I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and web access needs. They also have their own web server which hosts a simple informational website.
The current architecture, set up five years ago by a local technician, is pretty simple:
Having no previous experience with deploying IPS/IDS or firewalls, I wanted to ask this forum to comment on the following ideas.
- Between the WAN link and the current router: I can get a used, working Cisco ASA 5510 for almost nothing. It's an old model but - probably - could do the trick here. Otherwise, I was thinking of a dedicated pfSense Linux machine with three NICs. Two will route the traffic, and a third can be used as a network tap when needed.
- Port mirror on the switch and use Snort or Suricata as an IDS, with alerts going to an outside consultant (me or anyone else).
- The Windows machines are connected using a 2008 R2 running Active Directory. In its current form, AD is only used to control user access to the desktops, shared folders, and printers. I was going to implement basic security-related group policies to further restrict access on a as-needed basis.
EDIT: There shouldn't be any intra-VLAN traffic. Currently, no ports are set to negotiate trunks and they don't use the native VLANs.
Any comments or suggestions are appreciated. Thank you.