Since we still don't have a description of your network. This at least for now doesn't apply to Lips. Check if the following description is apropriate. Comments welcome. I'll be editing this post on changes for future referal. We don't want to make it super-real. I hope I've made it simple and secure enough.
Master node for all of your communication is Omar's commlink. The communication is encrypted. Keys for communication encryptions are automatically changed every day (every ten minutes during run). I assume that the encryption rating for the communication is Omar's encryption program rating.
All of your links are slaved to the Omar's link. This provide you +2 to firewall on direct hacking attempts, but also provide Omar with security access to your links and peripherals. All of you have at least user credentials to the Omar's commlink stored on your links to be able to access your own links. If Omar is out of reach (eg. when his commlink is turned off, your commlinks automaticaly turn into independent mode ie. they are not slaved to his node, but automaticaly reslave when he gets in range).
Omar's link node is encrypted and datamined on access. All of you know the databomb password. He has strong encryption with a 6 hours interval on decrypt. The encryption code for that is changed on a weekly basis.
If you do have a encrypt program and it is running your own node your own node is also encrypted strongly (6 hrs interval) encryption codes are shared within the network. (ie. unencrypted nodes have encryption code for Omar's link to allow access). You may also encrypt your access log - note this require dedicated encrypt program instance to do so.
All of you maintain personas in Omar link, both for encryption of internal communication and to automate encryption sharing tasks (Omar, make sure you have enough persona limit capacity)
your peripherals, are DNI controlled, but all cyberware, AR googles, AR lenses, AR gloves, and controllable but non-sklinlinked pieces of equipment are having signal 0 for maintenance. Which means, they are accessible once your commlink is hacked. They can also be hacked if the intruder succesfully connect mutual signal range of 3 meters (with +2 modifier for being slaved to the commlink, note this modifier isn't cumulative with the master network layer).
Please note on your cards signal ratings of your drones/vehicles.
Make sure you note (by putting a loaded/run comment on your runner cards) programs that are being used on a normal basis. Note the capacity and used capacity of the commlink. Make sure, you do not have any program exceeding response or system attribute of your commlink if they do reduce them to that value. If there is overloading of the programs number, note effective Response.
On request, all nodes, may be datamined by Omar. What is the result of datamine. Note, that datamined entry on routine access, can be dangerous, particulary during stressfull/confusive situation. Had you happen to relog to your node during dumpshock, under the effects of drugs or mind confusing spells I may request a memory check Logic + Logic (1) with modifiers apropriate to situation. Failure means accidental tripping of the datamine.
I'd need a status of your nodes, whether they are encrypted w/rating and or datamined on entry w/rating and additional effect. Make sure to note that on your cards.
All of your links are running a resident Analyze program (if you have any) to support Firewall during hacking attempts. Since you don't own any ICs the ARC in your node is to issue alert and scramble Omar and Mouse into the alerted node. If possible all identified hacking attempts trigger restricted alert against the intruder. if neither Omar not Mouse scrambled in the fallback action is to cut the connection of the intruder.