• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 272
  • Last Modified:

IT Audit requirements

Dear expert,


Our IT Audit has recommended to implement Intrusion Prevention Systems & Network Access Control on our network. So kindly advice which is the best Intrusion Prevention Systems & Network Access Control systems available.

Brief description about our network :

Around 250 users connected to core switch and HTTP traffic flow from fortigate firewall.  On server VLAN we have email server and ERP software published by Cisco ASA5510 with Internet Leased line
0
tabreed
Asked:
tabreed
  • 2
2 Solutions
 
SunBowCommented:
I personally do not think that there are any real good ones.  The more robust ones are not only costing more than they are worth, they are difficult to maintain well, mostly producing false positives to 'demonstrate' the need for their purchase. After spending millions on a number of products, a former company I'd had settled on Symantec, SEP. While I'm not personally recommending it, you'd do well to include it on your list of considerations for small site. I'd recommend going cheap, but it also helps where name recognition can affect one's career path. Similarly place Cisco on list for NAC considerations.
0
 
SunBowCommented:
I have to say that most intrusions I've witnessed were from employee computers used at home and then brought to work environment (inside wall), both individual and company owned. So you may also want to consider addressing or readdressing corporate policy concerning such activity in response to audit request. The weakest link in the system is the part between the chair and the keyboard. The email server should have configuration to deny attachments containing vulnerable extensions. Pattern matchers should be available upon contingency but not running continually due to false positive issue. "This is Important!" (quote)
0
 
tabreedAuthor Commented:
Thanks sunbow, since we have Symantec enterprise protection suite, can we implement IPS  please adivce
0
 
RafaelCommented:
There is more to security than a NAC and IPS. As mentioned above the threat is as simple as a thumb drive from home.  You must also have preventive measures in place as well as an Acceptable Use Policy.  You also have to consider budget and management of your NAC and IPS such as vendor support as well as technical resources to manage it.  

Your ASA5510 has the ability to use IPS if you purchase the IPS module. You may want to look into it as well.

In cases like this for your small office thought may be given to outsourcing it to a 3rd party that specializes in Managed Security Services.  I know both Sonic Wall and Symantec both offer this service,  

If cost of a NAC is an issue but have the technical resources I can suggest Packet Fence. I would also suggest Open DNS to regulate and create a secure DNS environment,  

Don't forget an alerting system to your events and an escalation procedure on how to handle them.

-Rafael
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now