Project 1 - Design Enterprise Security Model

The model includes the following components:

1. User Access Layer: This layer includes the customer and employee interfaces that allow users to access the bank's services. The interfaces are secured using SSL/TLS protocols to encrypt the communication between the user and the server.
2. Application Layer: This layer includes the bank's website and web application server that handle user requests and provide the bank's services. The website is developed in Java technology using the latest secure coding standards, and the server is capable of handling server-side validation for incoming requests.
3. Data Storage Layer: This layer includes the relational database management system (Oracle 11.2.0.2.0) that stores data using AES encryption. The database activity monitoring tool (IBM - Guardium Data Protection 11.5) monitors activities in the database and alerts in case of any suspicious events.
4. Network Layer: This layer includes the router/gateway/firewall/VPN (Cisco - ASA Series, 9.14(x)) that ensures authentication, authorization, and avoids duplication of requests. The IDS/IPS (Juniper Networks - Junos OS Release 17.3R1) monitors the traffic for malicious requests and takes appropriate actions in case of suspicion.

Security Checklist:

1. Website Security

• Use of latest secure coding standards for website development in Java
• Data sanitization to avoid input validation attacks
• Implementation of SSL/TLS to ensure encrypted communication between the server and the client
• Implementation of multi-factor authentication for website access

1. Web Application Server Security

• Use of Apache 2.0 server with server-side validation for incoming requests
• Implementation of firewalls to restrict unauthorized access
• Implementation of access controls to restrict the number of users accessing the server

1. Relational DBMS Security

• Use of Oracle 11.2.0.2.0 for data storage with AES encryption to secure sensitive data
• Implementation of firewalls to restrict unauthorized access
• Implementation of access controls to restrict the number of users accessing the database

1. Router/Gateway/Firewall/VPN Security

• Use of Cisco ASA Series 9.14(x) for Authentication and Authorization
• Implementation of firewalls to restrict unauthorized access
• Use of VPN for secure remote access

1. IDS/IPS Security

• Use of Juniper Networks Junos OS Release 17.3R1 for monitoring traffic for malicious requests
• Implementation of firewalls to restrict unauthorized access
• Implementation of access controls to restrict the number of users accessing the IDS/IPS

1. Database Activity Monitoring Security

• Use of IBM Guardium Data Protection 11.5 for monitoring database activities
• Implementation of firewalls to restrict unauthorized access
• Implementation of access controls to restrict the number of users accessing the database activity monitoring system

1. Regular Hardening

• All devices are hardened on a weekly basis on a specific day to keep them up to date with the latest security patches and updates.

Illustration of the Design in a Real Business Scenario/Use-case:

Consider a scenario where a customer wants to access their bank account on the bank's website. The customer enters their login credentials and initiates a transaction. The request is sent to the web application server, which validates the request and passes it on to the relational DBMS for processing. The DBMS stores the data using AES encryption to protect the sensitive information. The request is then passed back to the web application server, which sends the response to the customer. Meanwhile, the Router/Gateway/Firewall/VPN and IDS/IPS are continuously monitoring the traffic for malicious requests and taking appropriate actions in case of suspicion. The Database Activity Monitoring system is also monitoring activities going on in the database and alerting in case of any suspicious events. All devices are regularly hardened to keep them up to date with the latest security patches and updates. This ensures that the bank's infrastructure/assets are secure and the customer's information is protected at all times.