Network Security first-step

Second Edition

Tom Thomas and Donald Stoddard

Your first step into the world of network security

• No security experience required
• Includes clear and easily understood explanations
• Makes learning easy

Your first step to network security begins here!

• Learn how hacker attacks work, from start to finish
• Choose the right security solution for each type of risk
• Create clear and enforceable security policies, and keep them up to date
• Establish reliable processes for responding to security advisories
• Use encryption effectively, and recognize its limitations
• Secure your network with firewalls, routers, and other devices
• Prevent attacks aimed at wireless networks

No security experience required!

Computer networks are indispensible, but they also are not secure. With the proliferation of security threats, many people and companies are looking for ways to increase the security of their networks and data. Before you can effectively implement security technologies and techniques, you need to make sense of this complex and quickly evolving world of hackers and malware, as well as the tools to combat them.

Network Security First-Step, Second Edition explains the basics of network security in easy-to-grasp language that all of us can understand. This book takes you on a guided tour of the core technologies that make up and control network security. Whether you are looking to take your first step into a career in network security or simply are interested in gaining knowledge of the technology, this book is for you!

Tom Thomas, CCIE No. 9360, claims he never works because he loves what he does. When you meet him, you will agree!

Throughout his many years in the networking industry, Tom has taught thousands of people how networking works and the secrets of the life of a packet. Tom is the author or coauthor of 18 books on networking, including the acclaimed OSPF Network Design Solutions, published by Cisco Press and now in its second edition. Beyond his many books, Tom also has taught computer and networking skills through his roles as an instructor and training-course developer.

In addition to holding the Cisco Certified Internetwork Expert (CCIE) certification-the pinnacle of networking certifications-Tom holds Cisco CCNP Security, CCDA, and CCNA certifications and is a certified Cisco Systems instructor (CCSI). These certifications support his industry-proven, problem-solving skills through technical leadership with demonstrated persistence and the ability to positively assist businesses in leveraging IT resources in support of their core business. He has also completed his Master of Science degree in network architecture and is looking at a doctorate next.

Tom currently is the CIO of Qoncert, a Cisco Gold Partner in Southern Florida that has an affiliated arm known as CCPrep.com, a Cisco Learning Partner, where he provides strategic direction and a little hands-on for customers of all types.

Donald Stoddard began his career in information technology in 1998, designing networks and implementing security for schools in North Dakota and South Dakota. He then went on to design and implement Geographical Information Systems (GIS) for a firm in Denver, Colorado. While there, he earned his Bachelor of Science degree in computer information systems management from Colorado Christian University. From Colorado, he then moved south, learned the ins-and-outs of Cisco VoIP, and began working through designing and securing VoIP solutions throughout the southeast. Don holds Microsoft MCSA and Linux+ and Security+ certifications and is presently wading through the CISSP material.

Currently, Don works for the Department of the Navy as the Information Assurance Officer for one of the premier Navy research and development labs, where he provides certification and accreditation guidance for the various projects being developed for implementation and deployment.

Introduction xxii

Chapter 1 There Be Hackers Here! 1

Essentials First: Looking for a Target 2

Hacking Motivations 3

Targets of Opportunity 4

Are You a Target of Opportunity? 6

Targets of Choice 7

Are You a Target of Choice? 7

The Process of an Attack 9

Reconnaissance 9

Footprinting (aka Casing the Joint) 11

Scanning 18

Enumeration 23

Enumerating Windows 24

Gaining Access 26

Operating System Attacks 27

Application Attacks 27

Misconfiguration Attacks 28

Scripted Attacks 29

Escalating Privilege 30

Covering Tracks 31

Where Are Attacks Coming From? 32

Common Vulnerabilities, Threats, and Risks 33

Overview of Common Attacks and Exploits 36

Network Security Organizations 39

CERT Coordination Center 40

SANS 40

Center for Internet Security (CIS) 40

SCORE 41

Internet Storm Center 41

National Vulnerability Database 41

Security Focus 42

Learning from the Network Security Organizations 42

Chapter Summary 43

Chapter Review 43

Chapter 2 Security Policies 45

Responsibilities and Expectations 50

A Real-World Example 50

Who Is Responsible? You Are! 50

Legal Precedence 50

Internet Lawyers 51

Evolution of the Legal System 51

Criminal Prosecution 52

Real-World Example 52

Individuals Being Prosecuted 53

International Prosecution 53

Corporate Policies and Trust 53

Relevant Policies 54

User Awareness Education 54

Coming to a Balance 55

Corporate Policies 55

Acceptable Use Policy 57

Policy Overview 57

Purpose 58

Scope 58

General Use and Ownership 58

Security and Proprietary Information 59

Unacceptable Use 60

System and Network Activities 61

Email and Communications Activities 62

Enforcement 63

Conclusion 63

Password Policy 64

Overview 64

Purpose 64

Scope 64

General Policy 65

General Password Construction Guidelines 66

Password Protection Standards 67

Enforcement 68

Conclusion 68

Virtual Private Network (VPN) Security Policy 69

Purpose 69

Scope 69

Policy 70

Conclusion 71

Wireless Communication Policy 71

Scope 72

Policy Statement 72

General Network Access Requirements 72

Lab and Isolated Wireless Device Requirements 72

Home Wireless Device Requirements 73

Enforcement 73

Definitions 73

Revision History 73

Extranet Connection Policy 74

Purpose 74

Scope 74

Security Review 75

Third-Party Connection Agreement 75

Business Case 75

Point of Contact 75

Establishing Connectivity 75

Modifying or Changing Connectivity and Access 76

Terminating Access 76

Conclusion 76

ISO Certification and Security 77

Delivery 77

ISO/IEC 27002 78

Sample Security Policies on the Internet 79

Industry Standards 79

Payment Card Industry Data Security Standard (PCI DSS) 80

Sarbanes-Oxley Act of 2002 (SOX) 80

Health Insurance Portability and Accounting Act (HIPAA) of 1996 81

Massachusetts 201: Standards for the Protection of Personal Information of Residents of the Commonwealth 81

SAS 70 Series 82

Chapter Summary 82

Chapter Review 83

Chapter 3 P…