Solved

IT Audit requirements

Posted on 2014-04-23
4
232 Views
Last Modified: 2014-04-27
Dear expert,


Our IT Audit has recommended to implement Intrusion Prevention Systems & Network Access Control on our network. So kindly advice which is the best Intrusion Prevention Systems & Network Access Control systems available.

Brief description about our network :

Around 250 users connected to core switch and HTTP traffic flow from fortigate firewall.  On server VLAN we have email server and ERP software published by Cisco ASA5510 with Internet Leased line
0
Comment
Question by:tabreed
  • 2
4 Comments
 
LVL 24

Accepted Solution

by:
SunBow earned 250 total points
ID: 40019031
I personally do not think that there are any real good ones.  The more robust ones are not only costing more than they are worth, they are difficult to maintain well, mostly producing false positives to 'demonstrate' the need for their purchase. After spending millions on a number of products, a former company I'd had settled on Symantec, SEP. While I'm not personally recommending it, you'd do well to include it on your list of considerations for small site. I'd recommend going cheap, but it also helps where name recognition can affect one's career path. Similarly place Cisco on list for NAC considerations.
0
 
LVL 24

Expert Comment

by:SunBow
ID: 40019043
I have to say that most intrusions I've witnessed were from employee computers used at home and then brought to work environment (inside wall), both individual and company owned. So you may also want to consider addressing or readdressing corporate policy concerning such activity in response to audit request. The weakest link in the system is the part between the chair and the keyboard. The email server should have configuration to deny attachments containing vulnerable extensions. Pattern matchers should be available upon contingency but not running continually due to false positive issue. "This is Important!" (quote)
0
 

Author Comment

by:tabreed
ID: 40019225
Thanks sunbow, since we have Symantec enterprise protection suite, can we implement IPS  please adivce
0
 
LVL 10

Assisted Solution

by:Rafael
Rafael earned 250 total points
ID: 40019240
There is more to security than a NAC and IPS. As mentioned above the threat is as simple as a thumb drive from home.  You must also have preventive measures in place as well as an Acceptable Use Policy.  You also have to consider budget and management of your NAC and IPS such as vendor support as well as technical resources to manage it.  

Your ASA5510 has the ability to use IPS if you purchase the IPS module. You may want to look into it as well.

In cases like this for your small office thought may be given to outsourcing it to a 3rd party that specializes in Managed Security Services.  I know both Sonic Wall and Symantec both offer this service,  

If cost of a NAC is an issue but have the technical resources I can suggest Packet Fence. I would also suggest Open DNS to regulate and create a secure DNS environment,  

Don't forget an alerting system to your events and an escalation procedure on how to handle them.

-Rafael
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are some basic methods for preventing attacks on, hacking of and unauthorized access to a network -- maybe not completely, but up to a certain level. Start with a well-reputed firewall and unified threat management (UTM) system -- a gateway…
Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question