2-2 Activity: Identifying Threats and Vulnerabilities

3/13/2023 2-2 Activity: Identifying Threats and Vulnerabilities IT-313 Thistle, Cameron SNHU Numerous threats, vulnerabilities, and threat/vulnerability pairs must be addressed at Fertilizer Plus. The organization could be put in danger by these vulnerabilities in the seven IT domains. This briefing will discuss the areas of focus for the Fertilizer Plus IT department. First things first: we'll look for threats, vulnerabilities, and threat/vulnerability pairs. The user domain ought to receive most of the attention because of the high frequency of threats brought about by human error. Most of these issues might be kept away from and handily fixed, for example, not revealing passwords, leaving PCs unstable, and visiting risky sites on work PCs. The next focus should be on the workstation domain. Our workstations are running Windows 7, which is out of date. However, given that Windows 11 has a longer end-of-life cycle than Windows 10 and receives more security updates, we ought to upgrade to it. Without these essential enhancements, Fertilizer Plus is a straightforward target for criminal threat actors. Even though it's not terrible, our LAN Domain could be improved with a few simple changes. The first is putting in place an IPS and IDS system. The next step would be to change the T-1 LAN connection to a T-2 LAN connection. To address the LAN-to-WAN domain, security measures and DMZs must be implemented. The WAN and LAN of the company shouldn't be close to each other. Threats in the WAN domain can be reduced by configuring VPNs and SFTP. Threats from outside the company could access the LAN through the WAN, which would be extremely costly for the business. Access to the Remote Access Domain may be granted if security measures and passwords are insufficient. Using a VPN and a secure router can reduce this risk. Finally, cutting-edge antivirus and software can be used to manage the System/Application Domain. In the User Domain, inadequately trained staff pose a serious security risk. A colossal gamble to the organization is presented by displeased specialists. The operating system of Fertilizer Plus's workstations is vulnerable due to a lack of security updates. The LAN domain does not have an IPS or IDS to safeguard itself against threats. Slow T-1 LAN connections can cost businesses money, especially in today's business environment. The LAN to WAN domain is vulnerable because there is no DMZ to manage outside traffic. External users have access to the company's LAN through the WAN. The numerous vulnerabilities in the WAN domain can be exploited by malicious threat actors. Threat actors may target our users' home networks if they are not properly configured. Finally, the system application domain is at risk due to outdated operating systems and the absence of antivirus software. Identify threat/vulnerability pairs to determine threat actions that could pose risks to the organization. 1. VPNs and home networks that are not properly configured and allow WAN traffic to enter the corporate network pose several security risks. 2. Without IDS and IPS, hackers may gain access to the network undetected. 3. The most difficult threat/vulnerability pair to address is our users' unfamiliarity with the company's AUP. If a user leaves their workstation unsecure, a malicious threat actor may gain access to the network. 4. It is possible for outside traffic to enter the LAN and harm the workstations there if the DMZ and LAN are not properly configured. 5. The workstations are out-of-date, and the possibility of data loss could be catastrophic. 6. Unencrypted workstations on the network are susceptible to infection, which could result in data loss for the business. There is a moderate chance that Fertilizer Plus will be hacked or exploited in some way. We can address some weaknesses and vulnerabilities to safeguard our business from threats such as data loss and other financial losses. Because it contains most vulnerabilities, the user domain is the most dangerous. The LAN-to-WAN domain poses the smallest threat because of our VPN and firewalls. After addressing the issues and limiting threats and vulnerabilities, we can lower our threat level to low. The database server oversees managing all data on local direct-attached storage. It will be essential to establish sufficient physical security, investigate cloud storage options, or construct a data center, to ensure data redundancy. Users' Windows 7 workstations are connected to all three locations via industry-standard controlled switches via Ethernet-cabled LANs. It is important to think about adding user access points and wireless networks. Remote production facilities are connected to a firewall at headquarters via routers with T1 LAN connections provided by an outside internet service provider (ISP). These routers share an internet connection with the firewall. In addition to removing the shared internet connection, it may be necessary to maintain a firewall between the ISP and the company's firewall.