GFI Turn-Around IT Security Strategy and Network Design

Introduction: GFI's Security Posture and Business Risk

Global Finance, Inc. (GFI) operates in the financial services industry — a sector that demands tight security policies and robust strategies across all aspects of its network infrastructure. GFI has, however, given insufficient attention to its IT department, particularly to network security, and the resulting gaps have been exploited by malicious attackers. This is evident from the fact that the company's Oracle database has been compromised in terms of availability, confidentiality, and integrity. For organizations in the finance industry, maintaining the confidentiality, integrity, and availability of their databases is among their most critical assets. A single policy gap or implementation failure can lead to losses significant enough to threaten the organization's viability.

Any financial organization requires a strong IT department capable of designing sound policies, implementing them carefully, monitoring systems continuously, and responding to breaches promptly. To perform these functions and safeguard organizational assets, such a department requires an adequate budget and genuine commitment from senior management.

Several gaps in GFI's network security and technology strategy can be identified from the available information. The following sections discuss these gaps and explain how each one exposes the organization to specific risks, followed by a comprehensive remediation design.

Authentication Technology Gaps and Recommended Policy

Authentication is a critical element of information technology asset protection. Various authentication mechanisms are available to organizations seeking to prevent unauthorized access to their resources and to preserve the confidentiality, availability, and integrity of their data. Common mechanisms include standard username and password combinations, biometric authentication, and multi-factor approaches that combine two or more methods to strengthen security (Cole et al., 1978).

GFI does not appear to treat authentication as an important component of its IT strategy. Authentication controls in any organization should flow from a formal policy through to implementation by a capable IT department. Based on the information available, GFI lacks a defined policy specifying the most appropriate authentication mechanisms for ensuring that only authorized individuals access particular resources. Without such a policy, the IT department has no clear mandate to implement authentication controls. The GFI IT department should therefore prioritize the design of a formal authentication and accountability policy (Guichard & Apcar, 2001).

A practical and effective authentication policy can be built around a combination of staff-unique usernames and passwords meeting defined quality parameters. Unique staff identification numbers can serve as user IDs, ensuring accountability for all system interactions. Alongside usernames, passwords should meet standards covering the following parameters:

Weak authentication mechanisms represent a significant attack surface that black-hat hackers readily exploit to compromise organizational resources (Mark & Lozano, 2010).

The evidence at GFI indicates that attackers have already accessed its systems and caused measurable harm. The IT department observed a sudden, large surge of data flowing into the Oracle database, which is consistent with a denial-of-service attack. The timing of this event — following the publication of an article about GFI — suggests that social engineering may have informed the attackers about the absence of robust authentication controls. Hackers may have subsequently launched brute-force attacks using tools such as Kali Linux to gain unauthorized access. Enforcing a password policy with account lockout thresholds would substantially reduce the effectiveness of brute-force attacks by denying repeated login attempts (Evans, 2003).

Network Security Issues and Mitigation Measures

GFI faces network security weaknesses on both its LAN and WAN. Beginning with the LAN, there is no clear separation between guest broadcast domains and staff broadcast domains. The current Wi-Fi implementation appears to allow any user who connects to the wireless network to reach organizational resources. Malicious individuals can exploit this to gain unauthorized access. The recommended solution is to implement VLANs that create a clear boundary between guest networks and staff networks. The guest network should reside in a dedicated VLAN, completely separated from staff VLANs. Access control rules should then be applied to prevent traffic from the guest VLAN from traversing staff VLANs. The only resource guests should be able to reach from the organization's LAN is the internet, achieved through access lists and network address translation (NAT) configured on the perimeter router (Furht, 2010).

Accessing the GFI LAN does not currently require strong authentication, which leaves the network vulnerable to man-in-the-middle attacks and other exploits. GFI appears to be using either WEP wireless security or an open access point — both of which are inadequate. WEP passwords can be cracked readily with widely available hacking tools, effectively granting attackers full access to the network. GFI should upgrade its wireless access points to WPA or WPA2 authentication standards, as these are significantly more resistant to cracking. This wireless authentication should be supplemented by a web-based authentication layer that requires unique usernames and passwords for all wireless users, providing an additional line of defense (In Krcmar et al., 2014).

The range of GFI's Wi-Fi signal is also a concern. The wireless signal currently extends beyond the organization's premises, enabling attackers to connect to the network from outside the building without being detected. Restricting the signal to within the premises would reduce this risk considerably, as any attacker attempting to exploit the wireless network would need to be physically present on-site and could be identified. The IT department should configure access point transmission power to limit signal coverage to GFI's physical boundaries. Alternatively, antenna orientation can be adjusted to direct signals away from areas outside the perimeter.

On the WAN side, data flowing through GFI's VPN tunnels is not encrypted. Unencrypted HTTP traffic traversing these tunnels can be intercepted using tools such as Cain and Abel. Once captured, packets can be stripped to reveal payload and header information, including usernames and passwords, which attackers can then use to log into network resources. GFI must ensure that all traffic transmitted through its VPN links is encrypted using strong algorithms and appropriate key lengths to prevent man-in-the-middle interception.

References

Barry, D. K. (2013). Web services, service-oriented architectures, and cloud computing. Morgan Kaufmann.

Camison, C. (2009). Connectivity and knowledge management in virtual organizations: Networking and developing interactive communications. Information Science Reference.

Cole, G. D., Branstad, D. K., & Institute for Computer Sciences and Technology. (1978). Design alternatives for computer network security. The Bureau.

Evans, S., & Institution of Electrical Engineers. (2003). Telecommunications network modelling, planning and design. Institution of Electrical Engineers.

Furht, B., & Escalante, A. (2010). Handbook of cloud computing. Springer.

Guichard, J., Pepelnjak, I., & Apcar, J. (2001). MPLS and VPN architectures. Cisco Press.

Harrington, J. L. (2005). Network security: A practical approach. Elsevier.

In Krcmar, H., In Reussner, R., & In Rumpe, B. (2014). Trusted cloud computing.

Krutz, R. L., & Vines, R. D. (2010). Cloud security: A comprehensive guide to secure cloud computing. Wiley.

Marks, E. A., & Lozano, B. (2010). Executive's guide to cloud computing. Wiley.

McCabe, J. D. (1998). Practical computer network analysis and design. Morgan Kaufmann.

Pardoe, T. D., & Snyder, G. (2005). Network security. Thomson.

Shneyderman, A., & Casati, A. (2003). Mobile VPN: Delivering advanced services in next generation wireless systems. Wiley.

Ye, N. (2008). Secure computer and network systems: Modeling, analysis and design. Wiley.

Zhao, H., & Li, X. (2013). Resource management in utility and cloud computing. Springer.