Network Security Foundations Matthew Strebe O San SrBBC Francisco London
Introduction xv Chapter 1 Security Principles 1 Why Computers Aren't Secure 2 The History of Computer Security 4-1945 5 1945-1955 7 1955-1965 7 1965-1975 7 1975-1985 8 1985-1995 9 1995-2005 11 2005-12 Security Concepts 13 Trust 13 Authentication 13 Chain of Authority 14 Accountability 15 Access Control 15 Terms to Know 17 Review Questions 18 Chapter 2 Understanding Hacking 19 What Is Hacking? 20 Types of Hackers 20 Security Experts 21 Script Kiddies 21 Underemployed Adult Hackers 21 Ideological Hackers 22 Criminal Hackers 23 Corporate Spies 23 Disgruntled Employees 24 Vectors That Hackers Exploit 24 Direct Intrusion 25 Dial-Up 25 Internet 26 Wireless 26
vlll Contents Hacking Techniques 27 Target Selection 27 Information Gathering 29 Attacks 30 Terms to Know 37 Review Questions 38 Chapter 3 Encryption and Authentication 39 Encryption 40 Secret Key Encryption 41 One-Way Functions (Hashes) 41 Public Key Encryption 43 Hybrid Cryptosystems 44 Authentication 44 Password Authentication 45 Session Authentication 47 Public Key Authentication 48 Certificate-Based Authentication 49 Biometric Authentication 50 Terms to Know 51 Review Questions 52 Chapter 4 Managing Security 53 Developing a Security Policy 54 Creating a Policy Requirements Outline 54 Security Policy Best Practices 58 Implementing Security Policy 63 Applying Automated Policy 64 Human Security 65 Updating the Security Policy 67 The Security Cycle 67 Terms to Know 69 Review Questions 70 Chapter 5 Border Security 71 Principles of Border Security 72 Understanding Firewalls 74 Fundamental Firewall Functions 74 Firewall Privacy Services 82 Virtual Private Networks 83 Other Border Services 83
Selecting a Firewall 84 Terms to Know 85 Review Questions 86 Chapter 6 Virtual Private Networks 87 Virtual Private Networking Explained 88 IP Encapsulation 88 Cryptographic Authentication 89 Data Payload Encryption 90 Characteristics of VPNs 90 Common VPN Implementations 91 IPSec 92 L2TP 93 PPTP 94 PPP/SSL or PPP/SSH 95 VPN Best Practices 96 Terms to Know 99 Review Questions 100 Chapter 7 Securing Remote and Home Users 101 The Remote Security Problem 102 Virtual Private Security Holes 102 Laptops 102 Protecting Remote Machines 103 VPN Connections 104 Data Protection and Reliability 106 Backups and Archiving 106 Protecting against Remote Users 107 Terms to Know 108 Review Questions 109 Chapter 8 Malware and Virus Protection 111 Understanding Malware 112 Understanding Viruses 112 Virus Protection 117 Prevention 117 Natural Immunity 118 Active Protection 118 Understanding Worms and Trojan Horses 119 Protecting Against Worms 121 Implementing Virus Protection 121
Client Virus Protection 122 Server-Based Virus Protection 123 E-Mail Gateway Virus Protection 124 Firewall-Based Virus Protection 124 Enterprise Virus Protection 125 Terms to Know 125 Review Questions 126 Chapter 9 Creating Fault Tolerance 127 Causes for Loss 128 Human Error 128 Routine Failure Events 128 Crimes 130 Environmental Events 132 Fault Tolerance Measures 133 Backups 133 Uninterruptible Power Supplies (UPSs) and Power Generators 138 Redundant Array of Independent Disks (RAID)... 139 Permissions 141 Border Security 141 Auditing 141 Offsite Storage 141 Archiving 142 Deployment Testing 142 Circuit Redundancy 143 Physical Security 143 Clustered Servers 144 Terms to Know 147 Review Questions 148 Chapter 10 Windows Security 149 Windows Local Security 150 Security Identifiers 151 Logging In 152 Resource Access 153 Objects and Permissions 154 NTFS File System Permissions 157 Encrypting File System (EFS) 158 Windows Network Security 159 Active Directory 159 Kerberos Authentication and Domain Security 160 Group Policy 163
xi Share Security 166 IPSec 169 Terms to Know 171 Review Questions 172 Chapter 11 Securing Unix Servers 173 A Brief History of Unix 174 Unix Security Basics 177 Understanding Unix File Systems 177 User Accounts 180 File System Security 184 Access Control Lists 186 Execution Permissions 186 Terms to Know 189 Review Questions 190 Chapter 12 Unix Network Security 191 Unix Network Security Basics 192 Remote Logon Security 193 Remote Access 194 Pluggable Authentication Module (PAM) 195 Distributed Logon 196 Distributed passwd 196 NIS and NIS+ 196 Kerberos 198 File Sharing Security 200 File Transfer Protocol (FTP) 201 Network File System (NFS) 203 Hypertext Transfer Protocol (HTTP) 204 Samba 205 Firewalling Unix Machines 206 IPTables and IPChains 207 TCP Wrappers 208 Firewall Toolkit (FWTK) 209 Terms to Know 210 Review Questions 211 Chapter 13 Web Server Security 213 Web Security Problems 214 Implementing Web Server Security 214 Common Security Solutions 215
Apache Security 226 Internet Information Services Security 229 Terms to Know 235 Review Questions 236 Chapter 14 E-mail Security 237 E-mail Encryption and Authentication 238 S/MIME 239 PGP 240 Mail Forgery 240 E-mail Viruses 241 Outlook Viruses 242 Commercial Gateway Virus Scanners 242 AMaViS 243 Attachment Security 244 Strip All Attachments 244 Allow Only Specific Attachments 245 Strip Only Dangerous Attachments 245 Foreign E-mail Servers 248 Spam 249 Authenticating SMTP 250 Systemic Spam Prevention 253 Terms to Know 256 Review Questions 257 Chapter 15 Intrusion Detection 259 Intrusion Detection Systems 260 Inspectors 260 Decoys 261 Auditors 263 Available IDSs 263 Windows System 264 Tripwire 265 Snort 265 Demarc PureSecure 266 NFR Network Intrusion Detector 267 Terms to Know 267 Review Questions 268
xiil Appendix A Answers to Review Questions 269 Chapter 1 269 Chapter 2 270 Chapter 3 271 Chapter 4 272 Chapter 5 273 Chapter 6 274 Chapter 7 275 Chapter 8 276 Chapter 9 276 Chapter 10 278 Chapter 11 279 Chapter 12 280 Chapter 13 281 Chapter 14 282 Chapter 15 283 Glossary 285 Index 299