| PREFACE |
|
xiv | |
| CHAPTER ONE Security Overview |
|
1 | (16) |
|
Understanding Network Security |
|
|
2 | (1) |
|
|
|
3 | (2) |
|
|
|
4 | (1) |
|
|
|
4 | (1) |
|
|
|
4 | (1) |
|
Security Ramifications: Costs of Intrusion |
|
|
5 | (3) |
|
|
|
5 | (1) |
|
|
|
6 | (1) |
|
|
|
6 | (1) |
|
|
|
7 | (1) |
|
Goals of Network Security |
|
|
8 | (1) |
|
|
|
8 | (1) |
|
Determining Authentication |
|
|
8 | (1) |
|
|
|
8 | (1) |
|
|
|
8 | (1) |
|
Creating a Secure Network Strategy |
|
|
9 | (3) |
|
|
|
9 | (1) |
|
|
|
9 | (1) |
|
|
|
9 | (1) |
|
Achieving Security through Persistence |
|
|
10 | (1) |
|
Remembering Physical Security |
|
|
10 | (1) |
|
|
|
10 | (1) |
|
|
|
10 | (1) |
|
|
|
10 | (1) |
|
|
|
11 | (1) |
|
|
|
11 | (1) |
|
|
|
11 | (1) |
|
Intrusion Detection Systems |
|
|
12 | (1) |
|
|
|
12 | (1) |
|
|
|
12 | (1) |
|
|
|
13 | (4) |
| CHAPTER TWO Authentication |
|
17 | (30) |
|
|
|
18 | (2) |
|
Strong Password Creation Techniques |
|
|
19 | (1) |
|
Techniques to Use Multiple Passwords |
|
|
20 | (1) |
|
|
|
20 | (1) |
|
|
|
20 | (5) |
|
|
|
21 | (1) |
|
Kerberos Authentication Process |
|
|
21 | (3) |
|
Using Kerberos in Very Large Network Systems |
|
|
24 | (1) |
|
Security Weaknesses of Kerberos |
|
|
25 | (1) |
|
Challenge Handshake Authentication Protocol |
|
|
25 | (2) |
|
The CHAP Challenge-and-Response Sequence |
|
|
25 | (1) |
|
|
|
26 | (1) |
|
|
|
27 | (1) |
|
|
|
27 | (3) |
|
Electronic Encryption and Decryption Concepts |
|
|
27 | (2) |
|
How Much Trust Should One Place in a CA? |
|
|
29 | (1) |
|
|
|
30 | (2) |
|
|
|
30 | (1) |
|
|
|
31 | (1) |
|
|
|
31 | (1) |
|
|
|
32 | (7) |
|
How a Biometric Authentication System Works |
|
|
32 | (1) |
|
False Positives and False Negatives |
|
|
33 | (1) |
|
Different Kinds of Biometrics |
|
|
34 | (4) |
|
General Trends in Biometrics |
|
|
38 | (1) |
|
Multi-Factor Authentication |
|
|
39 | (1) |
|
|
|
39 | (1) |
|
|
|
40 | (2) |
|
|
|
42 | (5) |
| CHAPTER THREE Attacks and Malicious Code |
|
47 | (44) |
|
Denial-of-Service Attacks |
|
|
48 | (5) |
|
|
|
49 | (3) |
|
|
|
52 | (1) |
|
IP Fragmentation Attacks: Ping of Death |
|
|
53 | (2) |
|
Distributed Denial-of-Service Attacks |
|
|
55 | (5) |
|
|
|
55 | (1) |
|
|
|
56 | (1) |
|
|
|
57 | (3) |
|
|
|
60 | (4) |
|
|
|
60 | (2) |
|
|
|
62 | (1) |
|
|
|
62 | (2) |
|
|
|
64 | (1) |
|
|
|
64 | (2) |
|
|
|
66 | (1) |
|
|
|
67 | (2) |
|
|
|
69 | (2) |
|
|
|
70 | (1) |
|
|
|
70 | (1) |
|
Social Engineering Countermeasures |
|
|
70 | (1) |
|
Attacks against Encrypted Data |
|
|
71 | (3) |
|
|
|
71 | (1) |
|
|
|
71 | (1) |
|
|
|
72 | (1) |
|
|
|
72 | (1) |
|
|
|
73 | (1) |
|
|
|
74 | (1) |
|
|
|
74 | (10) |
|
|
|
75 | (4) |
|
|
|
79 | (4) |
|
|
|
83 | (1) |
|
|
|
83 | (1) |
|
|
|
84 | (1) |
|
|
|
85 | (2) |
|
|
|
87 | (4) |
| CHAPTER FOUR Remote Access |
|
91 | (26) |
|
|
|
92 | (2) |
|
|
|
93 | (1) |
|
|
|
94 | (2) |
|
|
|
95 | (1) |
|
|
|
96 | (1) |
|
Remote Authentication Dial-In User Service |
|
|
96 | (3) |
|
Authenticating with a RADIUS Server |
|
|
97 | (2) |
|
Terminal Access Controller Access Control System |
|
|
99 | (2) |
|
Point-to-Point Tunneling Protocol |
|
|
101 | (1) |
|
Layer 2 Tunneling Protocol |
|
|
102 | (1) |
|
|
|
102 | (1) |
|
|
|
103 | (3) |
|
ESP and Encryption Models |
|
|
105 | (1) |
|
Telecommuting Vulnerabilities |
|
|
106 | (4) |
|
|
|
110 | (1) |
|
|
|
110 | (1) |
|
|
|
111 | (1) |
|
|
|
112 | (5) |
| CHAPTER FIVE E-mail |
|
117 | (26) |
|
Secure E-mail and Encryption |
|
|
118 | (5) |
|
|
|
119 | (1) |
|
|
|
120 | (1) |
|
|
|
120 | (1) |
|
|
|
121 | (1) |
|
Combining Encryption Methods |
|
|
122 | (1) |
|
|
|
123 | (8) |
|
|
|
126 | (1) |
|
|
|
126 | (1) |
|
|
|
127 | (1) |
|
|
|
127 | (1) |
|
S/MIME Encryption Algorithms |
|
|
127 | (1) |
|
|
|
128 | (1) |
|
S/MIME Trust Model: Certificate Authorities |
|
|
129 | (1) |
|
Differences between PGP and S/MIME |
|
|
129 | (2) |
|
|
|
131 | (1) |
|
|
|
132 | (1) |
|
|
|
132 | (1) |
|
|
|
133 | (2) |
|
Countermeasures for Hoaxes |
|
|
135 | (1) |
|
|
|
136 | (1) |
|
|
|
136 | (2) |
|
|
|
138 | (5) |
| CHAPTER SIX Web Security |
|
143 | (22) |
|
|
|
144 | (2) |
|
|
|
146 | (1) |
|
|
|
147 | (2) |
|
|
|
147 | (2) |
|
Vulnerabilities of Web Tools |
|
|
149 | (9) |
|
|
|
149 | (1) |
|
|
|
150 | (1) |
|
|
|
151 | (1) |
|
|
|
152 | (1) |
|
|
|
153 | (1) |
|
|
|
154 | (2) |
|
|
|
156 | (2) |
|
|
|
158 | (1) |
|
|
|
159 | (1) |
|
|
|
160 | (5) |
| CHAPTER SEVEN Directory and File Transfer Services |
|
165 | (22) |
|
|
|
166 | (6) |
|
|
|
166 | (2) |
|
|
|
168 | (1) |
|
|
|
169 | (1) |
|
|
|
170 | (1) |
|
LDAP Security Vulnerabilities |
|
|
171 | (1) |
|
|
|
172 | (6) |
|
|
|
172 | (3) |
|
|
|
175 | (3) |
|
|
|
178 | (1) |
|
|
|
179 | (2) |
|
Protecting Your File Shares |
|
|
181 | (1) |
|
|
|
181 | (1) |
|
|
|
182 | (1) |
|
|
|
183 | (4) |
| CHAPTER EIGHT |
|
|
Wireless and Instant Messaging |
|
|
187 | (1) |
|
The Alphabet Soup of 802.11 |
|
|
188 | (4) |
|
|
|
188 | (1) |
|
|
|
189 | (1) |
|
|
|
189 | (1) |
|
|
|
189 | (1) |
|
|
|
190 | (1) |
|
|
|
190 | (1) |
|
|
|
190 | (1) |
|
|
|
190 | (1) |
|
|
|
190 | (1) |
|
|
|
191 | (1) |
|
|
|
192 | (8) |
|
|
|
193 | (3) |
|
|
|
196 | (2) |
|
The Wireless Transport Layer Security Protocol |
|
|
198 | (2) |
|
|
|
200 | (3) |
|
|
|
201 | (1) |
|
|
|
201 | (2) |
|
Conducting a Wireless Site Survey |
|
|
203 | (3) |
|
Conducting a Needs Assessment of the Network Users |
|
|
203 | (1) |
|
Obtaining a Copy of the Site's Blueprints |
|
|
204 | (1) |
|
Doing a Walk-Through of the Site |
|
|
204 | (1) |
|
Identifying Possible Access Point Locations |
|
|
204 | (1) |
|
Verifying Access Point Locations |
|
|
205 | (1) |
|
Documenting Your Findings |
|
|
205 | (1) |
|
|
|
206 | (2) |
|
|
|
206 | (1) |
|
Lack of Default Encryption Enables Packet Sniffing |
|
|
206 | (1) |
|
Social Engineering Overcomes Even Encryption |
|
|
207 | (1) |
|
Technical Issues Surrounding IM |
|
|
207 | (1) |
|
Legal Issues Surrounding IM |
|
|
207 | (1) |
|
|
|
208 | (1) |
|
|
|
208 | (1) |
|
|
|
208 | (1) |
|
|
|
208 | (3) |
|
|
|
211 | (4) |
| CHAPTER NINE Devices |
|
215 | (30) |
|
|
|
216 | (5) |
|
Drafting a Security Policy |
|
|
216 | (2) |
|
Designing the Firewall to Implement the Policy |
|
|
218 | (1) |
|
What do Firewalls Protect Against? |
|
|
218 | (1) |
|
|
|
218 | (3) |
|
|
|
221 | (5) |
|
How a Router Moves Information |
|
|
221 | (1) |
|
|
|
222 | (3) |
|
|
|
225 | (1) |
|
Limitations of Packet-Filtering Routers |
|
|
226 | (1) |
|
|
|
226 | (3) |
|
|
|
227 | (2) |
|
|
|
229 | (1) |
|
|
|
229 | (2) |
|
DSL Versus Cable Modem Security |
|
|
230 | (1) |
|
Dynamic Versus Static IP Addressing |
|
|
230 | (1) |
|
|
|
231 | (1) |
|
Security Problems with RAS |
|
|
231 | (1) |
|
Telecom/Private Branch Exchange |
|
|
231 | (1) |
|
|
|
232 | (2) |
|
Intrusion Detection Systems |
|
|
234 | (2) |
|
|
|
234 | (1) |
|
|
|
234 | (1) |
|
|
|
235 | (1) |
|
Signature-based Detection |
|
|
236 | (1) |
|
Network Monitoring and Diagnostics |
|
|
236 | (1) |
|
|
|
236 | (2) |
|
Personal Firewall Software Packages |
|
|
237 | (1) |
|
Antivirus Software Packages |
|
|
237 | (1) |
|
|
|
238 | (1) |
|
|
|
238 | (1) |
|
|
|
239 | (2) |
|
|
|
241 | (4) |
| CHAPTER TEN Media and Medium |
|
245 | (18) |
|
|
|
246 | (4) |
|
|
|
246 | (1) |
|
Twisted Pair Copper Cable |
|
|
247 | (1) |
|
|
|
248 | (1) |
|
|
|
249 | (1) |
|
Securing Transmission Media |
|
|
250 | (2) |
|
|
|
|
|
|
252 | (2) |
|
|
|
254 | (1) |
|
Solid-State Storage Media |
|
|
255 | (2) |
|
|
|
257 | (1) |
|
|
|
257 | (1) |
|
Storing and Destruction of Media |
|
|
257 | (1) |
|
|
|
258 | (1) |
|
|
|
258 | (1) |
|
|
|
259 | (4) |
| CHAPTER ELEVEN Network Security Topologies |
|
263 | (24) |
|
Perimeter Security Topologies |
|
|
264 | (5) |
|
Three-tiered Architecture |
|
|
264 | (3) |
|
Creating and Developing Your Security Design |
|
|
267 | (2) |
|
|
|
269 | (4) |
|
|
|
271 | (1) |
|
|
|
272 | (1) |
|
Network Address Translation |
|
|
273 | (2) |
|
|
|
275 | (1) |
|
Virtual Local Area Networks |
|
|
276 | (5) |
|
Security Features of VLANs |
|
|
279 | (1) |
|
Vulnerabilities of VLAN Trunks |
|
|
280 | (1) |
|
|
|
281 | (1) |
|
|
|
282 | (1) |
|
|
|
282 | (5) |
| CHAPTER TWELVE Intrusion Detection |
|
287 | (28) |
|
The Value of Intrusion Detection |
|
|
288 | (2) |
|
|
|
288 | (2) |
|
Network-based and Host-based IDS |
|
|
290 | (10) |
|
|
|
291 | (5) |
|
|
|
296 | (4) |
|
Active Detection and Passive Detection |
|
|
300 | (5) |
|
Anomaly-based and Signature-based IDS |
|
|
302 | (2) |
|
Intrusion Detection Products |
|
|
304 | (1) |
|
|
|
305 | (3) |
|
Honeypot Deployment Options |
|
|
307 | (1) |
|
|
|
307 | (1) |
|
Honeypots, Ethics, and the Law |
|
|
308 | (1) |
|
|
|
308 | (2) |
|
|
|
308 | (1) |
|
Information Security Incident Response Team |
|
|
309 | (1) |
|
|
|
310 | (1) |
|
|
|
310 | (2) |
|
|
|
312 | (3) |
| CHAPTER THIRTEEN Security Baselines |
|
315 | (38) |
|
|
|
316 | (1) |
|
|
|
317 | (4) |
|
Creating Needed User Groups |
|
|
319 | (1) |
|
Configuring Access Controls |
|
|
319 | (1) |
|
Installing and Configuring File Encryption Capabilities |
|
|
320 | (1) |
|
|
|
320 | (1) |
|
|
|
321 | (5) |
|
|
|
322 | (1) |
|
|
|
322 | (2) |
|
|
|
324 | (2) |
|
Enabling and Disabling of Services and Protocols |
|
|
326 | (2) |
|
|
|
328 | (17) |
|
|
|
328 | (2) |
|
|
|
330 | (2) |
|
|
|
332 | (2) |
|
|
|
334 | (3) |
|
|
|
337 | (1) |
|
|
|
338 | (1) |
|
|
|
339 | (2) |
|
|
|
341 | (1) |
|
|
|
341 | (4) |
|
|
|
345 | (1) |
|
|
|
346 | (3) |
|
|
|
349 | (4) |
| CHAPTER FOURTEEN Cryptography |
|
353 | (20) |
|
|
|
354 | (1) |
|
|
|
354 | (1) |
|
Symmetric versus Asymmetric Algorithms |
|
|
354 | (4) |
|
|
|
355 | (1) |
|
|
|
356 | (1) |
|
Common Encryption Algorithms |
|
|
356 | (2) |
|
Concepts of Using Cryptography |
|
|
358 | (2) |
|
|
|
359 | (1) |
|
|
|
360 | (3) |
|
|
|
360 | (2) |
|
|
|
362 | (1) |
|
Key and Certificate Life Cycle Management |
|
|
363 | (5) |
|
|
|
364 | (2) |
|
|
|
366 | (1) |
|
Certificate Revocation and Suspension |
|
|
367 | (1) |
|
|
|
367 | (1) |
|
|
|
367 | (1) |
|
|
|
368 | (1) |
|
|
|
369 | (1) |
|
|
|
370 | (3) |
| CHAPTER FIFTEEN Physical Security |
|
373 | (18) |
|
|
|
374 | (5) |
|
|
|
374 | (1) |
|
|
|
374 | (1) |
|
|
|
375 | (3) |
|
|
|
378 | (1) |
|
|
|
379 | (6) |
|
Personnel Access Controls |
|
|
379 | (3) |
|
|
|
382 | (1) |
|
|
|
382 | (1) |
|
|
|
382 | (1) |
|
Fire Detection and Suppression |
|
|
383 | (1) |
|
|
|
384 | (1) |
|
|
|
385 | (1) |
|
|
|
385 | (1) |
|
|
|
385 | (1) |
|
|
|
386 | (5) |
| CHAPTER SIXTEEN Disaster Recovery and Business Continuity |
|
391 | (20) |
|
|
|
392 | (1) |
|
Disaster Recovery Planning Process |
|
|
392 | (5) |
|
|
|
393 | (2) |
|
|
|
395 | (2) |
|
|
|
397 | (7) |
|
|
|
397 | (3) |
|
|
|
400 | (2) |
|
|
|
402 | (2) |
|
|
|
404 | (2) |
|
|
|
406 | (1) |
|
|
|
406 | (1) |
|
|
|
406 | (5) |
| CHAPTER SEVENTEEN Computer Forensics and Advanced Topics |
|
411 | |
|
|
|
412 | (5) |
|
|
|
412 | (1) |
|
Principles of Digital Evidence |
|
|
412 | (1) |
|
|
|
413 | (4) |
|
|
|
417 | (1) |
|
|
|
417 | (1) |
|
|
|
417 | (1) |
|
|
|
418 | (1) |
|
|
|
418 | (1) |
|
|
|
418 | (1) |
|
|
|
418 | (1) |
|
|
|
419 | (1) |
|
|
|
419 | (2) |
|
|
|
421 | (2) |
|
|
|
421 | (1) |
|
|
|
421 | (1) |
|
|
|
421 | (1) |
|
|
|
422 | (1) |
|
Classification and Notification |
|
|
422 | (1) |
|
|
|
422 | (1) |
|
|
|
423 | (1) |
|
|
|
423 | (1) |
|
|
|
423 | (1) |
|
|
|
424 | |
APPENDIX A Answers to
Chapter Review Questions |
|
391 | (50) |
| GLOSSARY |
|
441 | (18) |
| INDEX |
|
459 | |
