Assignment: The Internet and Network Security
1: Putting the Next Day Air Service "on the Internet" and their network security
President Coone has asked you to put Next Day Air Service (NDAS) "on the Internet." You interpret this to mean getting a Website up and running and putting Internet access technologies into the NDAS offices.
With your knowledge of NDAS's network, what types of Internet access technologies (e.g., leased line, DSL, cable modem, wireless) would you recommend for Atlanta, New Orleans, and the corporate office in Tampa and other locations as well? Why? (max 400 words)
Discuss some of the precautions you should take before taking the NDAS web site "live" on the Internet. (max 400 words).
Use a website called "Shields Up" to elaborate your answer to the question above. Perform a port test on the server your computer is using for networking. Report your results. Remember to include your IP address and other analysis outcomes. (max 400 words)
The president of NDAS has just read a newspaper article explaining that the top security threat to companies are NOT always from hackers trying to break in though the corporate firewall. In many cases, companies are more concerned about things such as internal employees and social engineering. After reading this article, he rushed down to Les Coone's office to understand what could happen to NDAS. Les has turned to you to prepare analysis of NDAS security.
While Les was in your office you mention that a security issue you recently learned about needs to be addressed. Five employees in the Accounts Payable office were recently given two weeks notice of their impending layoff due to the outsourcing of some of the Accounts Payable functions to another company. As you understand it, those five employees are NOT happy with being released.
Outline the major security threats faced by NDAS. Be sure to identify those that you that you think are major threats and those that are minor threats. (max 400 words)
Prepare a partial risk assessment for NDAS that includes their major assets, threats, and controls. You need to make some reasonable assumptions and document them. (max 400 words)
Develop a set of security controls, for use in the NDAS main office and for its Website, designed to control risks due to disruption, destruction, and disaster and unauthorised access. (max 800 words)
Think about the Accounts Payable employees that are being laid off. What should be done to ensure that they do NOT do anything (such as steal customer data files, etc.) before they leave the company. With their access to so much accounting data and other network access, list some of the main concerns that you may have. In addition, what will you suggest to mitigate these risks? (max 400 words)
Part 3: Network Design and Management/Implementation
The holding company that owns NDAS has just purchased a regional trucking company called Sunshine Trucking (ST). NDAS believes that ST offers a way to build revenues in an area in which it has experience (package delivery), even though ST will not operate directly with NDAS. ST focuses on large commercial shipments (e.g., food products for wholesalers, packaged goods for department stores).
At present, ST has a very poor data communications network. Because you have done such a good job on the NDAS network, President Coone offers your expertise to ST to help with their new network.
ST operates three regional shipping hubs: Miami, Dallas, and Atlanta. Each of these regional hubs is responsible for taking shipping requests from customers and scheduling pickups and deliveries. Each regional hub has about four dozen computers are networked to each other using a small LAN and need to be connected onto a WAN. The computers access the network server (a Windows NT file server) and the corporate minicomputer almost constantly. The current LAN is a 10 Mbps Ethernet that is beginning to become overloaded with the network traffic. The regional hubs communicate with one another fairly regularly via a VPN connection, usually a dozen times an hour.
The Atlanta hub also houses the corporate head office and therefore has an additional 20 computers for use by corporate staff. This office also has the aforementioned corporate minicomputer that processes all accounting data (a UNIX computer). There has been some discussion about establishing a corporate Website, but no plans have been made.
ST has a series of seven local offices for short-term storage, truck maintenance, and managing the local drivers: Houston, New Orleans, Jackson, Birmingham, Tallahassee, Charlotte, and Memphis. Each regional office has 5 to 10 computers that are peer networked together but need to be connected to the WAN. These computers have fairly minimal networking requirements. At present, each local office sends data to the aforementioned corporate minicomputer at the end of each day by sending one diskette via overnight courier(NDAS). ST would like to automate this process so that it can transmit the data via a network. ST also would like to enable the local offices to communicate with all the regional hubs (and perhaps with one another) but do NOT anticipate needing to send a large amount of data.
Based on your assessment of the large number of changes that need to occur, you quickly realise that you do NOT have the time to design and implement the new network yourself. Thus, you suggest that a vendor help with this project and you volunteer to create an Request for Proposal (RFP) to be sent out to some local networking vendors for their consideration. Using the outline provided in the textbook section 6.4.1, create an RFP for ST's new network. Keep in mind that you need to think about their network at the LAN, MAN, WAN, and BN levels. Also, please remember that typically an RFP includes the following sections:
1) Background information with subsections for Organizational profile, Overview of current network, Overview of new network, and Goals of new network,
2) Network requirements with subsections for Choice sets of possible network designs (hardware, software, circuits), Mandatory, desirable, and wish-list items, Security and control requirements, Response-time requirements, and Guidelines for proposing new network designs,
3) Service requirements with subsections for Implementation time plan, Training courses and materials, Support services (e.g., spare parts on site), and Reliability and performance guarantees,
4) Bidding process with subsections for Time schedule for the bidding process, Ground rules, Bid evaluation criteria, and Availability of additional information, and
5) Information required from vendor with subsections for Vendor corporate profile, Experience with similar networks, Hardware and software benchmarks, and Reference list. Make sure that your RFP is not longer than 4,000 words (excluding the references). (max 25 points).
The NDAS network system is finally in place and operating. President Coone has assigned operational control of the network to the Information Services/ Data Processing Division. He believes this is reasonable and justified because of the division's data processing responsibilities and experience in operating data communications equipment. In addition, his nephew, Les Coone, is running that department and has expressed considerable interest in data communications.
The Human Resources Division originally set up the telephone system, because - at the time - nobody else was interested in doing it. As a result, Human Resources, headed by Karen Lott, controls the voice and facsimile communication system for the company.
One recurring problem is that two division heads disagree on which department should be responsible for dealing with the common carriers. Each division believes it should be the contact for dealing with the common carriers, and each thinks the other is stopping it from assuming its rightful place within the organisation.
Because of your excellent past performance, President Coone has asked you to study certain organisational issues pertaining to the control and operation of both voice and data communications. He wants you to analyse the operations of both divisions and propose a method for streamlining the organisation and fixing the problem. This analysis should address the possibility of combining the voice and data communication responsibilities under a single manager. You may propose any reorganisation that seems appropriate. Be sure to consider economies of scale when submitting any recommendations. President Coone reminds you that you were a staunch advocate of videoconferencing. He wants you to include video and image transmission considerations in your analysis.
You should also consider the type of individual that should manage this reorganisation. Some of the factors to evaluate are the traits and characteristics needed for successful leadership, the ability to understand current systems, the ability to handle both data and voice networks, and the ability to analyse and manage future growth. The results of this evaluation will help determine whether such an individual exists within NDAS or whether the firm needs to hire someone from outside the organisation.
Another little problem occurred last week when NDAS experienced its first network line failure. President Coone had to ask Karen Lott to determine what failed on the circuit. After fiddling with the problem for an hour and a half, she finally called the server vendor, who then took three hours to get to the Tampa headquarters building. The good news is that the vendor's maintenance employee swapped a new network card into the server and had it fixed in fifteen minutes. Needless to say, President Coone was NOT happy!
If the responsibilities for managing communications were to be consolidated into one division, which one would you choose, and why? Base your answer on your knowledge of the communication management responsibilities exercised by both the Human Resources and Information Services Divisions. (max 200 words)
Review the organisation chart for NDAS, as shown in the Week 1 materials, and then develop an organisation chart that reflects a realignment of the responsibilities for communications. Show separate organisational entities for both data processing and communications. Consider the pros and cons of creating a new communications manager position. Discuss the reasons why NDAS should promote someone from within the company to fill this new position. Now discuss the contrary reasons why NDAS should hire someone from outside the organisation for this position. Which method would you take and why? (max 800 words)
Sketch out a simple network management system for NDAS. What software and hardware support would you recommend? Be sure you justify the information items collected and reported for this system, as well as your software and hardware recommendations. Price the recommended software and hardware using sources of your choice (see, e.g., OfficeWorks and Harvey Norman websites) and some assumptions. (max 2,000 words).