The fitness club was unsure whether the Web server hacking took place because of the former administrator, who quit under less than amenable circumstances, or if an external party had found their "Achilles heel." The perpetrator was able to access the corporate Web server by using the remote login of the Microsoft Windows network administrator. Once the hack was realized, the administrator was forced to shut down the connections to all their 129 franchisees that needed access to the corporate Web server. The franchisees require access to the Web server to review their customers’ personal information, fitness progress, and goals as well as to share information with the corporate headquarters in a secure manner. Members and club staff also make periodic payments for dues and services using this system, including credit card payments. Your company has been engaged to provide a cost-effective solution that would allow the new administrator to do the following:
Control access to resources by preventing unauthorized users from logging in to privileged areas.
Audit and review user activities to prevent future hacks that could compromise network integrity.
Change the existing system to strengthen it as necessary.
Add technology, as necessary, to detect security breaches.
To be able to develop a cost-effective solution, your company must focus on developing a reasonable and cost-effective testing plan to identify any weaknesses in the network.
Develop a comprehensive and ongoing vulnerability and penetration test plan. Include solutions in the test plan for unauthorized access in the corporate workstations, application servers, mail and Web servers, and wireless routers.
Reflection
What are your thoughts about your results? What are you feelings towards this assignment? How would you improve it?