Research Proposal on "Information Technology (IT) Security Implementation"

Research Proposal 16 pages (5733 words) Sources: 5

[EXCERPT] . . . .

it Security Plan & Implementation

IT Security Plan and Implementation for a Small Corporation

IT Security Proposal Summary

Small corporations often have to deal with many conflicting it and often time-consuming priorities to keep their businesses making progress and profits. Yet the lack of having an it Security Plan in place can seriously cripple any company's performance and profitability and is one of the leading causes of smaller corporations failing (Gupta, Hammond, 2005). The intent of this project proposal is to define an it Security Plan for a small business network of thirty computers and three servers that are running Web-based applications, an e-mail system and a database application server. E-mail systems in smaller corporations are also specifically in need of continual security upgrades as this is often one of the systems that pose a significant security risk (Zambroski, 2006). In addition the lack of e-mail system security there is also a lack of metrics around the entire security system performance as well (Frankland, 2008).

Given the significant lack of security coverage of these areas, there is the need for managing the it Security Plan and Implementation using a proven framework.

This proposal relies on the Open Systems Interconnect (OSI) Model defined by the International Organization for Standardization (ISO). The purpose of ISO is to ensure a high level of interoperability and integration between systems, specifically focusing on the flow of data between systems. The OSI Model is an excellent framework for evaluating the security of networks and is shown in Figure 1, the Open Systems Interconnect (OSI) Model. This model is designed to provide a logical grouping of network functions taking into account the physical connections required to make a network effective. This model is ideally suited for evaluating the security of a network as its upper layers define the logical connections and process workflows of a network where the majority of security planning and execution are necessary to alleviate threats.

Figure 1: The Open Systems Interconnect (OSI) Model

Source: (Cisco Tutorial 2007)

An analysis of the considerations for a small corporations' network of thirty computers and three servers to run their Web, e-mail and database applications within the framework of each of the layers of the OSI Model are defined below.

The Physical Layer's role is for defining the standards relating to the physical medium of the network, such as cable, unshielded twisted pairs (UTP), Ten BaseT (10BaseT) and other hardware connections. The primary security risk of this layer is that the packets sent over the network via the TCP/IP protocol can be intercepted by devices (often called "packet sniffers") and messages read and data stolen (Gupta, Hammond, 2005). For small corporations this threat often goes undetected and cannot be easily stopped with firewalls or DMZ-based software or hybrid software and hardware security platforms. The need for physical security at this level is critical to protect a company's information assets and access to their network. Using Virtual Private Networks (VPN) and a reliance on advanced IPSec-based security would make the intercepting and interpreting of packets more difficult (Rowan, 2007). As a result, VPNs have become predominant for this and additional security benefits evident in an analysis of the OSI Model. The Data Link Layer interprets data packets and defines the transfer and reception of data on the network, managing data frames between network layer and physical layer, receiving raw data from physical layer. In addition, this layer creates data frames, and then delivers them to the network layer at the originating or sender side of the connection. Packets are in turn interpreted and coded down to bits on the receiving side. This is a layer of the OSI Model that hackers attempt to gain control of specifically for the vulnerabilities of the Logical Link Control function which handles error correction and the Media Access Control (MAC) layer which enables point to point connections over a network. The MAC layer is one of the most vulnerable from the packet re-direct standpoint and one that spoofing or impersonation viruses attempt to penetrate and take control of (Ciampa, 2005). As the MAC layer takes into account both the physical and logical connects of a network, it is critical that the security threats at this layer be protected against using DMZ-based security applications and firewalls (Loew, Stengel, Bleimann, McDonald, 1999). The third level of the OSI Model is the Network layer, which has the function of integrating and ensuring the security of the Internet Protocol (IP) into the remainder of the OSI Model protocol stack. This layer has many coordination and synchronization functions throughout the network, yet it's most important is the deconstructing of large IP-based packets being sent over the network to other systems. This layer works in data units called datagrams and is susceptible to re-routing of IP-based traffic based on IP address emulation and impersonation, in addition to the use of IP-based requests for data transfers (Gupta, Hammond, 2005). The Transport layer is the 4th layer of the OSI Model and is where the transmission of data occurs. This is the layer that has the Transport Control Protocol (TCP) and User Datagram Protocol (UDP) which are protected through firewalls (Ciampa, 2005) and also relied on for secure VPN connections for remote networks as well (Rowan, 2007). The Session Layer is the 5th one in the OSI Model and manages the establishing of session connections between Wireless and WiFi (Loo, 2008), Local Area (LANs) and Wide-Area Network (WANs). As an enabler of traffic over a network, this layer also defines then manages the bidirectional vs. unidirectional protocols used throughout the network, the extent to which TPC/IP relies on Error Correction Coding (ECC) and the use of Cyclic Redundancy (CRC) error checking as well. This layer also relies on the Session Protocol Data Unit (SPDU) to validate, secure and then release specific connections to ensure greater security (Cisco Tutorial, 2007). For the small corporation ne need for managing a consistent level of ECC and CRC checks is critical in this area (Gupta, Hammond, 2005) in addition to protocol-based security audits over the network as well. The 6th layer is the Presentation Layer, which acts as a converter of information from the lower layers and manages the transmission of messages by checking and validating message syntax, coordinating traffic from the lower layers of the OSI Model, and defining security authentication logic between originating and destination systems. This layer is often protected through multiple approaches to network security including firewalls that can sense impersonated or invalid IP addresses in addition to defining rules-based authentication on advanced firewalls and security applications (Gupta, Hammond, 2005). The last and 7th layer is the Application Layer which acts as the coordination point across the TCP/IP-based commands, Web browsers, and office automation applications that rely on XML messaging and Internet connections. Often this connection is protected through the use of VPN-based connections for shared applications, with IPSec used for point-to-point security and SSL support for broader Web-based application deployments (Rowan, 2007). Security on the 7th layer of the OSI Model is increasingly focused on shared or Web-based applications as a result of the en masse adoption of XML and AJAX-based applications.

Part 2: Review of Other Security Implementations (40 words)

In evaluating the it Security Plan for AMR Research, a small privately held corporation in Boston, Massachusetts there is several significant lessons that can be learned and applied to the security plan being defined here. First there is a reliance on a broad, strategic-wide approach to defining security strategies across all web content, VPN access points, internal databases accessible via authentication and access to accounting and financial systems (Loew, Stengel, Bleimann, McDonald, 1999). As AMR Research relies on teams of expert-level analysts to evaluate market trends and provide prescriptive guidance to it organizations globally there is also the need for secured VPN and SSL connections as well. The use of SSL as the means for ensuring security and verifiability of traffic over VPN connections is a best practice that corporations are finding scales to meet the needs of their increasingly mobile workforces (Rowan, 2007). These two aspects of an overarching security strategy and the need for creating a consistent VPN and remote access strategy are critical for AMR Research to protect its intellectual property as well.

Part 3: Rationale and Systems Analysis for it Security Upgrade

The need for higher levels of security across the corporations' network is accentuated by the fact that the majority of PCs in use today are laptops that rely on WiFi connections throughout the company. The three servers running the website, e-mail systems and database application servers will also need to have specific analysis of their existing security levels based on the options chosen during installation. Operating systems-level security also needs to be first evaluated to see options were configured for firewalls as well. All of these factors need to be taken into account for an initial security audit to be put into place which forms the baseline of security performance evaluation and… READ MORE

How to Reference "Information Technology (IT) Security Implementation" Research Proposal in a Bibliography

Related Research Proposals:

Security Policy Term Paper

Security Policy

IT Security Policy

The following security policy defines how strategic it resources and technologies are aligned to supporting organizational objectives and goals. Implicit in this security policy is… read more

Term Paper 4 pages (1080 words) Sources: 4 Topic: Computers / IT / Internet

---

Information Technology (IT) Infrastructure Project Capstone Project

It Infrastructure Project

Description

The project reveals the strategy the Oak Creek Healthcare Corporation (OCHC) implements the latest technology to enhance the quality of service (QoS) and achieving a leading… read more

Capstone Project 25 pages (7426 words) Sources: 10 Topic: Computers / IT / Internet

---

Security Policy Dr. Fossett's Dental Office Term Paper

Security Policy of a Dental Office

Information Technology Security for XYZ's Dental Office will be achieved by implementing these controls, policies, procedures and standards. This approved Security policy reflects the… read more

Term Paper 3 pages (1254 words) Sources: 0 Topic: Computers / IT / Internet

---

Information Technology (IT) Security Plan for Car Motor Company A-Level Coursework

it infrastructure to the day-to-day running of business operations cannot be overemphasized. Various critical business processes are controlled by the various computer systems that are tailored to meet the demands… read more

A-Level Coursework 16 pages (4621 words) Sources: 1+ Topic: Business / Corporations / E-commerce

---

Information Technology Aquarius Marketing Project Plan Term Paper

Information Technology

Aquarius Marketing Project Plan

The intent of this project plan is to comprehensively define the development process, testing, training, and introduction of an enterprise-class portal and series of… read more

Term Paper 12 pages (3970 words) Sources: 12 Style: Harvard Topic: Management / Organizations

---

View 100+ more related papers  >>