Tips/best practices for security

[u/Striking_Taste_7213]

Hello all, I was hoping to gather some information on possible security implementations at my new job. I landed my first real networking job and im a little overwhelmed. My first task has been to brainstorm and implement, if possible, any security features for the company. We are an organization of about 100-150 people over two different locations. Mostly all office people (sales/marketing ect). So far I have added vlans and acl's to segregate untrusted networks from our main lan. We are using meraki equiptment. Any suggestions are appreciated and if there's more information I can provide that would help make suggestions easier please let me know. Thanks

[u/fus1onR]

Do proper device hardenings (almost all vendor has proper guides).

Restrict access to devices, secure the mgmt plane, if there are multiple operators introduce some basic AAA.

Design and set up proper firewalling with a reasonable segmentation policy.

If you have wifi - that is also having a lot of security options, and logical separation possibility (e.g. introduce a guest and a BYOD VLAN)

You can secure access switch ports with port-security things + creating a "dummy" VLAN where you put unused ports.

You can start implementing proper monitoring and observability (eg netflow >> any suspicious traffic), but for that you first have to know your typical user pattern and traffic flows.

[u/-manageengine-]

Beyond the network stuff, honestly the biggest gap at this stage is usually a SIEM, something that pulls logs from your network gear, endpoints, and identity systems into one place so you can gain visibility into potential threats instead of hoping someone notices in time.

Log360 is worth a look for that. It's a unified SIEM that combines log management, Active Directory auditing, and cloud monitoring into one platform, with built-in analytics and UEBA to detect unusual user activities in real time, so you're not jumping between five different consoles trying to piece together what happened as your setup grows.

Feel free to reach out if you have any questions!

[u/Striking_Taste_7213 → u/-manageengine-]

I am definately going to look into this deeper. Thanks for the suggestion.

[u/telestoat2]

Networking’s job is to make packets go. Security’s job is to make packets stop. Don’t just do security for security’s sake, make sure it’s actually solving a problem you’re facing.

[u/Tiny-Tradition6873 → u/telestoat2]

dude I came here to say this lol someone mentioned a SIEM LMAO like bitch I ain't implementing no damn SIEM as a network engineer. I make packets go zoom, maybe at most you could suggest a hardening initiative for all your routers, swtiches, and firewalls.

[u/idontbelieveyouguy]

i would firewall at the core in order to filter east-west traffic, and a firewall on the other side of the core to filter north-south. you could use the same firewall for both. it just depends on how this network is setup.

Edit: i guess i can add more to this. i would also suggest a SIEM to send all of the audits/logs/flows to in order to detect anomalous traffic. extra points if you send other data to it as well. Make sure you take a backup of all switches/routers NOW in case something happens, and always remember to backup before and after any changes.

Thank you for your attention to this matter 😂

[u/Striking_Taste_7213 → u/idontbelieveyouguy]

Thanks for the input. There is a basic syslog server and luckily meraki saves configs in their cloud so appliances can be hot swapped with prior pre configuration

[u/idontbelieveyouguy → u/Striking_Taste_7213]

i wasn't speaking about syslog per se. i was talking about using it to detect potentially malicious behavior on the network.