Solved

IT Audit requirements

Posted on 2014-04-23
4
241 Views
Last Modified: 2014-04-27
Dear expert,


Our IT Audit has recommended to implement Intrusion Prevention Systems & Network Access Control on our network. So kindly advice which is the best Intrusion Prevention Systems & Network Access Control systems available.

Brief description about our network :

Around 250 users connected to core switch and HTTP traffic flow from fortigate firewall.  On server VLAN we have email server and ERP software published by Cisco ASA5510 with Internet Leased line
0
Comment
Question by:tabreed
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 24

Accepted Solution

by:
SunBow earned 250 total points
ID: 40019031
I personally do not think that there are any real good ones.  The more robust ones are not only costing more than they are worth, they are difficult to maintain well, mostly producing false positives to 'demonstrate' the need for their purchase. After spending millions on a number of products, a former company I'd had settled on Symantec, SEP. While I'm not personally recommending it, you'd do well to include it on your list of considerations for small site. I'd recommend going cheap, but it also helps where name recognition can affect one's career path. Similarly place Cisco on list for NAC considerations.
0
 
LVL 24

Expert Comment

by:SunBow
ID: 40019043
I have to say that most intrusions I've witnessed were from employee computers used at home and then brought to work environment (inside wall), both individual and company owned. So you may also want to consider addressing or readdressing corporate policy concerning such activity in response to audit request. The weakest link in the system is the part between the chair and the keyboard. The email server should have configuration to deny attachments containing vulnerable extensions. Pattern matchers should be available upon contingency but not running continually due to false positive issue. "This is Important!" (quote)
0
 

Author Comment

by:tabreed
ID: 40019225
Thanks sunbow, since we have Symantec enterprise protection suite, can we implement IPS  please adivce
0
 
LVL 10

Assisted Solution

by:Rafael
Rafael earned 250 total points
ID: 40019240
There is more to security than a NAC and IPS. As mentioned above the threat is as simple as a thumb drive from home.  You must also have preventive measures in place as well as an Acceptable Use Policy.  You also have to consider budget and management of your NAC and IPS such as vendor support as well as technical resources to manage it.  

Your ASA5510 has the ability to use IPS if you purchase the IPS module. You may want to look into it as well.

In cases like this for your small office thought may be given to outsourcing it to a 3rd party that specializes in Managed Security Services.  I know both Sonic Wall and Symantec both offer this service,  

If cost of a NAC is an issue but have the technical resources I can suggest Packet Fence. I would also suggest Open DNS to regulate and create a secure DNS environment,  

Don't forget an alerting system to your events and an escalation procedure on how to handle them.

-Rafael
0

Featured Post

Don't Miss ATEN at InfoComm 2017!

Visit booth #2167 to see the  new ATEN VM3200 32 x 32 Modular Matrix Switch. Other highlights include the VE8950 4K HDMI Over IP Extender, VS1912 12-Port DP Video Wall Media Player  and VK2100 ATEN Control System. Register now with Free Pass Code ATEN288!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question