IT Audit requirements

Posted on 2014-04-23
Medium Priority
Last Modified: 2014-04-27
Dear expert,

Our IT Audit has recommended to implement Intrusion Prevention Systems & Network Access Control on our network. So kindly advice which is the best Intrusion Prevention Systems & Network Access Control systems available.

Brief description about our network :

Around 250 users connected to core switch and HTTP traffic flow from fortigate firewall.  On server VLAN we have email server and ERP software published by Cisco ASA5510 with Internet Leased line
Question by:tabreed
  • 2
LVL 24

Accepted Solution

SunBow earned 750 total points
ID: 40019031
I personally do not think that there are any real good ones.  The more robust ones are not only costing more than they are worth, they are difficult to maintain well, mostly producing false positives to 'demonstrate' the need for their purchase. After spending millions on a number of products, a former company I'd had settled on Symantec, SEP. While I'm not personally recommending it, you'd do well to include it on your list of considerations for small site. I'd recommend going cheap, but it also helps where name recognition can affect one's career path. Similarly place Cisco on list for NAC considerations.
LVL 24

Expert Comment

ID: 40019043
I have to say that most intrusions I've witnessed were from employee computers used at home and then brought to work environment (inside wall), both individual and company owned. So you may also want to consider addressing or readdressing corporate policy concerning such activity in response to audit request. The weakest link in the system is the part between the chair and the keyboard. The email server should have configuration to deny attachments containing vulnerable extensions. Pattern matchers should be available upon contingency but not running continually due to false positive issue. "This is Important!" (quote)

Author Comment

ID: 40019225
Thanks sunbow, since we have Symantec enterprise protection suite, can we implement IPS  please adivce
LVL 10

Assisted Solution

Rafael earned 750 total points
ID: 40019240
There is more to security than a NAC and IPS. As mentioned above the threat is as simple as a thumb drive from home.  You must also have preventive measures in place as well as an Acceptable Use Policy.  You also have to consider budget and management of your NAC and IPS such as vendor support as well as technical resources to manage it.  

Your ASA5510 has the ability to use IPS if you purchase the IPS module. You may want to look into it as well.

In cases like this for your small office thought may be given to outsourcing it to a 3rd party that specializes in Managed Security Services.  I know both Sonic Wall and Symantec both offer this service,  

If cost of a NAC is an issue but have the technical resources I can suggest Packet Fence. I would also suggest Open DNS to regulate and create a secure DNS environment,  

Don't forget an alerting system to your events and an escalation procedure on how to handle them.


Featured Post

The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Will you be ready when the clock on GDPR compliance runs out? Is GDPR even something you need to worry about? Find out more about the upcoming regulation changes and download our comprehensive GDPR checklist today !
Phishing emails are a popular malware delivery vehicle for attack.  While there are many ways for an attacker to increase the chances of success for their phishing emails, one of the most effective methods involves spoofing the message to appear to …
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question