The content in chapter 1: Understanding information security, understanding the goals of information security, comprehending the security process, authentication issues to consider, distinguishing between security topologies.
General Security Concepts Contents v Understanding Information Security v Understanding the Goals of Information Security v Comprehending the Security Process v Authentication Issues to Consider v Distinguishing between Security Topologies Terminologies v Protocol: an official set of steps or language for communication v Algorithm: a specific set of steps to solve a problem or some task v String: a series of characters Example if a character can be a-z and 0-9 an character string might be “ar01z14b” v Control: a countermeasure or attempt to mitigate a security risk v A firewall is technical control Policies are HR controls Encryption is a technical control Information Security v Security? v Physical security of servers and workstations v Protecting data from viruses and worms or from hackers and miscreants v The capability to restore files if a user accidentally deletes them v … v Problems with security: v It is next to impossible for everyone to agree on what it means v We don’t really mean that we want things to be completely secured v While everyone wants inconvenienced by it security, no one wants to be Security Triad Securing the Physical Environment v Protecting your assets and information from physical access by unauthorized persons v Threats often present themselves as service technicians, janitors, customers, vendors, or even employees v Components of physical security: v Making a physical location less tempting as a target v Detecting a penetration or theft v Recovering from a theft or loss of critical information or systems Examining Operational Security v Operational security issues include: v Network access control (NAC), v Authentication, v Security topologies after the network installation is complete v Daily operations of the network v Connections to other networks v Backup plans v Recovery plans v In short, operational security encompasses everything that isn’t related to design or physical security in the network Examining Operational Security Working with Management and Policies v Guidance, rules, and procedures for implementing a security environment v Policies need the support of management to be carried out well v The issues that must be decided at the management and policy level affect the entire company and can greatly impact productivity, morale, and corporate culture Working with Management and Policies v A number of key policies are needed to secure a network The following list identifies some broad areas that require thought and planning: v Administrative policies v Disaster recovery plans v Information policies v Security policies v Software design requirements v Usage policies v User management policies Intranets Extranets v Extend intranets to include outside connections to partners v Connect to a partner via a private network or a connection using a secure communications channel across the Internet Extranets Demilitarized Zone (DMZ) v A demilitarized zone (DMZ) is an area where you can place a public server for access by people you might not trust otherwise v By isolating a server in a DMZ, you can hide or remove access to other areas of your network v Use firewalls to isolate your network Demilitarized Zone (DMZ) Some technologies v Virtualization Technology (VT) v VLANs v Network Address Translation (NAT) v Tunneling Virtualization v Today’s x86 computer hardware was designed to run a single operating system and a single application, leaving most machines vastly underutilized v Virtualization lets you run multiple virtual machines on a single physical machine, with each virtual machine sharing the resources of that one physical computer across multiple environments v Different virtual machines can run different operating systems and multiple applications on the same physical computer Why Virtualize? v Get more out of your existing resources v Reduce datacenter costs by reducing your physical infrastructure and improving your server to admin ratio v Increase availability of hardware and applications for improved business continuity v Gain operational flexibility v Improve desktop manageability and security Virtual Local Area Networks v A virtual local area network (VLAN) allows you to create groups of users and systems and segment them on the network v This segmentation lets you hide segments of the network from other segments and thereby control access v You can also set up VLANs to control the paths that data takes to get from one point to another A VLAN is a good way to contain network traffic to a certain area in a network Virtual Local Area Networks Network Address Translation v Originally, NAT extended the number of usable Internet addresses v Allow an organization to present a single address to the Internet for all computer connections v The NAT server provides IP addresses to the hosts or systems in the network and tracks inbound and outbound traffic Network Address Translation Tunneling v Tunneling refers to creating a virtual dedicated connection between two systems or networks v You create the tunnel between the two ends by encapsulating the data in a mutually agreed-upon protocol for transmission v In most tunnels, the data passed through the tunnel appears at the other side as part of the network v Tunneling protocols usually include data security as well as encryption Several popular standards have emerged for tunneling, with the most popular being the Layer Tunneling Protocol (L2TP) Tunneling v Tunneling sends private data across a public network by placing (encapsulating) that data into other packets Most tunnels are virtual private networks (VPNs) Tunneling ... Understanding Information Security v Understanding the Goals of Information Security v Comprehending the Security Process v Authentication Issues to Consider v Distinguishing between Security Topologies... Understanding Information Security v Understanding the Goals of Information Security v Comprehending the Security Process v Authentication Issues to Consider v Distinguishing between Security Topologies... Understanding Information Security v Understanding the Goals of Information Security v Comprehending the Security Process v Authentication Issues to Consider v Distinguishing between Security Topologies