Securing an information system

SAÉ 4.01, “Securing an information system”, is the major project of the cybersecurity track in semester 4. The goal is to build, from the WAN to the client workstation, the complete information system of a fictional company, then to secure it layer by layer. The work is done in a team of 3, with a lot of freedom in technical choices as long as the specification is met.

The target architecture starts from a client and a WAN link protected by a firewall, behind which the internal services are organised: DNS, LDAP directory, NFS file sharing, email (Postfix SMTP / Dovecot IMAP), a load-balanced web service, OpenVPN access for remote workstations and an Apache Guacamole administration bastion. Security is built around an in-house public key infrastructure (PKI): root certificate, server and client certificates to encrypt protocols with TLS (LDAPS, HTTPS, SMTPS, IMAPS) and authenticate remote workstations.

The whole lab runs on the Proxmox virtualisation platform: IP addressing plan, network creation (LAN without DHCP, NAT network), VM provisioning through linked clones and snapshots from a template, Ceph (RBD) storage with quotas. Part of the SAÉ is also to put Proxmox to the test and produce a report on its usability, bugs and suggestions.

The project is completed: the services were deployed and configured one by one (DNS BIND9, PKI, LDAP with LDIF and TLS, OpenVPN, NFS authenticated through LDAP/PAM, high-availability web, email). It ended with a 20-minute technical presentation focused on the chosen solution, the reasoning behind the choices, a close look at the security measures and a risk assessment.

Create and secure a company's information system end to end: a network virtualised on Proxmox with a firewall, LDAP directory, NFS sharing, email, remote VPN access and a bastion, relying on a public key infrastructure (PKI) to encrypt protocols with TLS and authenticate workstations.