1. COMP2221 Networks in Organisations
Richard Henson
March 2012

2. Protecting Organisational Data
By the end of this session you should be able to:
explain why the internal network user is potentially a threat
explain the importance of protecting entry to the network by outsiders
suggest ways to identify vulnerabilities of the network, so action can be taken to reduce the risk

3. Network Management
The network manager has two (conflicting?) responsibilities
provide facilities and services that users need to do their jobs
protect the network against abuse by naïve or malign users
General perception (by users!)…
network managers are more concerned with “protecting the network” than servicing the needs of its users

4. The “good insider”.. Threat (?)
Users: employees, who (generally) want to do their job, and do it well…
Possible conflict with the “security-orientated” or “nanny-state” approach to network management
Personal opinion: needs balance
the network IS there for the benefit of the users…
fulfill business objectives
the network MUST be as secure as reasonably possible
protect valuable company data

5. NOT Getting the balance right…
Worrying web page (BBC, 19/11/10):
BBC’s own network users so frustrated about IT restrictions stopping them doing their jobs that many (typically 41% according to a CISCO survey) ignore the rules!

6. “unthinking” insiders
Employees who do stupid things on the network
bring in viruses
spread passwords around
forward inappropriately
engage with phishing s…
etc…

7. Bad Insiders Could be disillusioned Could cause real damage
just plain corrupt
maybe a temp?
Could cause real damage
bring network down
put company out of business…

8. What to do about the Insider Threat?
A matter for organisational management
Establish policy
negotiated with users…
Educate/train users
Enable breaches of policy to be detected…
Enforce policy!

9. What about Outsiders? Two types:
employees working “in the field”
the rest of the world…
Organisational management can’t enforce policy on the latter…
network only protected through good, well-resourced network management

10. Firewalls: checking/blocking data coming in and out…
INTERNET
Firewall
Internal
Network
...

11. Do we have a problem?
Perceptions “from the inside” quite different from “outside looking in”

12. Should we find out…?
Almost impossible to tell if the network is secure from within…
could just hope so (!)
could go outside, and try to penetrate defences
better still, the organisation could get a benign expert to do it for them…

13. Here is one such expert…
Campbell Murray
Highly experienced Penetration Tester