Network Security

[mirixx]

    Hey guys, in my office we're pondering creating a network security checklist. A list that could be used for existing and future employees that can dictate how we keep our network and computers safe. My question to you guys is what do you think should be on that list? anything from strong passwords to email encryption. Just curious what you guys might come up with thanks for the help .

 

about our office:

 

    Our office is pretty standard we have a data server and a file share server. about 15 employees most with laptops that they take to and from work. we have VPN set up on our router so they can work offsite. emails are a big deal for us, keeping them safe is important. 

[Altecice]

• Keep passwords in your head and not on post it notes.
• Dont tell anybody your passwords.
• (probs not relevant to small company's) make your staff aware about social engineering and fake requests for information.
• Have a work USB storage device and a personal one to stop any chance of malware infection into the company domain.

 

All I can think of atm but that should get you started.

[Vebb]

Never use public wifi, always use your own hotspot.

[Blade of Grass]

Moved to Networking. 

[Blake]

A lot of these things you want to enforce.

 

1. Enforce password complexity requirements for computer Passwords.

2. Look at enforcing IPsec for all communication on the network (this is pretty straight forward on an AD network).

3. With emails, assuming you have an o365 subscription, look at enabling single sign on.

4. VPN access, restrict to only the employees who actually require it, and even then look IKEv2 with forced encryption.

5. deploy an enterprise Anti-Virus suite. I personally like Sophos, as it also lets me restrict CD/DVD/USB/floppy drives that are authorized to be used on our network - general rule of thumb is nothing ever, unless your a c-level exec, then give the request in writing so I can cover my ass in 5 months time when stuff hits the fan.

6. Setup App locker and block every executable running from the %appdata% directory. This is important as it will stop your accounts payable person getting emailed invoice5.exe which is actually cryptowall. I would also be blocking basically every attachment in every email, you can go through them on a test system to check if they are legitimate. Email is not a file transfer protocol, you can setup a FTP server for that.

7. Lock down your gateway, black list everything and only whitelist ports as needed. goes without saying the uPNP should be turned off.

8. make sure that no-one everyday computer login is a local or domain admin account, even the IT guys.

9. look at Segregating your network. VLANs are good.

 

This assumes your a windows shop, and even then it only barley scratches the surface.

[Blake]

Moved to Networking. 

not really a networking topic, more just a general security topic...

[Blake]

 emails are a big deal for us, keeping them safe is important. 

You might want to look at a retention policy. Litigation hold is always good for these... but can also eat a chunk disk space (so for hosted solutions it might not be the best).

[Blade of Grass]

not really a networking topic, more just a general security topic...

Networking is still the most appropriate section for posts like this.