Solved

IT Audit requirements

Posted on 2014-04-23
4
247 Views
Last Modified: 2014-04-27
Dear expert,


Our IT Audit has recommended to implement Intrusion Prevention Systems & Network Access Control on our network. So kindly advice which is the best Intrusion Prevention Systems & Network Access Control systems available.

Brief description about our network :

Around 250 users connected to core switch and HTTP traffic flow from fortigate firewall.  On server VLAN we have email server and ERP software published by Cisco ASA5510 with Internet Leased line
0
Comment
Question by:tabreed
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 24

Accepted Solution

by:
SunBow earned 250 total points
ID: 40019031
I personally do not think that there are any real good ones.  The more robust ones are not only costing more than they are worth, they are difficult to maintain well, mostly producing false positives to 'demonstrate' the need for their purchase. After spending millions on a number of products, a former company I'd had settled on Symantec, SEP. While I'm not personally recommending it, you'd do well to include it on your list of considerations for small site. I'd recommend going cheap, but it also helps where name recognition can affect one's career path. Similarly place Cisco on list for NAC considerations.
0
 
LVL 24

Expert Comment

by:SunBow
ID: 40019043
I have to say that most intrusions I've witnessed were from employee computers used at home and then brought to work environment (inside wall), both individual and company owned. So you may also want to consider addressing or readdressing corporate policy concerning such activity in response to audit request. The weakest link in the system is the part between the chair and the keyboard. The email server should have configuration to deny attachments containing vulnerable extensions. Pattern matchers should be available upon contingency but not running continually due to false positive issue. "This is Important!" (quote)
0
 

Author Comment

by:tabreed
ID: 40019225
Thanks sunbow, since we have Symantec enterprise protection suite, can we implement IPS  please adivce
0
 
LVL 10

Assisted Solution

by:Rafael
Rafael earned 250 total points
ID: 40019240
There is more to security than a NAC and IPS. As mentioned above the threat is as simple as a thumb drive from home.  You must also have preventive measures in place as well as an Acceptable Use Policy.  You also have to consider budget and management of your NAC and IPS such as vendor support as well as technical resources to manage it.  

Your ASA5510 has the ability to use IPS if you purchase the IPS module. You may want to look into it as well.

In cases like this for your small office thought may be given to outsourcing it to a 3rd party that specializes in Managed Security Services.  I know both Sonic Wall and Symantec both offer this service,  

If cost of a NAC is an issue but have the technical resources I can suggest Packet Fence. I would also suggest Open DNS to regulate and create a secure DNS environment,  

Don't forget an alerting system to your events and an escalation procedure on how to handle them.

-Rafael
0

Featured Post

Veeam gives away 10 full conference passes

Veeam is a VMworld 2017 US & Europe Platinum Sponsor. Enter the raffle to get the full conference pass. Pass includes the admission to all general and breakout sessions, VMware Hands-On Labs, Solutions Exchange, exclusive giveaways and the great VMworld Customer Appreciation Part

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Using in-flight Wi-Fi when you travel? Business travelers beware! In-flight Wi-Fi networks could rip the door right off your digital privacy portal. That’s no joke either, as it might also provide a convenient entrance for bad threat actors.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question