Vulnerability assessment is an important component of network security since it aids in the identification of security flaws, exploitable gaps, and future threats to a computer network or system. A secure and strong network requires proper, periodic, and timely vulnerability assessment. The two main aspects of vulnerability assessment are that first, it checks for existing network limitations and issues, and second, due to the proliferation of information technology and widespread availability of security architecture and standards, every network can become vulnerable to one or more threats over time [1]. Vulnerability assessment is highly important in academic institutions as the students, faculties, and researchers within the facility deal with many confidential, ground-breaking and innovative researches, house sensitive information and are generally weak in the implementation of the security due to budget constraints or lack of awareness. Considering, the new campus expansion of the University of Maryland University College (UMUC) a comprehensive assessment of vulnerability becomes essential to identify any possible loopholes in the network that might result from the physical design or hardware or software flaws and turn into major security threats to the institution.
One major source of vulnerability comes from the expansion of existing network or the integration of new network to the existing network. Potential attackers are more likely to target the new or the expanded unit in search for vulnerability and exploit it to gain access to and control over the main network. The new campus of UMUC at Adelphi, Maryland, USA being an extension to the main campus network. a rigorous and thorough vulnerability assessment of the network is essential to identify any accidental or unnoticed security issues and any backdoor to the main campus network.
UMUC requires a fully impenetrable and vulnerability free network that will offer a seamless, threat-free and scalable network to accommodate existing and new devices and workstations. The main motivation behind the proposed vulnerability assessment would be to scan the new campus facility at Adelphi, Maryland, USA to see if the network segment fits perfectly with the main campus network and avoid any vulnerability that might compromise itself and the entire University network.
In assessing the vulnerability to the new campus facility of the UMUC, it can be assumed that the main campus is highly secured and free from any explicit vulnerability that might affect the network. However, we are not assuming any status regarding the vulnerability profile of the new campus at Adelphi, Maryland. On top of that, we assume that the integration of the new campus network may introduce some vulnerability to the entire system.
2. Proposed Solution. The proposed solution has two major parts; firstly, it will identify and categorize resources and facilities based on their importance, relative priorities and level of exposure to the external and internal threats and the then use appropriate tools and devices to locate the vulnerability; secondly, it will recommend tools and measures to patch or eliminate any vulnerabilities that may exist. The proposed solution further includes development of a standard policy or guideline for remaining safe from any vulnerabilities and the list of to-dos during potential vulnerability incidents. In short, the vulnerability assessment will create a comprehensive plan for fighting any vulnerability that might exist or emerge on course of time.
Common network vulnerabilities include open ports, missing essential system patches, active default user accounts, unchanged default passwords or no passwords, weak configuration, missing security controls, missing firewall and active IP addresses [2]. Manually identifying vulnerabilities is a daunting and almost impossible task, which makes it imperative to search for a software or tool for vulnerability detection. Many vulnerability scanning tools and applications are available, both at cost and free of cost. Free scanners can only identify vulnerabilities but cannot take any remedial or preventive actions. Again, these scanners consume large computing resources and do not include user-friendly features. On the other hand, paid scanners can work silently, use minimal of computing resources and do not need any user intervention or attention to patch or remedy any vulnerability. They are easy to use–in most cases a simple mouse click can eliminate vulnerability from the system.
For UMUC the most popular and accurate vulnerability scanning tool Open Vulnerability Assessment System (OpenVAS) is recommended. OpenVAS is open source is a high standard vulnerability scanner with a large online community and support forum that helps in scanning and identifying any potential vulnerabilities and remains updated with recent technology and vulnerabilities [3]. This free scanning tool can perform a deep level scanning and accurately identify vulnerabilities. After initial scanning, the network administrator of UMUC will have an overview on the overall security posture of the new campus network. According to the scanned result obtained from OpenVAS, required security patching and essential security implementation should be performed to prevent the most vulnerable weaknesses of the system. In order to further ensure security, a second scanning should be performed using another scanning tool.
The organization may make use of Retina Network Community and Retina CS Community, which offers free service to 256 IPs and perform vulnerability scanning and required patching for many common and mostly used applications like Firefox browser, adobe applications and virtual machines. Unlike many free scanning tools, it offers highly attractive Graphic User Interface (GUI) and user-friendly features. The only downside of the tool is that it requires Windows Server to run [4]. If the second scanning report suggest the existence of new vulnerabilities that were not detected in the first scanning, UMUC may consider repeated scanning and consequent patching until satisfactory result is obtained. In order to kept the network free from vulnerabilities and prevent from external attack, regular scanning is recommended for the organization.
3. Justification. Currently, OpenVAS is the most accurate and highly stringent vulnerability scanner at free of cost. It offers functionalities and performance that are comparable to many paid tools. Network security experts consider the software to be highly accurate, rigorously made and essentially updated to fight against ever-growing vulnerabilities and network loopholes. The software is free with most of its components licensed under the GNU General Public License (GNU GPL). Apart from two obvious disadvantages of being a Linux-based host, and a slow scanning tool, OpenVAS is the strongest scanner that comes at free of cost. It offers thousands of features for the network administrator including silent monitoring and scheduled scanning. The database of the tool is ever-growing with information and detection techniques of newer vulnerabilities.
Retina Network Community and Retina CS community are a combination for detection and nullification of vulnerabilities and are highly effective for mobile, cloud, virtual machine, server and web applications along with computer workstations. This tool has the capabilities to detect vulnerability issues, missing patches and configuration issues [4]. On top of that it can send security alerts and scanned repots to system administrator or other concerned people in a predefined format. Unlike OpenVAS, Retina Network Community uses windows platform and uses different algorithm to detect vulnerabilities, which is why it is recommended for UMUC as a second line of defense against common vulnerabilities. Since paid vulnerability scanner tools require periodic payment and do not work until the payment is made, free applications are recommended here to avoid missing any essential update or potential vulnerability. The reason for recommending two scanners is to cross check the result of individual scans and make sure no vulnerability is left unattended or unpatched. The Retina CS Community tool does essential patching of the system and reduce the workload of the network administrator.
B. Security Policy
1. Requirements. Having a fairly big network that is composed of subnetworks at multiple geographical locations with a large userbase makes it imperative for UMUC to create a comprehensive security policy. The security policy is highly essential for making users and administrators aware of the potential risks, help them habituate with standard working methodology and teach them how to respond to emergency situations [5]. A comprehensive security policy can help in achieving the goal of making user’s educated and trained on how to contribute to the security of the network and avoid creating any vulnerability, either knowingly or unknowingly. For UMUC, the security policy will align business operations with safe working process on computer and computer related accessories and will ensure a secured working place.
UMUC will require a security policy that would essentially entail overall working procedure of the organization and prepare a realistic and logical flow of operation. It will create individual security procedures for employees and students working at different parts of the network hierarchy. It will outline all principles, guidelines and procedures to be followed during normal and emergency network situations. The policy suggested for UMUC will define user access levels, their privileges in using confidential data, protocols in creating, modifying and using data, the hardware and software specifications, rules in assigning information technology resources to individuals and finally, general and specific guidelines for users and network administrator. With the main focus being on establishing a secured network, the security policy will ensure both minimal system downtime and increased performance. Since the network is growing substantially over the period of time, UMUC will require a scalable network and appropriate security policy for it, which can be extended to meet future requirements.
2. Proposed Solution. UMUC needs to incorporate top security vendors and industry experts for formulating a comprehensive and full proof security policy for the network. A restrictive policy will be appropriate for UMUC, which will expressly put restrictions on all resources and all users; based on the usage requirement and level of authorization, individual user will get permission to specific resources [6]. For example, only teaching staffs will be able to access student’s grade related information. On the other hand, student’s accounting information will be available to accounts and academic staffs only. However, the security policy must balance between ease of use, network performance, and security issues; an overly restricted security policy can limit user’s activity and cause significant performance degradation. In order to achieve the best result, security specialists and contractors need to analyze the entire data domain of UMUC, its users’ need, their privileges and then design an appropriate security policy. Once designed, the management should ask for explicit agreement of all concerned stakeholders on the security policy devised because without proper consent and assistant, it is impossible to implement a security policy effectively [6]. All departments and individual must recognize the importance of the security for a security policy to become successfully implemented. All users should learn about the security policy and use it in their daily activities on the campus network. For this UMUC should continually conduct training and education program to let every user know about different aspects of security and rationale for implementing security policy. On top of everything, the UMUC authority should allocate proper budget to cover ongoing expenses of implementing security policy.
Based on the RFC 2196, the major components of network security for UMUC are listed below [7]. This security policy components cover everything related to the computer and information technology starting from purchasing guidelines to individual user policy.
A computer technology procurement guideline that will specify the make, model, and other details of hardware and software. The guideline should expressly specify minimum capacity, preferable vendors, order level and other information pertinent to the security of the organization.
A detailed privacy policy, which will particularly define privacy regarding user level data access. For example, it will clearly state who will have access to which data and what kind of access will be given to which user. Only authorized users will have the right to monitor, or read or modify or delete data.
A rigorous access policy that will define who will have access to the network, workstations and network resources. It is indented to prevent unauthorized access to critical system resources and protect university information and assets from loss or disclosure [6]. In its broad spectrum, access policy should provide guideline about external connections, data communication protocols, device access to the network, and installation of new software into the system. The access policy will act like a security guard for the entire system, which will allow users with required credentials or authentication only.
A policy for responsibility and accountability that will essentially guide user to learn about the rights, responsibilities and make aware of their accountability to the UMUC. Through this policy, every user will remain complaint with the usage guideline set by the security policy and avoid breaking any rule or practicing unauthorized access. An accountability policy will make the user or authorized individual liable for any security breaches or intrusion or loss and thus make them aware of their roles and responsibilities. For example, each user in the HR department will be liable for staff, teacher and student’s personal data. Should there be any breaches or leakages of personal information, staffs of HR department will be held accountable and should face ramifications.
An authentication policy that will define required authentication procedure for accessing system resources based on their priorities. For example, high level resources should be protected by two or three level authentications, whereas low level resources should be protected by passwords only. Furthermore, the authentication policy should enforce user to change their credentials frequently and follow all essential guidelines for a strong password creation.
Availability statement that will create user’s expectations about the availability of resources. The statement will help users learn about operating hours of different parts of the network, any prescheduled system downtime and any problems that might hinder smooth performance of the network. Since availability of system resources depend on many factors, the security policy should include detail analysis of the resources, redundancy and recovery management and other issues before estimating availability of the system. The statement should include how a user should respond to any critical system condition or handle unnoticed downtime.
A network and information system maintenance policy, which will enable system administrator and network maintenance team maintain integrity and continuity of service by responding correctly to emergency system issues. Furthermore, it explicitly specifies how to handle issues like external outsourcing or remote access control. A proper management of these two issues are highly important for UMUC because the two campuses are physically apart and people from two different facilities will try to access each other’s resources through remote login. Again, IT staffs from one location might need to carry out maintenance or troubleshooting tasks at another location through remote access. Whether or not these accesses are controlled is a big issue for UMUC.
A reporting policy that will specify how to and to whom to report all kinds of system condition or violations. System condition report includes current status of the system, any abnormal condition or any disruption in system continuity. On the other hand, the violation report includes all type of violations such as privacy violation, security violation, internal and external violations. The reporting policy for UMUC should be easy, and simple with a provision of anonymity that will encourage common users to report any system breaches or abnormal conditions.
Information management and distribution policy that will specify which information may be shared or exchanged with whom, which information should be kept public and appropriate guideline for handling inside and outside request for information. The policy should specify special coding or identification number that will categorize all information on the basis of their confidentiality, priority and sensitivity.
3. Justification. The UMUC needs to follow a strict security guideline that can bring a large userbase with diversified needs and activities under common usage policy. The proposed security policy covers all aspects of security and are intended to design a secured and robust network that can withstand any adverse condition. The security policy entails all officials and seeks resolution from each individual user to create a uniform working environment housed on security and integrity. The proposed security policy, if implemented can be a full proof solution to diversified network security issues and may integrate the entire network despite their geographical distances and physical dissimilarities.
C. Risk Management
1. Requirements. Risks are common to computer and information technology network, which is why risk management is an essential part of any computer network. Risk management focuses on identifying risks to a system before it strikes and keeping risks from damaging costly resources of the organization. However, due to nature of campus network and budget constraints, it is not possible to achieve proper risk management goals in an academic institute. UMUC is no exception; having two campuses at geographically apart locations make it further difficult for UMUC to manage risk. The organization should implement a stringent risk management policy that will help it avoid risk and recover from any damage that it might cause.
Risk management should include development of detailed policies, defining step-by-step procedures and create awareness among users both before and after any risk comes into reality. UMUC requires a comprehensive risk management policy that will guide it in mitigating risk in a highly vulnerable and risk averse environment; the risk management policy will include detailed procedural methods on how to deal with risks and how it can be prevented from creating a disaster. Finally, the risk management will focus on creating awareness among students, teaching staffs and other stakeholders of the university. The risk management should further take cloud based data protection into consideration by taking actions to keep a copy of total data in a safe place periodically.
2. Proposed Solutions. A comprehensive risk management plan is recommended for UMUC, which will take factors like exposure to internal and external threats, user’s awareness and potential disaster recovery actions into consideration. The proposed solution will include employee training for creating awareness and preparing them against any cyber security incidents. The solution proposes UMUC to use tools like antivirus and other malware detectors to identify any risks to the system. In order to reduce the damage from any attack, UMUC should segregate its data resources from the rest of the network. Furthermore, it will define individual roles and responsibilities in potential cyber-attack or disasters and how to mitigate them.
3. Justification. A proper risk management requires polices, employee training and awareness. The policy will create a guideline for users that will contribute to risk mitigation. Users must be trained to combat potential threats and risks to the system. User awareness can reduce the risk and improve overall strength of the network. In case of potential attacks or disasters, a chaotic environment results as everybody wants to avoid responsibilities and exposure to the risk [8]. That is why the solution proposes allocation of individual responsibility. On the other hand, cloud based data storage is subject to vendor failure and does not guarantee any data protection in case of any risk happens; this is why a periodic data duplication and storage is proposed for UMUC.
D. Business Continuity Plan
1. Requirements. A business continuity plan is a highly important aspect of UMUC network to ensure an interruption free, smooth working environment with zero system downtime. Being crucial to everyday work, the computer network at UMUC cannot afford to enjoy discontinuity. On top of that, discontinuity in service will create poor image of the university, put the security of the network into danger and will cause loss to the integrity of service [9]. Moreover, lack of continuity will result in loss of revenue for the UMUC. Continuity is interrupted mostly due to poor recovery and absence of redundancy [10]. UMUC requires a balance between redundancy of resources and cost of implementation to achieve best result in business continuity.
2. Proposed Solutions. The major threat to business continuity is network error and human factors, both contributing to about 50% and 40% of total system downtime. Natural calamity related failures may count up to 10% of the total system outage [11]. Network failure include both electrical, mechanical and technical faults whereas human factors include accidental maloperation, intentional sabotage and poor response to system emergencies.
A good portion of network error comes from electrical and mechanical failures. The overall design for the UMUC network and computer system should be electrically strong and mechanically withstanding to avoid any point of electrical or mechanical failure. The system shall incorporate earthing, lightening arresters and other electrical safety gears to protect the system from electrical damage. A good constructional design and proper placement of components are necessary to obtain a strong physical network that does not fall due to abrupt environmental conditions.
To deal with human error, UMUC should take a continuous training management, in which each employee should undergo regular training regarding how to keep their digital presence and profile secure and free from hacking. The best business continuity plan for UMUC will entail a contingency plan for the outage of any or more system components. Redundancy of critical system components like server, media, and the Internet may help the system remain functional even in the case of one or more component failure [12]. The proposed solution will prioritize on keeping the system alive and functional in critical conditions over cost.
3. Justification. Interruption is intolerable in IT services regardless of the type of service or organization. Having research facility and online services for students, UMUC cannot compromise the continuity, for which a cost effective and full proof solution is required. The focus on the two major causes of network failure has made it imperative for the university to enhance protection on the electrical and mechanical infrastructure of the facility. To prevent human error, training, and motivation of human personnel is essential, which is why UMUC is proposed to arrange periodic training and development of human resources. It is quite common for modern organization to arrange network or computer security related training for its staffs for making them aware against all odds and mistakes. One statistic shows that the average cost of unplanned system downtime may be as high as 2.5 billion USD per year [13]. Although we are looking at much lower figure for UMUC being an academic institute rather than a business organization, the cost of interrupted service in terms of academic and research perspective is nothing ignorable. Since IT has become an integral part of UMUC administration and academia, the price for business continuity can be justifiable by all means.
E. Access Controls
1. Requirements. Access control is a major part of security policy for UMUC and can be seen as the first line of defense against internal and external threats. Access control enables an organization and network administrator restrict use of computers and applications as well as create user level access to particular resources based on the privileges that the user avails [14]. For example, in case UMUC, the access control will enable teaching staffs to access past grades of students but students will be restricted to see grades of each other. Since UMUC has multiple departments and each possesses its own confidential data, access control to resources is highly essential. Furthermore, since the two campuses are remotely accessible, it is highly imperative to design access control privileges carefully to prevent unauthorized access from the external networks.
Identity management system can facilitate access control by creating electronic ID for each individual who access the system and network [15]. The electronic ID management system can help UMUC administrator control access to sensitive locations and keep track of individuals entering into critical resource locations such as in server room. Furthermore, it will help UMUC prevent fraudulent activity and detect malevolent user.
2. Proposed Solutions. Three levels of access control system are proposed for UMUC, which include surveillance and monitoring system, biometric security and computer based authentication system before granting access to any computer or software or critical system resources. The surveillance system will keep an electronic eye on every user and entrant to the computer and network facility of the UMUC. The biometric security will be part of identity management, in which each stakeholder of the university will receive an electronic ID created by using biometric identification such as fingerprint or voice or facial recognition or all of them. For the computer workstations, an active directory system is proposed using windows server, which will control users’ access as well as privileges within the system. Finally, UMUC will create a standard guideline for users to remain compliant with security and access control within the campus premises for the sake of their own good.
3. Justification. In today’s highly vulnerable and risky cyber world, traditional username and password input one-way authentication based access control is not adequate to ensure data integrity and system security [16]. One or more additional layers of security, both physical and software-based, can enhance the overall security drastically. The physical security such as surveillance or protected gates can reduce the possibility of remote hacking. Secondly, the biometric security will ensure that only authorized and enlisted persons will have the physical access to the facility. This will limit unauthorized access to any of the resources considerably. Finally, traditional software based authentication system will come into play, which acts as the last line of defense. If any unwanted persons can get closer to the workstations or any other resources, he or she will not be able to access them unless correct username or password is given. These three layers of security work together to create a strong access control management for UMUC; omission of any of these security protocols will potentially weaken the entire system and increase its vulnerability.
II. SECURING BOUNDARY DEVICES, HOSTS, AND SOFTWARE
A. Physical Security
1. Requirements. Physical security for UMUC datacenter and servers is highly imperative. These resources should be placed in a secure and infra-structurally strong place where costly and critical hardware can be kept without bothering for any mechanical damage or sabotages. Use of surveillance and strong locking mechanism can enhance physical security of the network whereas reduce the risk of accidents or attack [17]. UMUC campuses will have many people entering and leaving every second due to the large number of students, teachers and other staffs collaborating in the learning program.
2. Proposed Solution. UMUC needs to construct a highly secure a and dedicated room where the data and computing resources can be housed safely. The room should be fireproof, dustproof and access restricted. Constant surveillance of the room is essential to check for any abnormal condition. Furthermore, human security guards can be placed at the door of the room to protect the assets in case other security tools do not work. Individual computers and their accessories should be placed on a working desk to avoid damage.
3. Justification. Physical security is as important as the logical security to protect data. UMUC cannot afford to lose of its critical resources pertaining confidential and sensitive personal information of students. The physical security may cost the organization only one time during implementation but the cost is worth it. With physical security, it is impossible for UMUC to protect these resources from potential hazards like fire, storm and flooding and human factors.
B. Mobile Device Security
1. Requirements. As discussed in the previous paper that the university will allow individual user’s mobile devices to access to the network through. BYOD policy. Furthermore, the university will provide its own mobile devices to the faculties and other staffs to facilitate their jobs. A good control over these mobile devices is essential to restrict their access and privileges over enterprise data. Another potential issue with mobile device security that UMUC needs to address is the problem with loss of user’s mobile that has organization data and logged in users in it. If lost mobile falls into the hand of a fraud or malevolent individual, he or she can try to use the mobile device to log in to UMUC network and steal valuable information.
2. Proposed Solutions. To avoid mobile device related security issues, UMUC can focus on designing a MAC id filtering based two-way authentication policy into its network; under this policy, all user must register his or her devices prior to gain access into UMUC network. A user can access the UMUC network only if he or she has the device registered under the MAC id list at the university server or router and required credentials. Next, UMUC needs to train its users about standard security policy and safe practices in using mobile devices to keep themselves and the university network free from intrusion and data theft. To achieve this goal, the UMUC needs to conduct periodic training program for its staffs and students to train them on how to log in into the university network and use resources using their mobile devices in a safe and secured manner. In any cases, where the staffs or students might lose their devices, they should inform the authority immediately so that UMUC administrator can omit the entry of the device MAC id from its registry.
3. Justification. To prevent malicious use of mobile devices while promoting BYOD policy, the university has no other option but to trust the user to some extent that he or she will not leave his phone unattended to strangers nor they will use their phone to gain unauthorized access to the university resources. The MAC filtering and user awareness are the least thing that UMUC can afford to prevent this security loophole.
C. Perimeter Defenses
1. Requirements. UMUC network houses valuable and highly confidential research data generated by its researchers, which has the highest priority within the entire network. To prevent any theft or damage to this data, perimeter defense may be a good solution.
2. Proposed Solutions. In the proposed perimeter defense solution, UMUC needs to create a separate server that will store research related sophisticated data. The server is then put into perimeter defense zone where the server will receive minimal number of connection, both from the inside and outside, and reduce the possibility of attack sign...
