retake esp sonali task 1

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

TASK 1

Sonali Paul Jassal

 

Contents

Introduction............................................................................................................................... 2

Fault Finding Report................................................................................................................ 2

Test Plan.................................................................................................................................... 3

 

Introduction:

 

Longstaff Marketing solutions are a small or medium sized business who offer digital marketing services to other businesses. The company has grown over the past 12 months from a small family business of 5 staff to an SME to 25 staff and have relocated from the family home to a city centre office. They have a mixture of devices including desktops, laptops and a SOHO router with firewall enabled. However, they are particularly concerned about the security as they have encountered multiple incidents based around security settings and unauthorised installation of software. Additionally, would like to implement solutions to protect against malware attacks and data loss. This report will explore these issues, potential causes and provide solutions based on the specific need of the organisation.

 

 

Fault Finding Report:

 

According to Control Document B, there some specific issues that the staff are facing and clearly are causing concerns within the organisation.

User A-Marketing Manager.

User A, is a marketing manager who manages a team of marketing executives that work in the office on desktop computers, and they have noticed that some staff have installed games on their work computer and one user has turned off the installed anti- virus program. This is clearly a huge issue as staff have no restrictions at all and this can cause a potential security risk as unauthorised software may contain malicious code, viruses or spyware which poses a threat to the enterprise network and data. This can be a threat as, as a marketing company, it can involve working with a lot of data and all that data being lost or involved in a data breach can result in delays with projects, unhappy customers and a bad reputation. Moreover, it also impacts works efficiency, as unmanaged software can lead to unwanted system conflicts or even system crashes as employees may be spending a significant amount of time installing new software leading to the device becoming slower and impacting performance. It has also been clearly highlighted that all staff have administrative privileges which can be a concern as any staff can install or remove software without restrictions or alerts. Therefore, I would recommend in looking at providing endpoint restriction but also adding user account control meaning the organisation has a bit more visibility over the installed software. This approach would significantly decrease the risk of malware infections and data breaches.

 

 

User B-Sales Executive.

User B who is a sales executive, works both remotely and in the office on a laptop computer and they have reported that when they are working remotely, they are able to connect to the shared files on the network attached storage device but are not able

 

to connect when they are in the office. There is clearly an issue as the staff can connect to the NAS drive through the VPN remotely but have trouble accessing it in the office. This can be an issue as being a sales executive, it can involve accessing the NAS device for files and accessing the data, without this it can make it quite challenging for them to do their job but also can cause a lot of delay and loss of productivity. This issue is mainly because due to the restrictive rule in the firewall policy for PORT 138/445, the SMB (Server Message Block) service has blocked outbound traffic from internal IP addresses to the NAS device and since User B’s laptop operates in that IP range, the rule has effectively prevented office-based staff from accessing the NAS. This is clearly a misconfiguration that was likely for restrictive measures however it has been configured into being too restrictive. Consequently, I would recommend in reconfiguring the firewall for that specific port which will then allow office-based staff to connect to the network Attached storage device.

 

 

User C- IT Administrator.

User C who is an IT administrator works solely in the office and has reported that users are adding files to the NAS device that is not work related. Furthermore, the recent files found include games and movies downloaded from the internet. This is a concern again as it is a security risk but also a misuse of company’s resources. This is because downloading games and movies is all non-work-related files, but also is being downloaded from the internet can include legal risks such as copyright violations. In addition, this issue is plainly due to all staff having a single shared administrative account (LMSAdmin with the password, Pa$$w0rd) which grants them access to all the resources. This does lack user specific accounts which makes it harder to trace employees on what they have installed or accessed. Therefore, I would recommend replacing the shared administrative login with individual user logins, having group- based policies and audit logging to monitor and manage user activity. This will both improve security and accountability.

 

 

Test Plan

dont do the last box

 

 

Test Number	User Details	Issue	Proposed Tests	Expected outcomes	User Acceptance of work completed
T01	User A- Marketing Manager.	Unauthorised installations of software.	1. Log in as one of the users. 2. Attempt to install an application 3.There should be no restriction	-Users have full access to installation of software; multiple unapproved apps have been found.	Tested by:

 

			during installation 4.No admin users are notified about the installation 5.After applying software restrictions 6.Try to install a software 7.Access should be blocked	-After changing settings, users will have more restrictions and admin will be notified when there are any changes detected
T02	User A- Marketing Manager	One user has turned off the installed anti- virus program	1. Login as one of the User 2. Attempt to disable the Anti-Virus program 3. Check if action is blocked due to insufficient permissions	The Anti-Virus does not turn off and remains active, and the user receives an error stating there is a lack of permissions.	Tested by:
T03	User B-Sales Executive	Not able connect to the shared files on the Network Attached Storage device when working in the office.	1. Connect a device to the office network 2. Attempt to access the NAS 3. Check if the connection is blocked or if it unreachable 4. Check the firewall rules for outbound SMB block 5.Remove “deny” rules for IP range 192.168.1.1- 200, which will allow all	The device accessing the NAS will connect when working in the office.	Tested by:

 

			users to access the NAS device when in the office 7. When at home, try to login 8. Try to access the NAS device at home through the VPN 9. No error should occur
T04	User C-IT Administrator.	Using NAS drive for personal use- downloading unwanted materials.	1. Log in as a user 2. Attempt to access websites known for games or movies 3. Check if web filter or firewall blocks access	The restrictions in place do not allow the users to add any type of file from the internet as web filtering will not allow access to those specific web pages	Tested by:
T05	All Staff-NAS users	Shared administrative account	1. Login as a user 2. Attempt to access the NAS device with the shared administrative account 3.The account grants access to all the resources available in the device	The users access with the admin account should be denied and only should work with individual generic accounts Could also introduce folder specific access and audit logs for more traceability and visibility over users	Tested by:

 

T06	All Staff	Poor password Management	1.Replace shared login and all weak passwords (E.g., NAS Device login) with strong passwords 2.Enforce Password rotation for regular changing and resetting of passwords 3.Then, enforce a password policy 4.When attempting to set a weak password, it rejects the password till a strong one has been created	All passwords are strong and changed at regular interval and reduces the risk of any unauthorised access. Furthermore, all users have their own accounts.	Tested by:
T07	All Staff	Training and Awareness	1.Carry out a quiz or Test to test the employee’s knowledge 2.Gather scores and feedback 3.Find weaknesses and strengths 4.Fill any gaps that the employees may have with regular training sessions	Employees have a good understanding and awareness. Should have a score above 80%	Tested by: