The Secured Enterprise

PAUL E. PROCTOR has worked with the CIA, FBI, and NSA on security issues andled a study of state-of-the-art intrusion detection methodology for the U.S. government.Currently Senior Vice President for NFR Security, Inc., he has spent his entire careerdeveloping information security systems and assisting large enterprises in theirdeployment. Proctor is also author of The Practical Intrusion Detection Handbook(Prentice Hall PTR). F. CHRISTIAN BYRNES has worked for IBM, Oxford Software Corporation, andMETA Group. He is author of Security in Enterprise Computing: A Practical Guide, aglobal best-practices report that has become the benchmark for enterprise securityprocess formation by META Group clients worldwide.

Foreword.


Acknowledgments.


Introduction: How to Read This Book.
I. INTRODUCTION TO SECURITY.

1. Introduction to Security.


Objectives of Computer Security. Confidentiality. Integrity. Availability. Nonrepudiation. Who is responsible for security? Why me? Relative security. Organizing security: Roles and responsibilities. What do You need to know? The role of the business manager. The need for policy. Enforcement technology. Operations technology. Security services. Summary.

2. Threat Briefing.


Csi/Fbi StudY. Threats. Misuse Examples. Insider Threats. Hacker Threats. Social Engineering. Network Vulnerabilities. Loss of Brand Equity. Graffiti (Web Site Defacing). Denial of Service. Security and Return on Investment. Quantifying Risk. Summary.

3. Security Policies.


Nontechnology-related Security Topics. Business Policy. Why are policies important? How can one policy work for everyone? Policy Guidance. Secure Communications Policy. Isolation Infrastructure Policy. Identity Infrastructure Policy. Permission Infrastructure Policy. Configuration Management Policy. User Management Policy. Threat Management and Monitoring Policy. Conformance Monitoring Policy. Application Architecture Policy. What does a security policy look like? How are policies applied and enforced? Who is responsible for security policies? Summary.

4. Authentication, Authorization, Access Control.


The AAA Disciplines. Access Control. Authentication/Identification. Who Are You Really? Authorization. Assembling the Pieces. The Ultimate Solution. The Real World for the Next Few Years. Summary.

II. SECURITY TECHNOLOGIES.

5. Firewalls.


What is a firewall? Uses for Firewalls. Types of Firewalls and How They Operate. Network Layer Firewalls. Application Layer Firewalls. Hybrid Firewalls. Working with Firewalls. Access Rules. Architecting a Firewall Solution. Internet Firewalls. Extranets. The DMZ. Firewalls and Dial-Ups. High Availability. Managing Firewalls. Firewalls and Operating Systems. Firewall Logging and Reporting. Business Application. Summary.

6. Vulnerability Scanners.


Your computers are NOT configured securely. Proper Configuration Is Difficult. Consistency Is Hard in Large Enterprises. Enterprises Are Living, Breathing, and Changing Things. Vendors Delivered Insecure Software to You. Keeping Up on Patches and Updates Is Very Difficult. Poor Administrators Change Things Unintentionally. Hackers and Insiders Change Things Intentionally. Vulnerability Scanners. Network-Based Scanners. Host-Based Scanners. Port Scanners. Commercial Scanner Products. Free Vulnerability Scanners. Winfingerprint. SAINT. Cerberus Information Scanner. Vulnerability Databases. Security Process and Procedures for Scanners. Summary.

7. Virus Detection and Content Filters.


Viruses. The Virus Threat. The Wild List. How Viruses Work. How Viruses Spread. The Virus Calendar. Virus Mutation. Common Virus Types. Virus Detection. Tips to Protect Against Viruses. Enterprise Virus Protection. Content Filters. How Content Filtering Works. Email Content Tracking. Malicious Code Filters. URL Filters. Incident Response for Content Filtering. Summary.

8. Intrusion Detection.


The Case for Intrusion Detection. What is Intrusion Detection? The Most Common Intrusion Detection. Network versus Host-Based Intrusion Detection. Anatomy of an Intrusion Detection System. Command Console. Network Sensor. Alert Notification. Response Subsystem. Database. Target Agents. Anatomy of an Intrusion Detection Process. Intrusion Detection Myths. Myth #1: The Network Intrusion Detection Myth. Myth #2: The False-Positive Myth. Myth #3: The Automated Anomaly Detection Myth. Myth #4: The Real-Time Requirement Myth. Myth #5: The Automated Response Myth. Myth #6: The Artificial Intelligence Myth. Summary.

9. Public Key Infrastructure and Encryption.


Encryption Basics. Secret Key Encryption. Public Key Encryption. Key Lengths and Security Strength. Public Keys as Infrastructure. The Benefits of PKI. The Problems of PKI. Summary.

10. Encrypted Communications.


What is a Virtual Private Network? A Brief History of VPNs. VPN Technology in Business. VPN Technology. Point-to-Point VPNs. Client-to-Server VPNs. Application-Level VPNs. Secure Sockets Layer. SSL Example. Secure Shell. SSH Example. Summary.

11. Mobile Workers and Wireless LANs.


Mobile Users and Security. Physical Security Issues in Mobile Computing. Wireless Networks. Wireless over Long Distances (Miles). Wireless LANs (in the Same Building). Personal LANs (Within 10 Meters). Security in the Wireless World. Security in Radiospace. Securing Your WLAN. Security and Bluetooth. Cellular Security. Wireless and Mobile Computing in the Future. Summary.

12. Single Signon.


What is SSO? Why SSO Fails. Too Many Account Names. Too Many Passwords. Frequent Re-Entry. Password Resets. User Account Management. Should Your Organization Address SSO? Summary.

13. Digital Signatures and Electronic Commerce.


E-Commerce. Electronic Signatures. E-SIGN. Transactional Security. Identrus: A Transactional Security Infrastructure. Smart Cards in Electronic Commerce. Visa Compliance Standards. Summary.

III. IMPLEMENTATION.

14. Establishing a Security Program.


Step One: Define Responsible Personnel. Step Two: Establish Core Processes. The Risk Assessment/Data Classification Process. The User Administration Process. The Policy Definition Process. Technical Implementation, Planning, and Design. Step Three: Define Requirements. Step Four: Communicate! The Awareness Program. The Executive Communication Program. Step Five: Audit and Monitor. Configuration Control and Audit. Intrusion Monitoring and Vulnerability Scanning. Intrusion Response and Forensics. Security Performance Reporting. Summary.

15. Security Assessments.


What is Assessment? Penetration Testing. Vulnerability Assessment. Security Posture Review. Security Audit. Risk Assessment. Problems with Quantitative Risk Assessment. Summary.

16. Managed Security Services.


What Is MSS? The Business Case for Outsourcing. How Much Should You Outsource? Security Elements You Can Outsource. Perimeter Protection. Firewalls. Client-Side Firewalls. Virus Detection. VPNs. Vulnerability Assessments/Penetration Testing. Web Filtering. Intrusion Detection/Monitoring. Incident Response. Selecting a Managed Security Service Provider. Service Offerings. Service Level Agreements. SOCs. History. The Growing Market. Summary.

17. Response and Recovery.


Incident Response. Escalation Procedures. Incident Triage. Business Continuity. Elements of Business Continuity. CERT. National Coordination CERTs. The CERT Inside Your Company. Summary.

18. Implementing Web and Internet Security.


Establishing the Policy Base. Appropriate Use. Privacy. Data Location and Protection. Application Design. Authentication Requirements. Authorization and Scalability. Secure Code. Infrastructure Design. The DMZ of the Firewall. Server Connectivity. Operating System Configuration. Security Operations. Virus Scanners and Content Filters. Vulnerability Scanners. Intrusion Detection Tools. Change Control Process. Operating System Maintenance. More Than the Sum of its Parts. Summary.

IV. ODDS AND ENDS.

19. Legal Issues.


Introduction. Computer Crime Laws. Law Enforcement/Criminal Prosecutions. Tort Litigation. Negligence Litigation. Better Technology. Corporate Reluctance to Prosecute. Attacking Back. Liability When Your Network is Used to Attack Others. Standard of Due Care. Responsibilities. Evidentiary Issues. Rules of Evidence. Accuracy. Chain of Custody. Transparency. Case Study. Organizations. National White Collar Crime Center. National Cybercrime Training Partnership. High-Technology Crime Investigators Association. Government Regulation of Information Security. European Data Privacy Initiatives and U.S. Department of Commerce Safe Harbor. The Gramm-Leach-Bliley and Health Insurance Portability and Accountability Acts. Government Information Services Reform Act. Going Forward. Summary. Resources.

20. Putting It All Together.


Communication (again). Understand Your Company's Business. Advice on Politics. Protect Yourself. A Final Word.

Glossary.
Index.