Basic Scenario

The Mavis car rental company has a head office in Brisbane, Australia, with branch offices in five cities in the state of Queensland.

At head office there are 40 people:

? 5 top-level managers and executive officers

? 5 mid-level managers who deal with procurement, car service etc.

? 5 customer service people who deal with significant events, usually ones that require legal procedures

? 10 administrative staff who deal with the paperwork, procedures etc.

? 10 marketing staff who develop, plan and execute marketing strategies

? 3 HR staff who deal with employee data

? 2 IT people who keep the existing IT infrastructure working

These 40 people occupy a single floor of a high-rise building and space on this floor is extremely tight. Recently, the floor above has become vacant and Mavis has chosen to purchase the floor above so that they can expand the head office. The plan is to move five people upstairs and also increase the staff at head office by 30 so that there are 70 people all up at head office. The budget Mavis has set for this security revamp is $250,000 for all additions or changes to the security architecture.

Existing IT Infrastructure

The Mavis head office has this equipment already installed:

? Each person has a PC and an analogue (non-VOIP) phone

? There are two 24-port Cisco Catalyst switches which are cross-linked

? 24 100M access ports, with one 1G uplink port on each switch used to cross-link them

? There is an ADSL router which provides head office with basic Internet connectivity

There are six servers which provide these services:

? Jane is the e-mail server used by all the staff

? Danny is the internal web server used by all the staff

? Opie is the database and application server only used by the HR staff

? Superstar is the file server which the marketing staff use for brochures etc.

? Gotcha is the file server which is used by customer service to hold details of existing customer issues and legal documents

? Sauron is a server run by the IT staff. It provides general file service to all staff along with DNS, DHCP and Active Directory services

The floor plans, existing physical wiring and server room rack layout is shown in the diagrams at the end of this document. All PCs and phones are cabled back to patch panels in the server room using Category 6 UTP cable. There are 96 UTP runs on this floor back to the patch panels in the server room.

On the new floor above the existing floor, there is an empty server room with two racks. One rack has patch panels, and the other rack used to have equipment from the previous tenant but is now empty. This floor has 120 UTP runs from room ports back to the patch panels in the server room.

Security Requirements

The present security systems in place at Mavis are inadequate. With the expansion of the network into the floor above, Mavis realise that their existing security systems need to be upgraded and improved. At present their security requirements are unclear. As an IT security consultant you are invited to look into the following aspects of security within Mavis:

? Identify important / critical assets and associated risks investigating vulnerabilities and exploits.

? Propose a security plan for Mavis.

? Evaluate and verify your design against industry best practices.

overall task

Your task, in groups of 2 or 3, is to design a robust security infrastructure for Mavis so that it meets the security requirements of the organisation, and to write a detailed Risk Management Plan which you will submit to Mavis for consideration.

This overall task will be broken into smaller sub-tasks and each of these sub-tasks maps to the performance criteria in the following unit:

1. ICANWK511 Manage Network Security

Each sub-task will outline what performance criteria from these units you are expected to meet.

Task: Develop Risk Management Plan

Performance criteria:

1. Define a process for designing security plan.

2. Identify threats to network security.

3. Analyse security risks.

4. Create security plan.

5. Design / propose responses to security incidents.

6. Analyse the cost and provide a budget for the security plan.

For this task you will conduct a simulated face-to-face interview with the CEO of Mavis. The interview will only last 15 to 20 minutes so you must come to the interview with a set of questions that you need to ask to clarify Mavis' security requirements.

To complete this task you will:

? perform the simulated interview with the CEO, where all group members actively participate

? submit a document identifying the various assets / threats / risks and the security plan. Include your responses to the security incidents in this report.

? include in this document the answers that you obtained from the CEO and

how this information has helped you with your ideas for the security plan for Mavis.

Mavis floor plans

Here is a diagram of the existing Mavis floor plus the floor they intend to buy. The building size is 25m by 40m. On the existing floor, INT. ROOM holds the existing network equipment and servers. On the new floor, Mavis suggests that room 230 be used for networking and/or server equipment.

Mavis wiring diagrams

Here are the existing horizontal wiring diagrams for both floors. They show where the CAT-6 cables are laid horizontally, but not how many wires. The diagrams also do not show the approximately 4m drop from the roof space on each floor to the wall ports.

Mavis rack diagrams

Here are the diagrams of the racks on both floors and the equipment currently installed. The empty rack on the second floor is not shown.

Mavis logical network diagram

Here is the logical design of the existing Mavis network. The two switches are connected by a crossover cable. The six servers are connected to one switch. The 40 PCs are connected to both switches. There are also 40 old analogue phones which are connected to the old PABX system.

8 8 0 2 2 8 8 0 2 2