Richman Investments: Case Study

Richman Investments “Internal Use Only” Data Classification Standard

Due to the general nature of employees having access to systems, applications, and data depending upon their defined access rights, employees must conform to staff manuals and policies described within this document. The “Internal Use Only” data classification standards at Richman Investments will include the most basic of IT Infrastructure Domains to include User Domain, Workstation Domain, and LAN Domain. This will encompass all users, their computers; i.e. laptops, desktops access to the Internet, company servers and any information in between. Each Domain will ensue the proper roles and tasks, responsibilities, and accountabilities are adhered to as described here
in.
User Domain
The User Domain herein is anyone who has access to the organizational information system. The User Domain will enforce the Acceptable Use Policy (AUP) by ensuring that users who can access system, applications, and data depending upon their defined access rights, to include contractors, or third parties conform to the staff manual and policies defined by the AUP. The AUP defines what users are allowed to do with organizational-owned IT assets. A signature on the AUP will be required by all users; agreeing that they will keep company’s information confidential. Violation of these rules can be grounds for dismissal. All employees to include contractors, or third parties are responsible for their use of the company’s IT assets. Criminal background checks will be conducted on all employees who hold sensitive positions. The department manager or human resources manager will be in charge of verifying an employee’s identity and making sure all users sign and follow the AUP before allowing use of the company’s computer systems.
Workstation Domain The desktop support group is responsible for the Workstation Domain.
The Workstation Domain includes all approved computers on the company network. It requires tight security and access controls due to the fact that this is where most users connect to the IT infrastructure via. desktop, laptop, or any other device that connects to the network i.e., personal data assistant (PDA). Enforcing defined standards is critical to ensuring the integrity of user workstation and data. To prevent unauthorized access to workstations, systems, applications and data, the IT security personnel must safeguard controls with the Workstation Domain.; this can be achieved through constant monitoring. No personal or removable devices of any kind can be used on this network. Downloads of photos, music or other videos via the Internet are strictly prohibited. Only devices issue by the company will be allowed on the network for official use only. Human resources must define proper access controls for workers based on their job. On many occasions users whether knowingly or unknowingly violate the AUP; this creates security risks for the organization’s IT infrastructure. As a prevention measure, Access Control Lists (ACLs) will be drawn up to appropriately define what access each individual will have. IT security personnel will then assign access rights to systems, applications, and data based on this definition. Violations will call for immediate suspension of privileges and the violator will be
subject to company executive decisions and/or the authorities for punitive actions. An organization’s staff should have the access to be productive due to their tasks of configuring hardware, hardening systems and verifying antivirus files. Hardening the system is crucial in the Workstation Domain; ensuring that all computers have the latest software revisions, security patches, and system configurations will elevate desktop or laptop application software vulnerabilities. To access any computer on the network, a user will have to be verified and then setup with the proper account to be logged in with; his or her username and password. The IT desktop manager is accountable for allowing employees the greatest use of their Workstation Domain. The director of IT security is in charge of ensuring that the Workstation conforms to staff manuals and policy in addition to enforcing adherence to the guidelines set forth in the AUP.
LAN Domain The LAN Domain includes both physical network components and logical configuration of services for users; data closets, physical elements on the LAN, as well as authorized personnel.
Authorized personnel will be properly screened for access to the IT infrastructure. Management of physical components include that of the cabling, NIC cards, LAN switches and wireless access points (WAPs). For purposes of this document explanation are given: the workstation cabling will use RJ45 jacks to physical connect to LAN switches; the NIC interfaces between the computer and the LAN physical media; the LAN switch is the device that connects workstations into the physical Ethernet LAN, providing a dedicated Ethernet connection for workstations and servers and the wireless access point; for wireless LANs, a radio transceiver is used to transmit IP packets from a WLAN NIC to a wireless access point (WAP). The logical components of the LAN Domain and their purposes consist of the system administration, which is responsible for setting up user LAN accounts with login ID and password. The design of directory and file services are the servers, directories, and folders to which the user can gain access; configuration of workstation and server TCP/IP software and communication protocols addresses the IP addressing, IP default gateway router, subnet mask address. The default gateway router acts as the entry/exit to the LAN. The subnet mask address defines the IP network number and IP host number.
The design of server disk storage space, backup and recovery of user data; here users will store data files on LAN disk storage areas where data is backed up and archived daily and the design of virtual LANs (VLAN). The LAN Domain needs strong security and access controls. The LAN support group is in charge of the LAN Domain; both the physical components and logical elements. The LAN system administrators must maintain and support departments’ files and print services and configure access controls for users. The LAN will maximize use and integrity of data within the LAN Domain. The director of IT security must ensure that the LAN Domain conforms to policy.

Refences
"Richman Investments "Internal Use Only" Data Classification Standard."