Security infrastructure design for enterprise organizations: threats and countermeasures

Enterprise Technical Infrastructure Security Plan

for ABBA Corporation

Information Technology Security: Implementation

The wrong it security plan can cause an enterprise millions of dollars of damages if breached by a number looming threats waiting to steal valuable information and resources from the organization. It is important to plan out a proper design that fits the needs and objectives of the organization, as well as providing it the flexibility and fluidity it needs to adapt to changes in those objectives but also changes in the external environment and its potential threats. This current research explores the contemporary environment for enterprise organizations as a way to evaluate potential security threats and prepare the most effective countermeasures in a fluid and functioning it technical infrastructure security plan.

Table of Contents

Title Page I - Completed

Abstract

Overview

Scope

Customer will complete

Table of Content

Possibility of Attacks

Attack Launches

Countermeasures

Intrusion Detection Systems

Penetration Testing

Vulnerability Assessment

Government Regulations

Security Plan

Summary

Conclusion

References Completed

Overview

The research presented here evaluates both the threats in the modern business environment, but also how to best prepare for them through strong and effective it security infrastructure system. Working enterprise especially puts the organization in danger in regards to various threats, as a reward for stealing organizational data is higher based on the volume being stored in data servers. Based on this evaluation, the research presents a number of clear countermeasures which will prove incredibly effective at helping prevent these threats from getting into the enterprises security system. The two main systems examined are Intrusion Detection System and penetration testing. These two systems adapted in a tailored security plan to help facilitate organizational goals is the ultimate protection and enterprise organization would seek. Additionally, based on unique data quantities, enterprise organizations may also opt into building internal servers into the security infrastructure in order to provide more reliable protection for restricted and other sensitive data. Thus, a combined strategy using external and internal resources is recommended for any enterprise organization looking to design its own it security plan.

Scope

In order to conduct the necessary evaluation needed to make clear assumptions in regards to environmental threats and the best countermeasures, his current research conducted a review of the recent discourse. A number of successful it security plans were examined, with notes taken in regards to their most prominent and efficient features. Additionally, academic research was also included in the scope of this research, to help provide potential future solutions, as well is justified by their particular elements jested for an effective it security plan. From this discourse, the research presented here was able to make clear recommendations in regards to the most important elements of a security enterprise plan for enterprise organizations.

Introduction

Possibility of Attacks

Along with the run-of-the-mill hackers are much more complicated security breaches that implement the newest evolution and technology, often before most security systems have a chance to adapt to them. One of the biggest rage in it today is the use of cloud computing and third-party hosting for data storage and maintenance. Yet, these brand-new and innovative technologies bring with them enormous new threats. According to the research, "data stored in the cloud may be located across the country or overseas," and as such, enterprise organizations can often become victim to breaches in third-party security systems (Quest, 2013). Data within most enterprise organizations is a lucrative opportunity for hackers and it criminals. In many instances very sensitive data, which could be used to access customer resources and funds, if stored by the use of third parties promising the security of the latest implementation of technology. As such, these become major targets themselves, and can often not prevent some of the newest and more complicated security it threats as they become apparent in the network.

Intrusion Detection Systems

one of the most successful software strategies is the use of an Intrusion Detection System, also known as an IDS. Essentially, these are software applications that consistently review and monitor the organizational it network in order to uncover potential threats lurking somewhere within the system (Sans Institute, 2011). IDS software has gotten incredibly complex in recent years, being able to help detect malicious threats before they can do as much damage as they intended to. Many IDS systems use very extensive logs that help generate a type of learning system for the design architects of the system to find common and frequent patterns and thus respond to them more thoroughly at a more rapid rate. IDS software sits as a silent observer, monitoring all activities in order to uncover threats hidden as normal business operations. Including IDS within the security plan is absolutely necessary within an enterprise organization.

Penetration Testing

Penetration testing is another major aspect of most successful security plans in the contemporary business environment. Also known as a pentest, these are essentially another security measure which tests network security by pretending to be a threat itself. Through attack simulation, and enterprise organization can determine whether or not its current security system is capable of defending itself against the most recent in dangerous it security threats. Penetration testing helps point out architectural flaws to be worked on, before hackers or other security threats can exploit them to the company's disadvantage. They also help show what is at the greatest risk, therefore directing the future of it security design within the context of the enterprise organization.

Vulnerability Assessment

Enterprise organizations fall victim to a wide number of vulnerabilities that are often exploited by hackers and other security threats. As in the case of all enterprise organizations, the need to protect the massive load of sensitive data makes a strong security it plan necessary to avoid potentially giving up customer information or other details which could lead ultimately to litigation. The organization must protect the sensitive information of its clients and customers (Clotfelter, 2013). Yet, this is hard to do on a massive scale, which enterprise is known for. When there is simply way too much data in a security system that may have been unable to cope with influxes of new entries, they're always threats lurking waiting to take advantage of the it security systems weaknesses. One of enterprise's greatest vulnerability is its need to secure high quantities of data that is constantly changing. This becomes especially difficult in situations where organizations turn to third-party companies to help deal with the massive loads of data. Additionally, the growing use of cloud computing also has its own unique threats in terms of storing and transferring sensitive data (Clotfelter, 2013). Unfortunately, the organization which is hosting the enterprise's data cannot always be counted on to have their own guaranteed security plan. Customers are not going to care whether or not it was you or the third party hosting service that gave up their credit card information, the only care that their data was leaked. Thus, it is important to ensure that this will not occur. One of the best ways to do so is to try to post as much sensitive data in-house as possible. Maintaining "enterprise storage and special storage areas for certain restricted data," as well as other categories of sensitive data can be conducted using in-house and "locally hosted enterprise and departmental storage for structured data" (Clotfelter, 2013, p 2). Essentially, the most successful it security systems will rely on a fragmented structure; they may look to third-party or other external local hosting service providers for data that is not as crucial to keep secret. Thus, enterprises must plan for space for "machine rooms that afford high availability and reliability to departmental server resources as well as appropriate network security for these resources" (Clotfelter, 2013, p 7).Then, for more restricted data, in-house servers can provide an extra layer of security to help ensure that such sensitive data remains in proper hands. To protect such restricted data, proper identity management strategies should include "a cross functional client and technical team abstracted requirements for updates" (Clotfelter, 2013, p 5). Thus, enterprise organizations must rely on a tiered network infrastructure that provides a number of different levels of security for various elements of the enterprise organization.

Security Plan

Security plans are a necessary part of it protection precautions.

It is important that security plans are flexible and fluid in order to adapt, both to the internal changes of the enterprise organization, but also to the constantly evolving external threat of hackers and security breaches (Clotfelter, 2013). It security systems must be able to adapt to changing needs within the organization which they protect. Here, the research suggests that "the enterprise security architecture must ensure confidentiality, integrity, and availability throughout the enterprise and align with the corporate business objectives" (Arconati, 2002, p 2). It must help facilitate the meeting organizational goals, by securing a solid ground free of technological threats for the organization to grow. As such, all security plans must be highly detailed and tailored to each organization's specific goals and objectives. Specific goals may hinder some aspects of more general it security plan, and must be adapted in order to fit organizational needs. In this sense, "the objective of enterprise security architecture is to provide the conceptual design of the network security infrastructure, related to security mechanisms, and related to security policies and procedures," yet still able to adapt based on its conceptual nature (Arconati, 2002, p 2). Additionally, the threat of external technology develops a rapid pace. This research has already evaluated the sophisticated nature of attacks on enterprise it systems. As previously discussed, it threats are constantly changing, and are thus an incredible dangerous and intangible enemy to fight. Stiff security plans that do not have room for adaptations in IDS systems or penetration testing will surely lead to an enterprise organization falling victim to the latest in hacker technology.

.Government Regulations

Because of the nature of enterprise business, most organizations within this category are required to follow a number of regulations in regard to it safety. According to the research, "information security is partly a technical problem, but has significant procedural, administrative, physical, and personal components as well" (Arconati, 2002, p 4). As a result, there are a variety of regulatory bodies that enforce regulations that may hinder potential elements within a security plan. Federal and local regulations can have an impact on how the organization's security policy is created and enforced. Many federal regulations force organizations to have certain elements within the protection systems in order to be effective against particular and well-known attacks. Many regulations in force required firewalls, antivirus protection, IDS, encryption, and restricted access based on position within the organization (U.S. Bureau of Industry and Security, 2013). It is important for all enterprise organizations follow these requirements to the T. In order to prevent not only legal ramifications, but a general consumer mistrust for not providing the most effective security measures, especially with so many variations in local regions.