I have a network that has a single point of entry the WAN. The WAN exposes about 10 static IP's that resolve internally to servers that are in the same subnet. Meaning that if you RDP over 3389 to SQLPrimary1 from it you can RDP to all the other devices on the network. Each server has it's firewall disabled. There is no IPS, IDS, SPI nothing. We are however running Microsoft Security Essentials on all servers (FWIW). :sigh:
I need to implement a strategy for protecting the network from inbound threats, outbound threats, zero-day threats, patch vulnerabilities and good heuristics.
If I run IDS I need it to have all traffic run through the firewall directly into my IDS (Security Onion on Linux) and then back to my network. Right?
- If I run Security Onion non-stop will it add noticeable latency on my network? I think at present we are utilizing about 2% of our network. Is and IDS system something you run full-time?
Are V-LANS secure? Meaning if I isolate my mission critcal stuff on one VLAN and other resources on other VLAN's is that safest? If not how else could I partition my network so that mission critical data is still safe from beta, web servers and such? Would you use multiple firewalls? What would be the best practice?
We have customers in all 48 states and the U.K. and each of them must connect to our data and web servers. I'd like to impose VPN connections on our customers but I'm wondering:
- Is that overkill?
- If not would VPN clients licensed from my firewall vendor be more secure and/or efficient than Microsoft's own VPN software?
- Would VPN create tons of overhead and congestion?
I have to monitor 2 server datacenters that depend on each other. We have one in the UK and one in the US. I think the easiest way to make sure both datacenters have internet connections is by establishing site-to-site VPN tunnels between US and UK.
- Is that an effective way to monitor connectivity at each site or would something else me more effective?
If anyone remembers the "ILOVEYOU" virus that crushed SQL servers around 2000/2001 or so. Would anti-virus software of current quality be able to stop that kind of attack? Are attacks like that relevant anymore with IPS and SPI firewalls.
- When it comes to anti-virus on database servers real-time protection is a great way to go because it doesn't lock .mdf and .ldf files. Would it be wise to schedule downtimes to unmount .mdf/.ldf and full-text indexes to physically scan them for viruses using AV software?
Are there any open source tools that you can use to run your own penetration tests and get a list of action items along with the results?
We are a total windows shop and I'd love to hear some others thoughts and ideas on how to approach these issues.