Secured Enterprise, The: Protecting Your Information Assets

Description

• Copyright 2002
• Pages: 336
• Edition: 1st

• Book
• ISBN-10: 0-13-061906-X
• ISBN-13: 978-0-13-061906-8

Securing your key digital and information assets in an age of insecurity.

Securing enterprise data, applications, and intellectual property has become THE critical issue for business decision-makers in this era of hackers and potential cyberterrorism. But until now, most books on information security have been written for programmers and networking professionals, not business people. The Secured Enterprise: Protecting Your Information Assets fills the gap, delivering a non-technical, business-focused briefing on every key aspect of information security: frompeople to process to technology.

• A guide to today's security threats—including cyberterrorism
• How to establish effective, realistic security policies
• The tools for defending your information assets
• Effective mechanisms for identification, authentication, and access control
• What firewalls can—and cannot—do
• Vulnerability scanners, virus detectors, and intrusion detection systems
• Virtual private networks: leveraging the cost savings without exposing your data to risk
• Securing B2B and B2C e-commerce
• How to evaluate third-party security products and services
• New security options for wireless applications

Security has gotten more complex with time, and it has become more difficult to distill it. After reading this book you will understand security better and be more prepared to apply it in your enterprise.

—Jeff Moss,
Founder, DEF CON President,
Black Hat, Inc.



Sample Content

Online Sample Chapter

Information Security Must Balance Business Objectives

Table of Contents

Foreword.


Acknowledgments.


Introduction: How to Read This Book.

I. INTRODUCTION TO SECURITY.

1. Introduction to Security.

Objectives of Computer Security. Confidentiality. Integrity. Availability. Nonrepudiation. Who is responsible for security? Why me? Relative security. Organizing security: Roles and responsibilities. What do You need to know? The role of the business manager. The need for policy. Enforcement technology. Operations technology. Security services. Summary.

2. Threat Briefing.

Csi/Fbi StudY. Threats. Misuse Examples. Insider Threats. Hacker Threats. Social Engineering. Network Vulnerabilities. Loss of Brand Equity. Graffiti (Web Site Defacing). Denial of Service. Security and Return on Investment. Quantifying Risk. Summary.

3. Security Policies.

Nontechnology-related Security Topics. Business Policy. Why are policies important? How can one policy work for everyone? Policy Guidance. Secure Communications Policy. Isolation Infrastructure Policy. Identity Infrastructure Policy. Permission Infrastructure Policy. Configuration Management Policy. User Management Policy. Threat Management and Monitoring Policy. Conformance Monitoring Policy. Application Architecture Policy. What does a security policy look like? How are policies applied and enforced? Who is responsible for security policies? Summary.

4. Authentication, Authorization, Access Control.

The AAA Disciplines. Access Control. Authentication/Identification. Who Are You Really? Authorization. Assembling the Pieces. The Ultimate Solution. The Real World for the Next Few Years. Summary.

II. SECURITY TECHNOLOGIES.

5. Firewalls.

What is a firewall? Uses for Firewalls. Types of Firewalls and How They Operate. Network Layer Firewalls. Application Layer Firewalls. Hybrid Firewalls. Working with Firewalls. Access Rules. Architecting a Firewall Solution. Internet Firewalls. Extranets. The DMZ. Firewalls and Dial-Ups. High Availability. Managing Firewalls. Firewalls and Operating Systems. Firewall Logging and Reporting. Business Application. Summary.

6. Vulnerability Scanners.

Your computers are NOT configured securely. Proper Configuration Is Difficult. Consistency Is Hard in Large Enterprises. Enterprises Are Living, Breathing, and Changing Things. Vendors Delivered Insecure Software to You. Keeping Up on Patches and Updates Is Very Difficult. Poor Administrators Change Things Unintentionally. Hackers and Insiders Change Things Intentionally. Vulnerability Scanners. Network-Based Scanners. Host-Based Scanners. Port Scanners. Commercial Scanner Products. Free Vulnerability Scanners. Winfingerprint. SAINT. Cerberus Information Scanner. Vulnerability Databases. Security Process and Procedures for Scanners. Summary.

7. Virus Detection and Content Filters.

Viruses. The Virus Threat. The Wild List. How Viruses Work. How Viruses Spread. The Virus Calendar. Virus Mutation. Common Virus Types. Virus Detection. Tips to Protect Against Viruses. Enterprise Virus Protection. Content Filters. How Content Filtering Works. Email Content Tracking. Malicious Code Filters. URL Filters. Incident Response for Content Filtering. Summary.

8. Intrusion Detection.

The Case for Intrusion Detection. What is Intrusion Detection? The Most Common Intrusion Detection. Network versus Host-Based Intrusion Detection. Anatomy of an Intrusion Detection System. Command Console. Network Sensor. Alert Notification. Response Subsystem. Database. Target Agents. Anatomy of an Intrusion Detection Process. Intrusion Detection Myths. Myth #1: The Network Intrusion Detection Myth. Myth #2: The False-Positive Myth. Myth #3: The Automated Anomaly Detection Myth. Myth #4: The Real-Time Requirement Myth. Myth #5: The Automated Response Myth. Myth #6: The Artificial Intelligence Myth. Summary.

9. Public Key Infrastructure and Encryption.

Encryption Basics. Secret Key Encryption. Public Key Encryption. Key Lengths and Security Strength. Public Keys as Infrastructure. The Benefits of PKI. The Problems of PKI. Summary.

10. Encrypted Communications.

What is a Virtual Private Network? A Brief History of VPNs. VPN Technology in Business. VPN Technology. Point-to-Point VPNs. Client-to-Server VPNs. Application-Level VPNs. Secure Sockets Layer. SSL Example. Secure Shell. SSH Example. Summary.

11. Mobile Workers and Wireless LANs.

Mobile Users and Security. Physical Security Issues in Mobile Computing. Wireless Networks. Wireless over Long Distances (Miles). Wireless LANs (in the Same Building). Personal LANs (Within 10 Meters). Security in the Wireless World. Security in Radiospace. Securing Your WLAN. Security and Bluetooth. Cellular Security. Wireless and Mobile Computing in the Future. Summary.

12. Single Signon.

What is SSO? Why SSO Fails. Too Many Account Names. Too Many Passwords. Frequent Re-Entry. Password Resets. User Account Management. Should Your Organization Address SSO? Summary.

13. Digital Signatures and Electronic Commerce.

E-Commerce. Electronic Signatures. E-SIGN. Transactional Security. Identrus: A Transactional Security Infrastructure. Smart Cards in Electronic Commerce. Visa Compliance Standards. Summary.

III. IMPLEMENTATION.

14. Establishing a Security Program.

Step One: Define Responsible Personnel. Step Two: Establish Core Processes. The Risk Assessment/Data Classification Process. The User Administration Process. The Policy Definition Process. Technical Implementation, Planning, and Design. Step Three: Define Requirements. Step Four: Communicate! The Awareness Program. The Executive Communication Program. Step Five: Audit and Monitor. Configuration Control and Audit. Intrusion Monitoring and Vulnerability Scanning. Intrusion Response and Forensics. Security Performance Reporting. Summary.

15. Security Assessments.

What is Assessment? Penetration Testing. Vulnerability Assessment. Security Posture Review. Security Audit. Risk Assessment. Problems with Quantitative Risk Assessment. Summary.

16. Managed Security Services.

What Is MSS? The Business Case for Outsourcing. How Much Should You Outsource? Security Elements You Can Outsource. Perimeter Protection. Firewalls. Client-Side Firewalls. Virus Detection. VPNs. Vulnerability Assessments/Penetration Testing. Web Filtering. Intrusion Detection/Monitoring. Incident Response. Selecting a Managed Security Service Provider. Service Offerings. Service Level Agreements. SOCs. History. The Growing Market. Summary.

17. Response and Recovery.

Incident Response. Escalation Procedures. Incident Triage. Business Continuity. Elements of Business Continuity. CERT. National Coordination CERTs. The CERT Inside Your Company. Summary.

18. Implementing Web and Internet Security.

Establishing the Policy Base. Appropriate Use. Privacy. Data Location and Protection. Application Design. Authentication Requirements. Authorization and Scalability. Secure Code. Infrastructure Design. The DMZ of the Firewall. Server Connectivity. Operating System Configuration. Security Operations. Virus Scanners and Content Filters. Vulnerability Scanners. Intrusion Detection Tools. Change Control Process. Operating System Maintenance. More Than the Sum of its Parts. Summary.

IV. ODDS AND ENDS.

19. Legal Issues.

Introduction. Computer Crime Laws. Law Enforcement/Criminal Prosecutions. Tort Litigation. Negligence Litigation. Better Technology. Corporate Reluctance to Prosecute. Attacking Back. Liability When Your Network is Used to Attack Others. Standard of Due Care. Responsibilities. Evidentiary Issues. Rules of Evidence. Accuracy. Chain of Custody. Transparency. Case Study. Organizations. National White Collar Crime Center. National Cybercrime Training Partnership. High-Technology Crime Investigators Association. Government Regulation of Information Security. European Data Privacy Initiatives and U.S. Department of Commerce Safe Harbor. The Gramm-Leach-Bliley and Health Insurance Portability and Accountability Acts. Government Information Services Reform Act. Going Forward. Summary. Resources.

20. Putting It All Together.

Communication (again). Understand Your Company's Business. Advice on Politics. Protect Yourself. A Final Word.

Glossary.
Index.

Preface

Introduction:How to Read this Book

This book is directed to business people who are tasked with computer security responsibility, but it will also have value to security professionals looking for an overview. As such, security is viewed from a business perspective throughout the book. Topics are explored in a variety of technical depths to explain fully the impact on business and to give business professionals sufficient understanding to work effectively with their technical people. Whether you think of it as information technology (IT), information services (IS), or just the computer people, without a competent guide, security can go right over your head.

This book is divided into four sections.

Part 1—Introduction

This section introduces you to security, the threats you are protecting yourself from, and the basic technologies you will need to protect yourself.

Part 2—Protection Methods

This section explains the protection methods used commonly in today's business environment. This is where you will read about firewalls, virus protection, intrusion detection, etc.

Part 3—Implementation

This section focuses on implementation methods and choices for different sizes of businesses. In Part 3, you will read about risk assessment, configuration, deployment, and managed security services.

Part 4—Odds and Ends

This section includes discussions of legal issues, company politics, and other factors necessary in your success with information security.

To help you, the authors have provided plenty of examples, anecdotes, and technical descriptions to guide you.The authors understand that businesses are not created equal. To accommodate different sizes of businesses, we offer the following guides to help you find the information relevant to your situation.

Large Enterprise

A large enterprise is one with more than 1,000 servers, more than $1 billion in revenue, and more than 2,000 employees. Large enterprises are usually characterized by multiple worldwide sites and special requirements, such as "follow the sun" management. Large enterprises will likely require more security expertise than is offered in this book.

Medium Business

Medium-sized businesses have over $100 million in revenue, more than 100 servers, and over 500 employees. Medium businesses usually have multiple sites. This book will be especially useful to executives and managers of medium-sized businesses.

Small Business

A small business has less than $100 million in revenue, fewer than 100 servers, and fewer than 100 employees. Although most of the information in this book will have value to small businesses, some of it may be more than is necessary.

Security is a journey, not a destination. There will not be a point in this journey when you can say, "Now I'm secure." This book will be your road map.



Updates

Submit Errata

