Inside Network Security Assessment: Guarding Your IT Infrastructure

Michael Gregg, David Kim

  • 出版商: SAMS
  • 出版日期: 2005-11-28
  • 定價: $1,750
  • 售價: 5.0$875
  • 語言: 英文
  • 頁數: 312
  • 裝訂: Paperback
  • ISBN: 0672328097
  • ISBN-13: 9780672328091
  • 相關分類: 資訊安全
  • 立即出貨(限量) (庫存=1)

買這商品的人也買了...

商品描述

Book Description

As an IT professional, you need to know how to perform network security assessments. Inside Network Security Assessment: Guarding Your IT Infrastructure is a collection of utilities and templates that will take you through the assessment process. Written by two highly qualified authors with close ties to the International Information Systems Security Certification Consortium, this book was developed with the goal of being a text for the CISSP continuing education class on Network Security Assessment. You will be provided with step-by-step training on assessing security, from paperwork to penetration testing to ethical hacking. The supporting website will also provide you with access to a variety of tools, checklists, and templates to make your job even easier. You'll save everyone time and money by learning to perform security assessments yourself with the help of Inside Network Security Assessment.

 

Table of Contents 

Introduction.

 

1. Introduction to Assessing Network Vulnerabilities.

    What Security Is and Isn’t.

    Process for Assessing Risk.

    Four Ways in Which You Can Respond to Risk.

    Network Vulnerability Assessment.

      Types of Network Vulnerability Assessments.

      What Procedures Govern the Vulnerability Assessment?

      The Role of Policies in the Vulnerability Assessment.

      What Drives the Assessment?

      Managing a Vulnerability Assessment.

      Building Cooperation with Other Departments.

      Importance of Setting and Maintaining a Schedule for Assessments.

    Summary.

    Key Terms.

 

2. Foundations and Principles of Security.

    Basic Security Principles.

    Security Requires Information Classification.

      Governmental Information Classification System.

      Commercial Information Classification System.

      Classification Criteria.

    The Policy Framework.

      Types of Policies.

      Defining Appropriate Policy.

      Deploying Policy.

      Policy Life Cycle.

    The Role Authentication, Authorization, and Accountability Play in a Secure Organization.

      Authentication.

      Authorization.

      Accountability.

    Encryption.

    Security and the Employee (Social Engineering).

    Summary.

    Key Terms.

 

3. Why Risk Assessment.

    Risk Terminology.

    Laws, Mandates, and Regulations.

      Health Insurance Portability and Accountability Act (HIPAA).

      Gramm-Leach-Bliley-Act (GLBA).

      Federal Information Security Management Act (FISMA).

      Sarbanes-Oxley Act (SOX).

    Risk Assessment Best Practices.

    Understanding the IT Security Process.

    The Goals and Objectives of a Risk Assessment.

      Security Process Definition.

      Goals and Objectives of a Risk and Vulnerability Assessment.

    Summary.

    Key Terms.

 

4. Risk-Assessment Methodologies.

    Risk-Assessment Terminology.

      Risk-Management and Risk-Assessment Requirements.

      Defense-in-Depth Approach for Risk Assessments.

      Risk Analysis Approach for Risk Assessments.

      Asset Valuation Approach for Risk Assessments.

    Quantitative and Qualitative Risk-Assessment Approaches.

      Quantitative Risk-Assessment Approach.

      Qualitative Risk-Assessment Approach.

    Best Practices for Quantitative and Qualitative Risk Assessment.

      Quantitative Risk-Assessment Best Practices.

      Qualitative Risk-Assessment Best Practices.

    Choosing the Best Risk-Assessment Approach.

    Common Risk-Assessment Methodologies and Templates.

    Summary.

    Key Terms.

 

5. Scoping the Project.

    Defining the Scope of the Assessment.

      Driving Events.

      Initial Meeting.

      Becoming the Project Manager.

      Staffing the Assessment Team.

      Kickoff Meeting .

      Building the Assessment Timeline.

    Reviewing Critical Systems and Information.

      Information Criticality Matrix.

      Systems Criticality Matrix.

    Compiling the Needed Documentation.

    Making Sure You Are Ready to Begin.

    Summary.

    Key Terms.

 

6. Understanding the Attacker.

    Who Are the Attackers?

      Attacker Types and Their Characteristics.

      Who Are the Greatest Threat?

      Insecure Computing Habits Are a Threat.

      Disgruntled Employees Are a Threat.

    What Do Attackers Do?

      Four Kinds of Attacks.

      Things That Attackers Attack.

      Goals and Motivations of the Attacker.

      Attackers Conduct Their Own Risk Analysis.

      How Do Attackers Attack?

      Tools That Attackers Use During the Stages of an Attack.

    Reducing the Risk of an Attack.

    How to Respond to an Attack.

    Summary.

    Key Terms.

 

7. Performing the Assessment.

    Introducing the Assessment Process.

    Level I Assessments.

      Reviewing the Documentation.

      Interviewing Process Owners and Employees.

      System Demonstrations.

    Level II Assessments.

      Vulnerability Scans.

      Level II Assessment Caveats.

    Level III Assessments.

      Vulnerability Exploitation.

    Summary.

    Key Terms.

 

8. Tools Used for Assessments and Evaluations.

    A Brief History of Security Tools.

    Putting Together a Toolkit.

      Information-Gathering Tools and Techniques.

      Scanning Tools.

      Enumeration Tools.

      Wireless Tools.

      Password Auditing Tools.

      Vulnerability Scanning Tools.

      Automated Exploit and Assessment Tools.

    Determining What Tools to Use.

      What’s the Best Platform to Install Your Tools On.

      Additional Items for the Toolkit.

    Summary.

    Key Terms.

 

9. Preparing the Final Report.

    Preparing for Analysis.

    Ranking Your Findings.

      Impact Rating.

      Probability Scale.

      Determining Raw Risk.

      Control Level.

      Calculating the Risk Score.

    Building the Final Report.

    Contents of a Good Report.

      Notice.

      Executive Summary.

      Introduction.

      Statement of Work.

      Analysis.

      Findings.

      Conclusions.

    Determining the Next Step.

    Audit and Compliance.

    Summary.

    Key Terms.

 

10. Post-Assessment Activities.

    IT Security Architecture and Framework.

      Goals and Objectives.

      Terminology.

      Defining the Structure and Hierarchy.

      Hierarchical IT Security Architecture and Framework.

      Sample IT Security Architecture and Framework.

    Roles, Responsibilities, and Accountabilities.

      Seven Areas of Information Security Responsibility.

    Security Incident Response Team (SIRT).

      SIRT Response Procedures.

      Security Workflow Definitions.

      Security Workflow Procedures.

    Vulnerability Management.

      Enterprise Vulnerability Management.

    Training IT Staff and End Users.

    Summary.

    Key Terms.

 

A. Security Assessment Resources.

    Security Standards.

      Common Criteria (CC) for IT Security Evaluation.

      FIPS PUB 140-1 and 140-2.

      ISO17799.

      GAO Risk Assessment Process.

      OSSTMM.

      DoD Rainbow Series.

      NIST.

    General Security Websites.

    Security Tool Websites.

 

B. Security Assessment Forms.

    Information Request Form.

    Document Tracking Form.

    Critical Systems and Information Forms.

    Level II Assessment Forms.

 

C. Security Assessment Sample Report.

    Notice.

    Executive Summary.

    Introduction.

    Statement of Work.

    Analysis.

    Recommendations.

    Conclusions.

 

D. Dealing with Consultants and Outside Vendors.

    Procurement Terminology.

    Typical RFP Procurement Steps.

    Procurement Best Practices.

 

E. SIRT Team Report Format Template.

    SIRT Incident Report.

 

Index.

商品描述(中文翻譯)

書籍描述

《網路安全評估:保護您的IT基礎設施》是一本由兩位與國際資訊系統安全認證協會有密切聯繫的高資歷作者撰寫的書籍,內含一系列的工具和範本,將引導您進行網路安全評估的過程。作為一位IT專業人士,您需要知道如何進行網路安全評估,這本書將提供您逐步培訓,從文件工作到滲透測試和道德駭客。書中還提供了一個支援網站,讓您可以獲取各種工具、檢查表和範本,使您的工作更加輕鬆。通過學習如何進行安全評估,您將為大家節省時間和金錢。

目錄

導論
1. 網路漏洞評估介紹
- 安全的定義與非定義
- 評估風險的過程
- 四種應對風險的方式
- 網路漏洞評估
- 不同類型的網路漏洞評估
- 漏洞評估的程序
- 漏洞評估中的政策角色
- 驅動評估的因素
- 管理漏洞評估
- 與其他部門建立合作的重要性
- 設定目標的重要性