Premium Essay

Remote Access Attacks

In: Computers and Technology

Submitted By jaymaster28
Words 964
Pages 4
1. Analyze the Quick Finance Company Network Diagram and describe the assumptions you will need to make in order to identify vulnerabilities and recommend mitigation techniques as there is no further information from this company. The company does not wish to release any security related information per company policy.

Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw (U.S. Airforce) therefore my assumptions on the network diagram shows that there are vulnerabilities that may exist as a weakness in the automated systems, security procedures, administrative controls, and /or internet controls of the finance company there could also exist hardware vulnerabilities that could lead to unprotected storage of hardware the solution is to store all hardware at the recommended temperature, software vulnerability can occur with insufficient testing and a lack of audit trail solution will be to test and secure all software used and update software as appropriate, audit trails enable security relevant chronological records of activities that occur in the software. There could be network vulnerability with unsecure network architecture and unprotected communication lines the solution will be to install and configure network security equipment to curb these issues. Personnel can be compromised and may be used to create problems either directly or indirectly on the system a solution will be proper recruiting of staff and security awareness training there could also exist organizational vulnerabilities such as lack of security within the organization the solution will be to secure the organization and its assets.

2. Analyze the above case and network diagram, and describe how each access point is protected or unprotected.

Each access point is protected by…...

Similar Documents

Premium Essay

Remote Access Policies

...Remote access policies validate a number of connection settings before authorizing the connection, including the following: • Remote access permission • Group membership • Type of connection • Time of day • Authentication methods • Advanced conditions: ◦ Access server identity ◦ Access client phone number or MAC address ◦ Whether user account dial-in properties are ignored ◦ Whether unauthenticated access is allowed After the connection is authorized, remote access policies can also be used to specify connection restrictions, including the following: • Idle timeout time • Maximum session time • Encryption strength • IP packet filters • Advanced restrictions: ◦ IP address for PPP connections ◦ Static routes Additionally, you can vary connection restrictions based on the following settings: • Group membership • Type of connection • Time of day • Authentication methods • Identity of the access server • Access client phone number or MAC address • Whether unauthenticated access is allowed For example, you can have policies that specify different maximum session times for different types of connections or groups. Additionally, you can specify restricted access for business partners or unauthenticated connections. Authorizing access There are two ways to use remote access policies to grant authorization: 1. By user 2....

Words: 360 - Pages: 2

Free Essay

Remote Access

...Interests - What You Like/Dislike | | | Page 3 of 12 | People with interests that match their career tend to be happier at work, more self-confident and have the "staying power" to obtain the jewels of their chosen profession. This assessment is based on people's patterns of interest across different careers. Your scores indicate how your interests in various work activities compare to the interests of other people. Your Basic Interest Profile | | | Your Basic Interest Scores presented below measure your level of interest in 15 different areas. The first 12 scores measure your occupational interests. The next 3 scores are "work styles" that measure your attitudes towards certain common aspects of work. Click on the score names to see the definitions.Each Basic Interest score is displayed as a percentile. For example, a score of 80% means you scored higher in this Basic Interest than 80 percent of people (more info). | | Occupational Interests | | | Percentile Profile | Scale | Percentile | | | | Administration | 75 | | | | | | Art | 18 | | | | | | Clerical | 55 | | | | | | Food Service | 13 | | | | | | Health Service | 11 | | | | | | Industrial Art | 91 | | | | | | Outdoors | 17 | | | | | | Personal Service | 11 | | | | | | Sales | 54 | | | | | | Science | 79 | | | | | | Teaching / Social Service | 37 | | | | | | ......

Words: 280 - Pages: 2

Premium Essay

Richman Investment Remote Access Control Policy

...Richman Investment Richman Investment Remote Access Control Policy Document Remote Access Control Policy Document 01/14/14 01/14/14 Contents 1 Policy Statement 4 2 Purpose 4 3 Scope 4 4 Definition 4 5 Risks 4 6 Applying the Policy - Passwords 5 6.1 Choosing Passwords 5 6.1.1 Weak and strong passwords 5 6.2 Protecting Passwords 5 6.3 Changing Passwords 5 6.4 System Administration Standards 6 7 Applying the Policy – Employee Access 6 7.1 User Access Management 6 7.2 User Registration 6 7.3 User Responsibilities 6 7.4 Network Access Control 7 7.5 User Authentication for External Connections 7 7.6 Supplier’s Remote Access to the Council Network 7 7.7 Operating System Access Control 7 7.8 Application and Information Access 8 8 Policy Compliance 8 9 Policy Governance 8 10 Review and Revision 9 11 References 9 12 Key Messages 9 13 Appendix 1 10 Policy Statement Richman Investments will establish specific requirements for protecting information and information systems against unauthorised access. Richman Investments will effectively communicate the need for information and information system access control. Purpose Information security is the protection of information against accidental or malicious disclosure, modification or destruction. Information is an important, valuable asset of Richman Investments which must be managed with care. All information has a value to the Council. However, not all of this information has an......

Words: 2211 - Pages: 9

Premium Essay

Remote Access Control Policy Definition

...Remote Access Control Policy Definition Introduction to Information Security Remote access is the ability to log onto a network from a distant location. Generally, this implies a computer, a modem, and some remote access software to connect to the network. Whereas remote control refers to taking control of another computer, remote access means that the remote computer actually becomes a full-fledged host on the network. The remote access software dials in directly to the network server. The only difference between a remote host and workstations connected directly to the network is slower data transfer speeds. The purpose of a remote access policy is to define the standard connection to the company’s network from any remote host, untrusted host and remote network, including untrusted hosts on the company’s intranet. These standards are designed to minimize the potential exposure to the company’s from damages, which may result from unauthorized use of the company’s resources. At the main location, a set switches and routers are interconnected to from a Wide Area Network. The switches can be connected in different topologies. All remote users must follow the security requirements set forth in the standard for the company’s remote host accessing Information Technology Resources prior to such access, as well as any guidelines, procedures or other requirements issued by the Information Technology Department. Within the virtual private network multiple Virtual Private Network......

Words: 660 - Pages: 3

Premium Essay

Remote Access Control Policy Definition

...The following are types of Remote Access Control Policy I would like to put into place to make sure our company’s data is secure. We need to get the right security measures so the correct people can have access to the data they need to do their job. I would start by setting up a Remote Authentication Dial-In User Service (RADIUS), a VPN, Firewall, Local Biometrics, RSA – F.O.B. by using a security key carried by the employee or set it up on the local server. I would start in the Main office that is located in Phoenix, AZ by install a RADUIS, this is a client/server protocol that runs in the application layer and will connect all the employee and visitor to the server. In the main office, we need to set up a database with all username and passwords for the employees’. At all the satellite facilities, we need to set up the proper VPN, Firewall protection as well as setting up some type of biometric logon system or a random number generator where a user will be given a security key and they will need to input that when they log on to the system. We need to set up the password system to reset every 3 months and set up a password remembrance. For the mobile devices that the sales department will need, I would suggest to encrypt the local hard drives if stolen and set up biometric thumb scanner as well as a security key require to log on to their systems....

Words: 261 - Pages: 2

Premium Essay

Remote Access Control Policy

...Remote Access Control Policy Definition What is remote access? Remote access is the ability to log onto a network from a distant location. What that means that a computer, a modem, and some kind of remote access software is required to connect to the network. But remote control refers to actually taking control of another computer, whereas remote access means that the remote computer has the ability to become a hot on the network. When you use remote access software it will directly dial into the network server. There is a difference between a remote host and workstations that are connected directly to the network is the slower data transfer speeds. What the purpose behind a remote access policy is to define the standard hosts on the company’s intranet from the remote host, non-trusted hosts (on the company’s intranet too), and remote network. These standards are setup to minimize any potential exposure to the company’s network and data from any damages, which are a result of unauthorized access by attackers through the network, virus, software, and more. When it comes to the main location of the company, it will have a Wide Area Network (WAN), along with the WAN there will be a set of switches and routers connected to and from the WAN. This allows for the switches to be connected to different topologies. A Virtual Private Network (VPN) will be created using Internet Protocol (IP) by the company’s IT department. Within the VPN there will be other VPN routers will......

Words: 889 - Pages: 4

Premium Essay

Nt2580 Remote Access Policies

...NT2580 Week 2 Essay Create a Remote Access Policy Definition NT2580 The requirements for establishing a secure connection between remote locations vary between organizations. The needs of the organization are based on the type of information and data being transferred, as well as the sensitivity of the information. There are several options available to networks to get their data sent securely and reliably. All seven layers of the OSI model must be taken into account when designing secure Remote Access Control Policies. In order to create a secure remote connection between offices in Atlanta, San Francisco, Chicago, and Dallas, a WAN link would be the best type of connection. A dedicated WAN link would offer the organization a secure, reliable, dedicated P2P type of connection. Wide Area Network links would be monitored by the owners of the lines that connect each location. Leased lines from the providers will allow for scalability with potential growth. The downside to this type of connection is the expense and an internet connection is not necessarily provided by the link. In order to add to the security of the network physical and logical access controls are necessary. Logical implementations added to the network will be Acceptable, Email, and Wireless Use policies, Antivirus and firewall software, as well as Extranet, Interconnection, and Host Security. In order to ensure the physical assets, as well as employees, physical security must also be considered.......

Words: 704 - Pages: 3

Premium Essay

Remote Access

...Purpose This remote access policy is designed to prevent damage to the organizational network or computer systems and to prevent compromise or loss of data. Approval Any remote access using either dial-in, VPN, or any other remote access to the organizational network must be reviewed and approved by the appropriate supervisor. All employees by default will have account settings set to deny remote access. Only upon approval will the account settings be changed to allow remote access. Remote Computer Requirements 1. The anti-virus product is required to be operating on the computer at all times in real time protection mode. 2. The anti-virus library definitions shall be updated at least once per day. 3. Anti-virus scans shall be done a minimum of once per week. No one should be able to stop anti-virus definition updates and anti-virus scans except for domain administrators. 2. The computer must be protected by a firewall at all times when it is connected to the internet. Several popular choices include Zone Alarm, the Windows XP firewall, and Norton Personal firewall. Remote Connection Requirements The remote user shall use either dial-In or virtual private networking (VPN). Dial-In is typically used when the user in in a local calling area. VPN is typically used when the user would need to dial a long distance number to connect with a dial-in connection. VPN uses a local connection to an internet service provider (ISP) and creates a tunnel through the......

Words: 569 - Pages: 3

Premium Essay

Unit 3 Assignment 1 Remote Access Control Policy

...just incase something happens with the network Richman can know exactly when, where, and more details of how this incident transpired. Authorization- Richmann’s investments have to clarify and make known the rules as to who and what computers can gain access to the network resources. I would be best to create a group membership to help avoid accidents within the network. The administrator can assign different users to different group within the network ensuring that everything is place as he/she wants it. The users’ access would be based upon what group they are in that was put in place by the administrator of the network. Authentication- When a user try’s to get into the network system there must be proof in order to enter the network. Some people may think there is a lot of security to enter and access parts of the network but it is better to be safe as possible as a hacker taking or corrupting all the information causing a major or a possible critical problem. Accountability- Users will be held accountable and responsible for anything they do within the network system. I suggest using logs files that information is kept and users have to log in on a daily bases. Using a log book can help prevent, detect, or monitor access to the network system....

Words: 261 - Pages: 2

Premium Essay

Remote Access Control Policy

...Remote Access Control Policy The Remote Access Control Policy for Richman Investments is designed to protect the confidentiality and integrity of our corporate and customer information. All remote sessions, including internal wireless access will utilize PKI certificates from a public trusted third party vendor using encrypted tunnels on the Internet. Site-to-Site data exchanges will be conducted using IPSec encrypted Tunnels. Customer Remote Access These Connections must allow the customer to securely exchange information with our Web Server applications. The Web Servers will be place on the Corporate DMZ and the Database Servers on the interior corporate LAN. Web to Database traffic will be encrypted. The Web Servers will have PKI certificates from a trusted third party vendor to eliminate spoofing. Data will be encrypted using SSL connections initiated on the customer’s Browser to maintain confidentiality. The customer will need to supply a username and password which the Web browser will pass to a RADIUS Server for Authentication, and Access permissions prior to granting access to protected areas of the Website. Employee Access All Employee Connections, internal and external, to the Internal LAN at all sites will utilize Two Party Authentication to minimize the risks of utilizing passwords as the primary access method. Employees will have a employees will have a onetime pass key generating token (Ex. RSA) and PIN in addition to their Username and Password to......

Words: 510 - Pages: 3

Premium Essay

Remote Access Control Policy Definition

...Remote access security policy involves the policies and conditions that are in place that allow users to connect to servers when out of the network. In the case of Richman industries, they are interested in maintaining connections with their users, and sharing app data that is on a server for their day to day operations. In their case, I would have access policy that is based on Explicit Allow policies. This means that the policy grants “Permission” to access the servers remotely if the connection attempt matches the policy conditions. Some of the requirements would include strict control enforced via one-time password authentication or public keys with strong pass-phrases. Also, anyone trying to gain access must not be connected to any other network at the same time, aside from personal home networks under the user's complete control. Further, employees with access must not use email accounts other than the company's standards, so that personal use won't be confused with business. Users must have approved virus control and spyware protection in place on all devices accessing the company network. Remote access will be limited in certain areas, while at least Applications will be approved for access (Shared application data is an important part of Richman’s network). Systems and system settings will not be accessible from remote, out of network connections, to protect from outside alterations of systems or system settings, and any Data access will be read only, with......

Words: 300 - Pages: 2

Free Essay

Attacks

... Discuss the threat When infected restricts you to access to a computer system. This will become more refined in its targets and methods. Experts predict that the variants of ransomware that hurt the security software that are installed within a computer may particularly target the endpoints which sign up with cloud-based storage solutions like Google Drive, Dropbox, OneDrive and many more. On detecting the endpoint, ransomware will exploit the stored personal credentials of the logged-in user and will even infect the cloud storage that is backed up. McAfee has warned that ransomware attackers will try out as many ways possible to shell out ransom payments from their victims. Degree of damage The most advanced and most damaging ransomware in the wild at the moment, specifically targeting U.S. businesses and individuals. It's a $70 million per year criminal enterprise. Its magnitude is now confirmed by law enforcement. Some quick math shows $18,145 in costs per victim, caused by network mitigation, network countermeasures, loss of productivity, legal fees, IT services, and/or the purchase of credit monitoring services for employees or customers. As you can see, the total costs of a ransomware infection goes well above just the ransom fee itself, which is usually around $500 but can go up to $10,000. What it attacked Ransomware is a type of malware that infects a computer and restricts a user’s access to the infected computer. This type of malware,......

Words: 2057 - Pages: 9

Free Essay

Remote Network Access Technology

...WHAT IS REMOTE NETWORK ACCESS TECHNOLOGY? or REMOTE ACCESS SERVICE ( RAS ) Remote network access technology allows access to a computer or a network from a remote distance. Employees at branch or satellite offices or telecommuters, and travelling staff members may need access to the company or agency’s network and are able to do so via remote access. Users working from home get access through an Internet service provider (ISP) or Dial-up connection through desktop, notebook, or handheld computer modem over regular telephone lines. These days almost every company offers some type of remote access to accommodate employees working outside the office and others like business partners, vendors, or external technical support. Remote Access Service (RAS) allows remote clients to dial-in and connect to network as if they were locally connected in the office. VPN REMOTE ACCESS TECHNOLOGY VPN (Virtual Private Network) & Tunneling A Virtual Private Network (VPN) is a private connection over a public network such as the Internet. VPNs can save a company a lot of money because it use Internet connection rather than expensive long-distance point-to-point connections such as dial-up, ISDN, and leased lines, to allow remote networks and remote employees to connect to the corporate network. A site-to-site or LAN-to-LAN VPN as shown below is typically used for connecting branch offices of a single organization or for creating an extranet for business partners. The second main......

Words: 1041 - Pages: 5

Premium Essay

Richman Investment Remote Access Security Policy

...Richman Investment’s Remote Access Security Policy 1) Wireless Access At Richman Investment’s when the network is accessed remotely via wireless appropriate wireless security standards will be used. • Wired Equivalency Protocol (WEP) will be used as standard on Wi-Fi connections. • A WEP encryption key will be used. • The network will be configured not to advertise its presence. • The power of access points will be turned down to a minimum that still allows the access point to function. • Due to the possibility of cracking Wireless Encryption Protocol using sniffing software such as AirSnort all wireless access points will be outside the firewall. • Wi-Fi Protected Access (WPA) will be used where it is available. 2) Secure Access via VPN Access from remote users to the corporate network will be via secure IPSEC VPN or SSL VPN connections only. This is necessary to secure the connection from the remote device to the corporate network. 3) Prevention of Data Loss All laptops and PDA’s that are taken off site will have the following security configured, to prevent data loss in the event of theft. • The hardware password will be enabled if available. • All corporate data on the laptop or PDA will be encrypted using appropriate encryption software. • Sensitive documents will be accessed remotely and not downloaded to the laptop or PDA. 4) Remote Device Protection To prevent remote PC’s, laptops, PDA’s etc from compromising...

Words: 349 - Pages: 2

Premium Essay

Remote Access Control Policy for Richman Investments

...Authorization- Richman Investments must define rules as to who has access to which computer and network resources. My suggestion is that RI implements either a group membership policy or an authority-level policy to achieve this. Group policy would allow the administrator to assign different privileges to different groups. The admin would then assign different individual users to those different groups. So the users permissions would depend on the permissions of the group they were a member of. With authority-level policy the admin would assign different permissions to individual users based on their position and authority level within the company and what access that position requires. Identification- Richman Investments needs to assign a unique identifier to each user in order to have accurate records of who is accessing, or trying to access, what applications, which network resource, and what data. The most common ID is the username, account number, or PIN Authentication- In order to keep the remote access to Richman Investments secure, there must be proof that the person trying to gain access to the network remotely is the same person who has been granted access by identification. To do this RI can choose one of the following knowledge type authentications: PIN, password, or passphrase along with one of the following ownership type of authentication: smart card, key, badge, or token. Using a combination of ownership authentication and knowledge authentication...

Words: 298 - Pages: 2