Answer each written assignment separately.
COM520Written Assignment 5
Assignment: Network Security Controls
Assignment Requirements
Securing Windows networks requires recognizing potential vulnerabilities and selecting the best control to
address that vulnerability. You as a network administrator working for Ken 7 Windows Limited have been
given the task of reviewing the current network security policy and recommending the best network
security control to satisfy the policy. You can select from a short list of network security controls.
For each policy statement, select the best control to ensure Ken 7 Windows Limited fulfills the stated
requirements and provide a rationale.
Required Resources
Case Scenario for Rationale: Importance of Windows Access Control and Authentication (see
below)
Worksheet: Network Security Requirements Policy (see below)
Submission Requirements
Format: Microsoft Word
Font: Arial, Size 12, Double-Space
Citation Style: APA
Length: 1–2 pages
Self-Assessment Checklist
I have selected appropriate network security controls for each domain of the Ken 7 IT
environment.
I have provided rationale for my choices by explaining how each control makes the environment
more secure.
I have followed the submission requirements.
COM520 Written Assignment 5
Case Scenario for Rationale: Importance of Windows Access Control and Authentication
Ken 7 Windows Limited is a manufacturer of Windows for residential and commercial builders. Ken 7
Windows Limited carries a variety of Windows and related products. It supplies builders with all of the
tools and supplies to install finished Windows in any type of building.
Ken 7 Windows Limited has just purchased a new enterprise resource planning (ERP) software package
to help control costs and increase both quality and customer responsiveness. The ERP software collects
and stores information including:
• Raw material costs
• Labor costs
• Materials and labor requirements for products
• Purchasing requirements
Ken 7 Windows Limited has identified six basic roles for users in the new ERP software:
• Administrators—maintain ERP data and system operation.
• Planners—run planning software and generate requirements reports.
• Shop Floor users —enter operational data (receiving, shipping, and product progress during
manufacturing).
• Managers—manage department personnel.
• Purchasing users—generate purchasing documents based on planning requirements.
• Accounting users—maintain cost and accounting data.
Access controls limit what users or roles can do with different types of data. For example, consider the
following types of data:
• Cost information—raw materials and labor costs, including the cost of finished goods.
• Manufacturing details—cost, amount of labor, and time required to produce finished goods.
• Purchasing requirements—rules for determining when raw materials, components, or supplies
should be purchased.
Through access control:
• Cost information can be viewed only by Accounting users.
• Manufacturing details can be viewed only by Shop Floor users.
• Purchasing requirement can be viewed only by Purchasing users.
During the analysis phase of the ERP implementation, Ken 7 Windows Limited raised concerns about
users being able to access restricted data.
• Accounting users are able to login to shop floor computers.
• Purchasing users are able to access human resource (HR) applications and data.
The ERP implementation team suggested the following access control measures to protect restricted
data.
• Create an organizational unit (OU) in Active Directory for shop floor computers.
• Deploy Group Policy Objects (GPOs) to restrict shop floor users to the shop floor OU.
• Define data access controls in the ERP software to deny access for all non-HR users to restricted
data.
Implementation of several access control measures helped Ken 7 Windows Limited to restrict the data
access. Hence access control and authentication is important, as it helped Ken 7 Windows Limited in
reducing costs and increasing profits.
COM520 Written Assignment 5
Worksheet: Network Security Requirements Policy
Securing Windows networks requires recognizing potential vulnerabilities and selecting the best control to
address that vulnerability. You as a network administrator working for Ken 7 Windows Limited have been
given the task of reviewing the current network security policy and recommending the best network
security control to satisfy the policy. You can select from a short list of network security controls.
For each policy statement, select the best control to ensure Ken 7 Windows Limited fulfills the stated
requirements and also provide a rationale at the end of the table.
Select from these security controls:
a. Place a firewall between the Internet and your Web server.
b. Place a firewall between your Web server and your internal network.
c. Enforce password complexity.
d. Implement Kerberos authentication for all internal servers.
e. Require encryption for all traffic flowing into and out from the Ken 7 Windows environment.
f. Separate wired and wireless network entry points into separate logical networks.
g. Require all personnel attend a lunch and learn session on updated network security policies.
Security policy statements:
1. More and more users are using the Ken 7 Windows network to access social media sites
during business hours, causing the network to slow down. Users should not use Ken 7
network resources for social media access.
2. Most Ken 7 personnel own mobile phones and PDAs that can connect to the Internet. Ken
7 network administrators are concerned that personal device access may pose a security
threat to Ken 7 network resources. Personal devices must not be allowed to connect to
the Ken 7 Windows network.
3. Anonymous users of Ken 7 Web application should only be able to access servers located
in the demilitarized zone (DMZ). No anonymous Web application users should be able to
access any protected resources in the Ken 7 infrastructure.
4. Users who print confidential reports must not be allowed to send reports to unsecured
printers.
5. Passwords should not be words found in the dictionary.
COM 545 Writing Assignment 2
Scenario
UNFO traditionally has been a brick-and-mortar retailer, and the management has experiences
of associated business risks such as employee theft and shoplifting. However, as the
organization moves into the e-commerce model, new risks will be introduced to the
organization. As the junior information security analyst, it will be your role to summarize the
business impact of these new risks, the motivating factors that one may have to exploit
vulnerabilities, and how the risks can be mitigated.
Tasks
Prepare a report for presentation to senior management to assist the team in understanding IT
security risks associated with an e-commerce model. Additionally, the senior management team
will need to use the report as guidance for determining a budget allocation for hiring new IT
professionals. Through the given scenario of UNFO, identify the weaknesses and vulnerabilities
associated with the proposed Web platform. To do so, you must:
1. Research and classify common weaknesses and attacks associated with e-
commerce and social networking applications.
2. Identify the motivation for potential attacks.
3. Identify the roles such as system administrator, developer, security engineer, and
quality assurance analyst for each classification.
4. Explain the business impacts of a successful exploit on a Web application’s
weakness.
5. Summarize the importance of identifying weaknesses and motivation for attacks
early in the development or implementation process.
Submission Requirements
Submit your answer in a Microsoft Word document in two pages, along with a cover page and
executive summary.
Font: Arial 12-point size
Line Spacing: Double
Scoring Rubric
Students will complete the assignment with attention to the following criteria:
Rating Scale Exemplary: Corresponds to an A- to A (90-100%)
Proficient: Corresponds to B- to B+ (80-89%)
Basic: Corresponds to C- to C+ (70-79%)
Novice: Corresponds to D to D+ (60-69%)
Not Attempted: Corresponds to an F (0-59%)
Elements
Criteria
Score
Not Attempted
(Criterion is
missing or not
in evidence)
0-14.99%
Novice
(does not meet
expectations;
performance is
substandard)
15-17.49%
Basic
(works towards
meeting
expectations;
performance
needs
improvement)
17.5-19.99%
Proficient
(meets
expectations;
performance is
satisfactory)
20-22.49%
Exemplary
(exceeds
expectations;
performance is
outstanding)
22.5-25
Paper Topic
25%
There was little or
no evidence of an
essay.
The paper fails to address
multiple parts of the essay
prompt, and/or the paper
lacks a thesis statement.
The paper
addresses most,
but not all, of parts
of the essay
prompt, and/or the
paper’s thesis is
difficult to discern.
The paper addresses
all parts of the essay
prompt but not
adequately, and/or the
paper has an
adequate thesis, but it
is not explicitly stated
in the introductory
paragraph.
The paper adequately
addresses all parts of
the essay prompt; and
the paper clearly states
a well-defined thesis in
the introductory
paragraph.
___/25
Length
Requirements
25%
There was little or
no evidence of an
essay.
The paper is entirely too
short.
The paper contains
a great deal of “fluff”
and still doesn’t
meet the length
requirements.
The paper is just a
little on the short side,
and/or it meets the
requirements only
because it contains
“fluff” that could use
trimming.
The paper falls within
the required length
requirements without
going over and without
straying from the main
topic.
___/25
Mechanics of
Writing
25%
Little to no
evidence of
proper writing
mechanics.
The grammar of the paper
greatly impedes
understanding of content,
and/or the paper contains
no citations.
The paper needs a
good deal of
improvement with
respect to grammar,
citations, spelling,
and/or style.
The paper is mostly
free of errors with
respect to grammar,
citations, spelling,
and/or style, but needs
some improvement in
this area.
The paper is nearly
perfect with respect to
grammar, citations,
spelling, and style.
___/25
Understanding
25%
The paper
exhibits a
complete lack of
understanding of
the text and/or
course materials.
The paper exhibits very
little understanding of the
text and/or course
materials.
The paper exhibits
basic understanding
of the text and/or
course materials
but needs
improvement in this
area.
The paper exhibits
sufficient
understanding of the
text and/or course
materials, but some
improvement is
needed.
The paper does an
excellent job
demonstrating an
accurate understanding
of the text and/or course
materials.
___/25
____/100
Comments/Feedback:
