Comprehensive Security Infrastructure Plan For the Leading Groups of Companies in Sri Lanka

One of the leading groups of companies in Sri Lanka which is running businesses in different areas is hoping to automate the entire operations provided by the all companies in the group. The automation also targets to improve all the internal operations and the public services which provide online access to their customers and their remote employees. The group of companies have World-wide branch network. All the companies and branches are connected to the corporate office which is located in Colombo. They are running business such as Finance (private banks, etc.), Manufacturing and selling electrical and electronic appliances, Providing Cloud and Data Center facilities, and Transport and Logistic services. Most of their companies interact with customers, distributors, dealers, remote employees via internet. So Following key functionality and task to be consider in establishing the security infrastructure.


1. Customers, distributors, dealers, remote employees should be able to seek following through online (web/mobile) systems.
• Customers should be able view their products
• Customers should be place online orders and make online payments
• Submit all the related documents online and download all relevant documents 
• Distributors and dealers should be able check their stock levels and place online orders
• Certificate verification to identify legitimate business entities.
• People should be able to perform their financial transactions securely
• Customers should able reserve transport facilities and track the goods
• Maintain continues communication with remote employees and their offices
• People can purchase Cloud and Data Center facilities.
2. The corporate office will maintain and host all their internal systems in a private cloud infrastructure environment and external systems in a public cloud.
3. One company of the group runs a medium scale business of providing Cloud and Data Centre services
4. The companies will maintain direct connectivity to following key organizations to precede their business.
• Board of Investments of Sri Lanka
• Banks
• Sri Lanka Customs
• Central Bank of Sri Lanka
5. The security infrastructure must consider all related threats from inside, outside as well as the connected institutions.
6. The security infrastructure must be able to build and enhance the trust in public to use the facility and must reflect in providing the services.




Comprehensive Security Infrastructure Plan


1.0 Introduction 

Cyber security basically means securing the confidentiality and integrity but also maintaining the availability of the system. In the Cyber Breach Survey of the 2017, it shows that 46% of businesses reported cyber breach or cyber-attack. ( Care Provider Alliance & Social Care Programme at NHS Digital, 2017)  The CIA triad is a model that is created to manage protocols for information security. In this context we can learn that confidentiality is a set of guidelines that limits unauthorized access to information, integrity is the affirmation we get that the information is trustworthy, accurate and lastly, availability is the assurance that we get safe access to the information by the authorized people. The 4 main threats that we have in information security is, interference, interception, modification and fabrication.   

1.1 Interference 

• To continue confidentiality in the system we must block and eliminate all third-party intrusions by hackers and other cyber attackers from the system, which otherwise will damage the system and may be snoop our connection. 

• To continue integrity throughout the system we must take precautions such as user access controls and file permissions to ensure that our data and information are not modified or hampered by any intruders.  

• To continue availability, malicious attacks such as network intrusions and derailed service attacks must be stopped by taking extra security measures such as installing proxy servers and firewall is an essential.   
  
1.2 Interception 
  
• To continue confidentiality in the system, the main methods are data encryption and factor authentication can be used. Also training the staff to get more familiarize about how to guard the system against risk factors could be helpful. 

• To continue integrity, there must be a method to detect interception such as sever crash or electromagnetic pulse (EMP). 

• To continue availability in the system hardware and software maintaining on a schedule and handling the system correctly is a necessity. Also avoiding occurrence of bottle neck by providing a suitable bandwidth is crucial.   

 1.3 Modification  

• To continue confidentiality all, the data and information in the system should be branched or categorized according to the damage that and intruder could do.   • To continue integrity, accuracy and adherence throughout the system is a must. Precautions should be taken to avoid or minimize any corruption that can be done by unauthorized parties.  • To continue availability, additional security equipment and software such as firewalls and virus guards can be installed. Also, extra precautions against any intruders must be implemented in the system.  
  
1.4 Fabrication   

• In a fabrication attack, it usually sidesteps or ignores authenticity checks and mimic. Therefore, in order to maintain confidentiality in the system avoiding data redundancy and user authentication is required  • In counterfeiting or fabrication, it basically inserts information or modifies the system. So, to minimize fabrication and maintain integrity, users must be aware of these types of attacks and must always be prepared to face them. Since the main aim of fabrication is to gain access to a system or a service, users and admins should be trained how to perform in these types of attacks and to survive.   

2.0 Basic steps to enhance security of a system 

In order to manage and reduce the cyber-attacks must be needed to evaluate security risks and then identify the methods to manage them. An attacker could be a group an individual which their capabilities are based on their knowledge skills and tools which they use to conduct and attack. Identifying the potential threats of the attackers is the initial step in managing and avoiding the risk.   
 Ones the potential risk or the threats identify we must evaluate the vulnerability of our system. Vulnerabilities could be weakness in the physical system, or it may be in nonphysical form that could allow and attacker to compromise the system. During this vulnerability analysis we should identify the potential ways to minimize these vulnerabilities and there for reduce the risks. These will vulnerability assessments will help beside how to establish appropriate security measures and the security personals in the system should be updated about current threats and must do regular checks of any vulnerability in the system.   
Furthermore, in these vulnerabilities process we should consider what will be the consequences if an attacker is successful and the system is compromised. If and attack happened, 

 • Obtain information by unauthorized groups or individuals  
• Control or modification of data resulting the loss of integrity 
 • Customers will not be able to access, and loss of availability could happen  
  
Since there should be vulnerabilities in the system in order for an attacker to succeed we should take some basics steps such as, deleting all unnecessary user accounts Deleting all default or unnecessary files shares Deleting or aborting risky ports and services Implement access control on registries and file systems Establish encryption mechanisms.  
  
While these security controls may be helping detecting delaying or denying attack it is difficult to stop all attacks without any rain forcing auctions once and attack is detected incidents response activity can be started. To detect any attacks or intrusions to the system, firewalls intrusion detecting systems must be monitored on a daily or hourly basis is an essentially. Once the monitoring system started, we must establish the base line for the normal working system and for the user behavior. After studying the expected the normal behavior any anomalous behavior could be identified, investigated and if it’s a risk we could take actions to remove the risk. The monitoring of the system could be more efficient by using automated tools to help with the tracking and reporting them.  

 2.1 Threats in online 

  Since we are developing an online shopping store in the system, we must consider the possible threats that can happen such as,   

• Data breaches 
• Unsecured connection  

• Identity theft: 

The main security threat in an online shopping system is the identity theft. Cyber criminals try to loot personal information such as name, Email address, mobile number, home address etc. to sell them or use them in other malicious activities or to impersonate the user. When a hacker gets unauthorized access to a certain website mostly through phishing, is called a data breach. These data breaches cause financial damage and to the users in their personal and financial information has been stolen. Since the transaction done through this online shopping system the connection must always be secured. User’s credit card details, Login details and other personal information should be encrypted and must store in a secured data base and a server.    

• Eavesdropping:    

An eavesdropping is a stealthily attack, which is also known as snooping, where somebody attempts to take data that PCs, Smartphones, or different gadgets transmit over a system. An eavesdropping in attack exploits unbound arranges correspondences to get to the information being sent and got. Eavesdropping attacks are hard to recognize because they don't cause organize transmissions to give off an impression of being working strangely. Eavesdropping stealthily attacks are hard to recognize on the grounds that they don't cause arrange transmissions to seem, by all accounts, to be working anomalous. 

3.0 Security Infrastructure Plan  

3.1 Potential risks/threats to the system. 

Web based systems like this are wide-open to various risks and threats during the operation which will be related to the hardware and software or stemming from physical security vulnerabilities. Whenever such faulty area manifests in a web-based information system it really impacts on the business operation and ability of the organization in providing the service which is demanded by the service collectors. In this case which is correlated with the institution who are aiming at the initiation of an automated business registration service in Sri Lanka with implementation of a mobile supported web-based solution which will be providing the services related to business registration and will enhance the process with the solution. Before making the steps of going through the implementation of the idea it is worth of assessing the importance of a various possible risks, threats, vulnerabilities and faults which the company will have to go through in the events of instigating the system and executing. Following can be highlighted mainly as the identified types of risks and threats for the system depicted in the scenario. 

• Denial of Service (DoS)- These are types of simple but effective outbreaks which will distress the availability of services provided through the web-based solution. What will happen here is that DoS attack will consume the processing power, bandwidth and other computational factors making the actual consumers or customers experiencing nothing out of the service. That is web service will become very lethargic and customers will not able to access the website for some time. This also happens in a way that unauthorized accessing of the resources of the information system will take place at these times of attack and information theft will be the result. 

 • Session Hijacking - This is also referred with the terms cookie hijacking or session spoofing as it tries to exploit a valid session and the attacker may utilize this valid session and user’s identity to access the websites data, communicate with internal servers and manipulate the information system related with it.  

 • Cross site scripting - This happens in a way that a hacker or the attacker can inject lines of JavaScript into web pages of the website and if this is not properly secured the attackers can send malicious code as a browser side script and may post it as a user comment. 

 • Parameter Manipulation - Refers to modification of parameters by a hacker in a harmful manner which will affect the results of searching for the website on search engines. That is information from the website will be passed from one page to another through URL parameter. Manipulation of these parameters in a way that attackers want will be damaging the company reputation and name. 

 • Eavesdropping - This is a type of electronic attack which involves intercepting communications that happen in a network and listening to every data item that transfers in the network. (Chapple, n.d.)  

• SQL injection - This is like cross site scripting and involves malicious SQL statements will be inserted into the website and later database accessing by an intruder with deletion and accessing of sensitive and confidential information will result.  

• Password theft - For a web-based system like this who provides major web services, this type of risks may arise. What can happen is attackers will try to steal the passwords of users with password cracking software and will try to access those accounts illegally and will access that confidential and sensitive business information. 

 • IP spoofing - This attempt of attacker is related with gaining unauthorized access to the internal network and machines connected with it by handling the IP packets. What actually happens is that attacker will then launch outbreaks to network hosts and spread malicious software to bypass the security and steal private information.  

• Failure of devices connected with the information system and network - This is also a possible threat which could happen with this type of a system where servers, computers, routers, switches, firewalls and several other electric equipment may malfunction due to overheating and other causes.  

• Misuse of network equipment - Due to errors of staff who operate the system such as not taking proper backup, improper handling, water and fire damage due to misuse etc. also could affect riskily to the system.  

• Insider attacks - Staff who are working inside the company may work as a supporter to the attackers and may leak confidential information which the attackers need in launching any attack. 

 3.2 Key security requirements on applications /users/ infrastructure.    

The company which is mentioned here who are planning to launch the new web-based information system to provide business services, should focus on identifying the actual security requirements which are to be addressed mitigating the types of risks, vulnerabilities and threats mentioned above.  

• Enabling encryption - In order to protect communications that happen in the website such as client server communication and protecting server’s identity, database and network from attacks such as phishing attacks, eavesdropping, SQL injection, Cross site scripting and Dos attacks etc. encryption with the website can be done. There enabling Hypertext Transfer Protocol (HTTPS), IPsec and Secure Sockets Layer (SSL) can be employed which adds encryption to every communication that happen in the website.  

• Enabling multifactor Authentication - In the authentication process the company can make use of multiple authentication methods such as mobile verification, email verification, one-time passwords and temporary passwords etc. This would be helpful in avoiding threats such as password theft and account stealing by intruders. 

 • Constant backup and archiving databases - Company will have to focus on database and server backup constantly to meet the risks such as data loss due to human errors, failures in server environment and infrastructure, water and fire damage, malware infections and other types of every possible risk associated with databases and servers.  

• Usage of network security infrastructure such as firewalls, IDS & IPS, Proxy Servers, Application Level Gateway, Circuit Level Gateway and honeypot servers - These type of security infrastructure is important to lessen most of the network security risks and threats which we have described above such as DoS attacks, IP spoofing, SQL injection, Session Hijacking, password theft and all other unauthorized action from the attackers.  

• Implementing RAID systems - This is a storage virtualization technology that can be used with the multiple physical disk drives where failures in database servers and disappointments associated with malfunctioning of database disk drives are avoided in server environments. With RAID it is possible to improve the overall performance in the database and data redundancy can be increased. 

 • Performing security audits and network monitoring - With the risk assessment methodologies associated with information security performing security audits and network monitoring is important. Network monitoring will be highly beneficial for this type of web-based network systems as it will support the system administrators in identifying any anomalous behavior in the network traffic, identifying unfamiliar requests for the network. This will further increase the visibility over the live network performance which will be helpful in managing the network properly. 

 • Implementing Access Control Mechanisms - This is a technique allied with implementing policies for controlling user access in the internal network environment. What happens is that control access policies are enforced for resources, devices and tasks performed based on the role or location-based accessing. This will be helpful in implementing the desired level of security from the inside of the web-based system as different people are enforced only with the necessary access level. 

 • Executing Password management policies - This refers to implementing security policies in applying passwords and user account security options of the customer’s user accounts and also for the internal staff who are accessing the system. For examples it is possible to enforce policies which ask to set strong passwords with more characters and other many forms of competently managing robust and effective security in the system  

• Using VPN for remote communication purposes - This technology will be associate with communicating through a virtually created tunnel or a private network in the public network or what we call as internet. This will be very effective in avoiding many risks and threats in the internal communication processes and with communicating with customers.  

3.3 The key features /components of the security  

• Firewalls - This is a network security device which can be used with implementing security in a network where it can be configured in permitting or denying network traffic into an internal network or server environment with a configured DMZ. The basic duty of a firewall is to control the traffic between networks of different trust levels and ultimately a controlled interface will be provided between these zones of differing trust levels. This happens with the enforcement of a security policy and connectivity model based on the least privilege principle and separation of duties. This can be in both the forms of software or hardware and there are Hostbased firewalls and Network-based firewalls where host-based firewall will be installed inside each server that controls incoming and outgoing network traffic and network-based firewall will be built into the infrastructure of cloud or network.
  
• Application Level Gateway - It employs an application specific proxy where when a user requests any service from the proxy, it validate the requests for their legality and forwards the request and returns the result to the user. Here with this type of a setting it is needed to have separate proxies for each service such that if the HTTP (web) proxy is being used, the user must be first authenticated on the proxy server to gain the access to outside. It is not possible to use web proxy server for accessing mails as they operate on different ports. 

• Circuit Level Gateway - It works as a firewall which provides UDP and TCP connection security by working in the transport layer, application layer and the session layer of the OSI model. In contrast to application gateways, circuit level gateways can perform monitoring of TCP data packet handshaking and session fulfillment of firewalls and policies.  

• IDS - Intrusion Detection System is a device or software system which can perform the functions of detecting any intruder action with the sub modules it consists such as traffic monitor, detection engine and redirection engine. Traffic monitor module will inspect the network traffic, detection engine will check the pattern of data  
available in the data packets and detect whether there is any uncommon nature by comparing the pattern of data in data packets available within its database. With this action if it is detected that there is some sort of intrusion, it is redirection engine that will perform the function of forwarding those packets to the IPS.  

• IPS - Intrusion Prevention System is also prevailing in the form of both software and hardware and it also consists some sub modules such as intrusion recognizer, decision maker, backtracking module. Distinguishing the type of packet, which is intruding, and decision making module will involve in making the decision of blocking the certain IP address or backtrack it by or whether to redirect the request of to a dummy server. Backtracking model will be responsible for the process of backtracking the path of the IP and locking it.  

• Honeypot server - This is a kind of dummy server which acts as a genuine server in the network or the information system providing the intruders with a fake target for attacking and actual server will be not harmed. Honeypots contain a database containing false information which may attract the intruder towards it.  

• Usage of VPN - Involves utilization of a secured private network for internal communications of an organizations keeping the public network or internet as the backbone of communications. Encryption will be used in the VPN communication through a technique called VPN tunneling which tightens the communication process happening. 

3.4 A detailed approach and steps taken to enhance the public trust highlighting both technical and nontechnical steps.  

In a service providing web application like this which provides business registration services in collaboration with the government authorities such as Boards of investment of Sri Lanka, Bank, Sri Lanka customs, Central Bank of Sri Lanka etc., the level of public trust and level of confidence of the general public on using the service actually depends on the factors such as reliability, availability, efficiency, access time and associated robustness. In order to have these factors it is necessary to have the security infrastructure of the company providing the service at an optimum level such that the operation of these infrastructure in providing the service should ensure that public trust enhanced rather than destroying the company reputation and trustworthiness of offering a better service. Following major factors can be identified as key contributors in this case.
   
• Company should make sure that no failures of the web-based system happen at any time and availability of the web application should be at a level of 99.9%. That is security infrastructure should make sure that this website does not affect the action of any unauthorized action to down grade the performance or any Dos attack 

 • Security infrastructure should make sure no password theft and account hijacking happen with the user account of the users who have registered on the website to get done a specific service. 

 • Company should take actions in implementing password policies and security procedures and frequently engaging in security audits, network monitoring to avoid attacks to the network system and server environment. 

 • Employing proper intrusion detection and prevention accompanied with a honeypot server.  

• When customers are doing payments for services that they gain, company should make sure to give them a secure checkout or transaction. For that purpose, internal security mechanisms must be tightened using better security infrastructure and at the same time the company should make sure to employ a reliable and secure third-party payment vendor. Here using of SSL encryption and HTTPS will be helpful in avoiding unauthorized access from intruders.  

• Company can adopt a strategy of implementing a blog and frequently updating the blog with their national level service, efficiency, security and reliability of their service, security mechanisms they have employed and instructions on how to get done a service without getting attacked by an intruder etc.  

By successfully performing the above-mentioned tasks and procedures it will be possible for the institution in increasing the level of public trust on their security infrastructure as well as on the service. 

4.0 High level system Diagrams 

References 

Care Provider Alliance & Social Care Programme at NHS Digital, 2017. An Introduction to Cyber Security. [Online]  Available at: https://www.skillsforcare.org.uk/Documents/Topics/Digital-working/AnIntroduction-to-Cyber-Security.pdf [Accessed 20 12 2019]. 

Anon, 2009. 6 threats to web application security & how to avoid it.. [Online]  Available at: https://www.commonplaces.com/blog/6-threats-to-web-application-securityhow-to-avoid-it/ [Accessed 20 12 2019]. 

Caban, D. & Walkowiak, T., 2015. Risk Assessment of Web Based Services. In: Theory and Engineering of Complex Systems and Dependability. s.l.:Springer International Publishing Switzerland. 

Chapple, M. & Loshin, P., n.d. How to encrypt and secure a website using HTTPS. [Online]  Available at: https://searchsecurity.techtarget.com/tip/How-to-encrypt-and-secure-a-websiteusing-HTTPS [Accessed 20 12 2019]. 

DeMers, J., 2014. 11 Simple Tactics to Increase Trust Online. [Online]  Available at: https://www.inc.com/jayson-demers/11-simple-tactics-to-increase-trustonline.html [Accessed 2 1 2020]. 

Malhotra, V., Kaur, T. & Singh, D. D., 2014. Comparison of network security tools- Firewall,. International Journal of Enhanced Research in Science Technology & Engineering, 3(2), pp. 200-204. 

Safianu, O. & Twum, F., 2016. Information System Security Threats and Vulnerabilities: Evaluating the Human Factor in Data Protection. International Journal of Computer Applications , Volume 143, pp. 8-14.