book

Network Security Fundamentals

Name: Network Security Fundamentals
ISBN: 1587051672

by Gert De Laet, Gert Schauwers

September 2004

Beginner

480 pages

9h 37m

English

Cisco Press

Read now

Unlock full access

Copyright
Dedications
About the Authors
About the Technical Reviewers
Acknowledgments
Icons Used in This Book
Command Syntax Conventions
Foreword
IntroductionGoals of This BookWho Should Read This Book?Organization of This BookPart I: IntroductionPart II: Building BlocksPart III: Tools and TechniquesPart IV: Appendixes
I. Introduction
1. Network Security Overview
Defining TrustMost TrustedLess TrustedLeast TrustedWeaknesses and VulnerabilitiesResponsibilities for Network SecuritySecurity ObjectivesConclusionQ&A
2. Understanding Vulnerabilities—The Need for Security
Risk and VulnerabilityTCP/IP Suite WeaknessesIPTCPTCP/IP Security IssuesIP Address SpoofingCovert ChannelsIP Fragment AttacksTCP FlagsSYN FloodClosing a Connection by FINConnection HijackingCountermeasuresBuffer OverflowsBuffer Overflow MechanismsBuffer Overflow ProtectionCountermeasuresSpoofing TechniquesAddress Resolution Protocol SpoofingDomain Name Service SpoofingCountermeasuresSocial EngineeringTechniquesCountermeasuresConclusionQ&A
3. Understanding Defenses
Digital IDsIntrusion Detection SystemPC Card–Based SolutionsSecurity CardsHardware KeysPC Encryption CardsPhysical SecurityOutside and External SecurityInternal SecurityDisaster-Recovery PlansPersonnel AwarenessEncrypted LoginSecure Shell ProtocolKerberos Encrypted Login SessionsSecure Socket Layer (HTTP versus HTTPS)FirewallsReusable PasswordsWeaknessesSample Password PolicyAntivirus SoftwareEncrypted FilesBiometricsFingerprint ScanningVoice RecognitionTyping BiometricsFace RecognitionSignature RecognitionConclusionQ&A

II. Building Blocks
4. Cryptography
Cryptography versus CryptanalysisManual SystemsCrypto MachinesComputersModern-Day TechniquesSymmetric Key AlgorithmsData Encryption StandardTriple Data Encryption StandardAESAsymmetric Key AlgorithmsDiffie-HellmanRivest, Shamir, AdelmanPretty Good PrivacyHashing AlgorithmsMessage Digest 5SHA-1Secure Socket Layer and Transport Layer SecurityDigital CertificatesCharacteristics of Digital CertificatesEnrolling in a CAConclusionQ&A
5. Security Policies
Defining a Security Policy?Importance of a Security PolicyDevelopment ProcessIncident Handling ProcessSecurity WheelSample Security PolicyPurposeScopePolicyEnforcementDefinitionsConclusionQ&A
6. Secure Design
Network Design—PrinciplesTop-Down Design PracticesRequirements and ConstraintsTechnological ConstraintsSocial ConstraintsPolitical ConstraintsEconomic ConstraintsDesign Activities, Tools, and TechniquesAuditing and Analyzing an Existing NetworkSimulating Network TrafficDefense in DepthNetwork Design—MethodologyStages of the NetworkPlanning PhaseDesign PhaseImplementation PhaseOperation PhaseOptimization PhaseReturn on InvestmentPhysical Security IssuesSecuring the PerimeterInternal SecurityPersonnel TrainingSurvivability and RecoverySwitches and HubsConclusionQ&A
III. Tools and Techniques
7. Web Security
HardeningFile SystemsWeb ServersLoggingRestricting AccessBrowsersSecurity ZonesCookiesCase StudyConclusionQ&A
8. Router Security
Basic Router SecurityAdministrative AccessServicesRouter Security to Protect the NetworkAccess ListsEnhanced Access ListsDynamic Access ListsTime-Based Access ListsReflexive Access ListsCBACCase StudyConclusionQ&AReferences in This Chapter
9. Firewalls
Firewall BasicsDifferent Types of FirewallsHardware Firewalls: PIX and NetScreenPIXASAData Flow for the PIXNetScreen FirewallCheck Point Software FirewallsEnhancements for FirewallsNATProxy ServicesContent FiltersAntivirus SoftwareCase Study: Placing Filtering Routers and FirewallsSummaryQ&A
10. Intrusion Detection System Concepts
Introduction to Intrusion DetectionIDS FundamentalsNotification AlarmsSignature-Based IDSPolicy-Based IDSAnomaly-Based IDSNetwork IDS versus Host IDSEvasion and Antievasion TechniquesOrganizational Issues and ComplicationsTechnological ConstraintsSocial ConstraintsPolitical ConstraintsHost-Based IDSsHost Sensor Components and ArchitectureCisco Secure AgentCisco Secure Agent ManagerDeploying Host-Based Intrusion Detection in the NetworkNetwork-Based IDSsNetwork Sensor Components and ArchitectureDeploying Network-Based Intrusion Detection in the NetworkRouter IDS Features and Network ModulesPIX IDSResponse to Events and AlertsIP Session LoggingActive Response—TCP ResetsActive Response—Shunning or BlockingNotification and ReportingIDS Management Communications—Monitoring the NetworkCommunication Syntax—RDEPOut-of-Band ManagementIn-Band ManagementSensor MaintenanceCase Study: Deployment of IDS Sensors in the Organization and Their Typical PlacementIDS Placement on the Network BlueprintIDS Sensor Initialization and ConfigurationIDS TuningNetwork Under Attack—IDS Event ViewerIDS Active Responses in Action—Blocking a HostConclusionQ&A
11. Remote Access
AAA ModelAuthenticationAuthorizationAccountingAAA ServersTACACS+ OverviewRADIUS OverviewTACACS+ versus RADIUSKerberosLock-and-Key FeatureTwo-Factor IdentificationCase Study: Configuring Secure Remote AccessTACACS+ Configuration Task ListRouter COMMSROOM1 Setup and Configuration for This ScenarioTest and Troubleshoot Configuration for This ScenarioSummaryQ&A
12. Virtual Private Networks
Generic Routing Encapsulation TunnelsIP SecurityEncryptionData IntegrityOrigin AuthenticationPreshared KeysRSA SignaturesRSA-Encrypted NoncesAntireplay ProtectionProtocol FrameworkAHESPTunnel or Transport ModeTransport ModeTunnel ModeTransform SetsVPNs with IPSecCase Study: Remote Access VPNConclusionQ&A
13. Public Key Infrastructure
Public Key DistributionTrusted Third PartyPKI TopologyEnrollment ProcedureRevocation ProcedureCase Study: Creating Your Own CAConclusionQ&A
14. Wireless Security
Different WLAN ConfigurationsWhat Is a WLAN?How Wireless WorksWLAN ArchitectureSetting Up the WLAN ConnectionRisks of Open Wireless PortsSSID VulnerabilitiesOpen Authentication VulnerabilitiesShared Key Authentication VulnerabilitiesWEP Protocol OverviewWEP Protocol VulnerabilitiesCountermeasures to WEP Protocol VulnerabilitiesEAP Protocol and the 802.11i StandardWar-Driving and War-ChalkingSAFE WLAN Design Techniques and ConsiderationsCase Study: Adding Wireless Solutions to a Secure NetworkConclusionQ&A
15. Logging and Auditing
LoggingSYSLOGSimple Network Management ProtocolSNMP NotificationsSNMP VersionsSNMP ConfigurationCreate or Modify Access Control for an SNMP CommunityCreate or Modify an SNMP View RecordSpecify an SNMP Server Engine NameSpecify SNMP Server Group NamesConfigure SNMP Server HostsConfigure SNMP Server UsersMonitor and Troubleshoot SNMP StatusConfigure SNMP NotificationsRemote MonitoringService Assurance AgentCase StudyConclusionQ&A
IV. Appendixes
A. SAFE Blueprint
Introduction to the SAFE BlueprintSAFE Blueprint: Overview of the ArchitectureSummaryReferences in This Appendix
B. SANS Policies
SANS OverviewSANS Initiatives and ProgramsSecurity Policy ProjectIs It a Policy, a Standard, or a Guideline?Sample PoliciesReferences in This Appendix
C. NSA Guidelines
Security GuidesReferences in This Appendix
D. Answers to Chapter Q&A
Chapter 1 Q&AChapter 2 Q&AChapter 3 Q&AChapter 4 Q&AChapter 5 Q&AChapter 6 Q&AChapter 7 Q&AChapter 8 Q&AChapter 9 Q&AChapter 10 Q&AChapter 11 Q&AChapter 12 Q&AChapter 13 Q&AChapter 14 Q&AChapter 15 Q&A
Bibliography
BooksWebsite References

Content preview from Network Security Fundamentals

Chapter 15. Logging and Auditing

On completing this chapter, you will be able to

Describe the different tools available for logging and auditing
Describe a SYSLOG server
Explain how to configure SNMP
Describe RMON
Define a Service Assurance Agent (SAA)

This chapter presents a brief overview of some of the logging and auditing tools that are available today. Tools and protocols such as SYSLOG, SNMP, RMON, and SAA may sound foreign to you for the moment, but they will hold no secrets by the end this chapter. If you have a large or midsize network, it is always important to know what is occurring on it. These tools can help you to keep on top of the network.

Logging

By default, routers send logging messages to a logging process. This logging process controls ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 1587051672Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Network Security Fundamentals

by Gert De Laet, Gert Schauwers

Chapter 15. Logging and Auditing

Logging

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.