Contents
Acknowledgments
Introduction
Part I Network Security Foundations
1 Network Security Overview
Benefits of Good Security Practices
Business Agility
Return on Investment
Security Methodology
The Three Ds of Security
Five Steps to Better Security
Strategy and Tactics
The Evolution of Security
The Weakest Link
There Is No Silver Bullet
Business Processes vs. Technical Controls
Security Hierarchy
Summary
References
2 Risk Analysis and Defense Models
Threat Definition and Risk Analysis
Threat Vectors
Defense Models
The Lollipop Model of Defense
The Onion Model of Defense
Zones of Trust
Segmentation
Summary
References
3 Security Policy Development
Developing a Security Policy
Security Policy Developers
Security Policy Audience
Security Policy Organization
Security Policy Topics
Sample Security Policy Topics
Sample Computer System Security Policy Topics
Sample Personnel Management Security Policy Topics
Sample Physical Security Policy Topics
Implementing a Security Policy
Summary
References
4 Security Organization
Roles and Responsibilities
Security Positions
Position Descriptions
Security Incident Response Team
Separation of Duties
Separation of Duties in IT
Separation of Duties in System Administration
Security Operations Management
Security Operations Responsibilities
Project Management
Security Council
Interaction with Human Resources
Security Lifecycle Management
The Security Process
The Security Lifecycle
Security Awareness
Importance of Security Awareness
Objectives of an Awareness Program
Increasing Effectiveness
Implementing the Program
Enforcement
Policy Enforcement for Vendors
Policy Enforcement for Employees
Software-Based Enforcement
Information Classification
Classification Categories
Roles
Documentation
Importance of Documentation
Presentation of Documents
Security Audit
Managed Security Services
Benefits of MSPs
Services Performed by MSPs
Security Monitoring Services
Summary
References
Part II Access Control
5 Physical Security
Classification of Assets
Physical Vulnerability Assessment
Buildings
Computing Devices and Peripherals
Documents
Records and Equipment
Choosing Site Location for Security
Accessibility
Lighting
Proximity to Other Buildings
Proximity to Law Enforcement and Emergency Response
RF and Wireless Transmission Interception
Construction and Excavation
Securing Assets: Locks, Entry Controls
Locks
Entry Controls
Physical Intrusion Detection
Closed-Circuit Television
Alarms
Mantraps
System Logs
Summary
References
6 Authentication and Authorization Controls
Authentication
Usernames and Password
Certificate-Based Authentication
Extensible Authentication Protocol (EAP)
Biometrics
Additional Uses for Authentication
Authorization
User Rights
Role-Based Authorization
Access Control Lists (ACLs)
Rule-Based Authorization
Summary
7 Data Security Architecture
Principles of Data Security Architecture
Confidentiality
Privacy
Integrity
Availability
Non-Repudiation
Applications of Data Security Architecture
Securing Data in Flight
Data Storage and File Encryption
Digital Rights Management
Confidential E-Mail
Summary
8 Security Management Architecture
Acceptable Use Enforcement
Examples of AUP Enforcement Wording
Developing AUP Enforcement Policy Text
Enforcement Processing
Administrative Security
Preventing Administrative Abuse of Power
Management Practices
Accountability Controls
Activity Monitoring and Audit
System and Device Logging
Log File Summarization and Reporting
System and Network Activity Monitoring
Vulnerability Scanning
NASA Improves Security
Summary
Part III Network Architecture
9 Network Design Considerations
Introduction to Secure Network Design
Acceptable Risk
Designing Security into a Network
Designing an Appropriate Network
The Cost of Security
Performance
Availability
Security
Wireless Impact on the Perimeter
Remote Access Considerations
Internal Security Practices
Intranets, Extranets, and DMZs
Host Hardening
Outbound Filtering
Summary
References
10 Network Device Security
Switch and Router Basics
Switches
Routers
Routing Protocols
Network Hardening
Patches
Switch Security Practices
Access Control Lists
Services Not in Use
Administrative Practices
Internet Control Message Protocol
Anti-Spoofing and Source Routing
Logging
Summary
11 Firewalls
Understanding Firewalls
Firewall Strengths and Weaknesses
Firewalls and TCP/IP
Packet-Filtering Firewalls
Application Gateways
Circuit-Level Gateways
Stateful Packet-Inspection (SPI) Firewalls
Appliance- vs. OS-Based Firewalls
Additional Firewall Functions
Network Address Translation (NAT)
Auditing and Logging
Virtual Private Networks
Summary
References
12 Virtual Private Network Security
How a VPN Works
VPN Protocols
IPSec Tunnel Mode Products
L2TP over IPSec
PPTP
SSL VPNs
Client/Server Remote Access Vulnerabilities and Threats
Remote Dial-In Server Security
Remote Client Security
Site-to-Site Networking Vulnerabilities and Threats
Summary
13 Wireless Network Security
Radio Frequency Security Basics
Layer 1 Security Solutions
Data-Link Layer Wireless Security Features, Flaws, and Threats
802.11 and 802.15 Data-Link Layer in a Nutshell
802.11 and 802.15 Data-Link Layer Vulnerabilities and Threats
Closed-System ESSIDs, MAC Filtering, and Protocol Filtering
Built-in Bluetooth PAN Data-Link Security and Threats
Wireless Network Hardening Practices and Recommendations
Introducing the 802.11i Security Standard
Wireless Intrusion-Detection Fundamentals
Wireless Network Positioning and Secure Gateways
Summary
14 Intrusion-Detection Systems
IDS Concepts
Why Intrusion Detection
Threat Types
First-Generation IDSs
Second-Generation IDSs
Return on IDS Investment
IDS Types and Detection Models
Host-Based IDS
Network-Based IDS (NIDS)
Anomaly-Detection (AD) Model
Signature-Detection Model
Wireless IDSs
What Type of IDS Should You Use?
IDS Features
IDS End-User Interfaces
IDS Management
Intrusion-Prevention Systems (IPSs)
IDS Performance
IDS Logging and Alerting
IDS Reporting and Analysis
IDS Deployment Considerations
IDS Weaknesses
IDS Fine-Tuning
NIDS Deployment Plan
The Future of IDS
IDS Products
Online IDS Resources
Summary
15 Integrity and Availability Architecture
Version Control and Change Control
Documenting and Analyzing Change Control
The Change Control Policy
Usable Change Control Procedures
Patching
Determining What Should Be Patched
Where to Obtain Patch Notification
The Decision-Making Process
Audit Patch Application
Examples of Patching Processes and Procedures
Patch Management Products and Resources
Backups
Traditional Backup Methods
Backup Alternatives and Newer Methodologies
Backup Policy
System and Network Redundancy
Automated Redundancy Methods
Operational Procedures That Keep Systems Functional
Summary
16 Network Role-Based Security
E-Mail
Protocols and Security Issues
Mail Distribution
Spam and Spam Control
Viruses and Virus Control
Recommendations for Securing E-Mail Servers
Proxy Servers
Network Connectivity
Proxy Connectivity
Proxy Security Issues
DNS Servers
DNS Overview
DNS Security
Source Code Repository Access
Basic Security
Advanced Security
Web Servers
Overview of Web Server Security
Types of Attacks
Web Server Protection
IP Telephony and Streaming Media
Common Usage
Streaming Media Protocols
Key Features of VoIP/Streaming Media Protocols
Security Issues of VoIP/Streaming Media Protocols
Credit Card Security
Common Insecure Practices
Securing Credit Card Systems
Printers and Faxes
Printers
Fax Security
Special Systems
OS Security
Intercommunication Security
Level of Security Support
Auditing
SCADA
Overview
Typical SCADA Topology
SCADA Security
PBX
Hacking a PBX
Securing a PBX
Summary
Part IV Operating System Security
17 Operating System Security Models
Operating System Models
Access Control Lists
MAC vs. DAC
Classic Security Models
Bell-LaPadula
Biba
Clark-Wilson
TCSEC
Labels
Reference Monitor
Windows 2000/XP Security Reference Monitor
Windows NT Security Model and Monitor
Trustworthy Computing
International Standards for Operating System Security
Common Criteria
ISO 17799
COBIT
Summary
References
18 Common Unix Vulnerabilities
Start with a Fresh Install
Remove Unneeded Daemons
Look at Your Startup Scripts
Install OpenSSL
Replace Vulnerable Daemons with OpenSSH
Do Not Use root for Daemons
Change the Port
Special Cases
Use chroot to Isolate Processes
Use TCP Wrappers
Audit Your Applications
Audit Your cron Jobs
Scan for SUID and SGID Files
Keep . from Your PATH
Audit Your Scripts
Know What Ports Are Open
Using Netstat
Using lsof
Run CIS Scans
Keep Patches Up to Date
Use a Centralized Log Server
Configure All Your Daemons to Log
Consider Replacing Sendmail
Sendmail Replacements
Subscribe to Security Lists
Summary
19 Linux Security
Start with a Fresh Install
Install a File Scanning Application
Tripwire
Determine Your Server’s Role
Watching Commonly Scanned Ports
IP Restricting
Installing TCP Wrappers
Configuring TCP Wrappers
Read Your Log Files
Create a Centralized Log Server
Install a Log Scanning Application
Stay on Top of Vulnerabilities
Keep Your System Updated
Subscribe to Security Lists
Summary
20 Windows Security
The Six Basics of Security Applied to Windows Systems
Segment the Network into Areas of Trust and Provide Specific Controls at Border Areas
Patch Systems
Strengthen Authentication Processes
Limit the Number of Administrators and Limit the Privileges of Administrators
Harden Systems Against Known Attacks via System Configurations
Develop and Enforce Security Policy via Accountability, Technology, and Training
Threat Analysis, Windows Systems Specifics
Mitigation Possibilities, Windows Style
Logical Security Boundaries
Role-Based Administration
Security Configuration and Analysis
Group Policy
Public Key Infrastructure
Securing Windows Communications
A Role-Based Approach to Security Configuration
Mitigation Application—Security Checklists
Summary
21 Novell Security
NetWare Overview
Security Considerations of IP and IPX
NetWare Core Protocol (NCP) Packet Signature
Novell Directory Services (NDS)
NDS Basics
NDS Tree
NDS vs. Bindery Security
NDS Security
File-System Security
NDS Object Security
Rules of NDS Object Security
Tips and Best Practices for Securing NetWare
Securing the Server
Securing the Workstation
NCP Packet Signature
Login Security and User Accounts
General Ideas for NDS Security
Be Careful What You Place in the SYS:LOGIN Directory
Summary
References
Part V Application Security
22 Principals of Application Security
Web Application Security
SQL Injection
Forms and Scripts
Cookies and Session Management
General Attacks
Web Application Security Conclusions
Regular Application Security
Running Privileges
Application Administration
Integration with OS Security
Application Updates
Spyware and Adware
Network Access
Regular Application Security Conclusions
Embedded Applications Security
Security of Embedded Applications
Embedded Applications Security Conclusions
Remote Administration Security
Reasons for Remote Administration
Remote Administration Using a Web Interface
Authenticating Web-Based Remote Administration
Custom Remote Administration
Summary
23 Writing Secure Software
The Golden Rule—Be Careful Whom You Trust
Buffer Overruns
Integer Overflow Attacks
Cross-Site Scripting Issues
SQL Injection Attacks
The Golden Secure Rule
Summary
24 J2EE Security
Java and J2EE Overview
The Java Language
Attacks on the JVM
The J2EE Architecture
Servlets
JavaServer Pages (JSP)
Enterprise JavaBeans (EJB)
Containers
Authentication and Authorization
J2EE Authentication
J2EE Authorization
Protocols
HTTP
HTTPS
Web Services Protocols
IIOP
JRMP
Proprietary Communication Protocols
JMS
JDBC
Summary
25 Windows .NET Security
Core Security Features of .NET
Managed Code
Role-Based Security
Code Access Security
AppDomains and Isolated Storage
Application-Level Security in .NET
Using Cryptography
.NET Remoting Security
Securing Web Services and Web Applications
Summary
26 Database Security
General Database Security Concepts
Understanding Database Server Security Layers
Server-Level Security
Network-Level Security
Operating System Security
Understanding Database-Level Security
Database Administration Security
Database Roles and Permissions
Object-Level Security
Using Other Database Objects for Security
Using Application Security
Limitations of Application-Level Security
Supporting Internet Applications
Database Backup and Recovery
Determining Backup Constraints
Determining Recovery Requirements
Types of Database Backups
Keeping Your Servers Up-to-Date
Database Auditing and Monitoring
Reviewing Audit Logs
Database Server Monitoring
Summary
Part VI Response
27 Disaster Recovery and Business Continuity
Disaster Recovery
Business Continuity
The Four Components of Business Continuity
Third-Party Vendor Issues
Awareness and Training Programs
Summary
28 Attacks and Countermeasures
Attacks
Malicious Mobile Code
Manual Cracking
Countermeasures
Secure the Physical Environment
Keep Patches Updated
Use an Antivirus Scanner
Use a Firewall
Secure User Accounts
Secure the File System
Secure Applications
Back Up the System
Automate Security
Create a Computer Security Defense Plan
Summary
References
29 Incident Response and Forensic Analysis
Incident Response Plans
Incident Detection
Incident Response and Containment
Recovery and Resumption
Review and Improvement
Forensics
Legal Requirements
Evidence Acquisition
Evidence Analysis
Summary
References
30 Legal Issues: The Laws Affecting Information Security Professionals
Network Regulations: Defining Computer Crimes
Intrusions and Network Attacks: The Computer Fraud and Abuse Act
Unauthorized Access to Electronic Communications: The Electronic Communications Privacy Act
Other Cyber Crimes
Information Security Regulation: The Emerging Duty of Care
Gramm-Leach-Bliley Safeguards
Sarbanes-Oxley Act
HIPAA Privacy and Security Rules
California Section 1798.82
Voluntary Standards
The Future of Duty of Care: Enforcement Actions and Civil Lawsuits?
Compliance with Laws in Conducting an Incident Response Overview
Law Enforcement Referrals—Yes or No?
Preservation of Evidence
Protecting the Confidentiality of the Response: Privilege Issues
Summary
Glossary
Index