Description
The CIO of CTS has become concerned that the current networking environment may not be as secure as it was perceived to have been. To that end, you have been commissioned to undertake a review of the current policy environment and to make specific recommendations for improvements to the policy of the firm as regards the firewall and VPN control systems.
Undertake a complete policy review of the CTS policy suite to summarize the current policy regarding firewalls and VPNs. Save your review as it will be the basis for a report you will assemble. This review must include:
Review current CTS policy to identify all EISP-level policy provisions that touch on the network firewall and VPN subject area
Write a complete review of the current network and VPN policy (from all places including EISP, ISSP, and SysSP) in place now
Write a critique of the current network and VPN policy in place now
Your review and your critique must identify and comment on all policy provisions that touch on the network firewall and VPN subject area
Write a short memorandum. Address the memorandum to the CIO of CTS. In this memorandum, cover
The current state of the VPN connectivity available at CTS
Assessment of how important VPN connectivity is to the future of CTS
Include one paragraph to articulate your current level of technical ability (actual not simulated) in designing, installing, configuring, and using VPN technology.
Submit the memorandum for assessment as a PDF file using assignment “(M01C) Policy Memorandum”
Now, use your policy review prepared above to create a plan to revise the policy environment to fit current needs regarding the firewall and VPN technical realities and anticipated needs. The plan will:
Assume that one new ISSP-level policy document will be created to enable the design and deployment of a coherent firewall and VPN solution
Describe all changes needed in the EISP-level document (you need not re-write the EISP, just identify what needs to be rewritten)
Identify any ISSP-level documents that should be rescinded and that will be replaced by the new ISSP.
Completely describe all changes needed for all of the remaining ISSP-level documents (you need not re-write any of the ISSPs, just identify what needs to be changed)
Fully plan the new ISSP – This plan will include writing the complete ISSP introduction and then writing a fully descriptive and annotated outline for the rest of the new ISSP.
