Is3440 Project Part 1
Project: Project Part 1: Executive Summary
First World Savings and Loan is a financial institution that processes credit card transactions and loan applications online. We are currently considering implementing an open source infrastructure. This could potentially save us over $4,000,000 per year in licensing fees for the software we are currently using. However, due to our business needs; we must still comply with the Sarbanes-Oxley Act (SOX), Payment Card Industry - Data Security Standard (PCI-DSS), and the Gramm-Leach-Bliley Act (GLBA). We must comply with SOX, because we are a publicly-traded financial institution; PCI-DSS, because we process online credit card transactions; and GLBA, because we are a financial institution. All of the regulations of these three compliancy laws must be met, while still maintaining the Confidentiality, Integrity, and Availability (CIA) triad.
All security requirements for SOX, PCI-DSS, and GLBA can be achieved using Linux and open source infrastructure. Some examples of open source software that we might use are:
Web Server - Apache Web Filtering - DansGuardian Network Firewall - Turtle Firewall VPN - Endian Firewall Community IDS/IPS - Suricata Database - MySQL File Server - Samba SMTP Server - hMailServer
I would recommend that we use a "Defense in Depth" strategy, having multiple layers of access protection. We need to have an IDS/IPS on both sides of our edge firewall. The inside IDS/IPS will be used as additional protection for our network and the outside IDS/IPS will serve as an early warning system from attacks. We will also use the outside IDS/IPS for additional protection and to monitor what types of attacks are occurring. Our web server and mail server should be completely separated from the rest of our network in a de-militarized zone (DMZ). We need to have a network firewall between our DMZ and our internal network, between the outside world and our internal network, and between our DMZ and the outside world.
First World Savings and Loan is a financial institution that processes credit card transactions and loan applications online. We are currently considering implementing an open source infrastructure. This could potentially save us over $4,000,000 per year in licensing fees for the software we are currently using. However, due to our business needs; we must still comply with the Sarbanes-Oxley Act (SOX), Payment Card Industry - Data Security Standard (PCI-DSS), and the Gramm-Leach-Bliley Act (GLBA). We must comply with SOX, because we are a publicly-traded financial institution; PCI-DSS, because we process online credit card transactions; and GLBA, because we are a financial institution. All of the regulations of these three compliancy laws must be met, while still maintaining the Confidentiality, Integrity, and Availability (CIA) triad.
All security requirements for SOX, PCI-DSS, and GLBA can be achieved using Linux and open source infrastructure. Some examples of open source software that we might use are:
Web Server - Apache Web Filtering - DansGuardian Network Firewall - Turtle Firewall VPN - Endian Firewall Community IDS/IPS - Suricata Database - MySQL File Server - Samba SMTP Server - hMailServer
I would recommend that we use a "Defense in Depth" strategy, having multiple layers of access protection. We need to have an IDS/IPS on both sides of our edge firewall. The inside IDS/IPS will be used as additional protection for our network and the outside IDS/IPS will serve as an early warning system from attacks. We will also use the outside IDS/IPS for additional protection and to monitor what types of attacks are occurring. Our web server and mail server should be completely separated from the rest of our network in a de-militarized zone (DMZ). We need to have a network firewall between our DMZ and our internal network, between the outside world and our internal network, and between our DMZ and the outside world.