MOD002703 Advanced Network Security Principles

Callister Inc. is new in Manchester and has opened a branch in Cambridge. The company has designed its network, but the design has several security flaws. They have approached Anglia Ruskin University with a consulting contract where brilliant students in MSc in Cyber Security students will design, implement and document a proper security solution that can accommodate the requirements of the company.

 

This document describes the current state of the network as well as the security requirements of Callister Inc. Finally, it describes the final deliverables for this assignment.

The company has headquarters in Manchester and a branch in Cambridge. Figure 1 depicts the current topology of the company’s network.

• PUBLIC NETWORK: This network is outside Callister Inc. management and should not be changed. It has a HTTPS server, accessible through the https://google.com/ URL, a PC representing a teleworker (i.e. belongs to the company but works remotely), a PC representing an outsider to the company, a DNS server that is used by devices belonging to the PUBLIC NETWORK, and a DHCP server to provide IP address to devices connected to the PUBLIC NETWORK. The ISP router belongs to the PUBLIC NETWORK and therefore should not be modified (assume that ISP has been configured properly).

 

• DMZ: This is the demilitarised zone of Callister Inc. and contains all servers that are public to internal and external areas. This is under the management of the company and should be considered within your security design. It contains the company’s web server (https://Callister.com/), an email server and, a DNS server that is used by users of MANCHESTER HQ and CAMBRIDGE BRANCH. The DMZ servers are known externally through their external IP addresses and internally through their internal IP addresses, which means that static NAT has been configured in the DMZ_NAT router to perform this translation. All external devices trying to communicate with the DMZ servers need to use the public (external) IP addresses.