Network Security Proposal

Requirements
The UMUC’s network is vast and involves many students, staff and administration PCs and mobile devices to operate simultaneously.  Hence there arises a huge need of vulnerability assessment in order to find weaknesses and overcome them on time.  This helps in providing the university with targeted ways of avoiding and preventing the vulnerabilities for future security.  The UMUC’s network needs to thoroughly analyze and then take proper actions towards these vulnerabilities [1].

Proposed Solution
In order to perform vulnerability assessment, following steps should be taken
1. Scanning must be done of all the IP addresses available in the network. User credentials such as username and password to access the network should also be scanned in order to find weaknesses at that end
2. Scanning all the tools employed over the network. The scanning of these tools must be performed in safe mode only.
3. All the vulnerabilities discovered in the network must be verified.
4. The impact should also be analyzed and then these vulnerabilities should be prioritized to generate possible mitigations on each one of them [1].
The weaknesses in the network should be identified and prioritized as early as possible so that it does not affect the network operations.

Justification
The solution to the above stated requirements is very much valid and correct since vulnerability assessment should be done practically all over the network. The solution discussed will surely affect the network performance since there will be acute weakness in the network which will result in better services to staff and students. If vulnerability assessment is not carried out on the network, it may result in delayed services and may cause havoc.

The security policy states and enforces the basic security architecture of the network. The policy must make the UMUC’s network more effective in terms of security. The staff and students should not experience any security breach.
Requirements
The UMUC’s network stores confidential credentials including passwords, files it becomes mandatory to apply security policies for network. Security policy is responsible for safeguarding the information on the network and also that of stored on the server. These measures are taken for the protection of information to build trust factor for the users. The staff files and students’ information are needed to be secured. The best way to employ security policy is providing passwords to the users be it staff or students [2].

Proposed Solution
UMUC must protect intellectual property and other information of the network and its users. The best solution is to provide passwords to each user of the network with monitoring their browsing pattern. The passwords to each user may keep their information safe towards them. The passwords not should be easy to guess for the other user over the network. Moreover, passwords should be at least 10 characters long with one symbol and one alpha numeric character. These constraints may make the network more secure. The authentication system should be included the network for more secure network operations [2].

Justification
Since the authentication system makes each user distinct and adds password to the system security increases eventually. No other user can enter to the network other than staff and students. This makes system more secure. The policy may also include some of the other measures to make it even more secure.

The network needs to be monitor and manage for security risks. The foremost concern related to network is cyber-crime.  Cyber-crime is UMUC’s riskiest concern for its network which should not be ignored at any level. It may happen that the unauthorized access can be gained to the network and it may lead to suspicious acts related to crime. To avoid such scenarios the network must comprise of some good security measures for less risks in the network. But first it is important to find out the risks in the network.

Proposed Solutions
The network has several ways to avoid risks in the network. Cyber-crime avoiding is not a very difficult task. The possibility of attack must be known in order to avoid the risk. There are many risks involved with cyber-crime. Risk management must be initiated my looking up at a broader sense, then the amount of risk must be assessed with each risk identified [3].

Justification
With risk management, many risks related to cyber-crime can be found out. Learning how severe they can be and prioritizing them is very important and this can only be achieved by risk management. Risk management software such as SolarWinds MSP minimizes cyber-crime at very good level. Such applications may be helpful in identifying, verifying and mitigating risks especially for cyber-crimes. The networks where there are many users associated are more prone to such risks. Hence the risk management for cyber-crime is of much importance [3].

A plan that guarantees the business process can still remain the same during the time of adversity and emergency is a business continuity plan. Such emergencies may include network failure due to some reason. Business continuity plan ensures the timely delivery of services even after the disasters. UMUC’s network is very vast and may experience failure due to one or the other reasons. In such cases, the already built up plan may save from overall network services problems [4].
Requirements
The business continuity planning is required for the network so that the plans must be ready for the disaster of the network. The network break down may result in unfavorable situation which can disappoint its users. Hence a business continuity plan must be incorporated in order to serve the network users even after the failure [4].
Proposed Solutions
The UMUC should be ready with a backup plan on network break down. The backups should be very easily deployed for the operation of the network.  For an instance if an access point at one building fails, the another access point at the same floor must be capable of handling the load till the issues with the access point is fixed.  The staff and students must not experience any problems due to the small issue in the network [5].
Justification
The proposed solution is to avoid the problems arising due to network issues. Backup plans are very essential to continue any operation in the network even with small faults in the network. On small network changes, it may cause some problems in the network’s performance. Hence back up plans may save the overall network performance.

Access control chooses who can access what part of the network for example; staff can access all the files of the university whereas students are only allowed to view those files that are shared with them. Also both the staff and students cannot access all the official files which are accessed only by the administrative staff [6].
Requirements
The most essential part of the network is access control. With the huge network, it becomes necessary to provide access control mechanisms. UMUC involves many users with different roles. With this complexity comes, the challenge of what to be shared and with whom. No network can be open for all the users. Hence it is highly required to put access control over the network. The authentication system itself is designed in such a way that on authentication, predefined set of parameters determine the authorization of the user. The access may be accepted or failed by the system on the basis of user credentials entered while logging into the network.
Access control implementation is quite challenging because it needs communication between protocols and various technologies to make it execute in the proper manner [6].
Proposed Solutions
It has been a tough work to deploy network at university sites. This is due to frequent changes in users over a year. New students may add and old should be removed. Also the challenges are with those students who take a break from university especially if they have back logs during academic years. Staff and faculty members are constant than students but they login from multiple locations and different devices which again is a small challenge. Since multiple entities are involved with the network, access permissions are highly required.
The network access control provides the university campus network administrators the facility to determine who should access what part of the network and data. Access control also allows the administrators to set the restrictions for the number of devices a user can connect to the network [6].
Justification
The solution of implementing a good authentication and authorization system in the network is the only way to achieve access control. Using the authorization system may lead to divide the access to different users based on their roles in the university and the network.

To secure physical devices in the network has become quite difficult for the organizations. The PCs, laptops, USB drives, tablets, phones and other useful gadgets have become more prone to information loss due to mobile access. Hence physical security is again a concern to the network administrators [7].
Requirements
In the age when computers were in limited use, they were accessed by few people and were safe in rooms where very few people could enter. But today, all the PCs and laptops anywhere in the network has access to the network. Physical security is a major concern since new technologies have introduced [7].
Proposed Solution
The solutions for the physical threat are quite challenging. RJ plug lock in device can be used in order to remove unauthorized access from the device. Another solution is the surveillance of the entire college. Deploying cameras at different locations in the college may help reducing physical devices tampering threat. The cameras must be high definition with night vision and also must clearly show the object at its fair visible distance [7].
Justification
The cameras can prove to be very beneficial when it comes to secure physical devices at the site. It may lessen the bad act of harming them.

Mobile devices are becoming more advanced with new technologies and features which make them more prone to theft.
Requirements
Hackers may hack your personal information by accessing remotely to your phone. They may steal your banking credentials and make you pay their bills by using your stored card details in your phone. Mobile devices may also get harm by sending new viruses and malwares to your phone. This may lead to permanently break down of your device or theft of your data stored in it [8].
Proposed Solutions
The possible solutions can be considered as protecting your phone by making your phone more secure so that the thief may not know how to get into your phone. This can be achieved by adding some unlock pins or patterns. If your phone allows biometric ways to unlock such as fingerprint scanning and iris recognition then also apply those mechanisms. In order to save the data from stealing, encrypt the data that you store on the device. Always enable a feature name “remote wipe” on your phone. This feature is applicable to both iOS and android [8].
Justification
Mobile device security is the concern to the university students as well as staff members. Solutions to avoid mobile device theft are best as per the scenario. The users of University College network needs to safeguard their devices and information stored on it by taking above stated measures [8].

Requirements
A perimeter defense is employed in most of the network structures. It includes hard exterior and soft interior. The UMUC’s network must include perimeter defenses to highly secure the network. If configured in the wisest way, the perimeter defense allows only thoses activities that are required to be conducted on the network. It then denies all the other activities that aren’t allowed in the network [9].
Proposed Solutions
Perimeter defense includes use of firewalls, intrusion detection systems along with virtual private networks which can be very beneficial to remove anomalies and invalid requests from the network. Firewalls deny the unauthorized access to some websites from the network. It also identifies if the website contains malwares and viruses and also blocks its access for the users. Intrusion detection systems (IDS) are very useful to detect anomalies within the network [9].
Justification
Using virtual private networks, intrusion detection systems and firewalls may secure network in best possible way. University College should also employ all such infrastructural changes to make it less prone to external attacks.

The most vital role of network defense is to focus on breaches and attacks on the network. Network defense includes spotting, examining and avoiding these breaches and attacks
Requirements
The network defense is required at UMUC’s network to protect the network from vulnerabilities, threats and attacks. The network where several documents including official and academic are stored, the network is highly needed to be safeguarded in such environment. There are several tools and applications available in the market especially to perform network defense for all kinds of network [10].
Proposed Solutions
The tools are the best solution to provide network defense in the network. These tools enable the network administrators to preserve the veracity of the network. These tools available in the market protect all the data, credentials and other network information from getting tampered [10].
Justification
The ready solution in the market can save the network from threats and breaches that could harm the network in several other ways.

Requirements
Host defense is the key requirement of a network, be it small or huge. If the hosts in the network aren’t secure or they aren’t working fine, no services can be reached to its end users. For an instance, if no host defense mechanism is employed in the network, and some of the hosts got corrupted this may result in delayed services to staff and students. Hence host defense is another way of providing security especially to the hosts in the network. The host defense if not incorporated leads to compromising the effectiveness, performance and trust factor of the hosts [11].
Proposed Solutions
The firewalls and host based intrusion detection system can help in achieving the host defense. The attacker may destroy the hosts on the network by sending viruses or malwares in the network. These viruses can be blocked by intrusion detection systems and firewalls set up on the hosts. Using firewalls any unauthorized access on the host can be filtered out easily [11].
Justification
The proposed solution for host defense in the form of firewall and host based intrusion detection system is something that should be adopted at university college network. On destruction of the hosts, the network will be of no use since no services of the network could reach the end user.

Requirements
Public key infrastructure provides the public key assurance and its distribution. It includes a public key certificate as called as digital certificate, private key tokens, certification and registration authority and certificate management system. The network with several users attending different website needs the public key infrastructure in so as to secure data over the network [12].

Proposed Solutions
Public key infrastructure is a framework which helps in achieving security over the internet. Various websites are being surfed by different users’ every day. While designing s public key infrastructure for a particular website the key attributes involved are authentication, access control, confidentiality, integrity and non-repudiation [12].

Justification
The identity checking solutions based on certificates are deployed if the website is serving confidential data. The further advancements can be made by including file encryption while sharing files over the network, email security scan can be provided to filter out malwares attached with the mail.

A protocol is a set of rules followed by the network for the secure communication over the network.
Requirements
There are several security issues that should not be ignored at any cost. If ignored may cost to a huge loss. The security protocol is needed in the University college network because there are several files being transferred over the network. Moreover, all the entities, students, staff and administrative staff use the network for their personal use such as banking. Hence the protocol should be designed securely in order to provide secure network usage experience [13].

Proposed Solutions
The foremost way to achieve secure network protocol is to design the protocols in an understandable formal language. First Authentication Header (AH) should be designed to provide authentication to sender’s data. Not only AH but also with integrity check and non-repudiation the sender’s data must be secured.
Another step for secure protocol should be adding Encapsulating Security Protocol (ESP) which supports sender’s data authentication check which is being communicated [13].

Justification
Since for huge UMUC network, the administrators need to monitor the protocol in the most secure data transfer. To achieve this, both the solutions stated above can be proved to be very beneficial for the sound file transfer on the network. For an instance, the students need to upload their assignments through the portal and for securely transferring the file from student’s end to the server is the most essential part of secure transmission.

Physical security deals with securing physical assets in the network such as desktops, laptops, tablets, servers, access points, etc., file encryption safeguards the data present in the server or travelling on the network. File encryption keeps the data safe from hackers to steal or tamper them. Most hackers target the data for making them unreadable for the user and hence it becomes useless for the user. To prevent such data loss file encryption mechanism should be incorporated and used in a good way to safeguard the data over the network [14].

Requirements
All the data in UMUC network are intended for academic purpose and hence the loss in such data may result in overall huge data loss. Hence the file encryption is highly required in the network to safeguard the files stored on the servers and also it is equally of great need for files being transferred from one end to another.  The data that should be encrypted is either at rest or in transit. At rest means when that data is stored on the server in the databases. The data stored on computers or on the cloud are also referred to as data at rest. Whereas, the data transferring on the network while sending email attachment or through website downloading is the data in transit [14].
Proposed Solutions
To achieve encryption, following are the ways:
1.    Full Disk Encryption (FDE): The data at rest needs to be protected through encrypting the hard disks on the computer which protects data on the computers and other such devices.
2.    End-to-end Encryption (E2E) : This encryption conceals the data in such a way that the only he sender and the receiver can read it. This type of encryption is used to protect data in transit [14].
Justification
File encryption is achieved by adding suitable encryption mechanism to the data at transit and rest. Encryption of the data is the most suitable way to safeguard files on the network. It is equally important to protect encryption key because losing encryption key may lead to losing your data too.

On searching a keyword or a file in database, it is impossible to get results in few milliseconds because linear search may take time since it scans all the indices. Hence hashing is a technique most widely used to assess the direct location of data without associating the index structure used by disk. Hash functions generate hash codes that depict the exact location of the data [15].
Requirements
Hash functions are most widely used way to securely access data from huge databases. Many applications make fair use of hashing technique to search the data in the most efficient manner.  The function that converts an input value into another compressed form of input. The input usually is a numeric value. The input length may vary but the output is always fixed in length. The hash code is always different for all the different files. UMUC may require searching the files in the databases. To search a particular file from a pool of files is a tedious job for the system. Hence there is a good need of hashing to overcome this issue [15].
Proposed Solutions
The most popular hashing technique is MD (Message Digest). It generates hash code for each uploaded file on the server. On searching any file its hash code is compared with the available hash codes on the network. Message Digest algorithm has the variations like MD2, MD4, MD5 and MD6. Out of all the variations of MD, MD5 is proved to be the best [15].
Justification
The message digest code generation for each file on the server may help in reducing overall searching time on the network. UMUC needs such hash codes for searching files which reduces the time for searching the files. When staff or students need to search a file, files with hash codes may perform better in searching the files rather than linear searches.

Backing up data is the most common practice in IT field. Backing up data on servers is usually done in frequent manner but the network hardware isn’t backed up since there is no practice since from the beginning.
Requirements
The data as well as hardware configurations should be backed up regularly to save the network from failure. Data loss may lead to huge damage internally disappointing all its users. But network hardware configuration loss may lead to overall network failure. Hence in both the cases, both types of backups are equally important to deal with. To backup data regularly is of utmost importance since it changes very frequently. A back after before few hours may also lead to acute data loss since data changes regularly [16].
Proposed Solutions
To backup network hardware, is not a tedious job. Since the configurations are usually static, the network hardware setup does not change very frequently and hence a manual backup may also save the network from loss of services for a minor change in the network topology. University college network infrastructure needs to take hardware backups at some defined interval of time so as to save network break down. Backing up data on the server is quite challenging since it changes in short period of time. Servers store huge data and backing them up time to time needs a dedicated application intended to perform this task [16].
Justification
The backup applications are readily available in the market which can help a system in backing up software as well as hardware. Tools for backing up huge data should be employed on UMUC network for no chances of data loss. Restoring data is also performed by the same tool which creates back up of the network.