Mr C Johnston ICT Teacher BTEC IT Unit 05 - Lesson 12 Network Security Policy

Session Objectives Understand the necessity for security procedures and how they can be implemented to ensure that data equipment and data is kept secure

Network Security Policies Network security policies and procedures are in place to strengthen network security and prevent any loss to data with maliciously or accidental, Policies are rules which need to be followed whilst procedures are step by step instructions showing how to complete a task – e.g. blocking a port on the firewall, A typical network policy will have rules governing: Firewall management, Access control lists, Device hardening, Continuous policy review, (penetration testing, security audits, access control lists review) User rights and when to review them.

Network Administration Overview To ensure that users behave themselves there are number of techniques we can use – the next few slides cover some of the basic aspects of network administration.

User Accounts To log onto a network each user needs a unique user account with a username, Each user should have their own username and shouldn’t share because: Its possible to keep a log of who is logged in, Able to keep a history of who is logged in, Provides user with a unique identity on the network, Links user automatically to their files, Allows access rights to be enforced, Can trace any body who breaks the acceptable use policy. Users need to be told not the share / write down their password, Also should be encouraged to change their password regularly and log off workstations when finished – password policies can be used enforce this,

User Groups To make it easier to manage users they are spilt into groups, Groups are then given different security rules or policies and access to different files and folders, The policies then apply to all members in a group – much quicker than granting rights to each user account individually, A basic model is to have three groups but an organisation may have hundreds of different groups all with different levels of access. User 1User 2 User 6 User 3 User 4User 5 User 8User 9 User 13 User 10 User 11User 12 User 7 Group 1 = users Maximum Security Applied Group 2 = PowerUsers Medium Security Applied Group 3 = Administrator Have Full Control

Password Policies One of the easiest ways to hack a network is to guess a users password, Users tend to have silly passwords which can be easily deduced by others – brute force method hacking is very common, Password policy aims to prevent silly passwords from being used by: Ensuring a user account has a password, Allowing users to change their passwords, Setting a minimum length for passwords, Forcing users to frequently change their password, Ensuring passwords contain a mixture of numbers, upper and lower case characters, Blocking accounts for 24hours where the password has been entered incorrectly three times (prevents brute force attack),

Password Policy Examples Setting up password policy Example of a brute force attack Setting up password policy

Login Policies Security policies can also be applied to logging into the network, Network operating systems allow you to: Restrict login times (e.g. 9 till 5 Mon-Fri only), Disable a user or groups of users accounts, Limit the number of concurrent connections, Force accounts to automatically expire on a given day.

Login Policies Example Limiting Jacks logon hours to between 6am and 8pm

WorkStation Policies Workstation Policies apply to the computers users work on, They prevent users from: Changing Settings, Installing Software / Hardware, Customising Machines (screen savers, backgrounds etc), Accessing Certain Software, Normally you will have a Workstation policy for each group of users or type of user, which has an appropriate level of security, To set-up Workstation Policies you select from the what you will allow users to, and not to do.

Workstation Policies Example Setting up a security policy to control how the workstations look and prevent changes

File and Folder Policy To access a file or folder on the network you need to have the correct permissions, Each file or folder can be marked with permissions including: No Access List (File Scan) Read only Add (Write) Change (Modify) Full Control File and Folder policy specifies the permissions files and folders have to each user and group of users.

File and Folder Policy Example No Access - N List (File Scan) - FS Read only - R Add (Write) - W Change (Modify) - M Full Control - FC Shared Users – FS, R PowerUsers – FS, R Admins - FC Document Templates Users – FS, R PowerUsers – FS, R, A, M Admins – FC Private Users – N PowerUsers – FS, R Admins – FC Users Shared Users – FS, R, A, M PowerUsers – FS, R, A, M Admins – FC

Task 1 [P1] You will be given a machine to explore by your tutor – you need to make some notes about the specification of the hardware parts and what each is for, Use photos and system information utilities as evidence within your notes, Include a diagram to show the how data flows between some of the main components. For P1, evidence such as diagrams or photographs with clear supporting notes will be sufficient. An alternative form of evidence is a web page with hot-spots over different components explaining what the components are. The communication between components must be identified. It is possible that everything could be identified within one diagram. P1 - explain the function of computer hardware components