Linking internal communications with the outside world

Background
Summary:
Businesses commonly use Internet to access a variety of data and to perform transactions internally and externally. The Internet becomes the communications medium that links internal communications with the outside world. We discuss here the cybersecurity infrastructure and architecture that is associated with procedures and applications.
Description:
Businesses invest money to build a networking infrastructure and then build a networking and communication system on this infrastructure to support business activities. In today’s environment, extensive use is made internal communication via the Intranet and external communication via the Internet. An open architecture, as often used earlier, might have been good for data access. With the increased number of threats as found today, the open architecture can expose data and other assets to attacks.
We discuss business use of networking that protects the assets without hindering normal work.
Businesses invest money to build a networking infrastructure and then build a networking and communication system on this infrastructure to support business activities. In today’s environment, extensive use is made internal communication via the Intranet and external communication via the Internet. An open architecture, as often used earlier, might have been good for data access. With the increased number of threats as found today, the open architecture can expose data and other assets to attacks.
We discuss business use of networking that protects the assets without hindering normal work.
Risk – How Can It Happen?
There are a number of possibilities that may lead to undesirable situations, as follows:

1. Malicious destructive attack on network
2. Systematic penetration to steal data
3. Improper procedures to secure data
4. Complacence, network designed without security measures
5. Data integrated without partitions
6. Inadequate oversight of insiders
   The list is not necessarily complete.
   Example of Occurrence: Scenarios
   Ryan Chalak has recently taken charge of IT at Sun Health Systems which provides health care services over a region of the US. Because of the nature of their work, Sun Health holds in its database a large volume of patient information which has to be very secure as mandated by federal law. They also have other volumes of data that do not require the same level of security. Most of the data comes to the database at the head office from remote locations all over the region. However, the remote locations need access to the data to do their work.
   Ryan calls in a security consultant who has worked with defense contractors and they make a number of recommendations as follows:
7. All the data should be transported through secure VPN tunnels.
8. In addition to the existing firewalls there should be Intrusion Protection Systems (IPS).
9. The network should be partitioned so a compromised segment can be isolated.
10. The data should be segmented and partitioned with the highest security applied to only those parts that need the high security.
11. Network administrators and personnel who have access to the secure data should be supervised.
    Ryan took the recommendations to the Vice President who said that they were only providing health care and were not defense contractors. He could only provide money for some things.
    Answer the following questions:
    Question 1:
    Considering that the VP has agreed to doing some of the work, what should Ryan do?
    A. He should not worry unnecessarily. Nothing has happened so far.
    B. He should resign. The company is in serious danger and it will be his responsibility.
    C. If all of the security measures cannot be done there will be so many holes that there is no point in doing anything.
    D. He should get a prioritization from the consultant, get the budgets, and negotiate with the VP for a phased approach.

Question 2:
A general approach to guarding data from cyberattacks and penetration threats is to segment and partition. Which of the following best describes the reason for this?
A. Security can be focused and the most valuable data can be held most secure as in a vault.
B. Nobody wants all the data. There is no point in keeping it together.
C. One database may not have enough space for all data, and it is better to segment and separate.
D. Use multiple databases so that if one is down the others are still available.
Question 3:
At least one of the consultant’s recommendations can be implemented without any major budget outlay. This is the supervision of people with network access capabilities and access to sensitive data. What is the best approach in this respect?
A. These jobs should be held only by friends and family of senior management.
B. They are people and their privacy should be respected.
C. Everyone in a secure environment must submit to vetting, supervision, and audit.
D. All people should be encouraged to spy on their coworkers.

Sample Solution