Implementing Quarantine Services with Microsoft Virtual Private Network Planning Guide
Chapter 3 - Issues and Requirements
On This Page
IntroductionUsing virtual private network (VPN) quarantine to help secure remote access requires that an organization implement several technologies that must integrate smoothly and operate reliably as a single unit. To achieve success, an organization must clearly understand the underlying issues and requirements of each technology, and of how it interacts with the other technologies. This chapter analyzes the solution scenario for Woodgrove National Bank, and the issues surrounding the Woodgrove National Bank solution. Chapter 4, "Design the Solution," then incorporates this blueprint into an acceptable solution to those requirements. The Woodgrove National Bank ScenarioWoodgrove National Bank is a fictional global investment bank that serves institutional, corporate, government, and individual clients in its role as a financial intermediary. Its business includes securities underwriting, sales, trading, financial advisory services, investment research, venture capital, and brokerage services for financial institutions. Woodgrove National Bank is a fully owned subsidiary of WG Holding Company. WG Holding Company is a leading global financial services company headquartered in London, England. WG owns five companies: Woodgrove National Bank, NorthWind Trading, Contoso, Ltd., Litware Financials, and Humongous Insurance. All of these companies are large corporations, each employing more than 5,000 users. Geographical ProfileWoodgrove National Bank employs more than 15,000 people in more than 60 offices worldwide. They have corporate headquarters (hub locations) that have large numbers of employees in New York (5,000 employees), London (5,200 employees), and Tokyo (500 employees). Each hub location supports several offices. For each region served by corporate headquarters, there are a number of small secondary sites (for example, Boston and Atlanta in North America). In addition to the hub locations there are two other primary corporate locations, Sydney and Johannesburg, each of which has its own dedicated file, print, and application servers. IT Organization ProfileAlthough Woodgrove National Bank has a mixed server environment with Microsoft® Windows® and UNIX, their infrastructure runs on a Windows Server backbone. The majority of servers are located in the three corporate headquarter locations at New York, London, and Tokyo. The following figure shows the layout of the corporate locations and the links between them. Woodgrove National Bank currently uses a variety of Microsoft products and technologies for intranet and extranet services. Woodgrove National Bank uses a Windows 2000 Active Directory® directory service infrastructure, and is in the process of upgrading all domain controllers to Microsoft Windows Server™ 2003. Woodgrove has no legacy client computers; all desktop and laptop computers run Windows 2000 Professional with Service Pack 4 (SP4) or later, or Windows XP Professional with SP2 or later operating systems. The Woodgrove National Bank IT department has extensive experience with Windows Server 2003. Cope with Regulatory RequirementsWoodgrove National Bank must operate within the requirements of the relevant financial regulatory frameworks for each country/region in which it operates. It must also comply with all applicable data protection legislation and demonstrate effective operational security. Provide Secure Access to Remote WorkersWoodgrove National Bank provides remote access to the corporate network for sales staff, IT support workers, and corporate executives. The current remote access solution employs dial-in networking through private circuits to dedicated remote access servers that have modems or Integrated Services Digital Network (ISDN) adapters. These connections are slow and expensive when compared to broadband, particularly for remote users traveling overseas. The increasing availability of broadband Internet access allows organizations to use VPN for remote access scenarios. Although this approach provides savings by eliminating dial-up access and provides a better user experience, the vulnerability to malicious attack increases as proprietary data traverses the Internet. Comply with Regulatory RequirementsAs a financial institution, Woodgrove Bank must comply with strict legal requirements in various countries/regions. The bank must also maintain customer confidence by protecting corporate and customer assets. Woodgrove Bank has implemented a secure computer initiative and has set strict security polices on all computers that access the company network, both on the LAN and through remote connections. Check Software UpdatesWith the existing remote access solution, it is difficult to ensure that remote computers have the latest security updates and updates for applications and operating systems. The Woodgrove National Bank IT department has been unable to prevent access by unauthorized computers that use out-of-date antivirus programs or that have active viruses and might infect the network. This weakness can put the corporate network at risk and has forced Woodgrove National Bank to restrict connectivity to a small number of users. The Woodgrove IT department must overcome these challenges and provide a secure reliable service that benefits remote workers, but does not put the corporate network at risk. The remainder of this document refers to the planning factors and choices that Woodgrove National Bank faced as it addressed the issues of implementing VPN quarantine. Implement VPN Access for TelecommutersLike many organizations, Woodgrove National Bank has found that many executives and account managers are more productive if they can work from home at least one day a week. For example, account managers can write proposals, plan meetings, and modify customer contact information while they are out of the office. Woodgrove National Bank wants to extend the work-from-home option to other divisions and departments, but is concerned about the risks of allowing computers the do not meet the Woodgrove IT department compliance to connect to the corporate network. Therefore, Woodgrove IT only allows employees that have domain-joined computers to connect from remote locations. Business IssuesThe team that plans the implementation of VPN access for telecommuters has identified the following issues:
Technical IssuesThe planning and the initial pilot phases identified the following technical problems:
Security IssuesThe following issues affect the security strategy for the Woodgrove National Bank implementation of VPN quarantine:
Solution RequirementsThe solution that Woodgrove National Bank implements for VPN quarantine must satisfy the following requirements:
With these objectives in place, Woodgrove National Bank extensively researched and examined their design options. Chapter 4, "Design the Solution," presents the results of this research. Use Microsoft Operations FrameworkWoodgrove National Bank uses Microsoft Operations Framework (MOF) principles to manage and implement change within the company's network. MOF provides a collection of best practices, principles, and models that provide guidance for achieving high availability, reliability, and security. The two main areas that MOF affects are change management and operations. For more information about MOF, see the Microsoft Operations Framework Web site on TechNet, at www.microsoft.com/technet/itsolutions/cits/mo/mof/default.mspx. Implement Change ManagementThe system architects at Woodgrove National Bank appreciate that any project of this size needs effective planning and management. A management steering committee must oversee the budget, schedules, solution component development, and provide final approval for each phase of the project. The Woodgrove National Bank IT department understands the need to test the solution and implement pilot deployments prior to deployment in the production environment. Woodgrove operates in a global environment and realizes the need to adhere to specific processes for scheduling changes and providing clear communication to management, users, and help desk personnel. To ensure a smooth rollout of VPN quarantine, Woodgrove National Bank plans to set up virtual teams around the world. These teams must work closely to design, develop, and test the design and technologies in differing scenarios. These teams can then work to schedule, communicate, and manage changes to the remote access environment during deployment. In addition, the Woodgrove IT department must work with the operations support teams to schedule changes, usually based on the local time that would have the smallest effect on users or business units. In most remote access scenarios, the best time to make major changes is during business hours of 9 A.M. to 5 P.M. Monday to Friday, because most remote access connections occur outside these times. However, with the increased use of remote access to support business strategy during core business hours at Woodgrove National Bank, this is not always the case. Hence, effective analysis on a location-by-location basis is required to ensure that changes have minimal effects on operations. Monitor OperationsWoodgrove National Bank has a monitoring and alerting framework in place throughout its enterprise network that uses Microsoft Operations Manager (MOM) 2005. Woodgrove IT must extend this framework to cover the deployment of remote access solutions. Before you can monitor VPN quarantine, you must install the Routing and Remote Access Service Management Pack for MOM, available at www.microsoft.com/downloads/details.aspx?FamilyId=D1005486-2EEB-44A5-8196-5D4EB24F6EA0&displaylang=en. To pinpoint trouble areas during deployments, Woodgrove National Bank uses data collection and analysis methods. Woodgrove National Bank IT uses a key process element that is useful in helping to manage service health. This element consists of a remote access dashboard (a suite of visual gauges) that monitors live data. The dashboard can capture, plot, and highlight single user incidents that indicate connectivity issues. Data collection and analysis are critical to the management of services during any major changes and in the service management functions. By combining collected data and reports with help desk data, the Woodgrove National Bank IT department can determine the overall health of a service with a high degree of confidence at any given time. Operations teams can use this data to review any service-affecting event, correlate the effects to the service, and build proactive response plans and future predictability for the service. Recording this data is extremely valuable, whether to measure daily use or to identify long-term trends. The Woodgrove IT operations support teams use Microsoft SQL Server™ 2000 and On-Line Analytical Processing (OLAP) to generate reports to track, measure, and quickly analyze:
This monitoring and operations framework provides Woodgrove National Bank with a suitable environment to implement the VPN quarantine solution. The final chapter in this guide describes how Woodgrove National Bank planned the implementation of VPN quarantine and the decisions they took before the rollout process.
|
In This Article
|
