2.4 Risk analysis 49
5. Is there an authoritative directory?
6. The type of remote access available to the new combined network
Now for the opposite scenario. Your corporation has just sold a com-
pany or division. Review the same points in reverse. You may need to com-
pletely isolate the networks.
1. What access points to the Internet are/were in common?
2. How many DMZs does each company created from the split
3. What protocols are being used on each network?
4. What directories are being used to authenticate users?
5. Was there an authoritative directory?
6. What type of remote access is available to the new network?
So far in the discussion we have talked about a trusted network as a sin-
gle entity in a company. This is not always true. In a large enterprise or
multinational company, there can be many trusted networks, and each net-
work does not necessarily trust each other. Due to individual country laws
and requirements you may need to isolate your trusted network, and you
may even separate your networks via mini-DMZs. The common term for
this is "zones and perimeters." Security zones define the areas that need to
be protected. Each zone may have different security requirements. The
zones may be within a perimeter area that protects all zones or specific
Now you may be saying, "I don't have a DMZ or a trusted network."
No problem~all that means is that we have a lot of work ahead of us. So
let's move on to the next phase: initial risk analysis and the determination of
whether you need a DMZ or a trusted network.
2.4 Risk analysis
We have reviewed the business and the network. At this stage in the process
we will combine the information we have collected, which will give us a
high-level snapshot of our organization and our network.
Look at each business statement that you created from the "Identify the
Core Business" section. Identify each point where security could be an issue
or a concern.
I Chapter 2
50 2,4 Risk analysis
Perimeter #2
Perimeter #1
Figure 2.3
Example: The Company has been in business for 12 years and has 7000
employees. It has 600 parts distributors to which it sells Widgets. The
Company also has 22 vendors ~hat supply raw materials. The Company has
few direct sales customers. Selling directly to the part distributors generates
the most sales for the Company.
In this example we have several areas of concern.
7000 employees~security training awareness. What are the defini-
tions of trust with each group of employees?
22 vendors~what is the trust level of these vendors? Do the vendors
need to have direct access to the systems on the trusted network?
Parts distributors~how does the company communicate with the
parts distributors? Is encrypted mail used? Are secure web pages

Get Internet Security now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.