End-to-End Network Security 99
Ben Rothke writes "One of the mistakes many organizations make when it comes
to information security is thinking that the firewall will do it all. Management often replies incredulously to a
hacking incident with the thought "but don't we have a firewall". Organizations need to realize a single appliance alone
won't protect their enterprise, irrespective of what the makers of such
appliances suggest and promise. A true strategy
of security defense in depth is required to ensure a comprehensive level of
security is implemented. Defense in
depth uses multiple computer security technologies to keep organizations risks
in check. One example of defense in
depth is having an anti-virus and anti-spyware solution both at the user's
desktop, and also at the gateway." Read on for the rest of Ben's review.
End-to-End Network Security: Defense-in-Depth provides an in-depth look at the
various issues around defense in depth.
Rather than taking a very narrow approach to security, the book focuses
on the comprehensive elements of designing a secure information security
infrastructure that can really work to ensure an organization is protected
against the many different types of threats it will face on a daily basis.
| End-to-End Network Security: Defense-in-Depth | |
| author | Omar Santos |
| pages | 480 |
| publisher | Cisco Press |
| rating | 9 |
| reviewer | Ben Rothke |
| ISBN | 1587053322 |
| summary | Excellent and comprehensive look at how to secure a Cisco infrastructure |
The books 12 chapters provide a broad look at the various ways in which to secure a network. Aside from a minor mistake in chapter 1 where the author confuses encryptions standards and encryption algorithms (but then again, many people make the same mistake), the book provides a clear and to the point approach to the topic at hand. After reading the book, one will have a large amount of the information needed to secure their Cisco-based network.
While it is not in the title, the book is completely centered on Cisco hardware, software, and Cisco IOS. It is a Cisco Press title written by a Cisco employee, as you would expect, it has a heavy Cisco slant. For those that do not work in a Cisco environment, the information in the book will likely be far too Cisco centric for their needs. A review of the index shows that the book provides a near A-Z overview of information security. One of the only missing letters is 'J', but then again, that would require writing about Juniper.
Chapter 1 starts off with a detailed overview of the fundamentals of network security technologies. Chapter 2 details the various security frameworks and methodologies around securing network devices. The six-step methodology that the author writes of is comprised of preparation, identification, classification, traceback, reaction and postmortem.
The author mistakenly writes that manual analysis of complex firewall policies is almost impossible because it is very time-consuming. The truth is that the time-consuming aspect does not make it impossible. It can be done, but the author is correct that the use of automated tools makes such analysis much quicker and easier.
Chapters 5 and 6 provide an excellent overview of reacting to information security incidents. The chapters cover all of the necessary details, from laws, log finals, postmortem and more.
Chapter 9 provides and extensive overview of the various elements of IPT security. It includes various ways to protect the many parts of a Cisco IPT infrastructure. In this chapter and the others, the author does a very good job of detailing the various configurations steps necessary to secure a Cisco device, both at the graphical level and also at the ISO command line level.
Chapter 12 concludes the book with 3 case studies of using defense in depth a small, medium and large enterprise networks. Different size networks have different requirements and constraints and are not secured in the same manner.
Overall, End-to-End Network Security: Defense-in-Depth is an excellent and comprehensive book on how to secure a Cisco infrastructure. It details the many threats such an environment will face, and lists countermeasures to mitigate each of those threats. Anyone involved in securing Cisco-based networks will find this book to be quite helpful in their effort to secure their network.
Ben Rothke is a security consultant with BT INS and the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase End-to-End Network Security from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Let me be one of the first to say (Score:5, Insightful)
C'mon, an incoming firewall is a good start, but it's just that. You still need AV, Anti-malware is good. Spam filtering, individual machine firewalls, server security, access limits for users, restrictions on what can be attached to the network, a secure area with limited access for those whose laptops travel a lot...
This is, is it not, pretty elementary stuff?
Re: (Score:1)
Re: (Score:2)
You gave some good examples of this principle. If you provide the users with network shares or a collaboration solution, then they don't need to use thumb drives. If you sandbox Outlook and IE, you don't have to worry about the malware du jour.
Re: (Score:2)
Sure, assuming you don't have any employees... Employees break policy routinely and don't give a crap if plugging in a USB drive is "against policy." They'll do it because they feel entitled to do whatever then damn well please. So if you don't lock down your systems to enforce an existing policy, you might as well throw all your PCs, with all their confidential information, out into the street.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Where I work, "Stuff we don't want the users to do" and "Stuff we don't allow the users to do" are one and the same.
I also work with an "allow by exception" network with is basically a security guy's wet dream
Or, just get a Mac/Linux? (Score:1, Troll)
I remember reading on slashdot several years ago about a network security idea to scrap all this firewall gateway etc stuff and just implement a secure desktop (i.e. with almost no open ports other than 80 and 443).
In many ways, it makes sense to me.
Re: (Score:3, Interesting)
I remember reading on slashdot several years ago about a network security idea to scrap all this firewall gateway etc stuff and just implement a secure desktop
That's all well and good so long as you can really trust each individual machine. Also, you'll probably want to wait after the move to IPv6, or else you'll probably want to have some kind of gateway w/NAT. Even if you had all that, I wouldn't mind having a firewall anyway, just as an added layer of security.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Because we all know how stringently the average office worker sticks to IT policy...
Re:Let me be one of the first to say (Score:4, Interesting)
This is, is it not, pretty elementary stuff?
It really depends on who you are...
I suppose someone who has a Ph.D. in physics would say that quantum mechanics is pretty elementary stuff. The problem here is that you are assuming everyone who is in charge of a network has the knowledge, background and experience to understand security. Most don't. Many who think they do - don't. There is so much to keep track of that it's a full-time job just to keep up with the attackers. If you have a lot of other work to do, you probably aren't keeping current in every area you need to. That's why there are security experts who get paid a lot of money to help secure systems and networks.
Re: (Score:2)
I suppose someone who has a Ph.D. in physics would say that quantum mechanics is pretty elementary stuff.
Depends. The mathematic behind quantum mechanics is not exactly "elementary" but the basic ideas are. Wave functions, uncertainty, and quantum collapse, although weird, are easily grasped by most people. Just don't ask them to do the math on it. Same with computer security -- even if you don't know every gory detail, you should at least know what the basic components of a secure system is. Seriously,
Re: (Score:1)
looks like the book is aimed at trainees or students, any network admin should know this & those that dont are unlikely to read a book.
Re: (Score:1)
it seems to be slightly above the level of what users need to know, not many people run a corporate-style network at home & this kind of thing should be done for them at work.
Re: (Score:2)
Re: (Score:1)
In a perfect world... yes.
The real world... mgmt cares little about securtiy and pays little to those who are responsible for it.
the outcome = malware invested networks run by those behind the curve.
Re: (Score:2)
If you don't know every gory detail then how can you make intelligent decisions on where to spend your budget? Sure, you can learn the basics of quantum mechanics, but that doesn't make you qualified to determine how money should be spent for experiments. The same holds true here. You might have an idea that you should have firewalls, IDSes, updated systems, anti-everything, physical security, an employee training program, etc. However, you can't have it all - it would be too expensive in terms of time
Re: (Score:2)
If you don't know every gory detail then how can you make intelligent decisions on where to spend your budget?
Trusted, informed opinions. We can't know every gory detail on every subject in the world and yet we seem to all do okay, by relying on experts.
Re: (Score:1)
NEVER!!!!
Re: (Score:2)
Re: (Score:3)
That's all very noble sounding but its not at all the truth.
No we don't. We want to impress our corporate masters with all of these shiny reports showing how much we know about everyone is on the system, trying to candy up our asses in the name of safety. We're no different from the people pushing camcorders in grocery stores. Security is a protection racket industry... "buy from us, be
Godwin says... (Score:2, Funny)
Re: (Score:1)
if someone said:
"you're a nazi" => bad; the law applies
"I'm/We're nazi(s)" !=> bad ; law is N/A.
Re: (Score:1)
Why not just dump Windows? (Score:3, Insightful)
Re: (Score:1)
OTOH a bad secured Linuzzz, can be as insecure and any other...
So why just begin from the beginning with a new OS, new applications, emulatiosn, etc if the well configured real thing does the job?
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Maybe you shouldn't. The previous poster just argumented that costs for the migration might be less than others would want you to believe. After all, he showed an scenario where there was the chance of migrating from XP to Vista *or* Ubuntu; from Office whatever to last version *or* Open Office. But, then, "why should you" migrate to Vista or Office last version to begin with? Now, if you state your reasons clear you might find that there're better migration targets than Vista or Office.
"
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
Re: (Score:2)
System design is why even an "obscure" platform like MacOS could go from having dozens of malwares to about one post BSD transition.
Re: (Score:2)
Because that is not how the world works. Companies have a huge investment in Windows and all the apps that run on it. A rip and replace is simply not a viable option.
You know, there are ways that companies can lock dow
Re: (Score:3, Insightful)
Re: (Score:2)
Can it be customized to do what this does? http://www.altec-inc.com/ [altec-inc.com]
How about a Linux accounting package for the SMB market that does the equivalent of what this does? http://www.sagesoftware.com/pfw/ [sagesoftware.com]
While you're at it, got any waste management software for Linux? Waste Management went with AS/400. http://www.eweek.com/article2/0,1895,1773666,00.asp [eweek.com]
Re: (Score:3, Funny)
It's all gotten very fancy.
Re: (Score:2)
Re: (Score:1)
'nix is great at protecting against passive attacks, but can still suffer from pebcak.
In my experience, those who run linux tend either to not know what an OS is (parents, grandparents etc) or are curious nerd/geek types who either know what they are doing, or are willing to break a test system finding out. This education
Re: (Score:1)
Re: (Score:3, Insightful)
When faced with religious beliefs like these, the best you can do is try to make the best of them, while trying to minimize their damage to people and property.
[A couple decades ago I'd have included asking the USSR to dump Communism, but th
Re: (Score:2)
A couple decades ago I'd have included asking the USSR to dump Communism, but that happened. But I suspect that IBM/Microsoft, Christianity and Islam are much more deeply entrenched than Communism ever was.
And I suspect the reason for that is because Soviet communism, however much brainwashing was associated with it, did not condition people to supernaturalism. It made false claims because they were falsifiable. Time passed, people saw the results, and stopped believing in the system.
With the supernatualist conditioning to faith for its own sake, credulity becomes much more insidious. Falsifiable claims are more of an embarrassing accident, and esp. when they turn out false the authorities will explicitly ma
Re: (Score:1)
Similar argument: Stop hating people and no one will get killed.
We call people who make such crazy arguments weird.
from the protect-ya-network dept. (Score:3, Funny)
Re: (Score:1)
My security dream (Score:2)
There is one master drive image that sits on a server somewhere on the Lan....
My Documents or $home or whatever is mapped onto a server. Similar to a netboot I guess...
keep like 3 copies of the image around and MD5sum them before they go out to make sure that the master hasn't been corrupted or infected or some BS.
Added bonus is any software changes would just get done at the mas
I've heard of it. (Score:2)
The problem was that SOMETHING would go wrong with one or more of the machines and they would not get the image. Which really sucked when the user came in in the morning. Those machines had to be manually imaged.
Re: (Score:1)
Re: (Score:1)
great concept, really great.
but never took off. beats me why not.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
the real problem are your artistic and tech staff. not everyone needs Adobe Creative Suite, SQL server, and visual studio. these licenses are pricey and the software is to "heavy" requirement wise to deploy to all PCs.
Re: (Score:2)
If any node was having problems, all they had to do was flip a switch. If it came back up, great, if not pull it offline and see what faile
Re: (Score:1)
The computer labs where I went to college were setup this way. It's really the only sane desktop policy for 30,000 users who would love nothing more than to mess up every single computer they touched that they didn't own. Every reboot and you're back to a normal windows image.
Re: (Score:1)
Re: (Score:1)
It's all useless (Score:3, Insightful)
Yes, yes it can. (Score:2)
Oh, sorry Mr Marketing guy, you can't install new software, you don't need it.
No, you're not authenticated for full office network access mr homeworker, not until your machine's been fully scanned. Until then you can access your mail account and the web from this sandbox area.
Uh, no, mr software developer, you can't have root access to the main source repository...
There are many things you can do to pro
Choice quote from CSI (Score:5, Funny)
"We're under attack! Get that firewall UP NOW!"
I mean, yes, it's CSI and nobody expects perfection, but that's representative of the way people often see things...
Re: (Score:2, Insightful)
GET THE FIREWALL UP...
Defense in depth (Score:5, Insightful)
Considering that the book is cxclusively concerned with configuring proprietary network gear, that's perhaps understandable. But when the same book presumes, by its title, to offer a general treatment of end-to-end security will have badly misled its readers. This is not end-to-end security, but instead the much smaller subset which concerns how to manage network traffic.
If we genuinely want to talk about end-to-end security, we'll have to look closely at the endpoints. We have to look at them in terms of their own architectural security, as well as how they function as communicating agents. And where communication is concerned, all the stuff in the middle, generally speaking, is not trustworthy.
That's a more principled approach to what "defense in depth" means in the context of these endpoints. Sure there might be a few firewalls or encrypted tunnels along the way, but the endpoints have no means of assuring that this infrastructure is in fact secure. Should those layers fail to operate as expected, the security of the communication falls to other layers. Ultimately, the responsibility falls to the endpoints themselves.
Dealing with security in several fragmented pieces is not so great. That's because security is an emergent property of the entire system, not something which can be directly composed from elements of the system. A text which provides a treatment of security princples comprehensively would be most welcome. Let's save the "end-to-end" terminology for when we're really looking at end-to-end architectures.
Re: (Score:1)
Re: (Score:2)
"i think it was made pretty clear that this is a by cisco, for cisco, there aint nothing in the world but cisco book."
Yep. Those Crisco people are sure greasy!
Better to cut the fat and switch to leanux.
Re: (Score:1)
Re: (Score:2)
Well, yes... (Score:3, Interesting)
Active NIDS is usually discouraged when placed in serial with the network, as it usually can't block the network when in parallel. But if the NIDS server can log onto the managed switch or router, it can disabl
Firewalls are your LAST line of defence... (Score:1)
I know many security guys (mostly on FreeBSD servers) who don't even bother with a firewall. You shouldn't have insecure services running in the first place.
Of course it's a whole other world when it comes to protecting a LAN where you can't effectively control the services running locally.
Re:Firewalls are your LAST line of defence... (Score:4, Informative)
Re: (Score:2)
Human Factors (Score:4, Interesting)
I used to do tech support at a major US university. I'd show up at the user's desk, flip the keyboard upside down
-kgj
Re: (Score:2, Insightful)
A critical question is what are you attacking against? if it's Joe Random Cracker out on the interweb then the password being taped to the keyboard is BETTER than having a weak password that's memorised (and easilly bruteforced).
If the threat is unauthorised access internally then it's a problem that it's taped to the keyboard written on a card in your wallet would still be better imho than a weak password.
In short it's bad.. but when the threat isn't
Networks, military bases, banks, whatever ... (Score:5, Insightful)
Antivirus on the desktop? (Score:1)
Re: (Score:1)
Re: (Score:1)
You only need AV software if you're technically incompetent. I realize those people are out there, but I'm just saying it's not necessary if you understand a few things about how computers work.
Re: (Score:1)
And that is conservatively 90% of the end-user base in the world. so for you and the few thousand people who do security right, fine.
for the other few hundred million people, they DO NEED AV SOFTWARE.
Re: (Score:1)
And that is 90% of the end user base in the world.
yes, for you and your friends, your premise is correct.
for the other few hundred million end users, AV IS A MUST!!! That is undisputable!!!
Re: (Score:1)
Suggesting Not running windows, not using IE, is plain impossible.
And what you did describe is HIGHLY TECHNICAL!!!
Most people cant find control panel, let alone configure it.
It's about integrating security into design! (Score:1)
Re: (Score:1)
I have no idea what that means, please explain.
Re: (Score:1)
Um...one big problem with this book (Score:1)