Comment from email: RFC IT Modernization

Concerning IT Modernization Part 1 of 6

After reading some of the stuff I sent earlier I think it may be too confusing for a nontechnical reader and too disorganized for a technical reader so here is a more organized simplification of some of what I thought was already simplified.

Here are some better graphics to help explain network compartmentation with edge cloud connections:

Simplified White House Compartment Overview
https://drive.google.com/file/d/0Byv_cnSQFHsmSlpWSHVPbXpJWVk/view?usp=sharing

Simplified Treasury Network Compartment Overview
https://drive.google.com/file/d/0Byv_cnSQFHsmQmlYRHdqdUJNNzA/view?usp=sharing

Simplified Judicial Network Compartment
https://drive.google.com/file/d/0Byv_cnSQFHsmYVNSRUZiYzVVQ3M/view?usp=sharing

Simplified Defense Network Compartment (an Einstein Source)
https://drive.google.com/file/d/0Byv_cnSQFHsmR0dhdGptWWtaOTQ/view?usp=sharing

Simplified USA Overview 1st Option
https://drive.google.com/file/d/0Byv_cnSQFHsmWVFrMGVpaHNMYmc/view?usp=sharing

Simplified USA Overview 2nd Option
https://drive.google.com/file/d/0Byv_cnSQFHsmLVJHQWVYMUtQOWc/view?usp=sharing

Sample Compartment Overview
https://drive.google.com/file/d/0Byv_cnSQFHsmS2xlZlhLamREcVU/view?usp=sharing

Simplified OOBM / IPMI Overview
https://drive.google.com/file/d/0Byv_cnSQFHsmQnZpS2J2Wl9rNTQ/view?usp=sharing

Simplified Partial White House Layered Detail
https://drive.google.com/file/d/0Byv_cnSQFHsmREtSQzFaTGJJUVU/view?usp=sharing

Simplified Partial White House Connection Detail
https://drive.google.com/file/d/0Byv_cnSQFHsmVWpaOEVZUHVnV3c/view?usp=sharing


Reasons & Process After a Network Breach

Always Use Layered Security
Reason for Multiple Layers of Security
Preventative
Each Layer must be breached for a hack to be completely successful
When / If Breached
Each Layer has some degree of monitoring and measurement
When any layer is breached alerts should start a process to:
Identify the breach
Isolate to protect each layer as needed
Locate and Detect, if any penetration is still on the network
If So, Remove the Threat or Otherwise Respond to the Threat
Repair any Damage the Threat Caused

Don't Forget to Finish
Follow Through - Be Active Start An Investigation
Reason
to restrict or eliminate any future threat from the same source
To this breached network
To other networks
to discourage Future Intrusion attempts
Locate and Report
Report Source to Source Network Authority for action
Report Source to Einstein
to actively blacklist confirmed hackers
to improve Einstein's Intelligence
Report to Cyber Police Force
Investigate, arrest & prosecute when in jurisdiction
Actively work with foreign entities to stop hacking from foreign soil
Actively follow protected foreign hackers for travel outside of protected region
Log Actions Reported and Actions Taken
Build a Record of Bad Actors
Build a Record of Poor Responding Source Network Authorities
Litigate, Isolate or Block Source

Setting up Security Layers

Cloud Networks Perimeters
Compartment Network Edge Cloud Networks
The Larger the Cloud the more likely an internal hack will be attempted
The Semi Private Perimeter cloud adds layered threat security at Internet Connection
Edge clouds add a communication layer to any connected compartment networks
Each Compartment Network has dedicated Threat Management between it and its edge clouds
Each Compartment Network can communicate to others according to a user’s Authorization Level across its edge clouds
IT or Semi-Private Cloud Network is Internet Connected
Monitored by Cloud Administrators
Monitored by Semi-Private Einstein 2 Cloud
OT or Private Cloud Network is Isolated from the Internet (Not Connected)
Monitored by Cloud Administrators
Monitored by Private Einstein 1 Cloud

Compartment Networks Perimeter
On Each Compartment Network
Semi Private Side
1. UTM Between Compartment and Cloud
UTM Monitored with an Einstein or Watson cloud
UTM Includes
Multiple Interfaces and Routing Capable
Network Services
Network Protection
Web Protection
Mail Protection
Advanced Protection
Endpoint Protection
Wireless Protection
Management for Remote network Ties
Site to Site VPN
Remote Access
Logging & Reporting
And Such as to Manage it
2. On Each Workstation and Server
Antivirus
Exploit Protection
Web Protection
Custom Firewall
Tamper Protection
Private Side
1. UTM Between Compartment and Cloud
UTM Monitored with an Einstein or Watson cloud
2. On Each Workstation and Server
(Note If Operations includes Control Networks then it will have some limitations. Generally Control Manufacturers are behind the curve.)
Antivirus
Exploit Protection
Web Protection
Custom Firewall
Tamper Protection

Compartment Network Organization
Each network should be separated into sub networks categories ie:
Data network
Communication network
Peripheral Security Network
IT Development network
Secure Wireless networks
IT network
Mobile network
Guest network
DMZ (Demilitarized Zone) network
High visibility and most vulnerable servers
ie Web Servers (Apache, IIS, Etc)
FTP Servers
Mail Servers
Honeypot network
Use the Honey Pot (Fake Networks) as a Reverse Trojan Horse:
To attract intruders as a diversion,
A way to track catch intruders,
A way to teach security to novice administrators
To implement other measures to discourage hacks.
Isolated Private Networks
1. IT Maintenance / Monitoring Network
A connection to an OOBM (Out Of Bank Management) Port on each switch
Management of Switches
Monitoring of all Switch Ports
A connection to an IPMI (Intelligent Platform Management Interface) port on each Workstation
Monitoring of individual Workstations
Use Monitoring software
(ie Solar Winds NTA (Network Traffic Analyzer)
Requires a SQL Server,
Solar Winds,
Runtime SQL Server,
IIS (Internet Information Server (Web Server)), and
At least 1 Workstation for Monitoring
watch the network traffic across all switch ports
Associate switch each port to a specific workstation
Feed logs to Einstein and Database via One Way Connection
2. OT Operational or Private Network
This network is isolated from all other networks
Exception to isolation
Oneway communication to other networks (not from)
Threat management connection to Operational or Private Cloud
The Private Network should have a separate OOBM/IPMI Monitoring similar to the semi-private side.

In Each Network Compartment
Network Threat Protection (Semi Private)
Each Network Compartment connects to a Threat Protection Appliance (Universal Threat Management (UTM))
All network compartments sub networks connect to different ports on one appliance
Each Threat Protection Appliance will then connect to the WAN (Semi-Private Cloud)
Each Network Compartment connects to an appliance for Threat Protection which connects to a WAN (Semi-Private Cloud)
Each Semi-Private Network Cloud connects to an appliance for Threat Protection
Compartment to Cloud
Cloud to Internet
Network Threat Protection (Private)
Each Network Compartment connect to a Threat Protection Appliance (Universal Threat Management (UTM))
All network compartments sub networks connect to different ports on one appliance
Each Threat Protection Appliance will then connect the to Private WAN (Private Cloud)
Each Network Compartment connects to an appliance for Threat Protection which connects to a Private WAN (Private Cloud)
Each Private Network Cloud connects to an appliance for Threat Protection
Compartment to Private Cloud
Private Cloud Does Not Connect to the Internet
Servers, Appliances, Workstations
Set All Server Logging to feed a security database
For efficient security Information retrieval and analysis
For efficient security information comparison to other servers/appliances/workstations
Set All Appliance Logs to feed a security database
For efficient security Information retrieval
For efficient security information comparison to other servers or appliances
All Database Information is analyzed by:
Network Administrators
Einstein Security Cloud

Servers, Appliances, Workstations
Add Protection with a central control
Antivirus
Web Security
Exploit Security
Firewall
Tamper Protection
Malware Security

Other Security Factors
Einstein
If Einstein can guard against intrusion it can:
Einstein Can:
1) Do Intrusion testing on each Network Security Changes, Each Network Addition, and any Security Policy Changes.
2) Compare my security model up against your proposed draft model
a) Show the president the strengths and weaknesses of each in terms a nontechnical person can understand.
b) Compare costs both short and long term (My model will cost more short term and probably less long term)
c) Compare Time to Implement (My security model will take longer to build and implement)
d) Give short term and long term goals and methods to securing the networks short term and long term.
e) Help everyone across these United States and not just the Government if it can be made cheap enough.
(Note: IBM has a history of price gouging and manipulating when their technology becomes obsolete)
f) Etc., Etc., Etc, Our imagination as to what is needed is the l
3) Work to each administrators strengths and understand and help them with their weaknesses.
4) Train network users to be responsible.
5) Can help with isolating protocols to only those that are needed on any network.

With something like Einstein available most likely you folks and I are 'spinning our wheels' because Einstein can probably come up with the solution with the highest probability of success. What is wrong with me that causes my guts to stir and me to really not like what I just said?

David Pinkston