Disclaimer: The opinions of the columnists are their own and not necessarily those of their employer.
Frank Cassano

Assessing your Organization’s Network Perimeter (pt. 2)

Welcome once again to the risk rack. This time on the risk rack we will be continuing our review of how to assess your organization’s network perimeter. As a reminder the identified steps were:

  • Step 1: Define the functions and purposes of your network perimeter.
  • Step 2: Assess the technology used along the perimeter of your network.
  • Step 3: Assess the Processes used to support your network perimeter.
  • Step 4: Assess the People that support your network perimeter.
  • Step 5: Review all the information gathered in steps 1- 4 and establish conclusions and findings.
  • Step 6: Report conclusions and findings and determine action plans.

In Part I we reviewed tips and tricks for Step 1 “Define the functions and purposes of your network perimeter” and started a spreadsheet.

In Part II of “assessing your perimeter” we will be looking at tips and tricks for Step 2: “Assess the technology used along the perimeter of your network.”

Let us begin by first defining the term “Technology” for the purpose of this article. Technology for the purpose of this article is defined as any hardware or software as well as architectural design. To provide some structure for the technology assessment I have provided the following stepped approach which I will describe below.

  • Step 1: Define your network perimeter endpoints.
  • Step 2: Identify hardware devices that make up each endpoint
  • Step 3: Identify operating system software and application software for each device.
  • Step 4: Map the hardware and software to the spreadsheet from Part I.
  • Step 5: Perform a technical analysis for each piece of hardware and software based on the functions and purposes they are mapped to.
  • Step 6: Document your observations and findings.

Defining an endpoint is simply identifying any segment of the network that interfaces with an external environment. There are three basic forms of endpoint interfaces:

  1. Private – An external link which is setup to communicate to a single entity (i.e. a standalone modem connection or T1 line) using a ‘closed’ network.
  2. Semi-Private – An external link that is setup to interface with a number of entities (i.e. modem pool, shared frame relay, etc.) using a ‘closed’ network
  3. Public – An external link that is that is setup using a open network such as the Internet

One Comment

  1. Rene w/ NCP Jun 17, 2008 at 2:44 pm | Permalink

    What should be mentioned as (one of the many) details would be that users within a company using WLAN although physically within the confines of the building are to be treated as remote access users. Someone outside on the street with a laptop and a malicious intent should be able to detect and possibly participate within the WLAN if not secured enough, as if they’re within the building and as one of the users. It’s therefore imperative to realize that physical and virtual perimeters do not necessarily coincide!

    Another point would be how far do I want to ‘extend the perimeter’ and use the right ‘technology’ to fulfill the requirements:

    Incidental access to internal resources can best be facilitated with SSL-VPN access. This allows for a limited access to internal resources by those that need it; such as suppliers/consultants/contractors and so on. This doesn’t require the user to install a ‘client’, but merely downloads the code within the browser and uses the browser to access the internal resources, and this access can be carefully controlled centrally on the SSL-VPN gateway.

    Conversely a full time employee may require to have access to the ‘regular’ resources he would normally have at his desk, while he’s on the road. An ‘full access’ or ‘LAN emulation’ (working remotely as if one is sitting at one’s desk) VPN solution would be a better suited option. This would imply that the latter’s work platform is secured; not only the communication between the two points, but the remote user’s device has become an extension to the corporate network perimeter; and thus should be protected accordingly. Why attack the corporate ‘perimeter’ firewall, when one can attack and possibly use a remote access user’s machine as a stepping stone into the corporate network?!

Post a Comment

Your email is never published nor shared. Required fields are marked *

*
*