Organizational Behavior, Mintzbergs Managers - 3841 Words

Introduction The theory our group will be discussing and explaining in depth is the leadership styles of top management using Mintzberg’s managerial roles. Mintzerg named ten different roles, all separated into three categories. The first category is interpersonal. This includes figurehead, leader, and liason. The second category is informational which includes monitor, disseminator, and spokesperson. The last category is decisional which includes entrepreneur, disturbance handler, resource allocator, and negotiator. These roles are all used in the leadership styles of top management and we will find throughout research which roles are most frequently used and which seem to be the most effective. We have selected five companies in†¦show more content†¦The spokesperson role takes information from inside the organization and relates it to the public. Good disseminators and spokespersons need to have good communication skills in order to interact with company heads as well as the public. A successful spokesperson needs to be able to speak during conferences with confidence and also be able to maintain a consistent relationship with the media. If a manager is both a spokesperson and disseminator, they are excellent in communicating both inside and outside of the company. The decisional category includes four roles: entrepreneur, disturbance handler, resource allocator, and negotiator. The entrepreneur role is one in which managers take initiative and seek out opportunities that will both benefit the organization as well as create innovation. These managers work on major projects and are proactive in accomplishing goals as well as bettering the organization. The disturbance handler role refers to managers who are responsible in taking action when problems or disturbances occur. Every organization faces conflict, most of which are sudden and unexpected. The disturbance handler steps in to handle this conflict and attempts to resolve and correct the problem so that the organization can continue successfully. Organizations Identification/ Introduction and Descriptions Disney The Disney Company was founded by its namesake Walt Disney on October 16, 1923. In 1923, WaltShow MoreRelatedDifferent Types of Organizational Structure1406 Words   |  6 Pagesbelieve that not all organizations are alike. Henry Mintzberg explains five distinct organizational structures one should consider when determining coordination of an organization; simple structure, machine bureaucracy, professional bureaucracy, divisionalized form, and adhocracy. (Mintzberg, 1981) pg. 103. Simple structure as Mintzberg points out is, â€Å"not much more than one large unit consisting of one or a few top managers.† (Mintzberg, 1981) pg. 105. Machine bureaucracy is, â€Å"the offspringRead MoreDifferent Theories Of Management, By Henri Fayol And Henry Mintzberg1121 Words   |  5 Pagestheories of Management, include Henri Fayol and Henry Mintzberg. This section of this paper provides an overview of functions, roles and skills required of a manager. What is Management? Management can define as the process of reaching organisational goals by working with and through people and other organisational resources. (Management Innovation, 2008). According the Fayol theory, there are five primary roles of a manager. The five roles of a manager put forward by Henri Fayol may not fully expressRead MoreComparison of Management View Points by Henri Fayol vs. Henry Mintzberg 888 Words   |  4 PagesLike the two sides of a penny, Henri Fayol vs. Henry Mintzberg (Anon., 2010) Henri Fayol and Henry Mintzberg both have their own views on management. Of which, each man came up with their own management frameworks. This essay will take a closer look and compare the different management frameworks developed by Fayol and Mintzberg. A mining engineer and director in France, Henri Fayol, the vital early contributor to classical school of management theory believes that basic management and skills canRead MoreStrategic Management Position For Hilton Resorts892 Words   |  4 Pagesstrategic plan for the organization. In a management position for Hilton Resorts, this is especially important for employees to understand the aims and objectives set and the steps they will take to achieve them. As a company our first efforts for organizational improvement efforts as described by Wells (1998) are: †¢ Creating a vision of the organization’s future †¢ Developing a set of guiding principles (behavioral norms necessary to achieve that vision) †¢ Clarifying the mission, or core purpose, ofRead MoreCritiquethe Manager’s Job: Folklore and Fact1532 Words   |  7 Pages | | |1:00Pm | Individual Critique The Manager’s Job: Folklore and Fact By Henery Mintzberg Summary †¢ Does anyone can fully expound what is manager’s job? The purpose of the article is to explore this question based on our bias and the essence of the managerial work. From a academic viewpoint, management can be divided into four elementsRead MoreMintzberg; S Decisional Roles1625 Words   |  7 PagesTo inaugurate this essay, a simple introduction of the manager interviewed and her company will be given. Ms YKL who accepted the interview works in Company BSB. Company BSB operates in the private and service sector with the size of 20-99 people. It provides digital marketing services. Ms YKL holds a position as a senior manager for Publishers amp; Partners, it is a term used in the Digital Marketing industry. Publishers amp; Partners team also means product team and this team will negotiate andRead MoreCritiquethe Managers Job: Folklore and Fact1547 Words   |  7 Pages| | 1:00Pm | Individual Critique The Manager’s Job: Folklore and Fact By Henery Mintzberg Summary †¢ Does anyone can fully expound what is manager’s job? The purpose of the article is to explore this question based on our bias and the essence of the managerial work. From a academic viewpoint, management can be divided into fourRead MoreManagement1653 Words   |  7 Pagesmore important in modern market. The key to survival and building of future dominance is getting much more information than competitors. Managers from its literal meaning are the persons who manage others. Therefore, organizations need good managers to help them coordinate team work and solve problems effectively and efficiently. According to Mintzberg(1973), managers have three roles which are informational roles, interpersonal roles and decisional roles. This essay focuses on Mintzberg’s informationalRead MoreMintzberg’s Theories On Organizational Configuration2139 Words   |  9 PagesTheories On Organizational Configuration According to Mintzberg, every organized human activity – from the making of pottery to the placing of a man on the moon – gives rise to two fundamental and opposing requirements: the division of labour into various tasks to be performed and the coordination of those tasks to accomplish the activity. Structure is simply the way in which an organization divides labor into distinct tasks and achieves coordination of these tasks. According to Henry Mintzberg, organizationsRead MorePower And Politics Organization Theory974 Words   |  4 Pagesthrough family and schools. Ordinary people such as scholars hesitate to talk about power. It is often equated with force brutality, unethical behavior, manipulation, connivance, and subjugation. Power and Politics organization theory was derived from the â€Å"modern† structural organization in the 1970’s to its present today. In the â€Å"modern† structural, organizational economics, and systems/environment theories of organization, organizations are assumed to be rational institutions with its primary purpose

Drinking Age Essay - 677 Words

Drinking Age When teen-agers turn 18, they are told that they are adults and are sent into the world. They go to college, get a job, marry or join the military. They do grown-up things like vote, pay taxes and become parents. But they cant go to the pub for a beer because when it comes to liquor, they are still just kids. Wheres the fairness in the 21-and-older drinking law? First, it is necessary to question this law. Why is 21 the magical age that makes one intelligent and mature enough to consume alcohol? Surely, some adults abuse alcohol and some teenagers would be perfectly able to drink responsibly. This seemingly arbitrary number is associated with adulthood, as if the day a person turns 21 they know everything and†¦show more content†¦When they have the opportunity to drink, they do so in an irresponsible manner because drinking by these youth is seen as a badge of rebellion against authority and a symbol of adulthood. Clearly, this kind of devious attitude does not encourage responsible drinking. While young people in foreign countries learn to regard moderate drinking as an enjoyable social activity, young Americans view it as something they have to sneak around to do. If 18 year olds do not have legal access to even a beer in a public place, they are ill equipped to deal with the responsibilities that come with drinking when they do have the right. The drinking age should be lowered because the current age has no real basis. With a lowered drinking age, fewer problems will be present. Safe drinking needs to be taught, along with drinking in moderation. All of the arguments for having a raised drinking level or retaining the current one are weak. The problems that make a drinking age limit necessary are better solved through a lowered drinking level. Tightening the laws on underage drinking is wrong, as laws will still be broken and people 20 years, 364 days and younger will continue to consume alcohol. The answer to the problem of underage drinking is not to add more restrictions, rather, it is simple: get rid of the underage part. With the thrill of breaking the law gone and the access to the bar granted, people, especially collegeShow MoreRelatedLowering the Drinking Age1523 Words   |  7 Pages According to Andrew Herman, â€Å"Each year, 14,000 die from drinking too much. 600,000 are victims of alcohol related physical assault and 17,000 are a result of drunken driving deaths, many being innocent bystanders† (470). These massive numbers bring about an important realization: alcohol is a huge issue in America today. Although the problem is evident in Americans of all ages, the biggest issue is present in young adults and teens. In fact, teens begin to feel the effects of alcohol twice asRead MoreNot Lowering The Drinking Age989 Words   |  4 PagesLowering the Drinking Age There are many different views on drinking alcohol, especially underage drinking. Everyone has different views on the drinking age. Some think it should be lowered and others believe that it should be raised. Then some believe that it should remain the same at the age of twenty-one years old. Keeping the alcohol consumption age at twenty-one limits the dangers of not only those under twenty-one, but other people in the community. Lowering the drinking age will cause moreRead MoreDrinking Age1395 Words   |  6 Pagesis good or bad, helpful or hurtful. Some debates are simple with no major side effects such as would drinking gatorade or water better maximize the performance of athletes. Other debates involving drinking are not as simple, these debates involve alcohol drinking age. Both arguments can have different viewpoints, the difference is the significance in the argument. What should the legal drinking age in the United States be? Consuming alcohol has been done for many years. Unlike a typical beverageRead MoreDrinking Age1012 Words   |  5 PagesDrinking Age The drinking age was moved from 18 to 21 for a reason. The higher drinking age of 21 has saved many lives, helped reduce the amount of underage drinking, and therefore should not be lowered. Many studies from a large variety of sources have proven higher drinking ages have a positive effect on society. Alcohol is harmful to the development of younger people. Research has shown that an adult is less likely to bingeRead MoreLowering the Drinking Age1223 Words   |  5 Pagesâ€Å"What we’re doing now to prevent underage drinking isn’t working; it’s time to try something else.† Although many people argue that the National Minimum Drinking Age Act of 1964, which lowed the drinking age from eighteen to twenty one, was a good idea. David J Hanson a professor in the State University of New York believed that something needs to be done to make the United States a safer place to live. Is it fair that people in the United States can serve in the military, vote in elections, serveRead MoreThe Debate Of The Drinking Age959 Words   |  4 PagesThe drinking age has always been twenty-one in the United States, whenever it has been questioned on why twenty-one and not eighteen. The scientific answer has always been because the eighteen-year-old brai n is not fully developed yet. See what I have a hard time understanding is why eighteen-year-olds are considered adults at the age of eighteen, but we can’t have a drink. At eighteen you are allowed to buy cigarettes, join the army, change your name. I just don’t understand why at eighteen youRead MoreMilitary Drinking Age1983 Words   |  8 PagesDrinking Age of the Military: Should it be Lowered Jason M. Stoudt DeVry University The drinking age in the military is currently set at 21 years old as it is set for the rest of the country. There has been an age old statement widely used by those in the military, â€Å"If I am old enough to fight and die for my country, I should be old enough to drink†. The debate is out there that the drinking age should be lowered for all young adults from 18 years old to 21 years old. The idea behind the factRead MoreLowering The Drinking Age Of The Age981 Words   |  4 PagesHowever, there are those who remain persistent in their requests to drop the drinking age to a slightly lower option. Opposition to the legal drinking age of twenty-one has shown to have some support from mostly younger groups of people, without much validation as to why a lowered drinking age would be beneficial to our country as a whole. Yet, there are still some interesting arguments for those in favor of dropping the age at which it is legal to drink to eighteen. Consider how many young adults chooseRead MoreBinge Drinking vs the Drinking Age Essays829 Words   |  4 PagesEnglish 101 March 13, 2013 Binge Drinking VS the Drinking Age Presidents of college campuses around the nation face issues of underage drinking and binge drinking on a regular basis and realizes that it is a danger and a problem. â€Å"Alcohol consumption is the third leading cause of death in the U.S., a major contributing factor to unintentional injuries, the leading cause of death for youths and young adults, and accounts for an estimated 75,000 or more deaths in the United States annually† (WechslerRead MoreBinge Drinking And The Minimum Legal Drinking Age3264 Words   |  14 PagesKarzhova Marina Erin Beaver English Composition II 5 November 2014 Binge Drinking and the Minimum Legal Drinking Age In the year 1984, President Ronald Reagan enacted a law that increased the minimum drinking Age all U.S states to 21 years. As a result, it is believed that the mortality rates due to road accidents reduced from 5,000 in the 80’s to 2, 000 in 2005 (Dean-Mooney). However, the issue of binge drinking remains unsolved with learning institutions having to deal with it every semester. In

Network Security Plan and Implementation Report for GB

Question: Network Security Plan and Implementation Report for GB. Answer: Introduction Banking sector is one popular area where computer networks and IT systems are extensively used. Banks make use of IT network capabilities to improve their business outcomes and ensure efficiency in all their operations. In this report the network security implementation is analyzed for The Golden Bank (GB). The network security aspects are explored for security planning and for ensuring robust and adequate security measures are implemented in their systems. GB network is wide and big and faces lot of issues in maintaining and managing their IT network infrastructure. This is because the existing network found in their HQ, operations and branch offices use different protocols which are viewed as a security challenge since some of the native protocols are more vulnerable to latest attacks and viruses. Company Overview GB Headquarters is based in Tivoli which has 80 employees. There are two remote branch offices, one at Greenland and the second one at Faroe. In addition to this the operations building is located 60 Kms away from Tivoli and a warm backup storage site located 100 Kms away from Tivoli. In addition to this, there are 28 branch offices all connecting to operations office using frame relay or DSL links. All these 28 branch offices are similar in spread. GB also has 28 ATM machines which use SNA protocols to communicate with operations. Some file servers still run primitive IPX/SPX protocols and some of them use TCP/IP. The HQ and operations office and warm backup site use T3 leased line, HQ connects with Greenland and Faroe with T1 leased line. The warm site backup office is used for off-site data storage and this is done regularly to ensure protection. The bank also provides connectivity to outside vendors. The bank uses CISCO 2600 multiservice platform routers, has network attached sto rage (NAS), a combination of windows and Linux servers and desktops running Windows 8 OS. Each branch office, the operations office, remote offices and warm backup site has a LAN running on 10Base-T Ethernet, the LAN in HQ runs on 100Base-T Ethernet. Frame relay networks are used by branch offices and vendor to connect to operations center. Problems faced by GB: GB network is dependent on IPX/SPX, SNA and frame relay networks which the board feels is a bottleneck for further business growth. Further, GB is already pending huge amount of money in maintaining existing IT network and infrastructure with very less room for expansion. The bank also plans to expand its existing branch offices by 30% in which case the network must be scalable and flexible to accommodate more data volumes efficiently. GB also desires to have an efficient and high performing WAN/LAN with zero problems during their business operations. The scope of this report is to explore traditional WAN based solutions for managing all systems and LANs in GB through IP addressing, and to plug vulnerabilities in their servers, network devices and to protect all systems IT network infrastructure of GB from attacks and hackers. The security plans are explored and discussed for their importance in securing data and customer services in GB. Security plans and security measures will be implemented across all areas of GB operations to, Protecting all servers - web servers and database servers, NAS, servers in other offices/branches which connect to the operations center. Protection will also include individual systems and LANs at warm backup site, two remote offices, operations office and the LANs and individual systems found in all the 28 branch offices. Securing the network links between offices using appropriate encryption, decryption methods as needed. Providing redundancy at warm backup site for ensuring latest data is available from all the other offices to ensure business continuity. Positioning firewalls, proxies, DMZ, IDS/IPS, for protecting individual network devices, routers, switches, etc. Develop security implementation planning and test security vulnerabilities in the network. Network Design and Assumptions made The GB network consists of different networks all of them connected through some common routers and protocols. In order to secure the network in GB, the following general aspects are analyzed (Daya, 2008). They include, Network architecture for each network, security aspects on internet and so on. Types of attacks on servers, computers, networks, applications and data While access is provided on internet, the security measures to be implemented Understand the existing security, hardware, software, etc. GB requires cost effective high speed WAN links with accuracy between their offices. The internet can be considered as a network carrier, but since it is an open public network, GBs network packets on the internet are vulnerable to attacks. The option of VPN connectivity between operations center and branch office is considered instead of frame relay, because VPN (Ferguson Huston, 1998) can establish a more secure network compared to fame relay nets. A WAN network is essential for GB to connect all their sites and branch offices, ATMs and remote sites. WAN has the ability to connect multiple LANs (Rouse, 2007). The sites of GB are distributed however their database is centrally maintained and managed. At the same time, the data available on remote servers are also secured by real time backup at the warm backup site. In order to implement security measures at all LANs and WAN links along with devices, servers and individual computers, the top-down network design approach (Oppenheimer, 2011) is considered. The top-down approach begins with upper layers of the OSI model and moves down to further layers. In this approach the sessions layer and data transport layer is considered. The approach also takes into account GBs group structure, organization structure along with user and service authentication principles in order to fulfill certain controls in the network are fulfilled. The secured network for GB is designed to fulfill business goals that include, Improve productivity and communications along with providing data security to the organization. Reduce operational costs incurred for telecommunications and maximize business outputs Ensure information in the organization is highly protected for all employees in all locations of GB The network must also fulfill future information needs (Wen, 2001) and technical goals which is summarized as, Scalability: Scalability refers to the ability of the network to continue to function efficiently in spite of drastic changes in data flow volume or size. For good network performance in peak loads, scalability is important. Availability: Services and the network must be available at all time to users. Performance: Performance of a network is highly important to ensure GBs transactions are made efficiently and the network is able to work in its full capacity. Security: In enterprise networks, security is highly crucial particularly in enterprise networks because the computers keep connecting with other sites and also to the internet. Concerns related to security must be integrated in network design stages itself. It is important to devise a security plan and policies for the company to address the risks in deploying a secure project. The security plan must determine the consequences of an attack and make plans accordingly. The performance, availability and scalability are handled by the redundancy provided by T1 and T3 links between GBs offices and remote branches. Security is planned by establishing firewall and IDS at the periphery of the network and in internal LAN respectively. Security measures for user authentication and data encryption, establishing VPNs for connecting branch offices are considered in ensuring network security. Network Design and Architecture GB has one headquarters, two remote offices, an operations office, a warm site for offsite backup, remote offices and branches. Each office has a LAN with multiple users, routers for transferring packets and firewalls for authentication. The main router is located at operations site and warm site backup. This is the CISCO Immersive Tele-presence system as it can manage multiple protocols. The WAN plan for GB is shown in figure 1 with routers, firewalls and LAN at each location. All data passes through the main router in operations and routed to respective offices. For example, if any one branch office sends a packet to HQ, it is routed through main router. Figure 1: The WAN plan for GB Since, the entire LAN and WAN for GB is a TCP network, the router uses RIP protocol (Hendrick 1988) for routing packets from any one LAN to other LAN or subnet. For routing correctly RIP must be enabled in all routers. In the figure, the network addresses must be included in routing and interfaces participating in the WAN must be specified. This is done using the RIP command. RIP Version 2 is used to define routing tables in router. The network command is used to define connected subnets on routers. Subnets are included in routing updates because HQ has four subnets namely Finance, Accounting, Management and Administrative users. In addition to this each branch, remote offices, operations office and warm backup site, ATMs, outside support vendors are also available. RIP command must specify all IPs in each office and must also include network devices. In the GB networks, classful networks are also available in the form of outside support vendors. Classful network refer to IPs that use the GB network in addition to their existing IPs. Certain default routing updates are summarized in the network (Antoniou 2007) perimeter to establish a DMZ. RIP is used mainly to update routing tables automatically which is done as below: A router for example at remote office 1 (Faroe) may experience changes to an entry update in its routing table to include a new route. When the table in Faroe router is updated, this information is sent to other routers in the WAN to update tables automatically for this change In this way data packets across different locations in WAN is routed to their respective destinations Therefore RIP is used to define routing tables in routers in GB. IP addressing Network address in CIDR format is used for GB as it is a private IP. The private address 10.0.0.0 for GB will be subnetted across its locations by taking 3-bits as below: Number of subnets = 8 (23) Total number of hosts = 221 2 = 2097150 Subnet mask will be 255.254.0.0 The above is defined to expand the network in future. Table 1 shows the start and end IPs along with their broadcast address. Network Address First Address/n Last Address/n Broadcast Address 10.0.0.0 10.0.0.1/11 10.31.255.254/11 10.31.255.255 10.32.0.0 10.32.0.1/11 10.63.255.254/11 10.63.255.255 10.64.0.0 10.64.0.1/11 10.95.255.254/11 10.95.255.255 10.96.0.0 10.96.0.1/11 10.127.255.254/11 10.127.255.255 10.128.0.0 10.128.0.1/11 10.159.255.254/11 10.159.255.255 10.160.0.0 10.160.0.1/11 10.243.255.254/11 10.191.255.255 Table 1: GBs IP addressing scheme followed for their locations In the above table since HQ needs 80 IPs, the start address will be 10.160.1.1 and end with10.243.255.254. The router steps are given below: Router Network Address = 10.160.0.0/11 Password: gbwan Router Configuration Steps hostname hq hq(#) config t hq(config) interface fa0/1 hq(config-in) ip address 10.160.0.1 255.243.0.0 hq(config-in) no shutdown For VLAN Routing Branch office with Operations (one branch) operations(config) int fa0/0.1 operations(config-in) ip address 10.0.0.1 255.248.0.0 operations(config-in) no shutdown operations(config-in) encapsulation dot1q 2 VLAN Configuration for one branch vlan 2 name branch1 Likewise all 28 branch offices are defined, along with two remote offices at Faroe and Greenland. As each branch office, remote offices, and operations office have servers they must be defined in router. Similarly the warm back up site has network attached storage which must be taken into account in the routing table. Network Security Plan The main objective is to plan WAN security for GB due to increased threats and their use of old and obsolete protocols and systems. The network security plan is made by ensuring there is no disruption to their existing network and business operations. The following aspects are considered in GBs security plan: Identify all assets in GB along with the risks and vulnerabilities posed by each element Developing security policies and procedures for implementation Implement antivirus software in all systems (servers, PCs, etc) Testing and implementing security procedures in all GB locations Data confidentiality, privacy and integrity are highly important in WAN security. Confidentiality: In confidentiality, information contained in the network is private. The data stored in servers in GB networks is meant for private use and must be protected. Integrity: Data integrity is an important network security aspect as data is prevented from getting modified or corrupted by attackers. Non-repudiation: Ensures users will not deny using GB network. The above five aspects are highly important to be considered in order to have effective secured network system (Dowd, 1998). Physical security measures such as controlled user access by authentication process, establishing access levels in system and encryption are implemented (Oppenheimer 2011). User and access control measures will be implemented across all services, databases, servers and VPNs. The security aspects of RIPv2 protocol is also examined (Davis, 2006). Two authentication methods are available with this protocol namely plain-text and message digest 5 (MD5) (Khalid, et al., 2008). In routers plain-text is the default method, but they must be configured using MD5 because this method encrypts the password in router and secures the table. Hence, if a hacker is able to get access to physical environment the WAN can become unsecured (Parziale, et al., 2006). WAN authentication will occur when updates are received by a trusted source or router. Hence, in routers authentication ensures the entry of corrupt or malicious update, or denial of service (DoS) attacks (Rivest, 1992). Therefore, MD5 algorithm is used for authentication. From the above, the network security plan for GB network will consist of, A security plan consisting of standards, guidelines, policies, implementing IDS, procedures for managing incidents and so on are developed (Winkler, 2011). Security policies are defined for the entire GB network, which includes, accessing internet, user policies, privacy matters, etc (FCC, 2012). Developing the implementation strategy which outlines steps of the plan for action in GB. Gain support from management. Network security strategies and implementation is an organization wide activity. This must be supported by IT, business and all employees in GB. Training to staff, technical training to IT staff in managing the plan must be imparted. Finally the security systems are implemented. Implementing network security technology In the WAN firewalls are implemented in the periphery of the network to prevent outside attacks and when users access the internet. A general implementation of a firewall for GB is shown in figure 2. Firewalls are used in periphery of GB network and positioned at different places in the network to prevent IP address that do not meet the specified criteria in routing tables. Since GB network uses the internet for VPNs, security measures such as port address translation (PAT) are implemented to stop attacks from outside. Figure 2: An implementation of firewall Further, the main CISCO router will ensure packet filtering, and IDS is used in GB to enhance security of data because this is an additional layer of security to prevent attacks that pass through perimeter firewall. The positioning of IDS for GB is illustrated in figure 3. Figure 3: Use of IDS along with firewall for network security Network services in GB must be analyzed for its implications for users (Zwicky, 2001). For instance, if a user has database server access, the user must be examined for web server and access to file server. Security areas are classified as trust and untrusted areas. For instance, the internet is an untrust area. In GB network DMZ zones are defined to show if the network is fully secure or insecure. The DMZ zone will provide access to untrusted users, i.e., users gaining access from internet. Normally, web and mail servers fall in DMZ zone. Database servers, authentication servers, file servers and storage systems fall in the protected zone for GB. Virtual LANs (VLAN) are implemented to ensure protection of servers. The protocols implemented in GB for network management are ICMP, RCP, TCP/IP and SNMP for monitoring availability, utilization and latency in WAN (Leskiw, 2005). In addition to this the other protocols used in configuring network security and consistency include WMI, HTTP, UDP MD5, RIP v2. The next step is to define ACLs. For example, In ACL Administration is not allowed to access Management and Accounting Using extended list ip access-list extended vlan_administration deny ip 10.8.0.0 0.7.255.255 10.64.0.2 0.31.255.255 deny ip 10.8.0.0 0.7.255.255 10.64.0.3 0.31.255.255 int fa0/0.2 ip access-group vlan_administration out Faroe not allowed to access warm site ip access-list extended vlan_faroe deny ip 10.32.0.0 0.7.255.255 10.64.0.2 0.31.255.255 permit ip 10.32.0.0 0.7.255.255 10.64.0.3 0.31.255.255 int fa0/0.4 ip access-group vlan_faroe out The ACL is configured in GB for all the sites. The deny ip command will ensure the hosts belonging to administration and Faroe fulfill the access conditions as required by GB. Testing The next stage is testing. The network and system configurations are considered in testing (Thai, 2012). In addition to this network penetration tests are done to prevent malicious IP from entering the network. The entire security technology is tested using Universal Threat Management System (UTMS) and software tool named Endian FW is used to monitor network traffic and view malicious behaviour. Testing can also be done using tool named CISCO flow, which is also sued for trouble-shooting (Kunth, 2011). The final implementation for network security is illustrated in figure 4. Figure 4: Network security implementation in GB To test packet transfer from any user IP to another remote IP on the network, ping command is used. The remote IP will respond as shown in screenshotfigure 5. Figure 5: Ping command and response from staff IP The network packet flow is illustrated in figure 6 for GB. Figure 6: Network packet flow in GB The intrusions are monitored from packet flows using UTMS and monitoring software. Conclusions In this report, the redesign of GB enterprise network is explored for ensuring network security to protect their systems and infrastructure. The security solution is achieved through the implementation of network planning, security planning and implementation of secured network to connect their offices with the enterprise network. The existing infrastructure for GB is examined for threats, attacks and performance impact on the network. The redesign of the network is explored by considering different aspects of business and IT operations. The aspects of implementing a security policy and operating procedures are emphasized. The security solution is shown in figure 1 to show the positioning of firewalls, routers and connectivity between different locations. The secured network is implemented using standard protocols with adequate scope for expansion in future. The security implementation is demonstrated using UTMS and Endian FW monitoring and network management software to test the des igned network. References Antoniou, Stelios (2007). How to configure RIP Version 2. Daya, B., (2008), Network Security: History, Importance, and Future. Florida, USA: University of Florida Department of Electrical and Computer Engineering. Davis, David (2006). Cisco administration 101: Know the basics about RIPv2. Dowd, P.W., (1998), Network security: it's time to take it seriously. Computer , 24-28. FCC (2012), Cyber Security Planning Guide. Federal Communications Commission. Ferguson, P. G. Huston, (1998), What is a VPN? Cisco Systems. Hedrick, C. (1988). Routing Information Protocol RFC1058. Network Working Group, Rutgers University. Khalid, S., T. Hatim, A. Elzoghabi and S. Mohammad (2008), Performance Evaluation of Secured Versus non-secured EIGRP Routing Protocol. Proceedings of SAM. pp.174-178. Kunath, A. (2011), Enterprise Network Testing . Indianapolis : Cisco press. Leskiw, Aaron (2015), Techniques for Monitoring WAN Links. Oppenheimer, Priscilla, (2011), Top-Down Network Design. 3rd ed. IN, USA: Cisco Systems Inc. Parziale, Lydia, David T. Britt, Chuck Davis, Jason Forrester, Wei Liu, Carolyn Matthews and Nicholas Rosselot (2006). TCP/IP Tutorial and Technical Overview. 8th ed. USA: IBM Corporation.

Network Security Plan and Implementation Report for GB

Question: Network Security Plan and Implementation Report for GB. Answer: Introduction Banking sector is one popular area where computer networks and IT systems are extensively used. Banks make use of IT network capabilities to improve their business outcomes and ensure efficiency in all their operations. In this report the network security implementation is analyzed for The Golden Bank (GB). The network security aspects are explored for security planning and for ensuring robust and adequate security measures are implemented in their systems. GB network is wide and big and faces lot of issues in maintaining and managing their IT network infrastructure. This is because the existing network found in their HQ, operations and branch offices use different protocols which are viewed as a security challenge since some of the native protocols are more vulnerable to latest attacks and viruses. Company Overview GB Headquarters is based in Tivoli which has 80 employees. There are two remote branch offices, one at Greenland and the second one at Faroe. In addition to this the operations building is located 60 Kms away from Tivoli and a warm backup storage site located 100 Kms away from Tivoli. In addition to this, there are 28 branch offices all connecting to operations office using frame relay or DSL links. All these 28 branch offices are similar in spread. GB also has 28 ATM machines which use SNA protocols to communicate with operations. Some file servers still run primitive IPX/SPX protocols and some of them use TCP/IP. The HQ and operations office and warm backup site use T3 leased line, HQ connects with Greenland and Faroe with T1 leased line. The warm site backup office is used for off-site data storage and this is done regularly to ensure protection. The bank also provides connectivity to outside vendors. The bank uses CISCO 2600 multiservice platform routers, has network attached sto rage (NAS), a combination of windows and Linux servers and desktops running Windows 8 OS. Each branch office, the operations office, remote offices and warm backup site has a LAN running on 10Base-T Ethernet, the LAN in HQ runs on 100Base-T Ethernet. Frame relay networks are used by branch offices and vendor to connect to operations center. Problems faced by GB: GB network is dependent on IPX/SPX, SNA and frame relay networks which the board feels is a bottleneck for further business growth. Further, GB is already pending huge amount of money in maintaining existing IT network and infrastructure with very less room for expansion. The bank also plans to expand its existing branch offices by 30% in which case the network must be scalable and flexible to accommodate more data volumes efficiently. GB also desires to have an efficient and high performing WAN/LAN with zero problems during their business operations. The scope of this report is to explore traditional WAN based solutions for managing all systems and LANs in GB through IP addressing, and to plug vulnerabilities in their servers, network devices and to protect all systems IT network infrastructure of GB from attacks and hackers. The security plans are explored and discussed for their importance in securing data and customer services in GB. Security plans and security measures will be implemented across all areas of GB operations to, Protecting all servers - web servers and database servers, NAS, servers in other offices/branches which connect to the operations center. Protection will also include individual systems and LANs at warm backup site, two remote offices, operations office and the LANs and individual systems found in all the 28 branch offices. Securing the network links between offices using appropriate encryption, decryption methods as needed. Providing redundancy at warm backup site for ensuring latest data is available from all the other offices to ensure business continuity. Positioning firewalls, proxies, DMZ, IDS/IPS, for protecting individual network devices, routers, switches, etc. Develop security implementation planning and test security vulnerabilities in the network. Network Design and Assumptions made The GB network consists of different networks all of them connected through some common routers and protocols. In order to secure the network in GB, the following general aspects are analyzed (Daya, 2008). They include, Network architecture for each network, security aspects on internet and so on. Types of attacks on servers, computers, networks, applications and data While access is provided on internet, the security measures to be implemented Understand the existing security, hardware, software, etc. GB requires cost effective high speed WAN links with accuracy between their offices. The internet can be considered as a network carrier, but since it is an open public network, GBs network packets on the internet are vulnerable to attacks. The option of VPN connectivity between operations center and branch office is considered instead of frame relay, because VPN (Ferguson Huston, 1998) can establish a more secure network compared to fame relay nets. A WAN network is essential for GB to connect all their sites and branch offices, ATMs and remote sites. WAN has the ability to connect multiple LANs (Rouse, 2007). The sites of GB are distributed however their database is centrally maintained and managed. At the same time, the data available on remote servers are also secured by real time backup at the warm backup site. In order to implement security measures at all LANs and WAN links along with devices, servers and individual computers, the top-down network design approach (Oppenheimer, 2011) is considered. The top-down approach begins with upper layers of the OSI model and moves down to further layers. In this approach the sessions layer and data transport layer is considered. The approach also takes into account GBs group structure, organization structure along with user and service authentication principles in order to fulfill certain controls in the network are fulfilled. The secured network for GB is designed to fulfill business goals that include, Improve productivity and communications along with providing data security to the organization. Reduce operational costs incurred for telecommunications and maximize business outputs Ensure information in the organization is highly protected for all employees in all locations of GB The network must also fulfill future information needs (Wen, 2001) and technical goals which is summarized as, Scalability: Scalability refers to the ability of the network to continue to function efficiently in spite of drastic changes in data flow volume or size. For good network performance in peak loads, scalability is important. Availability: Services and the network must be available at all time to users. Performance: Performance of a network is highly important to ensure GBs transactions are made efficiently and the network is able to work in its full capacity. Security: In enterprise networks, security is highly crucial particularly in enterprise networks because the computers keep connecting with other sites and also to the internet. Concerns related to security must be integrated in network design stages itself. It is important to devise a security plan and policies for the company to address the risks in deploying a secure project. The security plan must determine the consequences of an attack and make plans accordingly. The performance, availability and scalability are handled by the redundancy provided by T1 and T3 links between GBs offices and remote branches. Security is planned by establishing firewall and IDS at the periphery of the network and in internal LAN respectively. Security measures for user authentication and data encryption, establishing VPNs for connecting branch offices are considered in ensuring network security. Network Design and Architecture GB has one headquarters, two remote offices, an operations office, a warm site for offsite backup, remote offices and branches. Each office has a LAN with multiple users, routers for transferring packets and firewalls for authentication. The main router is located at operations site and warm site backup. This is the CISCO Immersive Tele-presence system as it can manage multiple protocols. The WAN plan for GB is shown in figure 1 with routers, firewalls and LAN at each location. All data passes through the main router in operations and routed to respective offices. For example, if any one branch office sends a packet to HQ, it is routed through main router. Figure 1: The WAN plan for GB Since, the entire LAN and WAN for GB is a TCP network, the router uses RIP protocol (Hendrick 1988) for routing packets from any one LAN to other LAN or subnet. For routing correctly RIP must be enabled in all routers. In the figure, the network addresses must be included in routing and interfaces participating in the WAN must be specified. This is done using the RIP command. RIP Version 2 is used to define routing tables in router. The network command is used to define connected subnets on routers. Subnets are included in routing updates because HQ has four subnets namely Finance, Accounting, Management and Administrative users. In addition to this each branch, remote offices, operations office and warm backup site, ATMs, outside support vendors are also available. RIP command must specify all IPs in each office and must also include network devices. In the GB networks, classful networks are also available in the form of outside support vendors. Classful network refer to IPs that use the GB network in addition to their existing IPs. Certain default routing updates are summarized in the network (Antoniou 2007) perimeter to establish a DMZ. RIP is used mainly to update routing tables automatically which is done as below: A router for example at remote office 1 (Faroe) may experience changes to an entry update in its routing table to include a new route. When the table in Faroe router is updated, this information is sent to other routers in the WAN to update tables automatically for this change In this way data packets across different locations in WAN is routed to their respective destinations Therefore RIP is used to define routing tables in routers in GB. IP addressing Network address in CIDR format is used for GB as it is a private IP. The private address 10.0.0.0 for GB will be subnetted across its locations by taking 3-bits as below: Number of subnets = 8 (23) Total number of hosts = 221 2 = 2097150 Subnet mask will be 255.254.0.0 The above is defined to expand the network in future. Table 1 shows the start and end IPs along with their broadcast address. Network Address First Address/n Last Address/n Broadcast Address 10.0.0.0 10.0.0.1/11 10.31.255.254/11 10.31.255.255 10.32.0.0 10.32.0.1/11 10.63.255.254/11 10.63.255.255 10.64.0.0 10.64.0.1/11 10.95.255.254/11 10.95.255.255 10.96.0.0 10.96.0.1/11 10.127.255.254/11 10.127.255.255 10.128.0.0 10.128.0.1/11 10.159.255.254/11 10.159.255.255 10.160.0.0 10.160.0.1/11 10.243.255.254/11 10.191.255.255 Table 1: GBs IP addressing scheme followed for their locations In the above table since HQ needs 80 IPs, the start address will be 10.160.1.1 and end with10.243.255.254. The router steps are given below: Router Network Address = 10.160.0.0/11 Password: gbwan Router Configuration Steps hostname hq hq(#) config t hq(config) interface fa0/1 hq(config-in) ip address 10.160.0.1 255.243.0.0 hq(config-in) no shutdown For VLAN Routing Branch office with Operations (one branch) operations(config) int fa0/0.1 operations(config-in) ip address 10.0.0.1 255.248.0.0 operations(config-in) no shutdown operations(config-in) encapsulation dot1q 2 VLAN Configuration for one branch vlan 2 name branch1 Likewise all 28 branch offices are defined, along with two remote offices at Faroe and Greenland. As each branch office, remote offices, and operations office have servers they must be defined in router. Similarly the warm back up site has network attached storage which must be taken into account in the routing table. Network Security Plan The main objective is to plan WAN security for GB due to increased threats and their use of old and obsolete protocols and systems. The network security plan is made by ensuring there is no disruption to their existing network and business operations. The following aspects are considered in GBs security plan: Identify all assets in GB along with the risks and vulnerabilities posed by each element Developing security policies and procedures for implementation Implement antivirus software in all systems (servers, PCs, etc) Testing and implementing security procedures in all GB locations Data confidentiality, privacy and integrity are highly important in WAN security. Confidentiality: In confidentiality, information contained in the network is private. The data stored in servers in GB networks is meant for private use and must be protected. Integrity: Data integrity is an important network security aspect as data is prevented from getting modified or corrupted by attackers. Non-repudiation: Ensures users will not deny using GB network. The above five aspects are highly important to be considered in order to have effective secured network system (Dowd, 1998). Physical security measures such as controlled user access by authentication process, establishing access levels in system and encryption are implemented (Oppenheimer 2011). User and access control measures will be implemented across all services, databases, servers and VPNs. The security aspects of RIPv2 protocol is also examined (Davis, 2006). Two authentication methods are available with this protocol namely plain-text and message digest 5 (MD5) (Khalid, et al., 2008). In routers plain-text is the default method, but they must be configured using MD5 because this method encrypts the password in router and secures the table. Hence, if a hacker is able to get access to physical environment the WAN can become unsecured (Parziale, et al., 2006). WAN authentication will occur when updates are received by a trusted source or router. Hence, in routers authentication ensures the entry of corrupt or malicious update, or denial of service (DoS) attacks (Rivest, 1992). Therefore, MD5 algorithm is used for authentication. From the above, the network security plan for GB network will consist of, A security plan consisting of standards, guidelines, policies, implementing IDS, procedures for managing incidents and so on are developed (Winkler, 2011). Security policies are defined for the entire GB network, which includes, accessing internet, user policies, privacy matters, etc (FCC, 2012). Developing the implementation strategy which outlines steps of the plan for action in GB. Gain support from management. Network security strategies and implementation is an organization wide activity. This must be supported by IT, business and all employees in GB. Training to staff, technical training to IT staff in managing the plan must be imparted. Finally the security systems are implemented. Implementing network security technology In the WAN firewalls are implemented in the periphery of the network to prevent outside attacks and when users access the internet. A general implementation of a firewall for GB is shown in figure 2. Firewalls are used in periphery of GB network and positioned at different places in the network to prevent IP address that do not meet the specified criteria in routing tables. Since GB network uses the internet for VPNs, security measures such as port address translation (PAT) are implemented to stop attacks from outside. Figure 2: An implementation of firewall Further, the main CISCO router will ensure packet filtering, and IDS is used in GB to enhance security of data because this is an additional layer of security to prevent attacks that pass through perimeter firewall. The positioning of IDS for GB is illustrated in figure 3. Figure 3: Use of IDS along with firewall for network security Network services in GB must be analyzed for its implications for users (Zwicky, 2001). For instance, if a user has database server access, the user must be examined for web server and access to file server. Security areas are classified as trust and untrusted areas. For instance, the internet is an untrust area. In GB network DMZ zones are defined to show if the network is fully secure or insecure. The DMZ zone will provide access to untrusted users, i.e., users gaining access from internet. Normally, web and mail servers fall in DMZ zone. Database servers, authentication servers, file servers and storage systems fall in the protected zone for GB. Virtual LANs (VLAN) are implemented to ensure protection of servers. The protocols implemented in GB for network management are ICMP, RCP, TCP/IP and SNMP for monitoring availability, utilization and latency in WAN (Leskiw, 2005). In addition to this the other protocols used in configuring network security and consistency include WMI, HTTP, UDP MD5, RIP v2. The next step is to define ACLs. For example, In ACL Administration is not allowed to access Management and Accounting Using extended list ip access-list extended vlan_administration deny ip 10.8.0.0 0.7.255.255 10.64.0.2 0.31.255.255 deny ip 10.8.0.0 0.7.255.255 10.64.0.3 0.31.255.255 int fa0/0.2 ip access-group vlan_administration out Faroe not allowed to access warm site ip access-list extended vlan_faroe deny ip 10.32.0.0 0.7.255.255 10.64.0.2 0.31.255.255 permit ip 10.32.0.0 0.7.255.255 10.64.0.3 0.31.255.255 int fa0/0.4 ip access-group vlan_faroe out The ACL is configured in GB for all the sites. The deny ip command will ensure the hosts belonging to administration and Faroe fulfill the access conditions as required by GB. Testing The next stage is testing. The network and system configurations are considered in testing (Thai, 2012). In addition to this network penetration tests are done to prevent malicious IP from entering the network. The entire security technology is tested using Universal Threat Management System (UTMS) and software tool named Endian FW is used to monitor network traffic and view malicious behaviour. Testing can also be done using tool named CISCO flow, which is also sued for trouble-shooting (Kunth, 2011). The final implementation for network security is illustrated in figure 4. Figure 4: Network security implementation in GB To test packet transfer from any user IP to another remote IP on the network, ping command is used. The remote IP will respond as shown in screenshotfigure 5. Figure 5: Ping command and response from staff IP The network packet flow is illustrated in figure 6 for GB. Figure 6: Network packet flow in GB The intrusions are monitored from packet flows using UTMS and monitoring software. Conclusions In this report, the redesign of GB enterprise network is explored for ensuring network security to protect their systems and infrastructure. The security solution is achieved through the implementation of network planning, security planning and implementation of secured network to connect their offices with the enterprise network. The existing infrastructure for GB is examined for threats, attacks and performance impact on the network. The redesign of the network is explored by considering different aspects of business and IT operations. The aspects of implementing a security policy and operating procedures are emphasized. The security solution is shown in figure 1 to show the positioning of firewalls, routers and connectivity between different locations. The secured network is implemented using standard protocols with adequate scope for expansion in future. The security implementation is demonstrated using UTMS and Endian FW monitoring and network management software to test the des igned network. References Antoniou, Stelios (2007). How to configure RIP Version 2. Daya, B., (2008), Network Security: History, Importance, and Future. Florida, USA: University of Florida Department of Electrical and Computer Engineering. Davis, David (2006). Cisco administration 101: Know the basics about RIPv2. Dowd, P.W., (1998), Network security: it's time to take it seriously. Computer , 24-28. FCC (2012), Cyber Security Planning Guide. Federal Communications Commission. Ferguson, P. G. Huston, (1998), What is a VPN? Cisco Systems. Hedrick, C. (1988). Routing Information Protocol RFC1058. Network Working Group, Rutgers University. Khalid, S., T. Hatim, A. Elzoghabi and S. Mohammad (2008), Performance Evaluation of Secured Versus non-secured EIGRP Routing Protocol. Proceedings of SAM. pp.174-178. Kunath, A. (2011), Enterprise Network Testing . Indianapolis : Cisco press. Leskiw, Aaron (2015), Techniques for Monitoring WAN Links. Oppenheimer, Priscilla, (2011), Top-Down Network Design. 3rd ed. IN, USA: Cisco Systems Inc. Parziale, Lydia, David T. Britt, Chuck Davis, Jason Forrester, Wei Liu, Carolyn Matthews and Nicholas Rosselot (2006). TCP/IP Tutorial and Technical Overview. 8th ed. USA: IBM Corporation.

Network Security Plan and Implementation Report for GB

Question: Network Security Plan and Implementation Report for GB. Answer: Introduction Banking sector is one popular area where computer networks and IT systems are extensively used. Banks make use of IT network capabilities to improve their business outcomes and ensure efficiency in all their operations. In this report the network security implementation is analyzed for The Golden Bank (GB). The network security aspects are explored for security planning and for ensuring robust and adequate security measures are implemented in their systems. GB network is wide and big and faces lot of issues in maintaining and managing their IT network infrastructure. This is because the existing network found in their HQ, operations and branch offices use different protocols which are viewed as a security challenge since some of the native protocols are more vulnerable to latest attacks and viruses. Company Overview GB Headquarters is based in Tivoli which has 80 employees. There are two remote branch offices, one at Greenland and the second one at Faroe. In addition to this the operations building is located 60 Kms away from Tivoli and a warm backup storage site located 100 Kms away from Tivoli. In addition to this, there are 28 branch offices all connecting to operations office using frame relay or DSL links. All these 28 branch offices are similar in spread. GB also has 28 ATM machines which use SNA protocols to communicate with operations. Some file servers still run primitive IPX/SPX protocols and some of them use TCP/IP. The HQ and operations office and warm backup site use T3 leased line, HQ connects with Greenland and Faroe with T1 leased line. The warm site backup office is used for off-site data storage and this is done regularly to ensure protection. The bank also provides connectivity to outside vendors. The bank uses CISCO 2600 multiservice platform routers, has network attached sto rage (NAS), a combination of windows and Linux servers and desktops running Windows 8 OS. Each branch office, the operations office, remote offices and warm backup site has a LAN running on 10Base-T Ethernet, the LAN in HQ runs on 100Base-T Ethernet. Frame relay networks are used by branch offices and vendor to connect to operations center. Problems faced by GB: GB network is dependent on IPX/SPX, SNA and frame relay networks which the board feels is a bottleneck for further business growth. Further, GB is already pending huge amount of money in maintaining existing IT network and infrastructure with very less room for expansion. The bank also plans to expand its existing branch offices by 30% in which case the network must be scalable and flexible to accommodate more data volumes efficiently. GB also desires to have an efficient and high performing WAN/LAN with zero problems during their business operations. The scope of this report is to explore traditional WAN based solutions for managing all systems and LANs in GB through IP addressing, and to plug vulnerabilities in their servers, network devices and to protect all systems IT network infrastructure of GB from attacks and hackers. The security plans are explored and discussed for their importance in securing data and customer services in GB. Security plans and security measures will be implemented across all areas of GB operations to, Protecting all servers - web servers and database servers, NAS, servers in other offices/branches which connect to the operations center. Protection will also include individual systems and LANs at warm backup site, two remote offices, operations office and the LANs and individual systems found in all the 28 branch offices. Securing the network links between offices using appropriate encryption, decryption methods as needed. Providing redundancy at warm backup site for ensuring latest data is available from all the other offices to ensure business continuity. Positioning firewalls, proxies, DMZ, IDS/IPS, for protecting individual network devices, routers, switches, etc. Develop security implementation planning and test security vulnerabilities in the network. Network Design and Assumptions made The GB network consists of different networks all of them connected through some common routers and protocols. In order to secure the network in GB, the following general aspects are analyzed (Daya, 2008). They include, Network architecture for each network, security aspects on internet and so on. Types of attacks on servers, computers, networks, applications and data While access is provided on internet, the security measures to be implemented Understand the existing security, hardware, software, etc. GB requires cost effective high speed WAN links with accuracy between their offices. The internet can be considered as a network carrier, but since it is an open public network, GBs network packets on the internet are vulnerable to attacks. The option of VPN connectivity between operations center and branch office is considered instead of frame relay, because VPN (Ferguson Huston, 1998) can establish a more secure network compared to fame relay nets. A WAN network is essential for GB to connect all their sites and branch offices, ATMs and remote sites. WAN has the ability to connect multiple LANs (Rouse, 2007). The sites of GB are distributed however their database is centrally maintained and managed. At the same time, the data available on remote servers are also secured by real time backup at the warm backup site. In order to implement security measures at all LANs and WAN links along with devices, servers and individual computers, the top-down network design approach (Oppenheimer, 2011) is considered. The top-down approach begins with upper layers of the OSI model and moves down to further layers. In this approach the sessions layer and data transport layer is considered. The approach also takes into account GBs group structure, organization structure along with user and service authentication principles in order to fulfill certain controls in the network are fulfilled. The secured network for GB is designed to fulfill business goals that include, Improve productivity and communications along with providing data security to the organization. Reduce operational costs incurred for telecommunications and maximize business outputs Ensure information in the organization is highly protected for all employees in all locations of GB The network must also fulfill future information needs (Wen, 2001) and technical goals which is summarized as, Scalability: Scalability refers to the ability of the network to continue to function efficiently in spite of drastic changes in data flow volume or size. For good network performance in peak loads, scalability is important. Availability: Services and the network must be available at all time to users. Performance: Performance of a network is highly important to ensure GBs transactions are made efficiently and the network is able to work in its full capacity. Security: In enterprise networks, security is highly crucial particularly in enterprise networks because the computers keep connecting with other sites and also to the internet. Concerns related to security must be integrated in network design stages itself. It is important to devise a security plan and policies for the company to address the risks in deploying a secure project. The security plan must determine the consequences of an attack and make plans accordingly. The performance, availability and scalability are handled by the redundancy provided by T1 and T3 links between GBs offices and remote branches. Security is planned by establishing firewall and IDS at the periphery of the network and in internal LAN respectively. Security measures for user authentication and data encryption, establishing VPNs for connecting branch offices are considered in ensuring network security. Network Design and Architecture GB has one headquarters, two remote offices, an operations office, a warm site for offsite backup, remote offices and branches. Each office has a LAN with multiple users, routers for transferring packets and firewalls for authentication. The main router is located at operations site and warm site backup. This is the CISCO Immersive Tele-presence system as it can manage multiple protocols. The WAN plan for GB is shown in figure 1 with routers, firewalls and LAN at each location. All data passes through the main router in operations and routed to respective offices. For example, if any one branch office sends a packet to HQ, it is routed through main router. Figure 1: The WAN plan for GB Since, the entire LAN and WAN for GB is a TCP network, the router uses RIP protocol (Hendrick 1988) for routing packets from any one LAN to other LAN or subnet. For routing correctly RIP must be enabled in all routers. In the figure, the network addresses must be included in routing and interfaces participating in the WAN must be specified. This is done using the RIP command. RIP Version 2 is used to define routing tables in router. The network command is used to define connected subnets on routers. Subnets are included in routing updates because HQ has four subnets namely Finance, Accounting, Management and Administrative users. In addition to this each branch, remote offices, operations office and warm backup site, ATMs, outside support vendors are also available. RIP command must specify all IPs in each office and must also include network devices. In the GB networks, classful networks are also available in the form of outside support vendors. Classful network refer to IPs that use the GB network in addition to their existing IPs. Certain default routing updates are summarized in the network (Antoniou 2007) perimeter to establish a DMZ. RIP is used mainly to update routing tables automatically which is done as below: A router for example at remote office 1 (Faroe) may experience changes to an entry update in its routing table to include a new route. When the table in Faroe router is updated, this information is sent to other routers in the WAN to update tables automatically for this change In this way data packets across different locations in WAN is routed to their respective destinations Therefore RIP is used to define routing tables in routers in GB. IP addressing Network address in CIDR format is used for GB as it is a private IP. The private address 10.0.0.0 for GB will be subnetted across its locations by taking 3-bits as below: Number of subnets = 8 (23) Total number of hosts = 221 2 = 2097150 Subnet mask will be 255.254.0.0 The above is defined to expand the network in future. Table 1 shows the start and end IPs along with their broadcast address. Network Address First Address/n Last Address/n Broadcast Address 10.0.0.0 10.0.0.1/11 10.31.255.254/11 10.31.255.255 10.32.0.0 10.32.0.1/11 10.63.255.254/11 10.63.255.255 10.64.0.0 10.64.0.1/11 10.95.255.254/11 10.95.255.255 10.96.0.0 10.96.0.1/11 10.127.255.254/11 10.127.255.255 10.128.0.0 10.128.0.1/11 10.159.255.254/11 10.159.255.255 10.160.0.0 10.160.0.1/11 10.243.255.254/11 10.191.255.255 Table 1: GBs IP addressing scheme followed for their locations In the above table since HQ needs 80 IPs, the start address will be 10.160.1.1 and end with10.243.255.254. The router steps are given below: Router Network Address = 10.160.0.0/11 Password: gbwan Router Configuration Steps hostname hq hq(#) config t hq(config) interface fa0/1 hq(config-in) ip address 10.160.0.1 255.243.0.0 hq(config-in) no shutdown For VLAN Routing Branch office with Operations (one branch) operations(config) int fa0/0.1 operations(config-in) ip address 10.0.0.1 255.248.0.0 operations(config-in) no shutdown operations(config-in) encapsulation dot1q 2 VLAN Configuration for one branch vlan 2 name branch1 Likewise all 28 branch offices are defined, along with two remote offices at Faroe and Greenland. As each branch office, remote offices, and operations office have servers they must be defined in router. Similarly the warm back up site has network attached storage which must be taken into account in the routing table. Network Security Plan The main objective is to plan WAN security for GB due to increased threats and their use of old and obsolete protocols and systems. The network security plan is made by ensuring there is no disruption to their existing network and business operations. The following aspects are considered in GBs security plan: Identify all assets in GB along with the risks and vulnerabilities posed by each element Developing security policies and procedures for implementation Implement antivirus software in all systems (servers, PCs, etc) Testing and implementing security procedures in all GB locations Data confidentiality, privacy and integrity are highly important in WAN security. Confidentiality: In confidentiality, information contained in the network is private. The data stored in servers in GB networks is meant for private use and must be protected. Integrity: Data integrity is an important network security aspect as data is prevented from getting modified or corrupted by attackers. Non-repudiation: Ensures users will not deny using GB network. The above five aspects are highly important to be considered in order to have effective secured network system (Dowd, 1998). Physical security measures such as controlled user access by authentication process, establishing access levels in system and encryption are implemented (Oppenheimer 2011). User and access control measures will be implemented across all services, databases, servers and VPNs. The security aspects of RIPv2 protocol is also examined (Davis, 2006). Two authentication methods are available with this protocol namely plain-text and message digest 5 (MD5) (Khalid, et al., 2008). In routers plain-text is the default method, but they must be configured using MD5 because this method encrypts the password in router and secures the table. Hence, if a hacker is able to get access to physical environment the WAN can become unsecured (Parziale, et al., 2006). WAN authentication will occur when updates are received by a trusted source or router. Hence, in routers authentication ensures the entry of corrupt or malicious update, or denial of service (DoS) attacks (Rivest, 1992). Therefore, MD5 algorithm is used for authentication. From the above, the network security plan for GB network will consist of, A security plan consisting of standards, guidelines, policies, implementing IDS, procedures for managing incidents and so on are developed (Winkler, 2011). Security policies are defined for the entire GB network, which includes, accessing internet, user policies, privacy matters, etc (FCC, 2012). Developing the implementation strategy which outlines steps of the plan for action in GB. Gain support from management. Network security strategies and implementation is an organization wide activity. This must be supported by IT, business and all employees in GB. Training to staff, technical training to IT staff in managing the plan must be imparted. Finally the security systems are implemented. Implementing network security technology In the WAN firewalls are implemented in the periphery of the network to prevent outside attacks and when users access the internet. A general implementation of a firewall for GB is shown in figure 2. Firewalls are used in periphery of GB network and positioned at different places in the network to prevent IP address that do not meet the specified criteria in routing tables. Since GB network uses the internet for VPNs, security measures such as port address translation (PAT) are implemented to stop attacks from outside. Figure 2: An implementation of firewall Further, the main CISCO router will ensure packet filtering, and IDS is used in GB to enhance security of data because this is an additional layer of security to prevent attacks that pass through perimeter firewall. The positioning of IDS for GB is illustrated in figure 3. Figure 3: Use of IDS along with firewall for network security Network services in GB must be analyzed for its implications for users (Zwicky, 2001). For instance, if a user has database server access, the user must be examined for web server and access to file server. Security areas are classified as trust and untrusted areas. For instance, the internet is an untrust area. In GB network DMZ zones are defined to show if the network is fully secure or insecure. The DMZ zone will provide access to untrusted users, i.e., users gaining access from internet. Normally, web and mail servers fall in DMZ zone. Database servers, authentication servers, file servers and storage systems fall in the protected zone for GB. Virtual LANs (VLAN) are implemented to ensure protection of servers. The protocols implemented in GB for network management are ICMP, RCP, TCP/IP and SNMP for monitoring availability, utilization and latency in WAN (Leskiw, 2005). In addition to this the other protocols used in configuring network security and consistency include WMI, HTTP, UDP MD5, RIP v2. The next step is to define ACLs. For example, In ACL Administration is not allowed to access Management and Accounting Using extended list ip access-list extended vlan_administration deny ip 10.8.0.0 0.7.255.255 10.64.0.2 0.31.255.255 deny ip 10.8.0.0 0.7.255.255 10.64.0.3 0.31.255.255 int fa0/0.2 ip access-group vlan_administration out Faroe not allowed to access warm site ip access-list extended vlan_faroe deny ip 10.32.0.0 0.7.255.255 10.64.0.2 0.31.255.255 permit ip 10.32.0.0 0.7.255.255 10.64.0.3 0.31.255.255 int fa0/0.4 ip access-group vlan_faroe out The ACL is configured in GB for all the sites. The deny ip command will ensure the hosts belonging to administration and Faroe fulfill the access conditions as required by GB. Testing The next stage is testing. The network and system configurations are considered in testing (Thai, 2012). In addition to this network penetration tests are done to prevent malicious IP from entering the network. The entire security technology is tested using Universal Threat Management System (UTMS) and software tool named Endian FW is used to monitor network traffic and view malicious behaviour. Testing can also be done using tool named CISCO flow, which is also sued for trouble-shooting (Kunth, 2011). The final implementation for network security is illustrated in figure 4. Figure 4: Network security implementation in GB To test packet transfer from any user IP to another remote IP on the network, ping command is used. The remote IP will respond as shown in screenshotfigure 5. Figure 5: Ping command and response from staff IP The network packet flow is illustrated in figure 6 for GB. Figure 6: Network packet flow in GB The intrusions are monitored from packet flows using UTMS and monitoring software. Conclusions In this report, the redesign of GB enterprise network is explored for ensuring network security to protect their systems and infrastructure. The security solution is achieved through the implementation of network planning, security planning and implementation of secured network to connect their offices with the enterprise network. The existing infrastructure for GB is examined for threats, attacks and performance impact on the network. The redesign of the network is explored by considering different aspects of business and IT operations. The aspects of implementing a security policy and operating procedures are emphasized. The security solution is shown in figure 1 to show the positioning of firewalls, routers and connectivity between different locations. The secured network is implemented using standard protocols with adequate scope for expansion in future. The security implementation is demonstrated using UTMS and Endian FW monitoring and network management software to test the des igned network. References Antoniou, Stelios (2007). How to configure RIP Version 2. Daya, B., (2008), Network Security: History, Importance, and Future. Florida, USA: University of Florida Department of Electrical and Computer Engineering. Davis, David (2006). Cisco administration 101: Know the basics about RIPv2. Dowd, P.W., (1998), Network security: it's time to take it seriously. Computer , 24-28. FCC (2012), Cyber Security Planning Guide. Federal Communications Commission. Ferguson, P. G. Huston, (1998), What is a VPN? Cisco Systems. Hedrick, C. (1988). Routing Information Protocol RFC1058. Network Working Group, Rutgers University. Khalid, S., T. Hatim, A. Elzoghabi and S. Mohammad (2008), Performance Evaluation of Secured Versus non-secured EIGRP Routing Protocol. Proceedings of SAM. pp.174-178. Kunath, A. (2011), Enterprise Network Testing . Indianapolis : Cisco press. Leskiw, Aaron (2015), Techniques for Monitoring WAN Links. Oppenheimer, Priscilla, (2011), Top-Down Network Design. 3rd ed. IN, USA: Cisco Systems Inc. Parziale, Lydia, David T. Britt, Chuck Davis, Jason Forrester, Wei Liu, Carolyn Matthews and Nicholas Rosselot (2006). TCP/IP Tutorial and Technical Overview. 8th ed. USA: IBM Corporation.

Network Security Plan and Implementation Report for GB

Question: Network Security Plan and Implementation Report for GB. Answer: Introduction Banking sector is one popular area where computer networks and IT systems are extensively used. Banks make use of IT network capabilities to improve their business outcomes and ensure efficiency in all their operations. In this report the network security implementation is analyzed for The Golden Bank (GB). The network security aspects are explored for security planning and for ensuring robust and adequate security measures are implemented in their systems. GB network is wide and big and faces lot of issues in maintaining and managing their IT network infrastructure. This is because the existing network found in their HQ, operations and branch offices use different protocols which are viewed as a security challenge since some of the native protocols are more vulnerable to latest attacks and viruses. Company Overview GB Headquarters is based in Tivoli which has 80 employees. There are two remote branch offices, one at Greenland and the second one at Faroe. In addition to this the operations building is located 60 Kms away from Tivoli and a warm backup storage site located 100 Kms away from Tivoli. In addition to this, there are 28 branch offices all connecting to operations office using frame relay or DSL links. All these 28 branch offices are similar in spread. GB also has 28 ATM machines which use SNA protocols to communicate with operations. Some file servers still run primitive IPX/SPX protocols and some of them use TCP/IP. The HQ and operations office and warm backup site use T3 leased line, HQ connects with Greenland and Faroe with T1 leased line. The warm site backup office is used for off-site data storage and this is done regularly to ensure protection. The bank also provides connectivity to outside vendors. The bank uses CISCO 2600 multiservice platform routers, has network attached sto rage (NAS), a combination of windows and Linux servers and desktops running Windows 8 OS. Each branch office, the operations office, remote offices and warm backup site has a LAN running on 10Base-T Ethernet, the LAN in HQ runs on 100Base-T Ethernet. Frame relay networks are used by branch offices and vendor to connect to operations center. Problems faced by GB: GB network is dependent on IPX/SPX, SNA and frame relay networks which the board feels is a bottleneck for further business growth. Further, GB is already pending huge amount of money in maintaining existing IT network and infrastructure with very less room for expansion. The bank also plans to expand its existing branch offices by 30% in which case the network must be scalable and flexible to accommodate more data volumes efficiently. GB also desires to have an efficient and high performing WAN/LAN with zero problems during their business operations. The scope of this report is to explore traditional WAN based solutions for managing all systems and LANs in GB through IP addressing, and to plug vulnerabilities in their servers, network devices and to protect all systems IT network infrastructure of GB from attacks and hackers. The security plans are explored and discussed for their importance in securing data and customer services in GB. Security plans and security measures will be implemented across all areas of GB operations to, Protecting all servers - web servers and database servers, NAS, servers in other offices/branches which connect to the operations center. Protection will also include individual systems and LANs at warm backup site, two remote offices, operations office and the LANs and individual systems found in all the 28 branch offices. Securing the network links between offices using appropriate encryption, decryption methods as needed. Providing redundancy at warm backup site for ensuring latest data is available from all the other offices to ensure business continuity. Positioning firewalls, proxies, DMZ, IDS/IPS, for protecting individual network devices, routers, switches, etc. Develop security implementation planning and test security vulnerabilities in the network. Network Design and Assumptions made The GB network consists of different networks all of them connected through some common routers and protocols. In order to secure the network in GB, the following general aspects are analyzed (Daya, 2008). They include, Network architecture for each network, security aspects on internet and so on. Types of attacks on servers, computers, networks, applications and data While access is provided on internet, the security measures to be implemented Understand the existing security, hardware, software, etc. GB requires cost effective high speed WAN links with accuracy between their offices. The internet can be considered as a network carrier, but since it is an open public network, GBs network packets on the internet are vulnerable to attacks. The option of VPN connectivity between operations center and branch office is considered instead of frame relay, because VPN (Ferguson Huston, 1998) can establish a more secure network compared to fame relay nets. A WAN network is essential for GB to connect all their sites and branch offices, ATMs and remote sites. WAN has the ability to connect multiple LANs (Rouse, 2007). The sites of GB are distributed however their database is centrally maintained and managed. At the same time, the data available on remote servers are also secured by real time backup at the warm backup site. In order to implement security measures at all LANs and WAN links along with devices, servers and individual computers, the top-down network design approach (Oppenheimer, 2011) is considered. The top-down approach begins with upper layers of the OSI model and moves down to further layers. In this approach the sessions layer and data transport layer is considered. The approach also takes into account GBs group structure, organization structure along with user and service authentication principles in order to fulfill certain controls in the network are fulfilled. The secured network for GB is designed to fulfill business goals that include, Improve productivity and communications along with providing data security to the organization. Reduce operational costs incurred for telecommunications and maximize business outputs Ensure information in the organization is highly protected for all employees in all locations of GB The network must also fulfill future information needs (Wen, 2001) and technical goals which is summarized as, Scalability: Scalability refers to the ability of the network to continue to function efficiently in spite of drastic changes in data flow volume or size. For good network performance in peak loads, scalability is important. Availability: Services and the network must be available at all time to users. Performance: Performance of a network is highly important to ensure GBs transactions are made efficiently and the network is able to work in its full capacity. Security: In enterprise networks, security is highly crucial particularly in enterprise networks because the computers keep connecting with other sites and also to the internet. Concerns related to security must be integrated in network design stages itself. It is important to devise a security plan and policies for the company to address the risks in deploying a secure project. The security plan must determine the consequences of an attack and make plans accordingly. The performance, availability and scalability are handled by the redundancy provided by T1 and T3 links between GBs offices and remote branches. Security is planned by establishing firewall and IDS at the periphery of the network and in internal LAN respectively. Security measures for user authentication and data encryption, establishing VPNs for connecting branch offices are considered in ensuring network security. Network Design and Architecture GB has one headquarters, two remote offices, an operations office, a warm site for offsite backup, remote offices and branches. Each office has a LAN with multiple users, routers for transferring packets and firewalls for authentication. The main router is located at operations site and warm site backup. This is the CISCO Immersive Tele-presence system as it can manage multiple protocols. The WAN plan for GB is shown in figure 1 with routers, firewalls and LAN at each location. All data passes through the main router in operations and routed to respective offices. For example, if any one branch office sends a packet to HQ, it is routed through main router. Figure 1: The WAN plan for GB Since, the entire LAN and WAN for GB is a TCP network, the router uses RIP protocol (Hendrick 1988) for routing packets from any one LAN to other LAN or subnet. For routing correctly RIP must be enabled in all routers. In the figure, the network addresses must be included in routing and interfaces participating in the WAN must be specified. This is done using the RIP command. RIP Version 2 is used to define routing tables in router. The network command is used to define connected subnets on routers. Subnets are included in routing updates because HQ has four subnets namely Finance, Accounting, Management and Administrative users. In addition to this each branch, remote offices, operations office and warm backup site, ATMs, outside support vendors are also available. RIP command must specify all IPs in each office and must also include network devices. In the GB networks, classful networks are also available in the form of outside support vendors. Classful network refer to IPs that use the GB network in addition to their existing IPs. Certain default routing updates are summarized in the network (Antoniou 2007) perimeter to establish a DMZ. RIP is used mainly to update routing tables automatically which is done as below: A router for example at remote office 1 (Faroe) may experience changes to an entry update in its routing table to include a new route. When the table in Faroe router is updated, this information is sent to other routers in the WAN to update tables automatically for this change In this way data packets across different locations in WAN is routed to their respective destinations Therefore RIP is used to define routing tables in routers in GB. IP addressing Network address in CIDR format is used for GB as it is a private IP. The private address 10.0.0.0 for GB will be subnetted across its locations by taking 3-bits as below: Number of subnets = 8 (23) Total number of hosts = 221 2 = 2097150 Subnet mask will be 255.254.0.0 The above is defined to expand the network in future. Table 1 shows the start and end IPs along with their broadcast address. Network Address First Address/n Last Address/n Broadcast Address 10.0.0.0 10.0.0.1/11 10.31.255.254/11 10.31.255.255 10.32.0.0 10.32.0.1/11 10.63.255.254/11 10.63.255.255 10.64.0.0 10.64.0.1/11 10.95.255.254/11 10.95.255.255 10.96.0.0 10.96.0.1/11 10.127.255.254/11 10.127.255.255 10.128.0.0 10.128.0.1/11 10.159.255.254/11 10.159.255.255 10.160.0.0 10.160.0.1/11 10.243.255.254/11 10.191.255.255 Table 1: GBs IP addressing scheme followed for their locations In the above table since HQ needs 80 IPs, the start address will be 10.160.1.1 and end with10.243.255.254. The router steps are given below: Router Network Address = 10.160.0.0/11 Password: gbwan Router Configuration Steps hostname hq hq(#) config t hq(config) interface fa0/1 hq(config-in) ip address 10.160.0.1 255.243.0.0 hq(config-in) no shutdown For VLAN Routing Branch office with Operations (one branch) operations(config) int fa0/0.1 operations(config-in) ip address 10.0.0.1 255.248.0.0 operations(config-in) no shutdown operations(config-in) encapsulation dot1q 2 VLAN Configuration for one branch vlan 2 name branch1 Likewise all 28 branch offices are defined, along with two remote offices at Faroe and Greenland. As each branch office, remote offices, and operations office have servers they must be defined in router. Similarly the warm back up site has network attached storage which must be taken into account in the routing table. Network Security Plan The main objective is to plan WAN security for GB due to increased threats and their use of old and obsolete protocols and systems. The network security plan is made by ensuring there is no disruption to their existing network and business operations. The following aspects are considered in GBs security plan: Identify all assets in GB along with the risks and vulnerabilities posed by each element Developing security policies and procedures for implementation Implement antivirus software in all systems (servers, PCs, etc) Testing and implementing security procedures in all GB locations Data confidentiality, privacy and integrity are highly important in WAN security. Confidentiality: In confidentiality, information contained in the network is private. The data stored in servers in GB networks is meant for private use and must be protected. Integrity: Data integrity is an important network security aspect as data is prevented from getting modified or corrupted by attackers. Non-repudiation: Ensures users will not deny using GB network. The above five aspects are highly important to be considered in order to have effective secured network system (Dowd, 1998). Physical security measures such as controlled user access by authentication process, establishing access levels in system and encryption are implemented (Oppenheimer 2011). User and access control measures will be implemented across all services, databases, servers and VPNs. The security aspects of RIPv2 protocol is also examined (Davis, 2006). Two authentication methods are available with this protocol namely plain-text and message digest 5 (MD5) (Khalid, et al., 2008). In routers plain-text is the default method, but they must be configured using MD5 because this method encrypts the password in router and secures the table. Hence, if a hacker is able to get access to physical environment the WAN can become unsecured (Parziale, et al., 2006). WAN authentication will occur when updates are received by a trusted source or router. Hence, in routers authentication ensures the entry of corrupt or malicious update, or denial of service (DoS) attacks (Rivest, 1992). Therefore, MD5 algorithm is used for authentication. From the above, the network security plan for GB network will consist of, A security plan consisting of standards, guidelines, policies, implementing IDS, procedures for managing incidents and so on are developed (Winkler, 2011). Security policies are defined for the entire GB network, which includes, accessing internet, user policies, privacy matters, etc (FCC, 2012). Developing the implementation strategy which outlines steps of the plan for action in GB. Gain support from management. Network security strategies and implementation is an organization wide activity. This must be supported by IT, business and all employees in GB. Training to staff, technical training to IT staff in managing the plan must be imparted. Finally the security systems are implemented. Implementing network security technology In the WAN firewalls are implemented in the periphery of the network to prevent outside attacks and when users access the internet. A general implementation of a firewall for GB is shown in figure 2. Firewalls are used in periphery of GB network and positioned at different places in the network to prevent IP address that do not meet the specified criteria in routing tables. Since GB network uses the internet for VPNs, security measures such as port address translation (PAT) are implemented to stop attacks from outside. Figure 2: An implementation of firewall Further, the main CISCO router will ensure packet filtering, and IDS is used in GB to enhance security of data because this is an additional layer of security to prevent attacks that pass through perimeter firewall. The positioning of IDS for GB is illustrated in figure 3. Figure 3: Use of IDS along with firewall for network security Network services in GB must be analyzed for its implications for users (Zwicky, 2001). For instance, if a user has database server access, the user must be examined for web server and access to file server. Security areas are classified as trust and untrusted areas. For instance, the internet is an untrust area. In GB network DMZ zones are defined to show if the network is fully secure or insecure. The DMZ zone will provide access to untrusted users, i.e., users gaining access from internet. Normally, web and mail servers fall in DMZ zone. Database servers, authentication servers, file servers and storage systems fall in the protected zone for GB. Virtual LANs (VLAN) are implemented to ensure protection of servers. The protocols implemented in GB for network management are ICMP, RCP, TCP/IP and SNMP for monitoring availability, utilization and latency in WAN (Leskiw, 2005). In addition to this the other protocols used in configuring network security and consistency include WMI, HTTP, UDP MD5, RIP v2. The next step is to define ACLs. For example, In ACL Administration is not allowed to access Management and Accounting Using extended list ip access-list extended vlan_administration deny ip 10.8.0.0 0.7.255.255 10.64.0.2 0.31.255.255 deny ip 10.8.0.0 0.7.255.255 10.64.0.3 0.31.255.255 int fa0/0.2 ip access-group vlan_administration out Faroe not allowed to access warm site ip access-list extended vlan_faroe deny ip 10.32.0.0 0.7.255.255 10.64.0.2 0.31.255.255 permit ip 10.32.0.0 0.7.255.255 10.64.0.3 0.31.255.255 int fa0/0.4 ip access-group vlan_faroe out The ACL is configured in GB for all the sites. The deny ip command will ensure the hosts belonging to administration and Faroe fulfill the access conditions as required by GB. Testing The next stage is testing. The network and system configurations are considered in testing (Thai, 2012). In addition to this network penetration tests are done to prevent malicious IP from entering the network. The entire security technology is tested using Universal Threat Management System (UTMS) and software tool named Endian FW is used to monitor network traffic and view malicious behaviour. Testing can also be done using tool named CISCO flow, which is also sued for trouble-shooting (Kunth, 2011). The final implementation for network security is illustrated in figure 4. Figure 4: Network security implementation in GB To test packet transfer from any user IP to another remote IP on the network, ping command is used. The remote IP will respond as shown in screenshotfigure 5. Figure 5: Ping command and response from staff IP The network packet flow is illustrated in figure 6 for GB. Figure 6: Network packet flow in GB The intrusions are monitored from packet flows using UTMS and monitoring software. Conclusions In this report, the redesign of GB enterprise network is explored for ensuring network security to protect their systems and infrastructure. The security solution is achieved through the implementation of network planning, security planning and implementation of secured network to connect their offices with the enterprise network. The existing infrastructure for GB is examined for threats, attacks and performance impact on the network. The redesign of the network is explored by considering different aspects of business and IT operations. The aspects of implementing a security policy and operating procedures are emphasized. The security solution is shown in figure 1 to show the positioning of firewalls, routers and connectivity between different locations. The secured network is implemented using standard protocols with adequate scope for expansion in future. The security implementation is demonstrated using UTMS and Endian FW monitoring and network management software to test the des igned network. References Antoniou, Stelios (2007). How to configure RIP Version 2. Daya, B., (2008), Network Security: History, Importance, and Future. Florida, USA: University of Florida Department of Electrical and Computer Engineering. Davis, David (2006). Cisco administration 101: Know the basics about RIPv2. Dowd, P.W., (1998), Network security: it's time to take it seriously. Computer , 24-28. FCC (2012), Cyber Security Planning Guide. Federal Communications Commission. Ferguson, P. G. Huston, (1998), What is a VPN? Cisco Systems. Hedrick, C. (1988). Routing Information Protocol RFC1058. Network Working Group, Rutgers University. Khalid, S., T. Hatim, A. Elzoghabi and S. Mohammad (2008), Performance Evaluation of Secured Versus non-secured EIGRP Routing Protocol. Proceedings of SAM. pp.174-178. Kunath, A. (2011), Enterprise Network Testing . Indianapolis : Cisco press. Leskiw, Aaron (2015), Techniques for Monitoring WAN Links. Oppenheimer, Priscilla, (2011), Top-Down Network Design. 3rd ed. IN, USA: Cisco Systems Inc. Parziale, Lydia, David T. Britt, Chuck Davis, Jason Forrester, Wei Liu, Carolyn Matthews and Nicholas Rosselot (2006). TCP/IP Tutorial and Technical Overview. 8th ed. USA: IBM Corporation.