Steps to a More Secure Network
Set Clear Administrator Privileges. An important first step in
providing security for your network is to establish and enforce
administrator privileges, managing who has authorization to install
software and change system configuration settings.
Secure Your Private Network. Many intranet or private networks
consist of multiple local area networks (LANs) designed to connect
your computers to resources, such as printers, servers and other
applications. Trace department business functions from users
computers back to the physical servers that house their data. Your
network design should allow users to have access to the information
they need to do their job, without allowing them to access other
non-job-related information.
Secure Endpoints by Configuring Demilitarized Zone (DMZ). In
network security, endpoint security refers to protection of the
private network where it intersects with public network. The
common devices used at these endpoints to connect to the public
network include mail servers to send and receive emails, web
servers to host websites, and proxy servers to handle requests from
clients seeking resources.
A common security configuration to protect these endpoints is a
Demilitarized Zone (DMZ). A DMZ is a computer network with
firewalls and other prevention systems inserted as a "neutral zone"
between a company's private network and the outside public
network. All incoming and outgoing communications pass through
the firewall and intrusion detection and prevention systems prior to
entering the private network.
Monitor the Network. You and your cyber security providers
should implement network logging and monitoring strategies. These
allow companies to monitor unauthorized data transfers and
unauthorized attempts to access your private network. Detection
systems should provide responsible parties with appropriate alerts
and scheduled reports.
Maintain Firewalls. Firewalls are a fundamental network security
solution. They are used to permit only appropriate traffic to enter
and leave the private computer network. In addition to using
firewalls to protect your private network from the Internet,
firewalls installed within your private network can be used to
segment the network into unique security domains supporting
enhanced layers of defense.
Establish Intrusion Detection and Prevention
Systems. Intrusion detection systems (IDS) and intrusion
prevention systems (IPS) can work together with firewalls to
analyze traffic to determine if it is legitimate. An IDS product will
provide alerts on invalid traffic, while an IPS will block the traffic.
Protect Remote Access. If your employees are allowed access to
your private network from remote networks, this access should only
be through a firewall that protects your private network. Another
option is to utilize a Virtual Private Network (VPN) that uses
encryption and multi-factor authentication to provide greater
security.
Isolate Guest Wireless Local Area Network (WLAN). If your
company operates a wireless local area network (WLAN) for the use
of customers, guests and visitors, it is important that it is kept
separate from the main company network.
Use Encryption Programs. When used properly, encryption
technologies can virtually prevent files, directories, or disks from
falling into unauthorized hands.
Define and Practice Continuity Plans/Disaster Recovery. Once
you have completed mapping and securing your network, assess any
critical equipment or systems and evaluate the potential business
impact if they should fail or are breached.
