Hardening Network Infrastructure

By: Wes Noonan

Write A Review

Paperback | 6 May 2004

At a Glance

Paperback
576 Pages

Dimensions(cm)
22.86 x 18.42 x 3.18

Paperback

$85.75

or 4 interest-free payments of $21.44 with

Ships in 15 to 25 business days

"This book is invaluable to anyone facing the challenges of security in a business environment." --Paul D. Robertson, Moderator of Firewall-Wizards and Director of Risk Assessment, TruSecure Corporation

A Note From Series Editor: "I first got to know Wesley Noonan through a common newsgroup. His insightful and technical comments stuck with me, and I finally met him at a conference several years later. Wes has the gift to present network security in a concise, well-reasoned way--easy for everyone to understand regardless of their security or networking knowledge. His writing style reflects his congenial presentation manner and his knowledge, and his eagerness to share his expertise is exceptional. Wes's guide to hardening your network infrastructure provides the step-by-step how-to approach that you need to build, deploy, and maintain a security defense. I've read every word; you will not be disappointed." --Roberta Bragg

Features a four-part hardening methodology:

Do This Now!--Checklist of immediate steps to take to lockdown your system from further attack
Take It From The Top--Systematic approach to hardening your perimeter and internal network infrastructure, focusing on firewalls, IDS/IPS, network content filtering, wireless LAN connections, routers, and switches
Once Is Never Enough!--Ongoing monitoring and assessment plan to keep your network secure, including patch management and auditing
How to Succeed at Hardening Your Network Infrastructure--Strategies for getting budget approval, management buy-in, and employee cooperation for your security program

About the author: Wesley J. Noonan, MCSE, CCNA, CCDA, NNCSS, Security+, is a Senior Network Consultant for Collective Technologies, LLC, a company specializing in storage, server and network design, architecture, implementation, and security. Series Editor: Roberta Bragg, CISSP, MCSE: Security, Security+, is the Security Advisor columnist for MCP magazine and a Security Expert for searchWin2000.com. She also writes for the Security Watch newsletter and is the author of several computer books.

Shipping

	Standard Shipping	Express Shipping
Metro postcodes:	$9.99	$14.95
Regional postcodes:	$9.99	$14.95
Rural postcodes:	$9.99	$14.95

Orders over $79.00 qualify for free shipping.

How to return your order

At Booktopia, we offer hassle-free returns in accordance with our returns policy. If you wish to return an item, please get in touch with Booktopia Customer Care.

Additional postage charges may be applicable.

Defective items

If there is a problem with any of the items received for your order then the Booktopia Customer Care team is ready to assist you.

For more info please visit our Help Centre.

You Can Find This Book In

Non-Fiction Computing & I.T.Computer Security Data Encryption Computer Networking & Communications Network Security

Foreword	p. xv
Acknowledgments	p. xvii
Introduction	p. xix
Do This Now!
Do These Six Things Before You Do Anything Else	p. 3
Review Your Network Design	p. 5
Implement a Firewall	p. 9
Application Proxies	p. 10
Stateful Packet-Inspecting/Filtering Gateways	p. 10
Hybrid Firewalls	p. 10
Which Firewall Should You Implement?	p. 10
Implement Access Control Lists	p. 11
Turn Off Unnecessary Features and Services	p. 12
Implement Virus Protection	p. 12
Secure Your Wireless Connections	p. 14
Summary	p. 14
Take It from the Top: The Systematic Hardening Process
Write a Security Policy	p. 19
The Role of a Security Policy	p. 20
The Purpose of a Security Policy	p. 22
Security Policy Components	p. 23
Where to Start?	p. 23
The Characteristics of a Good Security Policy	p. 27
Security Policy Recommendations	p. 30
Encryption Policy	p. 30
Analog/ISDN Policy	p. 30
Antivirus Policy	p. 30
Audit, Vulnerability Assessment, and Risk Assessment Policy	p. 31
Dial-in Policy	p. 31
DMZ Policy	p. 31
Extranet Policy	p. 31
Wireless Communications Policy	p. 32
VPN Policy	p. 32
Firewall Security Policy	p. 32
Router and Switch Security Policy	p. 33
Remote Access Policy	p. 33
Password Policy	p. 33
Intrusion Detection/Prevention System Policy	p. 34
Content-Filtering/Internet Policy	p. 34
Enterprise-Monitoring Policy	p. 34
Acceptable-Use Policy	p. 35
Network Connection Policy	p. 35
Network Documentation Policy	p. 35
Why Security Policies Fail and How to Ensure Yours Won't	p. 35
Security Is Viewed as a Barrier to Progress	p. 36
Security Is a Learned Behavior	p. 36
Security Is Rife with Unexpected Events and Occurrences	p. 36
Your Security Policy Is Never Finished	p. 37
Preventing the Failure	p. 37
Summary	p. 37
Hardening Your Firewall	p. 39
Hardware-Based and Software-Based Firewalls	p. 40
Hardening Remote Administration	p. 41
Implementing Authentication and Authorization	p. 48
Hardening the Underlying Operating System	p. 50
Hardening Firewall Services and Protocols	p. 51
Using Redundancy to Harden Your Firewall	p. 64
Hardening Routing Protocols	p. 66
Summary	p. 71
Hardening Your Network with Intrusion Detection and Prevention	p. 73
IDS/IPS Technologies	p. 74
Host-Based Intrusion Detection/Prevention	p. 75
Network-Based Intrusion Detection/Prevention	p. 76
IDS/IPS Components	p. 77
IDS/IPS Device Hardening	p. 78
Hardening PureSecure on Microsoft Windows	p. 78
Hardening Cisco IDS	p. 81
IDS/IPS Deployments	p. 83
Detection vs. Prevention	p. 84
Sensor Placement	p. 85
Sensor Placement in a Switched Network Infrastructure	p. 86
IDS/IPS Tuning	p. 87
Tuning PureSecure Sensors	p. 88
Tuning Cisco IDS Sensors	p. 90
IDS/IPS Logging, Alerting, and Blocking	p. 94
Logging with PureSecure	p. 95
Logging with Cisco IDS	p. 96
Alerting with PureSecure	p. 98
Alerting with Cisco IDS	p. 99
Blocking Traffic Using Cisco IDS and Cisco PIX Firewalls	p. 103
Summary	p. 104
Hardening VPN and Dial-in Remote Access	p. 105
Hardening VPN Connectivity	p. 106
Different VPN Connection Types and Technologies	p. 107
VPN Device-Hardening Methods	p. 110
Hardening IPsec-Based VPNs	p. 135
Hardening VPN Clients	p. 150
Hardening Dial-in Remote Access	p. 151
Summary	p. 153
Hardening Your Routers and Switches	p. 155
Hardening Management Access	p. 156
Securing Console Access	p. 157
Securing VTY Access	p. 158
Securing Web-Based Management Access	p. 161
Securing Auxiliary Access	p. 161
Securing Privileged Mode Access	p. 162
Implementing Usernames and AAA	p. 163
Implementing Banners	p. 164
Hardening Services and Features	p. 164
Cisco Discovery Protocol (CDP)	p. 165
TCP and UDP Small Servers	p. 165
finger	p. 166
Network Time Protocol (NTP)	p. 166
bootp Server	p. 167
Dynamic Host Configuration Protocol (DHCP)	p. 167
Configuration Autoloading	p. 168
Name Resolution	p. 168
Proxy ARP	p. 169
Directed Broadcasts	p. 169
IP Source Routing	p. 169
ICMP Redirects, Unreachables, and Mask Replies	p. 170
syslog	p. 170
Simple Network Management Protocol (SNMP)	p. 171
Implementing Loopback Address	p. 173
Disabling Unused Interfaces	p. 174
Configuring Core Dumps	p. 175
Hardening Router Technologies	p. 175
Implementing Redundancy	p. 175
Hardening Routing Protocols	p. 176
Implementing Traffic Management	p. 181
Implementing IPsec	p. 191
Hardening Switch Technologies	p. 194
Hardening VLANs	p. 194
Hardening Services and Features	p. 198
Summary	p. 204
Securing the Network with Content Filters	p. 205
Internet Content Filtering Architectures	p. 207
Client-Based Content Filtering	p. 207
Server-Based Content Filtering	p. 207
Gateway-Based Content Filtering	p. 210
Internet Content Filtering	p. 211
Misuse of Resources	p. 211
Preserving Network Bandwidth	p. 211
Hostile Work Environment	p. 211
Hostile Web Code (Java/ActiveX Applets)	p. 212
Implementing Content Filtering	p. 212
E-mail Content Filtering	p. 234
Implementing Virus Protection	p. 235
Filtering Attachments	p. 236
Implementing Content Filtering	p. 237
Implementing Spam Control	p. 238
Summary	p. 239
Hardening Wireless LAN Connections	p. 241
Banning WLANs Without IT/Management Approval	p. 242
Preventing Rogue APs	p. 242
Implementing WLAN Discovery Procedures	p. 244
Removing Rogue WAPs	p. 248
Hardening Wireless Access Points	p. 248
Hardening Remote Administration	p. 249
Securely Configuring the Service Set Identifier (SSID)	p. 252
Configuring Logging	p. 255
Hardening Services	p. 255
Restricting Wireless Mode	p. 258
Using MAC Address Filtering	p. 259
Hardening Wireless LAN Connections	p. 262
Hardening Wired Equivalent Privacy (WEP)	p. 263
Hardening WiFi Protected Access (WPA)	p. 266
Hardening WLANS with Virtual Private Networks	p. 271
Hardening Windows XP Wireless Clients	p. 271
Hardening with WEP	p. 272
Hardening with WPA Using Pre-shared Keys	p. 273
Hardening with WPA Using RADIUS/802.1x	p. 274
Summary	p. 276
Implementing AAA	p. 279
AAA Mechanisms	p. 280
Remote Authentication Dial-In User Service (RADIUS)	p. 281
Terminal Access Controller Access Control System (TACACS+)	p. 281
Authentication and Access Control	p. 281
AAA Authentication on IOS-Based Equipment	p. 282
AAA Authentication on PIX Firewalls	p. 292
Hardening Your Network with Authorization	p. 295
Authorization on IOS-Based Devices	p. 295
Authorization on PIX Firewalls	p. 297
Hardening Your Network with Accounting	p. 300
AAA Accounting on IOS-Based Equipment	p. 300
AAA Accounting on PIX Firewalls	p. 301
802.1x Port-Based Authentication	p. 302
802.1x Network Device Roles	p. 302
Configuring 802.1x Authentication for IOS-Based Switches	p. 304
Summary	p. 310
Hardening Your Network with Network Management	p. 311
Implementing a Network Management System (NMS)	p. 312
Fault Management	p. 313
Configuration Management	p. 330
Performance Management	p. 333
Accounting or Asset Management	p. 335
Security Management	p. 335
Hardening Your Network Management Protocols	p. 335
Configuring IPsec on Microsoft Windows 2000	p. 336
Summary	p. 345
Implementing a Secure Perimeter	p. 347
DMZ Implementation Methods	p. 348
Using a Multi-homed Firewall for Your DMZ	p. 349
Using Dual Firewalls for Your DMZ	p. 351
VLANs and DMZs	p. 353
Internet Access Module	p. 354
Traffic Flow Through the Internet Module	p. 354
Firewall Implementation	p. 356
VPN/Remote Access Module	p. 360
Remote Access VPN Termination Segment	p. 361
Site-to-Site VPN Termination Segment	p. 362
Dial-in Remote User Termination Segment	p. 362
NIDS/NIPS Deployment	p. 362
WAN Access Module	p. 363
Extranet Access Module	p. 364
Wireless Access Module	p. 365
E-Commerce Access Module	p. 366
Web Services DMZ Segment	p. 366
Application Services DMZ Segment	p. 367
Database Services DMZ Segment	p. 367
Summary	p. 368
Implementing a Secure Interior	p. 371
Using Virtual LANs (VLANs) to Segment the Network	p. 372
Trust Model Enforcement	p. 373
Using VLANs to Isolate Systems	p. 375
Designing the Enterprise Campus	p. 375
Core Module	p. 378
Server Module	p. 378
Building Distribution Module	p. 379
Building Access Module	p. 381
Management Module	p. 381
Lab Module	p. 382
Hardening Branch/Remote Offices	p. 383
Summary	p. 384
Once Is Never Enough!
Auditing: Performing a Security Review	p. 389
Reviewing Your Security Policy	p. 391
Is Your Security Policy Being Adhered To?	p. 391
Does Your Security Policy Address All Known Threats to Your Environment?	p. 393
Protecting Yourself from Future Exploits	p. 393
Do You Have Adequate Prevention Mechanisms and Enforcement of Your Security Policy?	p. 396
Reviewing Your Security Posture	p. 398
Auditing Your Environment	p. 399
Performing an Internal Audit	p. 400
Using Nmap and Nessus to Perform a Basic Security Review	p. 405
Performing an External Audit	p. 422
Summary	p. 425
Managing Changes to Your Environment	p. 427
Implementing Change Control	p. 428
Defining the Change Management Team	p. 428
The Change Planning Proces	p. 432
The Change Management Process	p. 438
How to Ensure a Successful Change Control Process	p. 443
Implementing a Patch and Update Policy	p. 445
When to Use a Workaround, Hotfix, Patch, or an Upgrade	p. 447
Staying Informed of Workarounds, Hotfixes, Patches, and Upgrades	p. 448
Purchasing Maintenance and Support Agreements	p. 449
Defining a Change Control Patch Policy	p. 450
Writing Patch and Update Procedures	p. 451
Changing the System Image	p. 452
Changing the System Configuration	p. 464
Changing the Application	p. 472
Summary	p. 472
How to Succeed at Hardening Your Network Infrastructure
Setting Perceptions and Justifying the Cost of Security	p. 477
Setting Perceptions and Expectations	p. 478
Setting User Perceptions and Expectations	p. 479
Setting Management Perceptions and Expectations	p. 485
Justifying the Cost of Security	p. 488
Risk Analysis	p. 488
Summary	p. 497
Addressing Staffing and Training Issues	p. 499
Staffing Issues	p. 500
Increasing Staff Headcount	p. 500
Utilizing Contractors	p. 501
Outsourcing	p. 501
Recruitment and Retention	p. 501
Individual Roles and Responsibilities	p. 507
Organization/Group Roles and Responsibilities	p. 508
Knowledge Management	p. 509
Training Issues	p. 510
Training Resources	p. 510
Implementing a Lab Environment	p. 513
Summary	p. 514
Incident Response	p. 517
Building an Incident Response Plan	p. 518
Assembling a Computer Incident Response Team (CIRT)	p. 518
Planning for Incident Response	p. 523
Discovering Incidents	p. 527
Handling Incidents	p. 530
Summary	p. 535
Index	p. 537
Table of Contents provided by Rittenhouse. All Rights Reserved.

Hardening Network Infrastructure

At a Glance

Paperback

Shipping

How to return your order

Defective items

You Can Find This Book In

More in Computer Networking & Communications

Dark Wire

The Incredible True Story of the Largest Sting Operation Ever

The New Age of Sexism

How the AI Revolution is Reinventing Misogyny

Grey Area

Dark Web Data Collection and the Future of OSINT

The E-Myth Revisited

Why Most Small Businesses Don't Work and What to Do About It

Fundamentals of Software Architecture

A Modern Engineering Approach

Essentials of Computer Networking

Theory and Applications of Error Correcting Codes

Cybersecurity All-in-One For Dummies

For Dummies

Liars and Outliers

Enabling the Trust that Society Needs to Thrive

Making Embedded Systems

2nd Edition - Design Patterns for Great Software

Dark Wire

The Incredible True Story of the Largest Sting Operation Ever

Computer Networking, Global Edition

8th edition

Linux All-In-One For Dummies

For Dummies (Computer/Tech)

The Site Reliability Workbook

Practical ways to implement SRE

Crafting an Information Security Playbook

Business Data Communications and Networking

14th Edition

Hacking For Dummies

For Dummies (Computer/Tech)

Network Security Essentials 6ed

Applications and Standards, Global Edition

Hackers & Painters

A First Course in Digital Communications

Data Science from Scratch

First Principles with Python

Cryptography and Network Security

8th Edition - Principles and Practice, Global Edition

Cloud Computing

2nd Edition - Concepts, Technology, Security, and Architecture

From Chaos to Clarity

How Data Visualization can Save the World

This product is categorised by