Suggestions on Comprehensive Security
I just want to throw something at you guys to get some opinions and input. Where I'm working as net admin presently, I'm really wanting to purchase some new toys to harden our security, because I think as it is presently, we're lacking a bit. Problem is, my suggestions keep getting met with "I think that's overkill" from the powers that be. Now, personally, I don't think the words "leading financial advising firm in the region" and "overkill" should ever show up in the same sentence when talking security, but that's just me evidently. Nonetheless, I want to find something that's good enough to get the job done well but cheap enough to not get shot down by the boss.
As said, the company is a leading financial advising firm in this region, multi-million dollar corporation. Several satellite offices between here in Arkansas and Texas. I'm the only IT staff they have.
Every ounce of vital information we have on our clients and company is kept on our network at the corporate headquarters, where I am. The network is roughly 20+ computers running on typically 8 or 9 servers, including a file server, terminal servers, mail server, web server, AV server, and three backup servers.
Two active domain controllers, one as a backup to the other.
Our terminal servers are accessed by all employees, often from the outside (company laptops from hotels, employees' homes, etc.).
We give software to clients that allows them to access their data on our servers from wherever they are.
Mostly wired LAN, plus a US Robotics access point for a few wireless laptops.
So, given all that, here's our current security level:
1) Servers run a T1, workstations on DSL, both lines protected by SOHO3 SonicWALL hardware firewalls.
2) No DMZs.
3) Cayman router (discontinued by manufacturer)
4) CA eTrust antivirus on all desktop/server machines, McAfee on laptops
5) Hard to crack network administrative password. User-level privaledges limited.
6) All desktops are Windows 2000 Pro, servers are Windows 2000 Advanced Server. Laptops are Windows XP Home. No SP2 update yet.
7) Laptops have no additional security beyond McAfee antivirus.
8) Wireless AP has 128-bit encryption enabled. SSID broadcast disabled.
9) Servers are upstairs (in a major traffic area unfortunately) and are password locked at all times.
Personally, I think we should add:
1) An intrusion detection system, or at least --
2) Log monitoring software.
Keep in mind though, I gotta keep it low-price to escape having it dubbed "overkill". Heck, I wanted some under-$300 security cameras thrown up in the sever room and transmitted to my office, but I couldn't get that either. :(
So, please, by all means cut loose and play with the info here, throw any ideas at me you have. If this were your network, what would you do? What products do you suggest? What should I look at beyond a good IDS?