GFI Turn-Around IT Security Strategy and Network Design
This paper presents a turnaround information technology strategy for Global Finance, Inc. (GFI), a financial services company whose Oracle database has been compromised by malicious attackers. The paper identifies critical security gaps across authentication mechanisms, LAN and WAN configurations, perimeter defenses, and remote access procedures. It proposes a detailed remediation plan encompassing password policy design, VLAN segmentation, WPA2 wireless security, CHAP-based WAN authentication, firewall and IDS deployment, VPN access controls, and a secure cloud computing architecture. The paper also addresses disaster recovery planning and the risks posed by unencrypted VPN traffic, concluding with recommendations for building a capable internal IT department to sustain long-term network security.
- Introduction: GFI's Security Posture and Business Risk: Overview of GFI's neglected IT security and risks
- Authentication Technology Gaps and Recommended Policy: Weak authentication mechanisms and password policy fixes
- Network Security Issues and Mitigation Measures: LAN and WAN vulnerabilities and recommended solutions
- Access Points to GFI's Network: Internal and external network access points enumerated
- Designing Secure Authentication and Network Security for GFI: Full security design including VLANs, encryption, and IDS
- WAN Authentication and Perimeter Security: CHAP protocol, firewall, and perimeter defense design
- Remote VPN Access, Cloud Computing, and Conclusion: VPN access controls, cloud architecture, and final recommendations
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- It systematically moves from problem identification to solution design, giving the reader a clear cause-and-effect narrative across each security domain.
- Technical recommendations are grounded in real protocols and tools (CHAP, WPA2, SSH, VLANs, IDS), making the proposals actionable rather than generic.
- The paper addresses multiple network layers — physical Wi-Fi signal range, authentication protocols, traffic encryption, and application-level access — demonstrating breadth of security thinking.
- Concrete policy language (e.g., minimum password length, 90-day rotation, lockout thresholds) illustrates how to translate strategic intent into operational controls.
Key academic technique demonstrated
The paper demonstrates applied problem-solution structuring: each identified vulnerability is paired with a specific technical countermeasure, and both the rationale and the implementation mechanism are explained. This technique is characteristic of professional IT security reports and helps readers understand not just what to do but why each control addresses the stated risk.
Structure breakdown
The paper opens with a business-context framing that establishes the stakes of security failure for a financial firm. It then proceeds through authentication gaps, LAN/WAN vulnerabilities, access point enumeration, a full security design proposal (authentication policy, VLAN strategy, encryption, IDS, backups), WAN authentication protocols (PAP vs. CHAP), perimeter security, remote VPN design, and finally a secure cloud computing architecture. A conclusion ties the recommendations back to organizational risk and cost-benefit considerations.
Introduction: GFI's Security Posture and Business Risk
Global Finance, Inc. (GFI) operates in the financial services industry — a sector that demands tight security policies and robust strategies across all aspects of its network infrastructure. GFI has, however, given insufficient attention to its IT department, particularly to network security, and the resulting gaps have been exploited by malicious attackers. This is evident from the fact that the company's Oracle database has been compromised in terms of availability, confidentiality, and integrity. For organizations in the finance industry, maintaining the confidentiality, integrity, and availability of their databases is among their most critical assets. A single policy gap or implementation failure can lead to losses significant enough to threaten the organization's viability.
Any financial organization requires a strong IT department capable of designing sound policies, implementing them carefully, monitoring systems continuously, and responding to breaches promptly. To perform these functions and safeguard organizational assets, such a department requires an adequate budget and genuine commitment from senior management.
Several gaps in GFI's network security and technology strategy can be identified from the available information. The following sections discuss these gaps and explain how each one exposes the organization to specific risks, followed by a comprehensive remediation design.
Authentication Technology Gaps and Recommended Policy
Authentication is a critical element of information technology asset protection. Various authentication mechanisms are available to organizations seeking to prevent unauthorized access to their resources and to preserve the confidentiality, availability, and integrity of their data. Common mechanisms include standard username and password combinations, biometric authentication, and multi-factor approaches that combine two or more methods to strengthen security (Cole et al., 1978).
GFI does not appear to treat authentication as an important component of its IT strategy. Authentication controls in any organization should flow from a formal policy through to implementation by a capable IT department. Based on the information available, GFI lacks a defined policy specifying the most appropriate authentication mechanisms for ensuring that only authorized individuals access particular resources. Without such a policy, the IT department has no clear mandate to implement authentication controls. The GFI IT department should therefore prioritize the design of a formal authentication and accountability policy (Guichard & Apcar, 2001).
A practical and effective authentication policy can be built around a combination of staff-unique usernames and passwords meeting defined quality parameters. Unique staff identification numbers can serve as user IDs, ensuring accountability for all system interactions. Alongside usernames, passwords should meet standards covering the following parameters:
- Minimum password length
- Complexity requirements (alphanumeric and special characters)
- Password expiry intervals
- Lockout durations after repeated failed login attempts
- Maximum number of incorrect password attempts before lockout
- A requirement to change passwords on first logon
Weak authentication mechanisms represent a significant attack surface that black-hat hackers readily exploit to compromise organizational resources (Mark & Lozano, 2010).
The evidence at GFI indicates that attackers have already accessed its systems and caused measurable harm. The IT department observed a sudden, large surge of data flowing into the Oracle database, which is consistent with a denial-of-service attack. The timing of this event — following the publication of an article about GFI — suggests that social engineering may have informed the attackers about the absence of robust authentication controls. Hackers may have subsequently launched brute-force attacks using tools such as Kali Linux to gain unauthorized access. Enforcing a password policy with account lockout thresholds would substantially reduce the effectiveness of brute-force attacks by denying repeated login attempts (Evans, 2003).
References
Barry, D. K. (2013). Web services, service-oriented architectures, and cloud computing. Morgan Kaufmann.
Camison, C. (2009). Connectivity and knowledge management in virtual organizations: Networking and developing interactive communications. Information Science Reference.
Cole, G. D., Branstad, D. K., & Institute for Computer Sciences and Technology. (1978). Design alternatives for computer network security. The Bureau.
Evans, S., & Institution of Electrical Engineers. (2003). Telecommunications network modelling, planning and design. Institution of Electrical Engineers.
Furht, B., & Escalante, A. (2010). Handbook of cloud computing. Springer.
Guichard, J., Pepelnjak, I., & Apcar, J. (2001). MPLS and VPN architectures. Cisco Press.
Harrington, J. L. (2005). Network security: A practical approach. Elsevier.
In Krcmar, H., In Reussner, R., & In Rumpe, B. (2014). Trusted cloud computing.
Krutz, R. L., & Vines, R. D. (2010). Cloud security: A comprehensive guide to secure cloud computing. Wiley.
Marks, E. A., & Lozano, B. (2010). Executive's guide to cloud computing. Wiley.
McCabe, J. D. (1998). Practical computer network analysis and design. Morgan Kaufmann.
Pardoe, T. D., & Snyder, G. (2005). Network security. Thomson.
Shneyderman, A., & Casati, A. (2003). Mobile VPN: Delivering advanced services in next generation wireless systems. Wiley.
Ye, N. (2008). Secure computer and network systems: Modeling, analysis and design. Wiley.
Zhao, H., & Li, X. (2013). Resource management in utility and cloud computing. Springer.
Create your account
Always verify citation format against your institution’s current style guide requirements.