Question

for this activity, imagine you have been tasked with setting up the lan and vlan for a business office. here are the required elements for the network.

• the office has 20 workers with 17 administrative staff and three managers who need higher - level system access.
• the 17 administrative workers all need to be able to connect to printers, and all need to be able to check company email though a dedicated pop3 setup, but they do not need any other external internet access. the three managers need to have some way to access the internet occasionally.
• the lan will be set up through a dsl/cable modem.
• everyone needs to be able to access a database of customer information that has credit card data and order histories, etc.
• one manager needs to be able to access the system remotely.

create a document describing, precisely step - by - step, what actions you would take to set up this secure lan and vlan, including discussions of:

1. how you will configure the firewalls for the software and hardware. include your

ules\/protocols in this section.

1. what security settings you would apply to switches.
2. how you would configure and secure wireless devices.
3. how you would secure the overall lan and dsl/cable modem connection.
4. how you would secure any servers related to this setup.
5. what tools you would recommend for monitoring ports and network traffic (according to your own research). you must go beyond simply listing tools and defend your choices.
6. what os and ips you will include (per your own research).
7. what you will include to accommodate the manager who needs remote access.

to ensure full credit for this assignment, you must be explicit in your steps. for example, rather than saying “change the router’s password”, you could say “i would a new password for the router using xyz software so that the password is secure.”
you may consult any amount of independent research to enhance your plan, but all of the items mentioned above must be addressed in your work (with research for items 6 and 7 being mandatory).

Explanation:

The problem requires designing a secure LAN/VLAN for a business office, covering firewall configuration, switch security, wireless device protection, modem security, server security, monitoring tools, OS/BIOS settings, and remote access. Below is a structured step-by-step plan:

1. Firewall Configuration: Use a hardware firewall (e.g., Cisco ASA) and software firewalls (Windows Defender Firewall) to segment traffic. Hardware firewall rules: allow admin staff only to printers/POP3 (block external internet); allow managers to internet (restrict to trusted sites); allow all to customer database (with IP whitelisting). Software firewall rules: enforce inbound/outbound restrictions per user role.
2. Switch Security Settings: Enable port security (limit MAC addresses per port); disable unused ports; enable 802.1X authentication; create VLANs (Admin VLAN for staff, Manager VLAN for managers, Database VLAN for the customer DB); configure trunking with 802.1Q and disable DTP.
3. Wireless Device Security: Use WPA3-Enterprise encryption; enable RADIUS authentication; disable SSID broadcast; set up a guest network (isolated from internal VLANs); enable MAC filtering for wireless access.
4. LAN and Modem Security: Change default modem credentials; enable modem firewall; disable UPnP; use static IPs for critical devices (database server, printers); segment LAN via VLANs to isolate sensitive traffic.
5. Server Security: Harden the database server (disable unnecessary services, apply patches); use encryption (AES-256) for customer data; implement role-based access control (RBAC) for the database; enable server firewalls to allow only authorized IPs.
6. Monitoring Tools: Deploy SIEM (e.g., Splunk) to log traffic; use IDS/IPS (e.g., Snort) to detect anomalies; implement network traffic analysis (NTA) tools to monitor VLAN traffic; set up alerts for unauthorized access attempts.
7. OS and BIOS Settings: OS: Enable full disk encryption (BitLocker); disable auto-run; enforce strong password policies (12+ characters, MFA). BIOS: Set a BIOS password; disable booting from external media; enable secure boot.
8. Remote Access for Manager: Use a VPN (e.g., OpenVPN) with 256-bit encryption; require MFA (e.g., Google Authenticator); restrict remote access to the manager’s static IP; log all remote sessions.

Answer:

A structured step-by-step plan for setting up the secure LAN/VLAN as outlined above.