homework 7

sarahmazin

lesson_8.pdf

Home >Computer Science homework help >homework 7

D esig

n and Im

p lem

ent Security O

p eratio

ns M anag

em ent B

est Practices

LAB #10 – ASSESSMENT WORKSHEET A

Design and Implement Security Operations Management Best Practices

Course Name and Number:

Student Name:

Instructor Name:

Lab Due Date:

Overview Review the deliverables you created for Lab #6 and Lab #8, including the following:

From Lab #6: • Block diagram of a LAN-to-WAN DMZ in Microsoft® PowerPoint, Visio, or OpenOffice; • Functional overview document explaining your DMZ and LAN-to-WAN security solution; • Your answers to the Lab #6 Assessment Questions and Answers.

From Lab #8: • Block diagram design of the Mock IT infrastructure components in Microsoft® PowerPoint or Visio; • Functional overview document explaining each of the security controls and security countermeasures

enabled within each block/component; • Your answers to the Lab #8 Assessment Questions and Answers.

Security Monitoring and Operations Management Rationale Using the information just reviewed as the basis for your answer, develop a short text document (no more than two pages) detailing your rationale for why a security monitoring and operations management strategy is critical.

Note:

To successfully complete this deliverable, you will need access to a text editor or word processor, such as Word. If you don’t have a word processor or graphics package, use OpenOffice on the student landing vWorkstation for your lab deliverables and to answer the lab assessment questions. To capture screenshots, press Prt Sc > mSPaINt, paste into a text document, and save the document in the Security_Strategies folder (C:\Security_ Strategies\) using the File Transfer function.

Assessment Worksheet A 147

38504_LB10_Pass1.indd 147 26/02/13 6:35 PM

LAB #10 – ASSESSMENT WORKSHEET B

Design and Implement Security Operations Management Best Practices

Course Name and Number:

Student Name:

Instructor Name:

Lab Due Date:

Overview Work alone or in a small group and formulate a strategy for implementing a security operations management best practices policy for the Cisco Mock IT infrastructure. Reference the deliverables you submitted for Lab #6 and Lab #8 as part of your discussion. Answer the following questions and indicate, where possible, how tools like Splunk contribute to the overall strategy you develop. Record your strategy in a text document of no longer than five pages and provide it to your instructor as a deliverable for this lab.

Note:

Network/Security Assessment Questionnaire

Network Assessment – Required Information

1. Do you have detailed logical network drawings? If so, please attach.

148 Lab #10 | Design and Implement Security Operations Management Best Practices

38504_LB10_Pass1.indd 148 26/02/13 6:35 PM

D esig

n and Im

p lem

ent Security O

p eratio

ns M anag

em ent B

est Practices

2. What Directory service, if any, is in use?

3. How many network elements do you have? List each, including make and model or attach list.

4. Have you configured multiple networks on this infrastructure?

5. What internal (RFC1918 or otherwise not-Internet-routable) IP address ranges do you use?

6. What external (Internet routable) address ranges do you use?

7. What protocols are in use on your network?

Assessment Worksheet B 149

38504_LB10_Pass1.indd 149 26/02/13 6:35 PM

8. What is the role of each network? (Attach list if multiple networks.)

9. How many hosts do you have on the network?

10. What operating systems are used among your servers and workstations?

11. What applications rely on your network(s)?

12. How many Internet-exposed servers are on your network?

13. What applications do you use to manage your network(s)?

150 Lab #10 | Design and Implement Security Operations Management Best Practices

38504_LB10_Pass1.indd 150 26/02/13 6:35 PM

D esig

n and Im

p lem

ent Security O

p eratio

ns M anag

em ent B

est Practices

14. What geographic locations connect to your network(s)?

15. What are your future growth plans for your network(s)?

Security Assessment – Required Information

1. Do you have firewalls, ACLs, or other types of traffic filters in place within your network? If yes, please describe.

2. What is the general firewall policy: Default permit, default deny inbound, default permit outbound?

3. Do you have any other filtering technologies implemented at the network or host level, such as data leakage prevention, spam filtering, and Web application firewall or other? If so, please describe.

4. Do you use wireless networking? If so, what types? What wireless security measures are in place?

Assessment Worksheet B 151

38504_LB10_Pass1.indd 151 26/02/13 6:35 PM

5. Do you use any of the following technologies, and if so, what model:

a. IDS/IPS:

b. Antivirus:

c. Anti-spyware or anti-spam:

d. Desktop encryption:

e. Other:

6. Do you use VPNs to connect? If so, what type and vendor of VPN software do you use?

7. What services are permitted inbound to your network? Such as SMTP, DNS, HTTP, FTP, or other?

8. Are the servers delivering these services in a DMZ?

9. Are your various system logs aggregated to a central location for monitoring and analysis?

10. Do you have a patch management system in place? If so, please describe.

152 Lab #10 | Design and Implement Security Operations Management Best Practices

38504_LB10_Pass1.indd 152 26/02/13 6:35 PM

D esig

n and Im

p lem

ent Security O

p eratio

ns M anag

em ent B

est Practices

LAB #10 – ASSESSMENT WORKSHEET C

Design and Implement Security Operations Management Best Practices

Course Name and Number:

Student Name:

Instructor Name:

Lab Due Date:

Overview In this lab, you used the Splunk administration tool to develop a standard operating procedure for imple- menting security operations best practices. After exploring the main areas of Splunk, you used it to create a security monitoring and alerting solution. You also worked alone or in a small groups to organize and prioritize the information about network, IT, and security assets into a security operations management best practices deliverable based on your work in the two paper-based labs for this couse.

Lab Assessment Questions & Answers

1. During the lab demo, how did you connect to the Splunk management tool?

2. What are the main functions of Splunk that were demonstrated in the lab and why do they help build more secure operations?

Assessment Worksheet C 153

38504_LB10_Pass1.indd 153 26/02/13 6:35 PM

3. What types of “Data Inputs” are available in Splunk and most other log management tools?

4. What types of “Alert Conditions” are available in Splunk and most other log management tools?

5. What is the search string for the “Top five sourcetypes” preconfigured Search?

6. Describe at least three examples of security- or operations-related Windows Management Reports and Searches that are preconfigured and available within Splunk.

154 Lab #10 | Design and Implement Security Operations Management Best Practices

38504_LB10_Pass1.indd 154 26/02/13 6:35 PM

D esig

n and Im

p lem

ent Security O

p eratio

ns M anag

em ent B

est Practices

7. What Chart Types are available for a search or report within Splunk?

8. Based on the information you learned in the Getting started module of Splunk, which preconfigured search would you wish to receive via the Alerts feature described? Explain the reasoning behind sched- uling this particular alert. How will this alert help your goal of implementing security operations management best practices?

Assessment Worksheet C 155

38504_LB10_Pass1.indd 155 26/02/13 6:35 PM

38504_LB10_Pass1.indd 156 26/02/13 6:35 PM

Course Name and Number:
Student Name:
Instructor Name:
Lab Due Date:
Course Name and Number_2:
Student Name_2:
Instructor Name_2:
Lab Due Date_2:
1 Do you have detailed logical network drawings If so please attach 1:
1 Do you have detailed logical network drawings If so please attach 2:
1 Do you have detailed logical network drawings If so please attach 3:
1 Do you have detailed logical network drawings If so please attach 4:
2 What Directory service if any is in use 1:
2 What Directory service if any is in use 2:
2 What Directory service if any is in use 3:
2 What Directory service if any is in use 4:
3 How many network elements do you have List each including make and model or attach list 1:
3 How many network elements do you have List each including make and model or attach list 2:
3 How many network elements do you have List each including make and model or attach list 3:
3 How many network elements do you have List each including make and model or attach list 4:
4 Have you configured multiple networks on this infrastructure 1:
4 Have you configured multiple networks on this infrastructure 2:
4 Have you configured multiple networks on this infrastructure 3:
4 Have you configured multiple networks on this infrastructure 4:
5 What internal RFC1918 or otherwise notInternetroutable IP address ranges do you use 1:
5 What internal RFC1918 or otherwise notInternetroutable IP address ranges do you use 2:
5 What internal RFC1918 or otherwise notInternetroutable IP address ranges do you use 3:
5 What internal RFC1918 or otherwise notInternetroutable IP address ranges do you use 4:
6 What external Internet routable address ranges do you use 1:
6 What external Internet routable address ranges do you use 2:
6 What external Internet routable address ranges do you use 3:
6 What external Internet routable address ranges do you use 4:
7 What protocols are in use on your network 1:
7 What protocols are in use on your network 2:
7 What protocols are in use on your network 3:
7 What protocols are in use on your network 4:
8 What is the role of each network Attach list if multiple networks 1:
8 What is the role of each network Attach list if multiple networks 2:
8 What is the role of each network Attach list if multiple networks 3:
8 What is the role of each network Attach list if multiple networks 4:
9 How many hosts do you have on the network 1:
9 How many hosts do you have on the network 2:
9 How many hosts do you have on the network 3:
9 How many hosts do you have on the network 4:
10 What operating systems are used among your servers and workstations 1:
10 What operating systems are used among your servers and workstations 2:
10 What operating systems are used among your servers and workstations 3:
10 What operating systems are used among your servers and workstations 4:
11 What applications rely on your networks 1:
11 What applications rely on your networks 2:
11 What applications rely on your networks 3:
11 What applications rely on your networks 4:
12 How many Internetexposed servers are on your network 1:
12 How many Internetexposed servers are on your network 2:
12 How many Internetexposed servers are on your network 3:
12 How many Internetexposed servers are on your network 4:
13 What applications do you use to manage your networks 1:
13 What applications do you use to manage your networks 2:
13 What applications do you use to manage your networks 3:
13 What applications do you use to manage your networks 4:
14 What geographic locations connect to your networks 1:
14 What geographic locations connect to your networks 2:
14 What geographic locations connect to your networks 3:
14 What geographic locations connect to your networks 4:
15 What are your future growth plans for your networks 1:
15 What are your future growth plans for your networks 2:
15 What are your future growth plans for your networks 3:
15 What are your future growth plans for your networks 4:
describe 1:
describe 2:
describe 3:
describe 4:
2 What is the general firewall policy Default permit default deny inbound default permit outbound 1:
2 What is the general firewall policy Default permit default deny inbound default permit outbound 2:
2 What is the general firewall policy Default permit default deny inbound default permit outbound 3:
2 What is the general firewall policy Default permit default deny inbound default permit outbound 4:
leakage prevention spam filtering and Web application firewall or other If so please describe 1:
leakage prevention spam filtering and Web application firewall or other If so please describe 2:
leakage prevention spam filtering and Web application firewall or other If so please describe 3:
leakage prevention spam filtering and Web application firewall or other If so please describe 4:
4 Do you use wireless networking If so what types What wireless security measures are in place 1:
4 Do you use wireless networking If so what types What wireless security measures are in place 2:
4 Do you use wireless networking If so what types What wireless security measures are in place 3:
4 Do you use wireless networking If so what types What wireless security measures are in place 4:
5 Do you use any of the following technologies and if so what model:
Antivirus:
undefined:
Antispyware or antispam:
d Desktop encryption:
6 Do you use VPNs to connect If so what type and vendor of VPN software do you use 1:
6 Do you use VPNs to connect If so what type and vendor of VPN software do you use 2:
6 Do you use VPNs to connect If so what type and vendor of VPN software do you use 3:
6 Do you use VPNs to connect If so what type and vendor of VPN software do you use 4:
7 What services are permitted inbound to your network Such as SMTP DNS HTTP FTP or other 1:
7 What services are permitted inbound to your network Such as SMTP DNS HTTP FTP or other 2:
7 What services are permitted inbound to your network Such as SMTP DNS HTTP FTP or other 3:
7 What services are permitted inbound to your network Such as SMTP DNS HTTP FTP or other 4:
8 Are the servers delivering these services in a DMZ 1:
8 Are the servers delivering these services in a DMZ 2:
8 Are the servers delivering these services in a DMZ 3:
8 Are the servers delivering these services in a DMZ 4:
9 Are your various system logs aggregated to a central location for monitoring and analysis 1:
9 Are your various system logs aggregated to a central location for monitoring and analysis 2:
9 Are your various system logs aggregated to a central location for monitoring and analysis 3:
9 Are your various system logs aggregated to a central location for monitoring and analysis 4:
10 Do you have a patch management system in place If so please describe 1:
10 Do you have a patch management system in place If so please describe 2:
10 Do you have a patch management system in place If so please describe 3:
10 Do you have a patch management system in place If so please describe 4:
Course Name and Number_3:
Student Name_3:
Instructor Name_3:
Lab Due Date_3:
1 During the lab demo how did you connect to the Splunk management tool 1:
1 During the lab demo how did you connect to the Splunk management tool 2:
1 During the lab demo how did you connect to the Splunk management tool 3:
1 During the lab demo how did you connect to the Splunk management tool 4:
more secure operations 1:
more secure operations 2:
more secure operations 3:
more secure operations 4:
more secure operations 5:
3 What types of Data Inputs are available in Splunk and most other log management tools 1:
3 What types of Data Inputs are available in Splunk and most other log management tools 2:
3 What types of Data Inputs are available in Splunk and most other log management tools 3:
3 What types of Data Inputs are available in Splunk and most other log management tools 4:
3 What types of Data Inputs are available in Splunk and most other log management tools 5:
3 What types of Data Inputs are available in Splunk and most other log management tools 6:
4 What types of Alert Conditions are available in Splunk and most other log management tools 1:
4 What types of Alert Conditions are available in Splunk and most other log management tools 2:
4 What types of Alert Conditions are available in Splunk and most other log management tools 3:
4 What types of Alert Conditions are available in Splunk and most other log management tools 4:
5 What is the search string for the Top five sourcetypes preconfigured Search 1:
5 What is the search string for the Top five sourcetypes preconfigured Search 2:
5 What is the search string for the Top five sourcetypes preconfigured Search 3:
5 What is the search string for the Top five sourcetypes preconfigured Search 4:
Searches that are preconfigured and available within Splunk 1:
Searches that are preconfigured and available within Splunk 2:
Searches that are preconfigured and available within Splunk 3:
Searches that are preconfigured and available within Splunk 4:
Searches that are preconfigured and available within Splunk 5:
Searches that are preconfigured and available within Splunk 6:
Searches that are preconfigured and available within Splunk 7:
7 What Chart Types are available for a search or report within Splunk 1:
7 What Chart Types are available for a search or report within Splunk 2:
7 What Chart Types are available for a search or report within Splunk 3:
7 What Chart Types are available for a search or report within Splunk 4:
7 What Chart Types are available for a search or report within Splunk 5:
management best practices 1:
management best practices 2:
management best practices 3:
management best practices 4: