Security
When implementing security and access control, administrators must be aligned with the business and security needs of the company. This may be different for each company, depending on the industry and sector in which they operate. A financial institute will have stricter security controls than a small logistics company for example. Key differentiators are the value of the data held and the services provided.
Therefore, it is important for businesses to assess and evaluate their data and infrastructure and build security policies around that. What are the most important data and where are they stored? This can be user data, code, other digital assets, and intellectual property. Who can access these data? What are possible vectors in which these data can be stolen or compromised? What are services that the company provides? Where are these hosted? What are possible vectors in which these servers can be hacked?
In our hypothetical software engineering company, servers and services that store important data are either in the IT lab or Engineering lab. Therefore, these networks have restrictive access.
On another note, company policies might exist about internet access and the type of content that can be accessed. These policies should be considered by type of users and devices that will access the internet.
On the FortiGate, security is managed by customizing security profiles and firewall policies. The next sections demonstrate the recommendations for our hypothetical company.
This section contains the following topics: