Project 1 - Design Enterprise Security Model

Security design/model for the bank’s infrastructure/assets and a security checklist for this design:

The submitted attachment shows the bank's network security through which the employees access the internet and other features enabled to restrict any external agents. The checklist provides the insights about the bank's security architecture.

1. A Local Area Network(LAN) comprises cables, access points, switches, routers, and other components that enable devices to connect to internal servers, web servers, and other LANs via wide area networks.

The rise of virtualization has also fueled the development of virtual LANs, which enable network administrators to logically group network nodes and partition their networks without a need for major infrastructure changes. A network switch is established between the network commodities so that it is ditributed among the LAN to each and every employee access.

For example, in an office with multiple departments, such as accounting, IT support, and administration, each department's computers could be logically connected to the same switch but segmented to behave as if they are separate.

Here, in bank's a client/server LAN is set up which consists of several devices (the clients) connected to a central server. The server manages file storage, application access, device access, and network traffic. A client can be any connected device that runs or accesses applications or the Internet. The clients connect to the server either with cables or through wireless connections.

Typically, suites of applications can be kept on the LAN server. Employees can access databases, email, document sharing, printing, and other services through applications running on the LAN server, with read and write access maintained by a network or IT administrator.

A Firewall is placed between the LAN and next zone which is a network security device that monitors and filters incoming and outgoing network traffic based on an organization’s previously established security policies. At its most basic, a firewall is essentially the barrier that sits between a private internal network and the public Internet. A firewall’s main purpose is to allow non-threatening traffic in and to keep dangerous traffic out.

2. A DMZ or demilitarized zone is a perimeter network that protects and adds an extra layer of security to an organization’s internal local-area network from untrusted traffic.

From Inner DMZ,

Mainly in banking security, the Storage Area Network security is generally used for first analyzing the underlying SAN infrastructure for possible loopholes and/or vulnerabilities.

• Encrypting data at rest when stored on a SAN infrastructure or storage drives
• Isolating users/departments/organizations using a virtual SAN
• Securing network and communication interfaces
• Implementing an access control list (ACL) and digital certificates such as certificate revocation list(CRL Archive) within the switch to ensure only authenticated switches join a SAN fabric network.
• Removing and resolving single points of failure
• Mitigating network-based vulnerabilities such as Simple Network Management Protocol (SNMP), which is vulnerable to Denial of Service (DoS) attack
• SAN security may also involve creating and implementing a SAN backup for entire application, database and policies, and recovery plan to ensure it stays operational even after an attack or threatening incident.
• Also the backups and resolved threats are stored in logs as references.

From Middle DMZ,

An Intrusion Detection System (IDS) - Management console is a hardware/software combination or a combination of both hardware and software that detects the intrusions into a system or network. IDS complements a firewall by providing a thorough inspection of both the packets’ header and its contents thus protecting against attacks, which are otherwise perceived by a firewall as seemingly benign network traffic.

Role-based Authority Management security, is a mechanism that restricts system access. It involves setting permissions and privileges to enable access to authorized users. Most banking organizations use role-based access control to provide their employees with varying levels of access based on their roles and responsibilities. This protects sensitive data and ensures employees can only access information and perform actions they need to do their jobs.

Bank IT organization assigns a role-based access control role to every employee; the role determines which permissions the system grants to the user. For example, we can designate whether a user is an administrator, a specialist, or an end-user, and limit access to specific resources or tasks. IT based Banking sectors may let some individuals create or modify files while providing others with viewing permission only.

A CRL is a list maintained by a certification authority of the certificates it has issued and revoked prior to their stated expiration date. CRLs contain certificates that have either been irreversibly revoked (revoked) or have been marked as temporarily invalid (hold). The CRL does not include expired certificates. Also, the CRL issuer (third party) may not be the same entity as the CA that issued the revoked certificate.

The reasons for revoking a certificate include:

The issuing CA has been compromised
The certificate owner no longer owns the domain for which it was issued
The certificate owner has ceased operations entirely
The original certificate has been replaced with a new certificate from another issuer.

From Outer DMZ,

Data Loss Prevention (DLP) is used for detecting and preventing data breaches, exfiltration, or unwanted destruction of sensitive data. Organizations use DLP to protect and secure their data and comply with regulations.

The DLP term refers to defending in bank organizations against both data loss and data leakage prevention. Data loss refers to an event in which important data is lost to the enterprise, such as in a ransomware attack. Data loss prevention focuses on preventing illicit transfer of data outside organizational boundaries.

One way for banks and other credit institutions to protect their assets and comply with the new regulations is an Intrusion Detection System. It is usable on host, network and application levels. It analyzes the system or network traffic or controls the incoming connections to different ports, and then it detects the occurring attacks. It can detect known attacks, unusual traffic, harmful data, misuse and unauthorized
access to the systems and networks by internal users or external intruders. It informs and notifies to the security manager by different types of warnings or notifications; sometimes, it disconnects the suspicious connections or blocks malicious traffic. In general, three main functionalities of IDSs include monitoring (evaluation), analyzing (detection) and responding (reporting) to the occurring attacks on computer systems and networks. IDSs use many methodologies to detect attacks.

RADIUS (Remote Authentication Dial-In User Service) is a networking protocol used to manage Authentication, Authorization, and Accounting (AAA) for remote users who access a network service. It provides a centralized means of managing network access control and can be used to authenticate users connecting to a network through a variety of devices, including routers, firewalls, and VPNs.

The RADIUS protocol uses a RADIUS Server and RADIUS Clients.

A RADIUS server is a central server that provides authentication and authorization services for remote users who access a network. It receives authentication requests from RADIUS clients, such as routers, firewalls, or VPNs, verifies the credentials of the user, and returns an authorization decision to the client.

A RADIUS client, on the other hand, is a device that sends authentication requests to the RADIUS server. The client acts as the intermediary between the remote user and the RADIUS server and is responsible for forwarding user credentials to the server for verification and receiving authorization decisions from the server.

The Lightweight Directory Access Protocol (LDAP) is an open-source application protocol that allows applications to access and authenticate specific user information across directory services. LDAP works on both public networks and private intranets and across multiple directory services, making it the most convenient language for accessing, modifying, and authenticating information in any directory. The most common LDAP use case is providing a central location for accessing and managing directory services. LDAP enables organizations to store, manage, and secure information about the organization, its users, and assets–like usernames and passwords. This helps simplify storage access by providing a hierarchical structure of information, and it can be critical for corporations as they grow and acquire more user data and assets.

From External Network,

An internet service provider (ISP) is a company that provides web access to businesses and consumers.
ISPs may also provide other services such as email services, domain registration, web hosting, and browser services.
An ISP is considered to be an information service provider, storage service provider, internet network service provider (INSP), or a mix of all of them. In Banking sectors, these ISP's are connected to a router and it is distributed among the organizations to get the internet access. It is then protected by firewall.

Wireless Access Points are used to provide consistent Internet access to wireless devices across rooms or building locations. They reduce the possibility of session interruption since the signal they serve is directly cabled to an organization’s main Internet source. For example, if a company wanted to provide Wi-Fi in their reception area, they could install a Wireless Access Point near the front desk and run an Ethernet cable through the ceiling back to the router in the server room. Also from internet provided there are encyptions handled by the routing packets to avoid discrepancy in the netowrk traffic or any external threats. Maintains good feasibility and network access without any interference. This are connected to the dedicated path of bank workstations and banking application to ensure proper security. The best practice is to use WPA2 Protected Access for strong network security and WPA 3 is currently rolling out markets for data protection facilities.

Routers use routing protocols to determine the best path for packets. The configuration file specifies all the information for the correct setup and use of the selected or enabled, routing and routed protocols on a router.