6 of 23

Write now Article Tools

Page 2 of 4

threats. The best strategy to resist external threats is through a "defense in depth" strategy. "Defense in depth" means that you should not depend upon a single security measure, such as a firewall, to protect your network. The best way to get a grasp on the challenge is to remember that every security device and/or software in the world has bugs, and that hackers are just as intent on finding and exploiting those bugs as the manufacturer is about fixing the problem. If a hacker gains access to a single system and if that system is your only security, the hacker has effectively gained access to (and control of) your entire network.

To set up a defense in depth, you should start with a firewall placed between your private network and the internet. This firewall should reject all traffic from the internet except for traffic that you specifically allow to enter, such as e-mail. By arbitrarily rejecting all traffic, you are significantly reducing the ways in which a hacker can attack your network. In addition, you should direct the permitted traffic to an appropriate internal address. This means that incoming e-mail traffic should go directly to your anti-SPAM or e-mail server, rather than going to an arbitrary address that may not have the appropriate port security configured.

Additionally, you should segment any computer that must be accessible from the internet into a separate network. This network is commonly referred to as the "DMZ" and is normally separated from both the internet and the company's private network by a firewall. This will ensure that any external attack must penetrate the security of a minimum of two firewalls and the security of a server in order to compromise the internal network.

One last step to help protect your network is to install a corporate level anti-virus, anti-spyware and anti-spam server in your DMZ. All traffic coming in from the internet, even traffic requested by an internal user, should be routed through these security servers. This is especially true of all e-mail and instant messaging traffic as they permit the easy transmission of file attachments that may include viruses, worms, spyware and/or other malicious applications.

Integrity:

The integrity of information is the second leg of the security triad. Data integrity means to protect information from unauthorized alteration or damage. This threat normally comes from internal sources, and much of it is inadvertent.

One of the greatest threats towards integrity comes through

• << previous page
• 1
• 2
• 3
• 4
• next page >>

Add your voice

Know something about Best practices for network security in small and medium-size businesses?
We want to hear your view. Write now!