Network Security by Bragg -- Read -- Imperial Library of Trantor

Index

Cover Page Network Security: The Complete Reference Copyright Page Dedication Contents at a Glance Contents About the Contributors and Technical Editors About the Authors Acknowledgments Introduction Part I Network Security Foundations

1 Network Security Overview

Benefits of Good Security Practices

Business Agility Return on Investment

Security Methodology

The Three Ds of Security Five Steps to Better Security Strategy and Tactics The Evolution of Security The Weakest Link There Is No Silver Bullet Business Processes vs. Technical Controls Security Hierarchy

Summary References

2 Risk Analysis and Defense Models

Threat Definition and Risk Analysis

Threat Vectors

Defense Models

The Lollipop Model of Defense The Onion Model of Defense Zones of Trust Segmentation

Summary References

3 Security Policy Development

Developing a Security Policy

Security Policy Developers Security Policy Audience Security Policy Organization Security Policy Topics

Sample Security Policy Topics

Sample Computer System Security Policy Topics Sample Personnel Management Security Policy Topics Sample Physical Security Policy Topics

Implementing a Security Policy Summary References

4 Security Organization

Roles and Responsibilities

Security Positions Position Descriptions Security Incident Response Team

Separation of Duties

Separation of Duties in IT Separation of Duties in System Administration

Security Operations Management

Security Operations Responsibilities Project Management Security Council Interaction with Human Resources

Security Lifecycle Management

The Security Process The Security Lifecycle

Security Awareness

Importance of Security Awareness Objectives of an Awareness Program Increasing Effectiveness Implementing the Program

Enforcement

Policy Enforcement for Vendors Policy Enforcement for Employees Software-Based Enforcement

Information Classification

Classification Categories Roles

Documentation

Importance of Documentation Presentation of Documents

Security Audit Managed Security Services

Benefits of MSPs Services Performed by MSPs Security Monitoring Services

Summary References

Part II Access Control

5 Physical Security

Classification of Assets Physical Vulnerability Assessment

Buildings Computing Devices and Peripherals Documents Records and Equipment

Choosing Site Location for Security

Accessibility Lighting Proximity to Other Buildings Proximity to Law Enforcement and Emergency Response RF and Wireless Transmission Interception Construction and Excavation

Securing Assets: Locks, Entry Controls

Locks Entry Controls

Physical Intrusion Detection

Closed-Circuit Television Alarms Mantraps System Logs

Summary References

6 Authentication and Authorization Controls

Authentication

Usernames and Password Certificate-Based Authentication Extensible Authentication Protocol (EAP) Biometrics Additional Uses for Authentication

Authorization

User Rights Role-Based Authorization Access Control Lists (ACLs) Rule-Based Authorization

Summary

7 Data Security Architecture

Principles of Data Security Architecture

Confidentiality Privacy Integrity Availability Non-Repudiation

Applications of Data Security Architecture

Securing Data in Flight Data Storage and File Encryption Digital Rights Management Confidential E-Mail

Summary

8 Security Management Architecture

Acceptable Use Enforcement

Examples of AUP Enforcement Wording Developing AUP Enforcement Policy Text Enforcement Processing

Administrative Security

Preventing Administrative Abuse of Power Management Practices

Accountability Controls Activity Monitoring and Audit

System and Device Logging Log File Summarization and Reporting System and Network Activity Monitoring Vulnerability Scanning NASA Improves Security

Summary

Part III Network Architecture

9 Network Design Considerations

Introduction to Secure Network Design

Acceptable Risk Designing Security into a Network Designing an Appropriate Network The Cost of Security

Performance Availability Security

Wireless Impact on the Perimeter Remote Access Considerations Internal Security Practices Intranets, Extranets, and DMZs Host Hardening Outbound Filtering

Summary References

10 Network Device Security

Switch and Router Basics

Switches Routers Routing Protocols

Network Hardening

Patches Switch Security Practices Access Control Lists Services Not in Use Administrative Practices Internet Control Message Protocol Anti-Spoofing and Source Routing Logging

Summary

11 Firewalls

Understanding Firewalls

Firewall Strengths and Weaknesses Firewalls and TCP/IP Packet-Filtering Firewalls Application Gateways Circuit-Level Gateways Stateful Packet-Inspection (SPI) Firewalls Appliance- vs. OS-Based Firewalls

Additional Firewall Functions

Network Address Translation (NAT) Auditing and Logging Virtual Private Networks

Summary References

12 Virtual Private Network Security

How a VPN Works VPN Protocols

IPSec Tunnel Mode Products L2TP over IPSec PPTP SSL VPNs

Client/Server Remote Access Vulnerabilities and Threats

Remote Dial-In Server Security Remote Client Security

Site-to-Site Networking Vulnerabilities and Threats Summary

13 Wireless Network Security

Radio Frequency Security Basics

Layer 1 Security Solutions

Data-Link Layer Wireless Security Features, Flaws, and Threats

802.11 and 802.15 Data-Link Layer in a Nutshell 802.11 and 802.15 Data-Link Layer Vulnerabilities and Threats Closed-System ESSIDs, MAC Filtering, and Protocol Filtering Built-in Bluetooth PAN Data-Link Security and Threats

Wireless Network Hardening Practices and Recommendations

Introducing the 802.11i Security Standard Wireless Intrusion-Detection Fundamentals Wireless Network Positioning and Secure Gateways

Summary

14 Intrusion-Detection Systems

IDS Concepts

Why Intrusion Detection Threat Types First-Generation IDSs Second-Generation IDSs Return on IDS Investment

IDS Types and Detection Models

Host-Based IDS Network-Based IDS (NIDS) Anomaly-Detection (AD) Model Signature-Detection Model Wireless IDSs What Type of IDS Should You Use?

IDS Features

IDS End-User Interfaces IDS Management Intrusion-Prevention Systems (IPSs) IDS Performance IDS Logging and Alerting IDS Reporting and Analysis

IDS Deployment Considerations

IDS Weaknesses IDS Fine-Tuning NIDS Deployment Plan The Future of IDS IDS Products Online IDS Resources

Summary

15 Integrity and Availability Architecture

Version Control and Change Control

Documenting and Analyzing Change Control The Change Control Policy Usable Change Control Procedures

Patching

Determining What Should Be Patched Where to Obtain Patch Notification The Decision-Making Process Audit Patch Application Examples of Patching Processes and Procedures Patch Management Products and Resources

Backups

Traditional Backup Methods Backup Alternatives and Newer Methodologies Backup Policy

System and Network Redundancy

Automated Redundancy Methods Operational Procedures That Keep Systems Functional

Summary

16 Network Role-Based Security

E-Mail

Protocols and Security Issues Mail Distribution Spam and Spam Control Viruses and Virus Control Recommendations for Securing E-Mail Servers

Proxy Servers

Network Connectivity Proxy Connectivity Proxy Security Issues

DNS Servers

DNS Overview DNS Security

Source Code Repository Access

Basic Security Advanced Security

Web Servers

Overview of Web Server Security Types of Attacks Web Server Protection

IP Telephony and Streaming Media

Common Usage Streaming Media Protocols Key Features of VoIP/Streaming Media Protocols Security Issues of VoIP/Streaming Media Protocols

Credit Card Security

Common Insecure Practices Securing Credit Card Systems

Printers and Faxes

Printers Fax Security

Special Systems

OS Security Intercommunication Security Level of Security Support Auditing

SCADA

Overview Typical SCADA Topology SCADA Security

PBX

Hacking a PBX Securing a PBX

Summary

Part IV Operating System Security

17 Operating System Security Models

Operating System Models

Access Control Lists MAC vs. DAC

Classic Security Models

Bell-LaPadula Biba Clark-Wilson TCSEC Labels Reference Monitor Windows 2000/XP Security Reference Monitor Windows NT Security Model and Monitor

Trustworthy Computing

International Standards for Operating System Security Common Criteria ISO 17799 COBIT

Summary References

18 Common Unix Vulnerabilities

Start with a Fresh Install Remove Unneeded Daemons

Look at Your Startup Scripts

Install OpenSSL Replace Vulnerable Daemons with OpenSSH Do Not Use root for Daemons

Change the Port Special Cases

Use chroot to Isolate Processes Use TCP Wrappers Audit Your Applications Audit Your cron Jobs Scan for SUID and SGID Files

Keep . from Your PATH Audit Your Scripts

Know What Ports Are Open

Using Netstat Using lsof

Run CIS Scans Keep Patches Up to Date Use a Centralized Log Server

Configure All Your Daemons to Log

Consider Replacing Sendmail

Sendmail Replacements

Subscribe to Security Lists Summary

19 Linux Security

Start with a Fresh Install Install a File Scanning Application

Tripwire

Determine Your Server’s Role Watching Commonly Scanned Ports IP Restricting

Installing TCP Wrappers Configuring TCP Wrappers

Read Your Log Files

Create a Centralized Log Server Install a Log Scanning Application

Stay on Top of Vulnerabilities

Keep Your System Updated Subscribe to Security Lists

Summary

20 Windows Security

The Six Basics of Security Applied to Windows Systems

Segment the Network into Areas of Trust and Provide Specific Controls at Border Areas Patch Systems Strengthen Authentication Processes Limit the Number of Administrators and Limit the Privileges of Administrators Harden Systems Against Known Attacks via System Configurations Develop and Enforce Security Policy via Accountability, Technology, and Training

Threat Analysis, Windows Systems Specifics Mitigation Possibilities, Windows Style

Logical Security Boundaries Role-Based Administration Security Configuration and Analysis Group Policy Public Key Infrastructure Securing Windows Communications A Role-Based Approach to Security Configuration

Mitigation Application—Security Checklists Summary

21 Novell Security

NetWare Overview

Security Considerations of IP and IPX NetWare Core Protocol (NCP) Packet Signature

Novell Directory Services (NDS)

NDS Basics NDS Tree NDS vs. Bindery Security

NDS Security

File-System Security NDS Object Security Rules of NDS Object Security

Tips and Best Practices for Securing NetWare

Securing the Server Securing the Workstation NCP Packet Signature Login Security and User Accounts General Ideas for NDS Security Be Careful What You Place in the SYS:LOGIN Directory

Summary References

Part V Application Security

22 Principals of Application Security

Web Application Security

SQL Injection Forms and Scripts Cookies and Session Management General Attacks Web Application Security Conclusions

Regular Application Security

Running Privileges Application Administration Integration with OS Security Application Updates Spyware and Adware Network Access Regular Application Security Conclusions

Embedded Applications Security

Security of Embedded Applications Embedded Applications Security Conclusions

Remote Administration Security

Reasons for Remote Administration Remote Administration Using a Web Interface Authenticating Web-Based Remote Administration Custom Remote Administration

Summary

23 Writing Secure Software

The Golden Rule—Be Careful Whom You Trust

Buffer Overruns Integer Overflow Attacks Cross-Site Scripting Issues SQL Injection Attacks

The Golden Secure Rule Summary

24 J2EE Security

Java and J2EE Overview

The Java Language Attacks on the JVM

The J2EE Architecture

Servlets JavaServer Pages (JSP) Enterprise JavaBeans (EJB) Containers

Authentication and Authorization

J2EE Authentication J2EE Authorization

Protocols

HTTP HTTPS Web Services Protocols IIOP JRMP Proprietary Communication Protocols JMS JDBC

Summary

25 Windows .NET Security

Core Security Features of .NET

Managed Code Role-Based Security Code Access Security AppDomains and Isolated Storage

Application-Level Security in .NET

Using Cryptography .NET Remoting Security Securing Web Services and Web Applications

Summary

26 Database Security

General Database Security Concepts Understanding Database Server Security Layers

Server-Level Security Network-Level Security Operating System Security

Understanding Database-Level Security

Database Administration Security Database Roles and Permissions Object-Level Security Using Other Database Objects for Security

Using Application Security

Limitations of Application-Level Security Supporting Internet Applications

Database Backup and Recovery

Determining Backup Constraints Determining Recovery Requirements Types of Database Backups

Keeping Your Servers Up-to-Date Database Auditing and Monitoring

Reviewing Audit Logs Database Server Monitoring

Summary

Part VI Response

27 Disaster Recovery and Business Continuity

Disaster Recovery Business Continuity

The Four Components of Business Continuity Third-Party Vendor Issues Awareness and Training Programs

Summary

28 Attacks and Countermeasures

Attacks

Malicious Mobile Code Manual Cracking

Countermeasures

Secure the Physical Environment Keep Patches Updated Use an Antivirus Scanner Use a Firewall Secure User Accounts Secure the File System Secure Applications Back Up the System Automate Security Create a Computer Security Defense Plan

Summary References

29 Incident Response and Forensic Analysis

Incident Response Plans

Incident Detection Incident Response and Containment Recovery and Resumption Review and Improvement

Forensics

Legal Requirements Evidence Acquisition Evidence Analysis

Summary References

30 Legal Issues: The Laws Affecting Information Security Professionals

Network Regulations: Defining Computer Crimes

Intrusions and Network Attacks: The Computer Fraud and Abuse Act Unauthorized Access to Electronic Communications: The Electronic Communications Privacy Act Other Cyber Crimes

Information Security Regulation: The Emerging Duty of Care

Gramm-Leach-Bliley Safeguards Sarbanes-Oxley Act HIPAA Privacy and Security Rules California Section 1798.82 Voluntary Standards The Future of Duty of Care: Enforcement Actions and Civil Lawsuits?

Compliance with Laws in Conducting an Incident Response Overview

Law Enforcement Referrals—Yes or No? Preservation of Evidence Protecting the Confidentiality of the Response: Privilege Issues

Summary

Glossary Index Footnotes

Fn1 Fn2

← Prev
Back
Next →

← Prev
Back
Next →