Реферат на тему «Analysis of business information security on the example of Design & Architecture»

Table of contents

Introduction

1. Brief description of Design & Architecture

2. Design & Architecture information security research methodology

3. Analysis of information security of business on the example of Design & Architecture

4. Recommendations for improving the information security of business on the example of the design company Design & Architecture

Conclusion

List of references (Harvard Referencing Standard)

Introduction

This report provides an analysis of the information security of the design company Design & Architecture (hereinafter also “the company”), which has an office in Oslo.

In 2017 the company opened its office in Norway. Design & Architecture rents space on the 6th floor of a building in the center of Oslo. The company has 15 employees in its branch.

As a result of internal audit, which was performed by the system administrator of the company, the report containing overall risk assessment with detailed risks analysis for further selection of a set of information security measures was issued.

Based on the analysis of the company’s risks, there are the following types of threats to information security, for preventing of which an IT security system should be developed:

• Threats of data privacy violations;
• Threats to data integrity;
• Threats to accessibility;
• Threats of data breaches;
• Threats to the authenticity of information.

Based on the results of the analysis of the company’s risks, we proposed implementation of a complex of information security software produced by Infotex. The software implies the implementation of an individual approach, in our case — the deployment of a secure network by introduction of ViPNet OFFICE version 2.2.

1. Brief description of Design & Architecture

The business of Design & Architecture studio consists of two interrelated areas: the first one is a comprehensive solutions related to the arrangement of the internal space of private housing and commercial real estate. The studio develops design projects for apartments, houses, offices, restaurants and manages renovation and construction works in Moscow, St. Petersburg, Russia and Europe.

The second activity of the studio is the sale of premium class decorative materials. The studio is the official distributor of European brands «Spiver» — decorative plaster, and «TKROM» — paintwork materials for any purpose: decorative painting, protection, preparatory and finishing works(Design&Architecture 2019).

The one more mission of the studio is to share its accumulated knowledge: “We organize master classes and workshops on interior design and application of decorative materials.”

Design & Architecture is registered in Russia as a Russian legal entity according to the Federal Law of February 08, 1998, No. 14-FZ (as amended on April 23, 2017) “On Limited Liability Companies” in 2009.

The head office of the company is located in Moscow, 129110, Moscow, Prospekt Mira street, 57, bldg. 2, office 17.

The legal and actual address of the company is the same.

In 2017 the company opened its office in Norway. Design & Architecture rents space on the 6th floor of a building in the center of Oslo. The company has 15 employees in its branch(Design&Architecture 2019).

Design & Architecture, despite of the fact that it recently opened a business in Norway, is already considered a «rising star» in the design industry.

2. Design & Architecture information security research methodology

Today, the main threat to business information security is the imperfection of the computer system (automated system), where important and confidential business information is stored.

There are several approaches for assessing the information security of automated systems.

The conclusion about the level if information security is made based on the indicator values of the protection system efficiency index. Within the limits of the given approach the attention is given to one of aspects of information safety — protection of the information from unapproved access (Babash, A 2013).

Evaluation according to the requirements of regulatory documents. As a result of meeting certain requirements, the information system is classified as having one or another class of safety. For example, International Standard ISO/IEC 15408.99 «Information Technology Security Assessment Criteria», developed under the General Criteria project (ISO/IEC 15408.99).

The risk assessment methodology outlined in the special recommendations 800-30 (NIST) presupposes a preliminary assessment of two parameters: potential damage and probability of hazard realization (Gromov, Y 2014).

The method of obtaining risk assessments with a preliminary assessment of three key parameters (CRAMM method). Here, in addition to potential damage and probability of hazard realization, the degree of vulnerability of the information system is assessed (Gromov, Y 2014).

3. Analysis of information security of business on the example of Design & Architecture

The building where the Design & Architecture office is located is the middle of a block of 7 buildings. In addition to the company’s office, which occupies the 6th floor, there are several other offices of the companies located on other floors (Design&Architecture 2019).

The tenants of the building have a joint reception area on the 1^st floor by the main entrance.

Their offices of the tenants are accessible via an elevator and stairs.

Moreover, they also have a fire escape at the back of the building with stairs both up to the roof and down to the ground level. There is also a helipad for emergency evacuation on the roof of the building.

There are ordinary fire and smoke sensors on the entire floor plan – which would set of an alarm and automatically spread water in the area of the sensor reacting.

They also have servers in racks in a storage room along with general office supplies.

The business of the company encompasses the whole of the 6th floor and they have an open office landscape with a few closed offices and a meeting room.

The all 15^th employees have stationary workstations – except for two members of the sales-team, who have laptops they bring along to conventions, seminars, conferences and such(Design&Architecture 2019).

As a result of internal audit, which was performed by the system administrator of the company, the report containing overall risk assessment with detailed risks analysis for further selection of a set of information security measures was issued.

Based on the analysis of the company’s risks, there are the following types of threats to information security, for preventing of which an IT security system should be developed(Design&Architecture 2019):

—      Threats of data privacy violations;

—      Threats to data integrity;

—      Threats to accessibility;

—      Threats of data breaches;

—      Threats to the authenticity of information.

4.  Recommendations for improving the information security of business on the example of the design company Design & Architecture

As a result of the analysis performed we proposed to implement a complex software for information security, developed by Infotex. The software implies the implementation of an individual approach, in our case — the deployment of a secure network by introduction of ViPNet OFFICE version 2.2.

This software is supplied in the Light package, which includes a license to create up to two coordinators, ten subscriber stations and five tunneled connections simultaneously. If necessary, you can buy a number of licenses to increase the number of workstations.

ViPNet OFFICE software package allows you to deploy a highly secure virtual network without changing the existing physical network infrastructure or reducing its performance. ViPNet OFFICE integrates a number of secure tools, with the help of which users can easily and efficiently carry out network interaction.

The core of the ViPNet software is the so-called ViPNet Driver, the main function of which is the filtering and encryption/decryption of incoming and outgoing IP packets.

Each outgoing packet is processed by the driver according to one of the following rules:

-redirected or sent in their original form (without encryption);

-is blocked;

-Encrypted and sent;

-Encrypts and redirects.

Each incoming packet is processed as follows:

-is skipped (if it is not encrypted and it is allowed by filtering rules for unencrypted traffic);

-is blocked (according to the set filtering rules);

-Encrypted (if the packet was encrypted) and redirected for further processing by the appropriate application.

The ViPNet Driver works between the data link layer and the network layer of the OSI model, which allows processing of IP packets before they are processed by the TCP/IP protocol stack and transferred to the application layer. Thus, the ViPNet Driver protects the IP traffic of all applications without disrupting the usual way of working of users.

Due to this approach, the implementation of ViPNet technology does not require any change in the existing business processes, and the costs of deploying the ViPNet network are low.

ViPNet encryption software uses the following symmetric algorithms:

-GOST 28147-89 (key length 256 bits) — Russian symmetric encryption standard.

-AEV (256 bits) — The U.S. standard for symmetric encryption based on the Rijndael algorithm.

The default algorithm is GOST 28147-89. If necessary, you can choose the algorithm AEG.

The coordinator is set up and supervised by the ViPNet Co-ordinator software.

ViPNet Cleant includes:

-Integrated personal network screen with the functions of attack detection (IDS) and network activity control of applications;

-TCP/IR encryption;

-A number of useful protected communication applications and other functions.

ViPNet Сlient allows you to manage the parameters of processing the application protocols FTR, HTTP, SIR.

The ViPNet OFFICE package includes a number of useful applications for fast and secure data exchange between ViPNet members, as well as other functions:

-Secure messaging / Secure conference;

-Business mail;

-File exchange;

-Call external applications;

-Open the web resource of the network node;

-Browse the network node’s shared resources.

The ViPNet Manager and ViPNet Client components must be installed in sequence at the ViPNet network administrator’s workplace.

ViPNet Manager is designed to form the structure of the ViPNet network (creation of servers, user workplaces and connections between them), as well as to create sets of keys and passwords for ViPNet network nodes. Key sets are used to organize secure connections and are necessary for subsequent installation of ViPNet Coordinator and ViPNet Сlient components on ViPNet network nodes.

A computer with ViPNet Manager software installed does not have to be available in the network permanently, because ViPNet Manager is used mainly for creating the initial network structure and key sets, and then for periodic network maintenance. In order for the ViPNet administrator to establish connections to other ViPNet network nodes and to send out key sets, the ViPNet Сlient software must be installed at the administrator’s workplace.

Conclusion

As a result of performed analysis of information safety of Design&Architecture, and taking into account actual threats and vulnerability, a place where complex organizational and technical measures on maintenance of information safety will be developed, the local computer network of company Design&Architecture becomes.

One of the main tasks for the normal functioning of the LAN and its capabilities is to ensure the security of the circulating in it information flows. At the moment the existing information security in the company is limited by the built-in means of used software, such as protective mechanisms of the operating system, which currently does not provide reliable protection.

LANs will be protected in such a way that the chances of threats, vulnerabilities and risks are minimized, i.e. the network that currently exists in the company will be protected. The entire responsibility for execution is assigned to the position of system administrator, who performs the duties of information security administrator.

The implementation of the ViPNet Office software package will affect all structural units of the company, as the program will establish full control over the entire local network deployed. As mentioned earlier, ViPNet Office includes a set of three software products, each of which is installed on a PC, depending on the function it performs. Each of the three software products also differs in installation and configuration.

List of references (Harvard Referencing Standard)

1. “On limited liability companies”, Federal Law of the Russian Federation #14-FZ as of 02.08.1998 (ed. by 04.23.2018);
2. “»On commercial secrets», Federal Law of the Russian Federation #98-FZ as of 07.29.2004;
3. «On information, information technologies and information security», Federal Law of the Russian Federation #149-FZ as of 07.27.2006;
4. ISO/IEC 15408.99 «Information Technology Security Assessment Criteria»;
5. Babash, A 2013, Information security. Laboratory workshop: Training manual, KnoRus, Moscow;
6. Gromov, Y 2014, Information security and information protection: Manual, TNT, Stariy Oskol;
7. Design&Architecture 2019, Annual report 2018, Design&Architecture Limited, Moscow