Identify security concerns related to distributed systems in an enterprise system.

Assignment

Using the knowledge gained from the Individual Projects prepared by members of the group during the course and additional research as required, your group will prepare a Consultant Team Report and PowerPoint presentation to address the following topics as they relate to the selected key project:

• Hardware and software: Identify the types of hardware and software that are appropriate for use in distributed enterprise systems. Include examples of systems and the hardware and software used in those systems.
• Concurrency: Describe the concept of concurrency. Use examples to discuss how concurrency is used in distributed enterprise systems and why concurrency is important in these scenarios.
• Advantages and disadvantages of distributed systems: Identify the goals and advantages of distributed systems. Use examples of real-world distributed systems and discuss how the associated organizations would benefit from the use of the systems in the short and long term. Identify and discuss potential disadvantages to the organization using the same distributed systems.
• Security: Identify security concerns related to distributed systems in an enterprise system. Discuss how these concerns can be addressed to reduce the potential risk. Provide examples of real-world distributed systems that have dealt with security threats.

Each member of the team should be assigned one of the topics and should prepare a written report for the group on that topic based on the work they have performed during the course, the knowledge they have gained from the experience, and additional research as required.

The team will then create a PowerPoint presentation summarizing the individual reports.

About the company: First Community Mortgage Inc.

• 2 offices, 45 miles away from each other.
• Office LANs connected via Metropolitan Area Network (MAN).
• Both offices have roughly the same setup. One office is the main office.
• 0 desktop computers for employees.
• Network closet with 3 servers (authentication services, shared disk, and print server)
• 3x24 port switches.
• A Wireless access point connects office to internet.
• Fibre connection to Government agencies and Banking institutions, through VPN.
• Copy room with some printers and a fax.
• Loan files can be printed not only locally, but at the other location, too. Print traffic must be secure (encryption, network segmentation).
• The company has a website, and an online loan application form for customers.
• Employees use email, web browsers.
• Loan officers interface with banking systems for finance rates and submitting loan applications.

Hardware and Software

• Hardware
• Multiprocessors
• Multicomputers
• Mobile and Ubiquitous Computing Systems
• Software
• Distributed Operating System
• Network Operating System
• Network File System (NFS)
• Middleware
• CORBA, DCOM, Java EE
• Proxy Server
• Web Applets
• User Application

Concurrency

• Consequences of Distributed Systems
• Software and hardware components are autonomous
• Components run concurrent tasks
• Processes run autonomously in isolation
• Synchronization and coordination via message passing
• Resource sharing
• No global clock / Limits on precision
• No global state
• Challenges
• Concurrency
• Consistent scheduling of concurrent threads
• Deadlock / Lifelock avoidance
• Resiliency / Reliability
• Retransmission of messages when failure occurs
• Data storage redundancy
• Exception handling, Timeouts
• Redundant network routes
• Make the system seem like one single system. Need to hide the distributed nature of the system.
• Local vs remote resources
• Location of resources (URLs, email addresses)
• Allow several processes to operate concurrently, consistently
• Replicated resources used as one
• Error handling
• Allow resources to be mobile, to be moved.
• Ability to adapt to varying levels of load (performance)
• Ability to expand and scale resources

Advantages and Disadvantages of Distributed Systems

• Client-Server
• Peer-to-Peer
• Multi-tiered Systems

Security

• Concerns
• Malware
• Eavesdropping
• Job Faults
• Resource starvation (DoS)
• Buffer Overflows
• Privilege escalation
• Injection attacks
• Solutions
• Authentication, Authorization, and Access Control
• Sandboxing
• Virtualization
• Encryption
• Intrusion Detection
• Network Firewall
• Anti-Malware / Virus Scanners
• SOX compliance

References

Distributed Systems (Overview)

http://tele.informatik.uni-freiburg.de/lehre/ws02/dsys/lectures/dsys.part1.pdf

Concurrency Concepts

http://sce.uhcl.edu/helm/rationalunifiedprocess/process/workflow/ana_desi/co_cncry.htm

Security for Distributed Systems

http://www.nr.no/~abie/security.htm

Group Portion

Using the knowledge gained from the Individual Projects prepared by members of the group during the course and additional research as required, your group will prepare a Consultant Team Report and PowerPoint presentation to address the following topics as they relate to the selected key project:

·         Hardware and software: Identify the types of hardware and software that are appropriate for use in distributed enterprise systems. Include examples of systems and the hardware and software used in those systems.

·         Concurrency: Describe the concept of concurrency. Use examples to discuss how concurrency is used in distributed enterprise systems and why concurrency is important in these scenarios.

·         Advantages and disadvantages of distributed systems: Identify the goals and advantages of distributed systems. Use examples of real-world distributed systems and discuss how the associated organizations would benefit from the use of the systems in the short and long term. Identify and discuss potential disadvantages to the organization using the same distributed systems.

·         Security: Identify security concerns related to distributed systems in an enterprise system. Discuss how these concerns can be addressed to reduce the potential risk. Provide examples of real-world distributed systems that have dealt with security threats.

Each member of the team should be assigned one of the topics and should prepare a written report for the group on that topic based on the work they have performed during the course, the knowledge they have gained from the experience, and additional research as required. The team will then create a PowerPoint presentation summarizing the individual reports.

Instructor’s Notes:

In the second chat I talk extensively about the group project but here are some of the key details. The group project asks each individual in the group to take part in the preparation of a Consultant Team Report and PowerPoint presentation to address a number of subjects related to a fictional or real company of your group's choice. Please do not replicate a company that one of your group members might have chosen for their individual projects. The content of the group project needs to be new material.

I have now created the groups. Please check in to the group in the next 48 hours. EVERY group member is to do their own research and assessment of at least one of the four parts of the project as outlined in the task list. There are no exceptions to this rule. If you have a group leader or a person who is putting together the final version they will need to do this on top of their individual written contribution to the project Your groups are rather large to help if some don't participate or drop the course. If you have more than four students participating in your group then simply double up on some of the topics, though you will each work on your own, and then compare notes after the first due date and produce one version of their assigned piece for submittal to the group.

Each group member’s contributions need to be posted by September 15th to the files area at the bottom of the small group area. This deadline is meant to ensure timely participation by each individual group member. Your individual score will be docked 15 points per day late past that due date, so please make sure you get this date on your calendar.

PLEASE NOTE THAT THE GROUP PROJECT IS NOT JUST AN AMALGAMATION of the other group member’s contributions! This final group submittal should be vetted and improved by the group as a whole before the due date of the project. The PowerPoint presentation should also be worked on by the group as a whole.

Each group member should contribute at least two pages each, minimum. This means that your final document will be 2 x whatever number of individuals you have in the group, not counting table of contents or title or references pages.

When I grade the project, I will first arrive at a group score, and then will go into each group area and make sure each member posted their contribution by the deadline.. Each individual’s contribution must be of high quality. It is important each group member participate fully and in a timely manner with the group throughout the entire process. This means joining the group by the second week of the course and helping participate in the division of responsibilities. If you do not fully meet these requirements you will receive fewer or no points for the group project.