Case Study

SCENARIO

ESSENCE OF THE CASE

Following are the essential elements in this case:

• Upload sensitive data over the Internet.

• Allow clients to securely access their own data over the Web.

• Secure data from start to finish.

Rockwell Financial Services is a company that deals in all aspects of financial management and investments. It has agents throughout North America that represent various firms for insurance and investments.

These agents use Windows XP Professional on their laptops. From the client's site, agents use the laptop to enter the investment information, and then they commute back to the their respective networks and transfer the data to their local SQL Server, which is then transferred to a centralized SQL Server in Chicago.

The company realizes the need for the security of this data, and this is why the agents currently must return to the office to transfer their information. However, the agents are complaining that they are losing valuable time that could be used to visit other clients, and in some cases, sales are lost because the market may fluctuate and opportunities are missed.

Rockwell Financial Services would like to implement a plan that would allow its agents to use the Internet to connect to the central SQL Server and upload the data through a Web interface ”while securing data. In addition, the company would like to offer services to its clients that would allow the clients to access their account information online.

ANALYSIS

Rockwell Financial Services should install Certificate Services. A hierarchy of CA could start in the central office in Chicago and then be dispersed to a child CA in each geographical location.

Sales reps would be issued a certificate from the local CA. A Web presence with a sales front and a SQL interface would be created to support secure uploads of clients' data over the Internet. In addition, a plan could be developed to secure any data the sales reps saved on their laptops through smart cards or through EFS implementation.

A Web presence would be created for clients accessing their personal data. A certificate would be issued by a CA that would verify that the clients have access to only their data.