Perimeter Security Strategy
There are various vulnerabilities and threats. Malware is an example of such a threat. It normally interrupts the operations of a computer, collects sensitive information, or gets access to a system of a computer to comprise data. Another threat pertains to hacking. Hacking usually occurs when a user who is not authorized gains access to a computer or a network allowing him/her to gain access to sensitive data. Advanced Persistent Threats (APT) is in this list as well. They serve to steal data in transit. Extreme weather events are also considered to be major vulnerabilities. Inclement weather has the tendency of knocking IT systems down or damaging them leading to loss of stored data or data in transit (Kim & Solomon, 2010). Human error is also vulnerability. People can accidentally delete stored data, or move it to the wrong location leading to the loss of the data.
Cryptographic Tools
The cryptography tools applicable in the AAA framework include the authentication token and authentication utilizing key. These cryptography tools are similar in that they seek to give the user authorization to decrypt data. These tools are also different. With regards to the authentication token, a security token is utilized to authenticate the user as well as offer statefulness to the HTTP protocol. The security token is normally encrypted to enable users run secure exchange of data (Rao, & Premchand, 2018). On the contrary, the authentication utilizing key requires a key for encrypted data to be decrypted.
Non-Cryptography Strategies
The following non-cryptography strategies will be applied:
• Use of multi-factor authentication-this is where people are required to utilize strong passwords and, in most cases utilize 2-factor authentication. It might also need sign-on and probably biometrics like facial recognition and fingerprint.
• Offsite backup-this where files are moved onto safe servers offsite like via Cloud storage solutions, that can make sure an organization has reliable copies of its data to restore from or make a comparison against if a security matter did come up.
• Mobile Device Management-this puts vital oversights and controls on mobile devices like tablets, smartphones, etc. It also enables an enterprise to wipe missing or lost gadgets, regulate the applications that are loaded onto gadgets and commission the gadgets as required (Hill, 2019).
Supporting Tools for the AAA Framework
One of the strategies that my company uses is multi-factor authentication. Apart from the username and password, the staff is required to have an/or use extra credentials like a code from their smartphone and answer a security question so as to gain access to an account. Another strategy is the use of encryption. Sensitive company information at rest and in motion (in cloud, laptops, servers, and mobile devices) is encrypted. The common tools used are Remote Authentication Dial-In User Service (RADIUS) and Terminal Access Controller Access Control System (TACACS).
Application of Access Control
It would be appropriate to consider applying access control while keeping the AAA framework in mind always. Security is the most vital element to being in the IT field. As such, the company should be utilizing the network access control (NAC). This system will serve to deny access of network to noncompliant gadgets, put them in an area that is quarantined, or give them only restricted access to computing resources hence protecting the network from being infected.
Policies/Guidelines
The following policies will be included in the security manual
• Use of Multi-factor authentication-the process in which over one authentication factor is utilized to verify a user’s identity requesting to access resources.
• Privileged access-this is the level of access that is above that of a normal user.
References
Hill, D. G. (2019). Data Protection: Governance, Risk Management, and Compliance. CRC Press.
Kim, D., & Solomon, M. G. (2016). Fundamentals of Information Systems Security. Jones & Bartlett Publishers.
Rao, B. S., & Premchand, P. (2018). Cryptographic Tamper Evidence and Detection System. International Journal of Pure and Applied Mathematics, 118(16), 199-211.
