CASE STUDY # 1: SMALL 20 - 25 PEOPLE OFFICE
From Microsoft Cybersecurity Course 3 Week 3
Overview of the current network
A thorough assessment of this organization's existing network was conducted. The network was found to encompass 10 office computers, 3 servers containing sensitive data, 15 employee smartphones and tablets, and 20 IoT devices including printers, security cameras, and smart TVs. A distinct department in the organization - the Finance Department, with 4additional computers handling confidential financial data, was given special consideration.
An assessment reveals the following devices on the organization's network:
- 10 office computers.
- 3 servers containing sensitive data.
- 15 employee smartphones and tablets.
- 20 IoT devices (printers, security cameras, and smart TVs).
- 4 additional computers in the finance department handling confidential financial data.
Proposed network segmentation
Based on the assessment, the network can be divided into five distinct segments:
- Segment 1 - Servers: This segment hosts critical data, and has been given the highest security priority.
- Segment 2 - Office computers: This segment consists of general office computers used for regular operations.
- Segment 3 - Finance department: This segment is exclusive to the finance computers handling confidential financial information. Due to the sensitive nature of the data, it is recommended that this segment be given high priority in terms of security.
- Segment 4 � Phones and tablets: This segment, consisting of the organization's phone systems, has been separated to prevent unnecessary access to the servers and to the finance department.
- Segment 5 - IoT devices: This segment groups all IoT devices and has been separated due to their inherent security vulnerabilities.
Security policies for each segment
To enhance security, the following security measures can be applied for each segment:
- Segment 1 � Servers: Communicate with segments 2, 3, 4, and 5 only when necessary. Traffic will be strictly controlled through firewall rules.
- Segment 2 � Office computers: Limit access to segment 1 and ensure no access to segments 3, 4, and 5 to minimize potential threats from general office computers.
- Segment 3 � Finance department: Limit access to segment 1 and no access to segments 2, 4, and 5. An additional firewall for this segment will further safeguard confidential financial data.
- Segment 4� Phones and tablets: Limit access to segment 1 and no access to segments 2, 3, and 5 to prevent potential threats from mobile devices.
- Segment 5 � IoT devices: Isolate from all segments to minimize the potential threats from IoT devices spreading to other segments.
Potential benefits and drawbacks
The proposed segmentation plan carries both potential benefits and drawbacks.
The potential benefits are as follows:
- The plan is anticipated to enhance network security by limiting the attack surface for potential cyber threats.
- Network performance could also be improved by reducing unnecessary traffic.
The potential drawbacks are as follows:
- The plan increases the complexity of the network, requiring additional resources for management.
- Communication between devices in different segments might become more challenging due to the restrictions imposed.
Conclusion
While network segmentation can introduce complexity in network management, the proposed plan offers significant benefits in terms of improved security and performance enhancements. It ensures the protection of sensitive data within the finance department while reducing the overall risk of cyberattacks.