book

Network Security Architectures

Name: Network Security Architectures
Author: Sean Convery
ISBN: 158705115X

by Sean Convery

April 2004

Intermediate to advanced

792 pages

21h 24m

English

Cisco Press

Read now

Unlock full access

About This eBook
Title Page
Copyright Page
About the Author
About the Technical Reviewers
Acknowledgments
A Note from Cisco Systems on the SAFE Blueprint and Network Security Architectures
Dedication Page
Contents at a Glance
Table of Contents
Icons Used in This Book
Command Syntax Conventions

Foreword
Preface
This Book’s Relationship to the SAFE White PapersWhy Network Security?New Technologies, New VulnerabilitiesHow This Book Is OrganizedWho Should Read This Book?Network/Security ArchitectNetwork/Security Operations EngineerIT ManagerCIO and Others with Passing InterestCaveatsSummary
Part I: Network Security Foundations
Chapter 1. Network Security Axioms
Network Security Is a SystemBusiness Priorities Must Come FirstNetwork Security Promotes Good Network DesignEverything Is a TargetEverything Is a WeaponStrive for Operational SimplicityGood Network Security Is PredictableAvoid Security Through ObscurityConfidentiality and Security Are Not the SameSummaryReferenceApplied Knowledge Questions
Chapter 2. Security Policy and Operations Life Cycle
You Can’t Buy Network SecurityWhat Is a Security Policy?Security Policy Enforcement ConsiderationsSecurity System Development and Operations OverviewSecurity System DevelopmentSecurity System Operations Life CycleSummaryReferencesApplied Knowledge Questions
Chapter 3. Secure Networking Threats
The Attack ProcessAttacker TypesScript KiddieCrackerEliteVulnerability TypesSoftware VulnerabilitiesHardware VulnerabilitiesConfiguration VulnerabilitiesPolicy VulnerabilitiesUsage VulnerabilitiesAttack ResultsDisclosure of InformationCorruption of InformationDenial of ServiceTheft of ServiceIncreased AccessAttack TaxonomyReadManipulateSpoofFloodRedirectCompositeSummaryReferencesApplied Knowledge Questions
Chapter 4. Network Security Technologies
The Difficulties of Secure NetworkingSecurity TechnologiesIdentity TechnologiesHost and Application SecurityNetwork FirewallsContent FilteringNetwork Intrusion Detection SystemsCryptographyEmerging Security TechnologiesHybrid Host SolutionsInline NIDSApplication FirewallsSummaryReferencesApplied Knowledge Questions
Part II: Designing Secure Networks
Chapter 5. Device Hardening
Components of a Hardening StrategySecurity PolicyDevice LocationThreat ProfileFunctional RequirementsManagement RequirementsNetwork DevicesRouterSwitchesFirewallsNIDSHost Operating SystemsPartitioning Disk SpaceTurning Off Unneeded ServicesPatching the Services NeededLogging Critical EventsApplicationsAppliance-Based Network ServicesRogue Device DetectionSummaryReferencesApplied Knowledge Questions
Chapter 6. General Design Considerations
Physical Security IssuesControl Physical Access to FacilitiesControl Physical Access to Data CentersSeparate Identity Mechanisms for Insecure LocationsPrevent Password Recovery Mechanisms in Insecure LocationsBe Aware of Cable Plant IssuesBe Aware of Electromagnetic RadiationBe Aware of Physical PC Security ThreatsLayer 2 Security ConsiderationsL2 Control ProtocolsMAC Flooding ConsiderationsVLAN Hopping ConsiderationsARP ConsiderationsDHCP ConsiderationsPrivate VLANsL2 Best Practices RecommendationsIP Addressing Design ConsiderationsGeneral Best Practices and Route SummarizationIngress/Egress FilteringNATICMP Design ConsiderationsICMP Message Type FilteringRouting ConsiderationsRouting Protocol SecurityAsymmetric Routing and State-Aware Security TechnologyTransport Protocol Design ConsiderationsDoS Design ConsiderationsNetwork Flooding Design ConsiderationsTCP SYN Flooding Design ConsiderationsICMP Unreachable DoS ConsiderationsSummaryReferencesApplied Knowledge Questions
Chapter 7. Network Security Platform Options and Best Deployment Practices
Network Security Platform OptionsGeneral-Purpose Operating System Security DevicesAppliance-Based Security DevicesNetwork-Integrated Security FunctionsNetwork Security Platform Option RecommendationsNetwork Security Device Best PracticesFirewallsProxy Servers/Content FilteringNIDSSummaryReferenceApplied Knowledge Questions
Chapter 8. Common Application Design Considerations
E-MailBasic Two-Tier E-Mail DesignDistributed Two-Tier E-Mail DesignAccess Control ExampleMail Application Design RecommendationsDNSDon’t Put All Your DNS Servers in One PlaceHave More Than One Authoritative DNS ServerMake Your External DNS Servers Nonrecursive Responders OnlyProvide Protected Internal DNS ServersSeparate the Information Provided by External and Internal DNS ServersLimit Zone Transfers to Authorized ServersDNS Filtering Case StudiesHTTP/HTTPSSimple Web DesignTwo-Tier Web DesignThree-Tier Web DesignFTPActive ModePassive ModeInstant MessagingApplication EvaluationSummaryReferencesApplied Knowledge Questions
Chapter 9. Identity Design Considerations
Basic Foundation Identity ConceptsDevice Versus User IdentityNetwork Versus Application IdentityWhom Do You Trust?Identity and Authentication, Authorization, and AccountingShared IdentityCryptographic Identity ConsiderationsTypes of IdentityPhysical AccessMAC AddressesIP AddressesLayer 4 InformationUsernamesDigital CertificatesBiometricsFactors in IdentityRole of Identity in Secure NetworkingIdentity Technology GuidelinesAAA Server Design Guidelines802.1x/EAP Identity Design GuidelinesGateway-Based Network AuthenticationPKI Usage BasicsIdentity Deployment RecommendationsDevice to NetworkUser to NetworkUser to ApplicationSummaryReferencesApplied Knowledge Questions
Chapter 10. IPsec VPN Design Considerations
VPN BasicsTypes of IPsec VPNsSite-to-Site VPNsRemote User VPNsIPsec Modes of Operation and Security OptionsThe Three Elements of IPsecTransport Mode and Tunnel ModeIPsec SA EstablishmentOther Security OptionsTopology ConsiderationsSplit TunnelingTopology ChoicesDesign ConsiderationsPlatform OptionsIdentity and IPsec Access ControlLayer 3 IPsec ConsiderationsFragmentation and Path Maximum Transmission Unit DiscoveryFirewall and NIDS Placement for VPNsHigh AvailabilityQoSIPsec Vendor InteroperabilitySite-to-Site Deployment ExamplesBasic IPsecGRE + IPsecDynamic Multipoint VPNIPsec OutsourcingNetwork-Based Managed IPsecCPE Managed IPsecSummaryReferencesApplied Knowledge Questions
Chapter 11. Supporting-Technology Design Considerations
ContentCachingContent Distribution and RoutingLoad BalancingSecurity ConsiderationsServer Load BalancingSecurity Device Load BalancingWireless LANsGeneral ConsiderationsTechnology OptionsUnique Deployment OptionsWLAN ConclusionIP TelephonySecurity ConsiderationsDeployment OptionsIP Telephony RecommendationsSummaryReferencesApplied Knowledge Questions
Chapter 12. Designing Your Security System
Network Design RefresherCore, Distribution, Access/EdgeManagementSecurity System ConceptsDomains of TrustChoke PointsSecurity Roles: Access/Edge, Distribution, CoreImpact of Network Security on the Entire DesignRouting and IP AddressingManageabilityScalability and PerformanceTen Steps to Designing Your Security SystemStep 1: Review Completed Security Policy DocumentsStep 2: Analyze the Current Network Against the Security PolicyStep 3: Select Technologies and Evaluate Product CapabilitiesStep 4: Design an Ideal Rough Draft of the Security SystemStep 5: Test Key Components in a LabStep 6: Evaluate and Revise Design/PolicyStep 7: Finalize DesignStep 8: Implement the Security System in One Critical AreaStep 9: Roll Out to Other AreasStep 10: Design/Policy ValidationTwo-Step Evaluation ChecklistSummaryApplied Knowledge Questions
Part III: Secure Network Designs
Chapter 13. Edge Security Design
What Is the Edge?Expected ThreatsThreat MitigationIdentity ConsiderationsNetwork Design ConsiderationsISP RouterNumber of Public ServersBranch Versus Head-End Design ConsiderationsRemote Access AlternativesSmall Network Edge Security DesignDesign RequirementsDesign OverviewEdge Devices and Security RolesVPNDesign EvaluationDesign AlternativesMedium Network Edge Security DesignDesign RequirementsDesign OverviewInternet EdgeRemote Access EdgeDesign EvaluationDesign AlternativesHigh-End Resilient Edge Security DesignDesign RequirementsDesign OverviewInternet EdgeRemote Access EdgeDesign EvaluationDesign AlternativesProvisions for E-Commerce and Extranet DesignE-CommerceExtranetSummaryReferencesApplied Knowledge Questions
Chapter 14. Campus Security Design
What Is the Campus?Campus Trust ModelExpected ThreatsThreat MitigationIdentity ConsiderationsNetwork Design ConsiderationsLayer 2 ConsiderationsStateful Versus Stateless ACLs and L3 Versus L4 FilteringIntrusion Detection SystemsWLAN ConsiderationsNetwork ManagementRogue DevicesSmall Network Campus Security DesignDesign RequirementsDesign OverviewCampus Devices and Security RolesDesign EvaluationDesign AlternativesIncreased Security AlternativeDecreased Security AlternativeMedium Network Campus Security DesignDesign RequirementsDesign OverviewCampus Devices and Security RolesDesign EvaluationDesign AlternativesIncreased Security AlternativeDecreased Security AlternativeHigh-End Resilient Campus Security DesignDesign RequirementsDesign OverviewCampus Devices and Security RolesDesign EvaluationDesign AlternativesSummaryReferencesApplied Knowledge Questions
Chapter 15. Teleworker Security Design
Defining the Teleworker EnvironmentExpected ThreatsThreat MitigationIdentity ConsiderationsNetwork Design ConsiderationsHost ProtectionsNetwork-Transit ProtectionsSoftware-Based Teleworker DesignDesign RequirementsDesign OverviewHardware-Based Teleworker DesignDesign RequirementsDesign OverviewPhysical Security ConsiderationsDesign EvaluationsSummaryReferenceApplied Knowledge Questions
Part IV: Network Management, Case Studies, and Conclusions
Chapter 16. Secure Network Management and Network Security Management
Utopian Management GoalsOrganizational RealitiesProtocol CapabilitiesTelnet/Secure ShellHTTP/HTTPSSimple Network Management ProtocolTFTP/FTP/SFTP/SCPSyslogNetFlowOthersTool CapabilitiesNetwork Security Management ToolsSecure Network Management ToolsSecure Management Design OptionsCleartext In-BandCryptographically Secure In-Band (Session and Application Layer)Cryptographically Secure In-Band (Network Layer)Hybrid Management DesignSecure Network Management Optional ComponentsNetwork Security Management Best PracticesMonitor Critical Security Events 24*7*365Separate Historical Event Data from Critical NotificationsChoose Sensible Logging LevelsSeparate Network Management and Network Security ManagementFocus on Operational RequirementsConsider OutsourcingSummaryReferencesApplied Knowledge Questions
Chapter 17. Case Studies
IntroductionReal-World ApplicabilityOrganizationOrganization OverviewCurrent DesignSecurity RequirementsDesign ChoicesMigration StrategyAttack ExampleNetGamesRUs.comOrganization OverviewCurrent DesignSecurity RequirementsDesign ChoicesMigration StrategyAttack ExampleUniversity of InsecurityOrganization OverviewCurrent DesignSecurity RequirementsDesign ChoicesMigration StrategyAttack ExampleBlack Helicopter Research LimitedOrganization OverviewCurrent DesignSecurity RequirementsDesign ChoicesMigration StrategyAttack ExampleSummaryReferenceApplied Knowledge Questions
Chapter 18. Conclusions
IntroductionManagement Problems Will ContinueSecurity Will Become Computationally Less ExpensiveHomogeneous and Heterogeneous NetworksLegislation Should Garner Serious ConsiderationIP Version 6 Changes ThingsNetwork Security Is a SystemSummaryReferences
Appendix A. Glossary of Terms
Appendix B. Answers to Applied Knowledge Questions
Chapter 1Chapter 2Chapter 3Chapter 4Chapter 5Chapter 6Chapter 7Chapter 8Chapter 9Chapter 10Chapter 11Chapter 12Chapter 13Chapter 14Chapter 15Chapter 16
Appendix C. Sample Security Policies
INFOSEC Acceptable Use Policy1.0 Overview2.0 Purpose3.0 Scope4.0 Policy5.0 Enforcement6.0 Definitions7.0 Revision HistoryPassword Policy1.0 Overview2.0 Purpose4.0 Policy5.0 Enforcement6.0 Definitions7.0 Revision HistoryGuidelines on Antivirus Process
Index
Code Snippets

Content preview from Network Security Architectures

About the Author

Sean Convery, CCIE No. 4232, is a security architect in the Cisco Systems VPN and Security Business Unit, focusing on new security technologies. He has been with Cisco for six years and is best known as the principle architect of the original Cisco SAFE Security Blueprint, as well as author of several of its white papers. During his time at Cisco, Sean has presented secure network design to thousands of Cisco customers around the world and has consulted with scores of customers on their security designs both large and small. Prior to his time at Cisco, Sean held various positions in both IT and security consulting during his 12 years in networking.

When not thinking about security, Sean enjoys two-wheeled transportation (with ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Network Security Fundamentals

Gert De Laet, Gert Schauwers

Integrated Security Technologies and Solutions - Volume II: Cisco Security Solutions for Network Access Control, Segmentation, Context Sharing, Secure Connectivity and Virtualization

Chad Mitchell, Jamie Sanbower, Aaron Woland, Vivek Santuka

Cisco ASA: All-in-One Firewall, IPS, and VPN Adaptive Security Appliance

Jazib Frahim - CCIE No. 5459, Omar Santos

Network Access Control For Dummies®

Jay Kelley, Rich Campagna, Denzil Wessels

Publisher Resources

ISBN: 158705115XPurchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Network Security Architectures

by Sean Convery

About the Author

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.