Not only must a security plan meet business requirements, but it also must meet any technical requirements that an organization defines.
After this lesson, you will be able to
- Identify technical requirements that will affect your security design
Estimated lesson time: 30 minutes
Determining Technical Requirements
Technical requirements serve as constraints in your security plan. When you develop your security plan, you must make sure that your solution meets all the technical requirements.
Technical requirements that can affect your security plan include
- Total size and distribution of resources. The size and distribution of users and computers will determine how security must be defined for an organization. The distribution will help you to define Active Directory sites, domains, and OUs based on your organization's security requirements.
- Performance considerations. Implementing encryption technologies in a network will result in performance costs. Before defining a security plan, an organization must define what is acceptable performance for common tasks that will be performed on the network. For example, an organization might define that for a database application, queries that return fewer than 100 records in the solution set must be returned within 2 seconds of the query being submitted. The security design must ensure that any security solutions to protect the database application, such as using Internet Protocol Security (IPSec) to protect the submitted query and the returned dataset, still fall within acceptable performance requirements.
- Wide Area Network links. Your security plan must evaluate how remote offices are connected to the corporate office. You must determine whether dedicated network links exist or whether to use virtual networking by using tunneling protocols such as Point to Point Tunneling Protocol (PPTP) or Layer 2 Tunneling Protocol (L2TP) with IPSec. Your security plan must determine what level of encryption is required for WAN links. It also must determine whether the tunneling protocol (if selected) is supported by any third-party products in use, such as a Cisco router.
- Wide Area Network usage. Your network security design may include branch offices or remote offices that are connected to the corporate head office with WAN links. If links exist, your network security plan must consider their current utilization. Don't fall into the trap of simply identifying the speed of the WAN links. For example, you may have a 512 Kbps fractional-T1 link to a branch office and a 128 K ISDN link to another office. At first glance, you might assume that there is more available bandwidth to the first branch office. Only after analyzing current usage can you verify this assumption.
- How data is accessed. Your network security plan must identify how data is accessed on the network. This must include which protocols, applications, users, and computers are used to access the data. By identifying these components of data access, you can define your security plan to overcome any existing security weaknesses and ensure that security is maintained as data is accessed.
- Administrative structure. Identifying who runs the network and where administration takes place will help you design a Windows 2000 network that meets your needs. Determining the administrative structure will lead you to the best Active Directory structure for an organization and administrative group memberships. The administrative structure will also help you design your delegation of administration strategy for managing objects in Active Directory and network resources.
- Current application base. Windows 2000 introduces a stronger base security for computers. This stronger base security isn't always compatible with older versions of applications. If you identify any applications that may not work in a Windows 2000 network, your security plan can include any necessary upgrades or updates that must be applied to the applications before the migration can take place. The security plan must contain all required testing and proposed solutions for the migration to a Windows 2000–compatible version of the application.
Making the Decision
To plan for technical requirements, first you have to gather the technical requirements that affect your organization. Once you define these requirements, you'll have the performance guidelines that you need to meet. Remember that the implementation of security within a network does have a cost. Most often this cost is a loss of productivity or performance. The organization must always determine what is an acceptable cost before implementing the security design.
When planning for technical requirements, you should consider the points laid out in Table 1.2.
Table 1.2 Applying Technical Requirements to Your Security Design
|If the Organization ||Determine the Following for Your Security Plan |
|Is spread across many physical sites ||Whether logon performance requirements will be the same for central and branch offices. |
Determine all physical sites for defining your Active Directory sites.
Determine placement of network services to meet performance requirements.
|Has performance requirements ||Develop physically measurable numbers for requirements. For example, a logon attempt must take place within a 5-second window. |
Test performance using a network that emulates the production environment. This must include all additional services that are running in the production network. Time trials performed in a network that don't mirror the production network aren't useful.
|Has existing WAN links ||Determine what applications currently use the WAN links. |
Identify each application's current bandwidth usage.
Determine if the introduction of Active Directory replication and WAN usage can be handled using the currently available bandwidth.
|Has a current administrative structure in place ||Design Active Directory to mirror the current administrative structure. If the organization uses centralized management, restrict access to the Domain Admins group. If it's decentralized, design an OU structure that supports delegation of administration. |
|Has a current application ||Test all applications to determine compatibility of the applications in a Windows 2000 environment. Identify whether the applications are supported, require an update, or will prevent an upgrade to Windows 2000. |
Applying the Decision
Lucerne Publishing's security design must meet the following technical requirements:
- Logon performance. The Caracas site is connected to the corporate network by a 256K WAN link that's currently 80 percent utilized. Remote sales force personnel are complaining about authentication speed when they connect over the WAN. Logon performance gains can only be increased by locating DNS services, a domain controller, and a global catalog server at the Caracas site to prevent transmission of data to the Denver office. This will increase the amount of replication traffic on the link. The WAN link must be monitored to determine if additional bandwidth ultimately will be required.
- Site definitions. To ensure that only local network services satisfy network requests, Lucerne Publishing must define Active Directory sites that map to their physical network topology. They must define a site for each physical location of the network and map the subnet address for that location to the site name. This will ensure that clients can find a local network service instead of sending requests across the WAN. Table 1.3 shows one potential site configuration.
Table 1.3 Proposed Site Configuration for Lucerne Publishing
|Site Name ||Location ||Subnet IP Address |
|Tokyo ||Tokyo, Japan ||172.16.0.0/22 |
|Denver ||Denver, Colorado ||172.16.4.0/22 |
|Moscow ||Moscow, Russia ||172.16.8.0/22 |
|Brisbane ||Brisbane, Australia ||172.16.12.0/22 |
|Casablanca ||Casablanca, Morocco ||172.16.16.0/22 |
|Caracas ||Caracas, Venezuela ||172.16.20.0/22 |
- Server placement. To ensure that authentication takes place locally, each site should have at least one DNS server, one domain controller for each domain that users and computers will require for authentication, and one global catalog server. For redundancy, it would be wise to include two of each category in the event of failure.
- Other performance requirements. The planned expansion of Lucerne Publishing to include multiple distribution centers in Europe and North America will require the establishment of additional WAN links and site definitions. These distribution centers will require that local domain controllers and global catalog servers also be established to ensure local authentication.
- Current administrative structure. The Active Directory design for Lucerne Publishing must ensure that it reflects the current administrative structures. The Active Directory design that you select must allow for centralized user account management and decentralized server management. Lucerne Publishing must manage membership of the Domain Admins, Enterprise Admins, Administrators, and Account Operators groups to ensure centralized management of all user accounts. Likewise, membership in the Server Operators groups will allow decentralized management of servers.
As with business requirements, you need to determine all technical requirements that will affect the design of your security plan. Technical requirements will give you measurable criteria that your security plan must meet.
When you gather technical requirements, make sure that each one is measurable so that you can test the security plan to ensure that it meets those requirements. Also make sure that testing takes place in a lab environment that emulates the production network. The lab environment must match current network usage so that the result that you get will reflect actual performance results when they're deployed in the production network.