Firewall” because it have strong security. It also protected Internal IP address and limited accesses.

13. Implementation plan Infrastructure Architecture Why we need Firewall system? DOD is required the maximum security of information system. Company have to pass a requirement before selling businesses. DOD will be audit our security system before selling the company. Generally, All defense contactor business must have a firewall system. This firewall system can protect external attackers by hidden the internal IP addresses. Internal users cannot direct connect to the internet. We can limitation the internal users activity while their using the internet. We need hardware firewall because it is secure and reliable.

14. Implementation plan Infrastructure Architecture Intrusion Detection System IDS software should installed on Bastion Host for detecting incoming and outgoing traffics. Installed IDS Software

15. Implementation plan Infrastructure Architecture Why we need IDS System? Because We need to detect our network and internet traffic of our system. Detection system is improve our security. In order to pass DOD requirement. Our system have to be clean and prevent viruses computer, spy ware and internet worm. IDS can help configuration the firewall and also check the reliable of firewall. IDS use for monitor the network traffic and checking firewall working reliable.

16. Implementation plan Infrastructure Architecture Why we need Anti-Virus software? Because We need our system have high security to pass the DOD requirement. Our system have to be clean and prevent viruses computer, spy ware and internet worm. The benefit of buying Anti-virus software purchasing version are helpdesk, fast updating virus signatures, and reliable. Firewall system cannot protect worms and spy wares if they are already in our system. The risk of internal user can access internet. They computer might be interface virus, worm or spy ware from the internet and E-mail.

17. Information Security Policies Some of the current Security policies are excellent. We don’t have to revise them for example; No network in Top secret area. Remote access is not allowed. Vendor patches are done religiously. Battery backup is available. Making backup everyday. The policies on the next slide must add and revise from the current policies.

18. Information Security Policies Information Security Responsibilities Information Sensitivity Classification Access Control Fixed Password Management Acceptable Use Of The Internet Establishing Network Connections Encryption Electronic Mail Printing, Copying and Fax Transmission Mobile Computing Viruses, Malicious Software, and Change Control Firewall Policy Personal Use of Information Systems Intellectual Property Rights Reporting problem Non-Compliance Situations

19. Conclusion Major implementation of Security system needed Establish Information Security System Policies. Secret documents and confidential email have to encrypt. Buy Firewall hardware and Anti-virus software. IDS, NMap freeware. Employees must use access card. Laptop computer policy (using and taking home).