Network Assessment Your Company s Name

Transcription

1 Network Assessment Your Company s Name October 11 th, 2009 NSK, Inc. Page 1

2 Contents Section 1 Network ISP Internal Network... 4 (a) Firewall... 4 (b) Switches...4 (c) Wireless...4 (d) DHCP...4 (e) DNS Remote Access... 5 Section 2 Servers Domain Controller File Server Anti-Virus Server Mail Server Backup Server Configuration... 6 Section 3 Workstations Standard Configuration... 7 Section 4 Peripherals and Other Devices Printers PBX UPS... 7 Section 5 Recommendations Licensing Network Switches Backups Internet Connection SharePoint Server Firewall... 9 NSK, Inc. Page 2

3 5.8 Anti-virus Workstations Appendix A Quick Reference Guide NSK, Inc. Page 3

4 Section 1 Network 1.1 ISP Your ISP Provider provides an internet connection to Your Company Name via a. Your ISP Provider has assigned a static routable IP address of ##.###.##.# to this connection. 1.2 Internal Network (a) Firewall YOUR COMPANY S NAME currently utilizes a Cisco 1811 router/firewall to prevent access to their network. The device has 6 interfaces. Interface 1 (out) connects to the Covad T1 line and is assigned the IP ##.###.##.##. Interface 2 (in) connects the device to the internal network. The Interface 2 (in) is assigned the IP ###.###.#.#. At the time of the audit, there was a rule in the firewall that allowed ANY traffic from ANY source on all ports. This was a significant security risk so NSK corrected this by blocking all traffic except for traffic on ports necessary for internet access, , VPN, FTP and LDAP. Telnet access was also enabled from ANY source. NSK disabled telnet access from any source and allowed access only from the internal network. (b) Switches YOUR COMPANY S NAME is using 3 unmanaged network switches as well as the Cisco router as the backbone for the network. The switches include a Dell Power Connect port switch, a Netgear FS port switch and a Netgear GS605 5 port switch. All of the ports on all of the switches are in use. Because of this, all of the available ports on the Cisco router are being used for network switching as well. (c) Wireless 1 wireless access point is currently installed at the YOUR COMPANY S NAME office. The device controlling wireless connection is a Belkin F5D The device is set to bridge mode and only extends access from the wired network to wireless devices. All devices use the same SSID: YOURCOMPANY, and the same WEP (d) DHCP DHCP is being provided by NAME. The DHCP server has a non-routable static IP address of ###.###.#.#. The DHCP scope includes ###.###.#.100-###.###.#.200. A DHCP lease assigns a subnet mask of , a gateway address of ###.###.#.#, NSK, Inc. Page 4

5 DNS as ###.###.#.#, and a domain prefix of yourcompany.com. (e) DNS DNS is provided by Your Company Namesbs1. The DNS server has a non-routable static IP address of ###.###.#.#. The following IP addresses are listed as DNS forwarders on the server: ###.##.###.###, ###.##.###.###, ###.###.#.##, ###.###.#.##. No secondary DNS exists on the LAN. 1.3 Remote Access Remote access was setup so that anyone with internet access could launch a remote session to the server via WAN IP address. This is a security issue and NSK has disabled this feature. Remote access has been set up such that YOUR COMPAPNY employees and NSK can gain access via an IPSec Cisco VPN connection to mail.yourcompany.com. The YOUR COMPANY.pcf configuration file is required to configure the Cisco VPN client for access to the YOUR COMPANY VPN. The Cisco router is configured to authenticate users using the RADIUS method. Your Server Name is configured as a RADIUS server and passes the active directory login information to the Cisco router. Using this method, users are able to connect to the VPN using their Windows Active Directory credentials. Users who are not authenticated on the domain are unable to access VPN. This rule was taken out of the firewall for security purposes. Section 2 Servers 2.1 Domain Controller Your Server is the sole domain controller at Your Company. The non-routable static IP ###.###.#.# is assigned to Your Server. Your Server hosts the Windows 2003 Active Directory YourWebPage.com. The server is licensed for 5 end users but there are 11 end user accounts currently in use on the server. 2.2 File Server Your Server is acting as the fileserver on the YOUR COMPANY S NAME network. Approximately 140GB of data is stored on the F: drive located on logical disk 0. YOUR COMPANY S NAME also has a Dell PowerVault 725N Network Attached Storage (NAS) device which is not being utilized at this time but could provide file-serving or backup functions in the future. NSK, Inc. Page 5

6 2.3 Anti Virus Server Symantec Corporate is installed on the Your Server server at Your Company Name. This software is used as a central management console for the workstations on the Your Company Name network. The anti-virus definitions were up-to-date at the time of the audit. 2.4 Mail Server Microsoft Exchange Server 2003 is installed on Your Server. The Exchange System Management Console is accessible from Your Server. Currently, the First Mail Store is approximately 4 GB. can be accessed via the internet using outlook web access at Backup Your Company Name utilizes Symantec s BackupExec 11D to manage their nightly backups. The software performs a backup via the Backup to Disk operation and transfers the files to a Netgear NAS device (model: ReadyNAS NV+, capacity =680 GB). Backups of the shared drive, Exchange information store and system state are performed nightly. Each nightly backup is set to overwrite the previous night s backup file. BackupExec is also using DLO technology to backup files and folders on each individual user s machine nightly. After being backed up to the server, these DLO files are backed up to the Netgear NAS device on a nightly basis. Every Saturday, all of the nightly backups stored on the Netgear NAS are backed up to a Seagate Free Agent external hard drive connected to the server. Your Company Name has an unused Dell PowerVault 725N that could be used for backup purposes. Your Company Name does not have any offsite data backup procedure in place. 2.6 Server Configuration Your Server Name is the domain controller, DHCP, DNS, Exchange, file, print, web, and application server for Your Company Name. Your Server Name has one RAID 5 array consisting of five physical disks arranged as one logical disk with one physical disk installed as a hot spare. The server model is an HP Proliant ML350 with one Intel Xeon 3.2 GHz processor, 3.5 GB of RAM, and is running Microsoft Windows Server 2003 SBS. Your NSK, Inc. Page 6

7 Company Name is also using a separate workstation to run their FTP site. Your Company Name currently utilizes FileZilla Beta to run the FTP site. Section 3 Workstations 3.1 Standard Configuration Your Company Name workstations consist of Dell Dimension and Dell Precision computers which are approximately 3 to 5 years old. All of the workstations are running Windows XP Pro with Office Many of the workstations are running various engineering applications such as MatLab, ANSYS, Finite Element, etc. Mapped drives are connected using one login script for all users so they are unified across the network. Your Employee s laptop is different than all of the other workstations in that it is a newer Toshiba Portege R500 running Windows Vista Business Edition. Section 4 Peripherals and Other Devices 4.1 Printers Your Company Name has two HP networked multifunction printers, a LaserJet 4250dtn and a LaserJet They have statically assigned non-routable IP addresses of ###.###.#.# and ###.###.#.# respectively. 4.2 PBX The PBX is a BIZFON Hybrid system. The system appears to work off of both traditional copper lines and Ethernet lines. The model number of the system is UPS Your Company Name has one APC SmartUPS 2200 UPS which provides backup battery power for their main server, NAS devices, all networking equipment and PBX. The UPS is not being actively monitored, so the current load and estimated backup time are unknown. The output on the front of the device shows the load as very minimal. NSK, Inc. Page 7

8 Section 5 Recommendations The following is a list of recommendations for Your Company s Name IT Environment that NSK has deemed necessary as a result of the audit and discussions with Your Company Name. These recommendations should be further discussed and clarified with Your Company Name before proceeding. Following discussion of the recommendations, NSK will provide a proposal(s) to implement the recommended changes. 5.1 Licensing Your Server Name is licensed for 5 end users but there are 11 end user accounts currently in use on the server. Additional client access licenses need to be purchased to comply with software licensing laws. 5.2 Network Switches Your Company Name is using three unmanaged switches that are at either near the end of their life-cycle or retail grade. Also, the Cisco 1811 router/firewall is being used as a switch which should be changed immediately because it is a security and performance problem. To increase performance and network stability, NSK recommends that Your Company Name replace these three switches with a 48 port managed Gigabit switch. At the time of the switch replacement, the server closet should also be cleaned up because of the way that network equipment is installed and connected is messy. 5.3 Backups Your Company s Name backup system should be reviewed and revised. The DLO backup method should probably be replaced with another method such as Windows Offline Files or Shadow Protect for Employee Name and possibly others. Also, the data that is being backed up needs to be reviewed as some of this data (MS Office files, ) should be stored on the server and not on the local computers. A new method will assist with proper backups which are much faster and take up less network bandwidth. In addition, an offsite backup procedure such as removable hard drives or backup tapes should be developed to protect data in the event of a disaster. NSK also recommends exploring using the Dell PowerVault 725N NAS as a backup device. This is a more stable and secure business-class storage device. NSK will propose a comprehensive backup solution to Your Company Name at a later date if you wish. NSK, Inc. Page 8

9 5.4 Internet Connection During the audit it was brought to NSK s attention that the internet connection at Your Company Name seemed to be very slow when loading web pages. In order to resolve this issue, NSK must first perform some troubleshooting steps including testing web access when directly connected to the T1 router, when directly connected to the Cisco firewall and when connected to different network switches and comparing the results. Since the network setup at Your Company Name is not ideal, there could be many factors contributing to slow internet. It may not be the T1 connection itself, but troubleshooting is required to determine the cause(s) of the slowness 5.5 SharePoint During the audit it was brought to NSK s attention that the SharePoint site is generating 6-10 GB of logfiles on a regular basis that are filling up the server. This is a significant problem because the server can have decreased performance or stop operating altogether if the hard drive becomes full. NSK recommends that we troubleshoot this issue and turn off any SharePoint logging as it is unnecessary in this environment. 5.6 Server Your Server is approximately 4 years old and is currently in good condition. The RAID array is operating as it should, backups are performed nightly and the system is up-to-date in terms of security patches. The warranty on this server will expire on April 27, NSK does not feel that there is an urgent need to replace this server, however, it is approximately 2/3 of the way through it s lifecycle. If Your Company Name decides to continue to use this server the warranty should be renewed for at least 1 more year. The maximum amount of years that the warranty can be renewed for is 2. As a best practice, NSK recommends cleaning up the structure of files/folders on the server. This will help keep the data sorted properly and in one central location. NSK also recommends upgrading the FTP server software on the Windows XP workstation that controls the FTP site. Currently a Beta version of the software is being used. This should be upgraded to a final build to ensure proper stability and performance. 5.7 Firewall Your Company Name is currently using a Cisco 1811 device as their main router/firewall. This firewall class is well suited for the needs of Your Company Name but may be out of NSK, Inc. Page 9

10 warranty. The warranty status should be checked and renewed if possible so that it can be quickly and easily replaced should a component or the entire device fail. NSK also recommends updating the internal operating system and firmware as well as the SDM (graphical management interface) on this router. All of these items are out-of-date and should be updated to ensure the most stable and secure operation of the device. NSK has already fixed a number of configuration and security issues on the firewall. However, the router configuration should be reviewed and cleaned up further as necessary. NSK also recommends the deletion of some VLANs within the device. Several VLANs are configured and turned on but not in use. These VLANs should be disabled or deleted entirely. Lastly, NSK recommends relieving the switching ports of the Cisco 1811 and moving those devices that are connected to the ports to another switch. 5.8 Anti virus Your Company Name has centralized anti-virus management software in Symantec Antivirus but at the time of the audit it was mentioned to NSK that Your Company Name may have a new license for the software which includes Symantec Endpoint Protection. If this is the case than the software should be upgraded to Symantec Endpoint Protection which provides better protection from malware than Symantec Anti-virus does. 5.9 Workstations Y Your Company Name would like to continue to use the workstations that they currently have but NSK will need to reimage the systems and possibly make some hardware upgrades such as RAM or hard drives. NSK will discuss the plan for this workstation reconfiguration with Your Company Name and provide a proposal to complete the project. NSK, Inc. Page 10

11 Appendix A Quick Reference Guide DC/DNS/DHCP/Exchange/RRAS/File/Web: Your Server Domain Name: YOUR COMPANY NAME ISP: Your ISP Registrar/Host: Network Solutions/Internally hosted SSID: Your Company Name WEP/WPA Key Remote Access: Cisco VPN integrated with Active Directory (Your Company Name.pcf file required) NSK, Inc. Page 11