Final Scenario

$1.$ Prepare effective top level and technical security policies

appropriate to a given scenario.

$2.$ Evaluate the security measures in place in a networked

computer system.

$3.$ Assess information, with regard to evidential value and forensic

safety.

$4.$ Propose security measures appropriate to a given scenario and

associated risks.

Assessment Criteria and Indicative Weighting

Description Points

Task $1$ contains: identification of services at each

location, diagram of the design $($services diagram,

hardware diagram covering thus logical and physical

design$),$ identification and description of the services

towards external providers and customers.

$20$

Task $2$ contains: identification of aggregation and

check$-$up points in the design, especially based on the

diagrams.

$10$

Task $3$ contains: the identification of the appropriate

method$($s$)$ to secure the data or data flows in the

identified aggregation points from task $2,$ based on the

technologies and rules of design explained in class,

during the semester.

$30$

Task $4$ contains: a security policy and conflict voidance

method for a system.

$15$

Task $5$ contains: the design of a AAA system which

solves permissions and creates forensics data.

$25$

Introduction

$1.$ Background to the Scenario

The company lewisutech.org is a company which provides IT

training and IT outsource consulting for partner companies $($seen

as clients$).$ Currently, the company has a main headquarter in

Romeoville, IL $(100$ employees$).$ In $2021$ the company will open

a new smaller facility in Metropolis, IL $(50$ employees, $253$ miles

away from Romeoville$).$ There need to be a decision made as to

what type of connection will be made between these two

locations. Due to the large demand in IT training, the

lewisutech.org will expand in $2021$ to a third location in Huntley, IL

$(25$ employees, $57$ miles away from Romeville and $414$ miles

away from Metropolis, IL$).$ All three locations need connectivity to

each other and access to the internet. All three must also have

redundancy to each other and be able to use each other Internet

connections if their connection to the Internet goes down.

In order to provide training and IT consultancy, lewisutech.org as

a company must know deep details of the customer companies

like their structure, detailed network plans and many other private

data. The private data is always stored in secured data storage

systems and, before the data is distributed to an employee of

lewisutech.org, that person should fill in a form for requesting the

data.

Moreover, lewisutech.org may on short term help any partner

company by letting then have access to either devices or cloud

services to the partner companies, providing them with

instant$-$on services until they are able to build an on$-$site or cloud

permanent service. All these services that lewisutech.org provides

to the partner companies are on site at lewisutech.org.

$2.$ Business and Technical Requirements

The inner working of lewiutech.org.

$2\mathrm{.}1.$ Currently Offered Services

lewisutech.org being a training and consultancy company and

thus must maintain high quality of the services. Essentially,

lewisutech.org has to be an example of a good, reliable and

secure services as this has to serve as a model for the partner

companies.

$$ The services which lewisutech.org in Romeoville, IL offers to

its customers are:

$$ IT training offered either at the location of the customer or on

the premises of lewisutech.org

$$ IT consultancy offered usually at the location of the customer

$$ Design and implementation of networked infrastructures

$$ Purchasing of equipment, software, and licensing on behalf

of the customers

$$ Collocation of different services required by the customer on

lewisutech.org servers and infrastructure, on a short$-$term

basis, until the services can be started at the location of the

customer. This service allows a customer to start a new

service in the shortest possible time, even before its

employees are fully trained and the necessary devices

purchased

$2\mathrm{.}2.$ The Internal Organization

lewisutech.org is divided into the following departments in

Romeoville IL:

$$ Financial $(10$ employees$)$

$$ HR $(10$ employees$)$

$$ Purchasing $/$ relationship to providers $(20$ employees$)$

$$ Planning $/$ relationship to customers $(20$ employees$)$

$$ Engineers $/$ trainers $(40$ employees$)$

Besides the infrastructure required to support the businessrelated activities of lewisutech.org there is an on$-$site datacenter

$($supporting all the activities of lewisutech.org, both businessrelated and production$)$ and an extensive lab $($dedicated to

testing, future implementations, prototyping, training, etc$).$

The current system $/$ network diagram was designed for only one

location, it is core collapsed and not entirely suited for scalability.

$2\mathrm{.}3.$ Expansion Requirements $$ Wave $1$ Metropolis, IL

It is necessary first to redesign the network in Romeoville,