Acme Enterprise Systems (AES) has hired you to perform a security risk assessment on their networks. They are interested in determining where their weak spots are, what kinds of risk those weak spots areas pose, and what they can do about them (on a budget). AES has 75 employees, to include: Accounting/Backoffice, Software Developers, and Sales. AES has a headquarters office in Maitland Florida, with a regional office in Jacksonville and Tampa. Each site is connected together over a VPN to allow for one cohesive network. AES develops a software product called BIRDS. BIRDS is a web-based software-as-a-solution product they host out of their primary office in Maitland. The web server infrastructure consists of 3 large servers, each of which runs a webserver and database server (there are three for scaling). The IT Director has one IT Administrator to help him secure and operate the networks. Upon questioning thoy did pot kpow what the CIS standards wore ThoY USe a WWindows domain controllor

Database System Concepts
7th Edition
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Chapter1: Introduction
Section: Chapter Questions
Problem 1PE
icon
Related questions
Question

I'd like to create a network diagram with this information 

Acme Enterprise Systems (AES) has hired you to perform a security risk assessment on their networks.
They are interested in determining where their weak spots are, what kinds of risk those weak spots
areas pose, and what they can do about them (on a budget).
AES has 75 employees, to include: Accounting/Backoffice, Software Developers, and Sales.
AES has a headquarters office in Maitland Florida, with a regional office in Jacksonville and Tampa. Each
site is connected together over a VPN to allow for one cohesive network. AES develops a software
product called BIRDS. BIRDS is a web-based software-as-a-solution product they host out of their
primary office in Maitland. The web server infrastructure consists of 3 large servers, each of which runs
a webserver and database server (there are three for scaling).
The IT Director has one IT Administrator to help him secure and operate the networks. Upon
questioning, they did not know what the CIS standards were. They use a Windows domain controller,
but have not applied any group policy. Each user in the network has local administrator accounts. The
only end-point control applied appears to be Windows Defender for Antivirus. The IT director can VPN in
to the network from home, no 2FA. No audit of expired user accounts has ever been performed.
On the network: The environment consists of about 100 machines. There is no segmentation between
any networks, including the web infrastructure. On inspection, it was found that the firewalls were all
unpatched and had been for several years. They have a Dell Sonicwall at each site and they use a
SonicPoint access point at each site for Wireless access. The Wireless network is secured using WEP and
MAC Filtering.
In speaking with the developers, it was discovered that they are developing custom software in PHP
without using any frameworks. Developers had no knowledge of secure coding practices, or security in
general.
All user-work is done using laptops over wifi.
Acme was recently hit with a CryptoLocker variant that spread through their entire enterprise,
encrypting all their files and source code. They were forced to pay roughly $5000 in ransoms because
they had no recent back-ups to restore from.
Acme is a very typical company who has not thought about security. Using the information gathered so
far, provide ACME with a comprehensive report and roadmap to improve their security posture.
Transcribed Image Text:Acme Enterprise Systems (AES) has hired you to perform a security risk assessment on their networks. They are interested in determining where their weak spots are, what kinds of risk those weak spots areas pose, and what they can do about them (on a budget). AES has 75 employees, to include: Accounting/Backoffice, Software Developers, and Sales. AES has a headquarters office in Maitland Florida, with a regional office in Jacksonville and Tampa. Each site is connected together over a VPN to allow for one cohesive network. AES develops a software product called BIRDS. BIRDS is a web-based software-as-a-solution product they host out of their primary office in Maitland. The web server infrastructure consists of 3 large servers, each of which runs a webserver and database server (there are three for scaling). The IT Director has one IT Administrator to help him secure and operate the networks. Upon questioning, they did not know what the CIS standards were. They use a Windows domain controller, but have not applied any group policy. Each user in the network has local administrator accounts. The only end-point control applied appears to be Windows Defender for Antivirus. The IT director can VPN in to the network from home, no 2FA. No audit of expired user accounts has ever been performed. On the network: The environment consists of about 100 machines. There is no segmentation between any networks, including the web infrastructure. On inspection, it was found that the firewalls were all unpatched and had been for several years. They have a Dell Sonicwall at each site and they use a SonicPoint access point at each site for Wireless access. The Wireless network is secured using WEP and MAC Filtering. In speaking with the developers, it was discovered that they are developing custom software in PHP without using any frameworks. Developers had no knowledge of secure coding practices, or security in general. All user-work is done using laptops over wifi. Acme was recently hit with a CryptoLocker variant that spread through their entire enterprise, encrypting all their files and source code. They were forced to pay roughly $5000 in ransoms because they had no recent back-ups to restore from. Acme is a very typical company who has not thought about security. Using the information gathered so far, provide ACME with a comprehensive report and roadmap to improve their security posture.
Expert Solution
trending now

Trending now

This is a popular solution!

steps

Step by step

Solved in 2 steps with 1 images

Blurred answer
Knowledge Booster
Enhanced ER Model
Learn more about
Need a deep-dive on the concept behind this application? Look no further. Learn more about this topic, computer-science and related others by exploring similar questions and additional content below.
Recommended textbooks for you
Database System Concepts
Database System Concepts
Computer Science
ISBN:
9780078022159
Author:
Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:
McGraw-Hill Education
Starting Out with Python (4th Edition)
Starting Out with Python (4th Edition)
Computer Science
ISBN:
9780134444321
Author:
Tony Gaddis
Publisher:
PEARSON
Digital Fundamentals (11th Edition)
Digital Fundamentals (11th Edition)
Computer Science
ISBN:
9780132737968
Author:
Thomas L. Floyd
Publisher:
PEARSON
C How to Program (8th Edition)
C How to Program (8th Edition)
Computer Science
ISBN:
9780133976892
Author:
Paul J. Deitel, Harvey Deitel
Publisher:
PEARSON
Database Systems: Design, Implementation, & Manag…
Database Systems: Design, Implementation, & Manag…
Computer Science
ISBN:
9781337627900
Author:
Carlos Coronel, Steven Morris
Publisher:
Cengage Learning
Programmable Logic Controllers
Programmable Logic Controllers
Computer Science
ISBN:
9780073373843
Author:
Frank D. Petruzella
Publisher:
McGraw-Hill Education