Register your product to gain access to bonus material or receive a coupon.
Inside Network Security Assessment: Guarding Your IT Infrastructure
- By Michael Gregg, David Kim
- Published Nov 18, 2005 by Sams.
Book
- Sorry, this book is no longer in print.
Description
- Copyright 2006
- Edition: 1st
- Book
- ISBN-10: 0-672-32809-7
- ISBN-13: 978-0-672-32809-1
As an IT professional, you need to know how to perform network security assessments. Inside Network Security Assessment: Guarding Your IT Infrastructure is a collection of utilities and templates that will take you through the assessment process. Written by two highly qualified authors with close ties to the International Information Systems Security Certification Consortium, this book was developed with the goal of being a text for the CISSP continuing education class on Network Security Assessment. You will be provided with step-by-step training on assessing security, from paperwork to penetration testing to ethical hacking. You'll save everyone time and money by learning to perform security assessments yourself with the help of Inside Network Security Assessment.
Sample Content
Online Sample Chapters
Why You Need to Conduct Risk Assessment
Table of Contents
Introduction.
1. Introduction to Assessing Network Vulnerabilities.
What Security Is and Isn’t.
Process for Assessing Risk.
Four Ways in Which You Can Respond to Risk.
Network Vulnerability Assessment.
Types of Network Vulnerability Assessments.
What Procedures Govern the Vulnerability Assessment?
The Role of Policies in the Vulnerability Assessment.
What Drives the Assessment?
Managing a Vulnerability Assessment.
Building Cooperation with Other Departments.
Importance of Setting and Maintaining a Schedule for Assessments.
Summary.
Key Terms.
2. Foundations and Principles of Security.
Basic Security Principles.
Security Requires Information Classification.
Governmental Information Classification System.
Commercial Information Classification System.
Classification Criteria.
The Policy Framework.
Types of Policies.
Defining Appropriate Policy.
Deploying Policy.
Policy Life Cycle.
The Role Authentication, Authorization, and Accountability Play in a Secure Organization.
Authentication.
Authorization.
Accountability.
Encryption.
Security and the Employee (Social Engineering).
Summary.
Key Terms.
3. Why Risk Assessment.
Risk Terminology.
Laws, Mandates, and Regulations.
Health Insurance Portability and Accountability Act (HIPAA).
Gramm-Leach-Bliley-Act (GLBA).
Federal Information Security Management Act (FISMA).
Sarbanes-Oxley Act (SOX).
Risk Assessment Best Practices.
Understanding the IT Security Process.
The Goals and Objectives of a Risk Assessment.
Security Process Definition.
Goals and Objectives of a Risk and Vulnerability Assessment.
Summary.
Key Terms.
4. Risk-Assessment Methodologies.
Risk-Assessment Terminology.
Risk-Management and Risk-Assessment Requirements.
Defense-in-Depth Approach for Risk Assessments.
Risk Analysis Approach for Risk Assessments.
Asset Valuation Approach for Risk Assessments.
Quantitative and Qualitative Risk-Assessment Approaches.
Quantitative Risk-Assessment Approach.
Qualitative Risk-Assessment Approach.
Best Practices for Quantitative and Qualitative Risk Assessment.
Quantitative Risk-Assessment Best Practices.
Qualitative Risk-Assessment Best Practices.
Choosing the Best Risk-Assessment Approach.
Common Risk-Assessment Methodologies and Templates.
Summary.
Key Terms.
5. Scoping the Project.
Defining the Scope of the Assessment.
Driving Events.
Initial Meeting.
Becoming the Project Manager.
Staffing the Assessment Team.
Kickoff Meeting .
Building the Assessment Timeline.
Reviewing Critical Systems and Information.
Information Criticality Matrix.
Systems Criticality Matrix.
Compiling the Needed Documentation.
Making Sure You Are Ready to Begin.
Summary.
Key Terms.
6. Understanding the Attacker.
Who Are the Attackers?
Attacker Types and Their Characteristics.
Who Are the Greatest Threat?
Insecure Computing Habits Are a Threat.
Disgruntled Employees Are a Threat.
What Do Attackers Do?
Four Kinds of Attacks.
Things That Attackers Attack.
Goals and Motivations of the Attacker.
Attackers Conduct Their Own Risk Analysis.
How Do Attackers Attack?
Tools That Attackers Use During the Stages of an Attack.
Reducing the Risk of an Attack.
How to Respond to an Attack.
Summary.
Key Terms.
7. Performing the Assessment.
Introducing the Assessment Process.
Level I Assessments.
Reviewing the Documentation.
Interviewing Process Owners and Employees.
System Demonstrations.
Level II Assessments.
Vulnerability Scans.
Level II Assessment Caveats.
Level III Assessments.
Vulnerability Exploitation.
Summary.
Key Terms.
8. Tools Used for Assessments and Evaluations.
A Brief History of Security Tools.
Putting Together a Toolkit.
Information-Gathering Tools and Techniques.
Scanning Tools.
Enumeration Tools.
Wireless Tools.
Password Auditing Tools.
Vulnerability Scanning Tools.
Automated Exploit and Assessment Tools.
Determining What Tools to Use.
What¿s the Best Platform to Install Your Tools On.
Additional Items for the Toolkit.
Summary.
Key Terms.
9. Preparing the Final Report.
Preparing for Analysis.
Ranking Your Findings.
Impact Rating.
Probability Scale.
Determining Raw Risk.
Control Level.
Calculating the Risk Score.
Building the Final Report.
Contents of a Good Report.
Notice.
Executive Summary.
Introduction.
Statement of Work.
Analysis.
Findings.
Conclusions.
Determining the Next Step.
Audit and Compliance.
Summary.
Key Terms.
10. Post-Assessment Activities.
IT Security Architecture and Framework.
Goals and Objectives.
Terminology.
Defining the Structure and Hierarchy.
Hierarchical IT Security Architecture and Framework.
Sample IT Security Architecture and Framework.
Roles, Responsibilities, and Accountabilities.
Seven Areas of Information Security Responsibility.
Security Incident Response Team (SIRT).
SIRT Response Procedures.
Security Workflow Definitions.
Security Workflow Procedures.
Vulnerability Management.
Enterprise Vulnerability Management.
Training IT Staff and End Users.
Summary.
Key Terms.
A. Security Assessment Resources.
Security Standards.
Common Criteria (CC) for IT Security Evaluation.
FIPS PUB 140-1 and 140-2.
ISO17799.
GAO Risk Assessment Process.
OSSTMM.
DoD Rainbow Series.
NIST.
General Security Websites.
Security Tool Websites.
B. Security Assessment Forms.
Information Request Form.
Document Tracking Form.
Critical Systems and Information Forms.
Level II Assessment Forms.
C. Security Assessment Sample Report.
Notice.
Executive Summary.
Introduction.
Statement of Work.
Analysis.
Recommendations.
Conclusions.
D. Dealing with Consultants and Outside Vendors.
Procurement Terminology.
Typical RFP Procurement Steps.
Procurement Best Practices.
E. SIRT Team Report Format Template.
SIRT Incident Report.
Index.
Updates
Errata
Note:
You will need the Free Adobe Acrobat Reader to view the file(s) for the book. If you do not already have Acrobat installed on
your machine, click the "Get Acrobat Reader" button to download and
install.
Click on the links below to display the PDF file in a new window. Right-click on the link and select Save As if you want to download it to your hard drive.
0672328097errata.pdf (10 KB)
Submit Errata
More Information
Other Things You Might Like
- Online Video $239.99