Slashdot Mirror
End-to-End Network Security
Ben Rothke writes "One of the mistakes many organizations make when it comes
to information security is thinking that the firewall will do it all. Management often replies incredulously to a
hacking incident with the thought "but don't we have a firewall". Organizations need to realize a single appliance alone
won't protect their enterprise, irrespective of what the makers of such
appliances suggest and promise. A true strategy
of security defense in depth is required to ensure a comprehensive level of
security is implemented. Defense in
depth uses multiple computer security technologies to keep organizations risks
in check. One example of defense in
depth is having an anti-virus and anti-spyware solution both at the user's
desktop, and also at the gateway." Read on for the rest of Ben's review.
End-to-End Network Security: Defense-in-Depth
author
Omar Santos
pages
480
publisher
Cisco Press
rating
9
reviewer
Ben Rothke
ISBN
1587053322
summary
Excellent and comprehensive look at how to secure a Cisco infrastructure
End-to-End Network Security: Defense-in-Depth provides an in-depth look at the
various issues around defense in depth.
Rather than taking a very narrow approach to security, the book focuses
on the comprehensive elements of designing a secure information security
infrastructure that can really work to ensure an organization is protected
against the many different types of threats it will face on a daily basis.
The books 12 chapters provide a broad look at the various ways in which to secure a network. Aside from a minor mistake in chapter 1 where the author confuses encryptions standards and encryption algorithms (but then again, many people make the same mistake), the book provides a clear and to the point approach to the topic at hand. After reading the book, one will have a large amount of the information needed to secure their Cisco-based network.
While it is not in the title, the book is completely centered on Cisco hardware, software, and Cisco IOS. It is a Cisco Press title written by a Cisco employee, as you would expect, it has a heavy Cisco slant. For those that do not work in a Cisco environment, the information in the book will likely be far too Cisco centric for their needs. A review of the index shows that the book provides a near A-Z overview of information security. One of the only missing letters is 'J', but then again, that would require writing about Juniper.
Chapter 1 starts off with a detailed overview of the fundamentals of network security technologies. Chapter 2 details the various security frameworks and methodologies around securing network devices. The six-step methodology that the author writes of is comprised of preparation, identification, classification, traceback, reaction and postmortem.
The author mistakenly writes that manual analysis of complex firewall policies is almost impossible because it is very time-consuming. The truth is that the time-consuming aspect does not make it impossible. It can be done, but the author is correct that the use of automated tools makes such analysis much quicker and easier.
Chapters 5 and 6 provide an excellent overview of reacting to information security incidents. The chapters cover all of the necessary details, from laws, log finals, postmortem and more.
Chapter 9 provides and extensive overview of the various elements of IPT security. It includes various ways to protect the many parts of a Cisco IPT infrastructure. In this chapter and the others, the author does a very good job of detailing the various configurations steps necessary to secure a Cisco device, both at the graphical level and also at the ISO command line level.
Chapter 12 concludes the book with 3 case studies of using defense in depth a small, medium and large enterprise networks. Different size networks have different requirements and constraints and are not secured in the same manner.
Overall, End-to-End Network Security: Defense-in-Depth is an excellent and comprehensive book on how to secure a Cisco infrastructure. It details the many threats such an environment will face, and lists countermeasures to mitigate each of those threats. Anyone involved in securing Cisco-based networks will find this book to be quite helpful in their effort to secure their network.
Ben Rothke is a security consultant with BT INS and the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase End-to-End Network Security from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
The books 12 chapters provide a broad look at the various ways in which to secure a network. Aside from a minor mistake in chapter 1 where the author confuses encryptions standards and encryption algorithms (but then again, many people make the same mistake), the book provides a clear and to the point approach to the topic at hand. After reading the book, one will have a large amount of the information needed to secure their Cisco-based network.
While it is not in the title, the book is completely centered on Cisco hardware, software, and Cisco IOS. It is a Cisco Press title written by a Cisco employee, as you would expect, it has a heavy Cisco slant. For those that do not work in a Cisco environment, the information in the book will likely be far too Cisco centric for their needs. A review of the index shows that the book provides a near A-Z overview of information security. One of the only missing letters is 'J', but then again, that would require writing about Juniper.
Chapter 1 starts off with a detailed overview of the fundamentals of network security technologies. Chapter 2 details the various security frameworks and methodologies around securing network devices. The six-step methodology that the author writes of is comprised of preparation, identification, classification, traceback, reaction and postmortem.
The author mistakenly writes that manual analysis of complex firewall policies is almost impossible because it is very time-consuming. The truth is that the time-consuming aspect does not make it impossible. It can be done, but the author is correct that the use of automated tools makes such analysis much quicker and easier.
Chapters 5 and 6 provide an excellent overview of reacting to information security incidents. The chapters cover all of the necessary details, from laws, log finals, postmortem and more.
Chapter 9 provides and extensive overview of the various elements of IPT security. It includes various ways to protect the many parts of a Cisco IPT infrastructure. In this chapter and the others, the author does a very good job of detailing the various configurations steps necessary to secure a Cisco device, both at the graphical level and also at the ISO command line level.
Chapter 12 concludes the book with 3 case studies of using defense in depth a small, medium and large enterprise networks. Different size networks have different requirements and constraints and are not secured in the same manner.
Overall, End-to-End Network Security: Defense-in-Depth is an excellent and comprehensive book on how to secure a Cisco infrastructure. It details the many threats such an environment will face, and lists countermeasures to mitigate each of those threats. Anyone involved in securing Cisco-based networks will find this book to be quite helpful in their effort to secure their network.
Ben Rothke is a security consultant with BT INS and the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase End-to-End Network Security from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
"Duh!"
C'mon, an incoming firewall is a good start, but it's just that. You still need AV, Anti-malware is good. Spam filtering, individual machine firewalls, server security, access limits for users, restrictions on what can be attached to the network, a secure area with limited access for those whose laptops travel a lot...
This is, is it not, pretty elementary stuff?
How much did Cisco pay for this placement?
We want freedom for the users to make their systems obey them, and allow them to study and modify it to suit their needs. That is rather different from lettin unauthorized peopel take their controll away. It's all about the user's freedom.
Why not just dump Windows and go for either emulating XP on a Virtual Machine or run OS-X, Linux or BSD? Seriously, if your worried about your employees downloading a "screensaver" for Windows and infecting the network, just run Linux and I bet you over 80% of the time thats what it is. As for "retraining" you would spend more money retraining and getting better hardware (and worse software) to get Vista, and Office 2007 while Ubuntu can be themed like XP/Vista/Amiga/OS-X or any other previous operating system. Open Office has a much lower learning curve then giving them Office 2007. So just switching to Linux takes out just about 100% of malware/virus problems which bring in back-doors and other ways of accessing, not to mention the code is open so you can be 100% sure that you won't get a "stealth update" or delayed patches or even currently unkown flaws in the kernel. As for a firewall, just running your connections through a router would help a bit, set up Firestarter or another iptables front-end for Linux, set secure root passwords and the only way that it can be cracked is if the IT department decided to crack it because they would be the ones that set it up. So moral to the book is, switch to Linux or just about any OS other then Windows, set up a firewall and secure passwords and you will be fine.
There is no "disagree" moderation, and troll, flamebait and overrated are not valid substitutes
I thought this would have come from the preaching-to-the-choir dept.
Does anyone know of a system that works like this?
..every night, when there is nobody using the workstation, it gets "re-imaged"
There is one master drive image that sits on a server somewhere on the Lan....
My Documents or $home or whatever is mapped onto a server. Similar to a netboot I guess...
keep like 3 copies of the image around and MD5sum them before they go out to make sure that the master hasn't been corrupted or infected or some BS.
Added bonus is any software changes would just get done at the master image...then get moved out to the clients that night....
kindof a netboot + SAN i think...
does anybody do this?
NewslilySocial News. No lolcats allowed.
You can spend billions of dollars securing your network end to end, but so long as you still employ staff (or let them have communication with the outside world) nothing you buy can protect you from ID-10-T security breaches
As they were chasing the bad guy (girl?) through the 2nd Life game, the CSI lab was hacked. Choice quote:
"We're under attack! Get that firewall UP NOW!"
I mean, yes, it's CSI and nobody expects perfection, but that's representative of the way people often see things...
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Back when I was consulting, one of the other consultants ran into a situation like that.
The problem was that SOMETHING would go wrong with one or more of the machines and they would not get the image. Which really sucked when the user came in in the morning. Those machines had to be manually imaged.
Considering that the book is cxclusively concerned with configuring proprietary network gear, that's perhaps understandable. But when the same book presumes, by its title, to offer a general treatment of end-to-end security will have badly misled its readers. This is not end-to-end security, but instead the much smaller subset which concerns how to manage network traffic.
If we genuinely want to talk about end-to-end security, we'll have to look closely at the endpoints. We have to look at them in terms of their own architectural security, as well as how they function as communicating agents. And where communication is concerned, all the stuff in the middle, generally speaking, is not trustworthy.
That's a more principled approach to what "defense in depth" means in the context of these endpoints. Sure there might be a few firewalls or encrypted tunnels along the way, but the endpoints have no means of assuring that this infrastructure is in fact secure. Should those layers fail to operate as expected, the security of the communication falls to other layers. Ultimately, the responsibility falls to the endpoints themselves.
Dealing with security in several fragmented pieces is not so great. That's because security is an emergent property of the entire system, not something which can be directly composed from elements of the system. A text which provides a treatment of security princples comprehensively would be most welcome. Let's save the "end-to-end" terminology for when we're really looking at end-to-end architectures.
Parity: What to do when the weekend comes.
Mac for the desktop and Linux for the server room.
I remember reading on slashdot several years ago about a network security idea to scrap all this firewall gateway etc stuff and just implement a secure desktop (i.e. with almost no open ports other than 80 and 443).
In many ways, it makes sense to me.
nothing for you to see, move along.
Anti-malware or anti-spyware is bad. It relies upon the enemy already making a foothold in your machine and then kicking them out.
If you can see them that is.
What about a OS that is so secure and self checking that malware doesn't even have a chance to exist?
How about a OS that checks itself from a ultra secure location and reverts a boot drive back to the original state before the malware gained entry? All seemlessly done in the background?
The offending code sent to the OS maker?
How long would the anti-spy/malware industry exist if a major OS maker did that?
...for web servers or any DMZ server anyway.
I know many security guys (mostly on FreeBSD servers) who don't even bother with a firewall. You shouldn't have insecure services running in the first place.
Of course it's a whole other world when it comes to protecting a LAN where you can't effectively control the services running locally.
Also consider the human factors angle.
... there's the password, taped to the underside of the keyboard. Hell, sometimes it was taped to the monitor. Not every time, of course -- a minority of users, really -- but often enough to make it a Bad Habit.
I used to do tech support at a major US university. I'd show up at the user's desk, flip the keyboard upside down
-kgj
-kgj
We want freedom for the users to make their systems obey them, and allow them to study and modify it to suit their needs.
That's all very noble sounding but its not at all the truth.
No we don't. We want to impress our corporate masters with all of these shiny reports showing how much we know about everyone is on the system, trying to candy up our asses in the name of safety. We're no different from the people pushing camcorders in grocery stores. Security is a protection racket industry... "buy from us, before some hacker/muslim/bigfoot, gets you..." And really, it seems to me that the climate of fear that we are imposing on IT far and away outweighs the perceived benefit, just as it does, whenever security becomes an industry by itself.
I guarantee that there is not a single developer on this board that has not written a security / tracking system for some product, somewhere, and not marveled at the possibilities of all that information they collect.
This is my sig.
if you're depending entirely upon a perimeter defense you will get pwned.
The higher the technology, the sharper that two-edged sword.
Am I the only one who's never found a single antivirus app to be worth a damn?
expandfairuse.org
I'm constantly befuddled about the time and energy wasted on the concept of end-to-end security. The plain basic truth is this: Productivity does not require security! What this means is we end up in a cycle of building networks and applications without considering the potential risks and security requirements. Security, whether it's a firewall to an end-to-end implementation with so-called defense in depth, is a bolt-on patch to something can could have been designed securely to begin with. There's never enough time and money to do something right, but tons of it to do it over. Start with zero, and define your applications, from routing protocols all the way up to e-mail and databases, and put security controls in place relative to those applications. If you support mobile hosts, figure out how they can be securely mobile, or treat them as external hosts at all times. Once you design security into your processes and hosts, deny the rest of the traffic. It just seems that users think they have some God given right to do as they choose on the Net as they do at home. This is just not the case.
Active NIDS is usually discouraged when placed in serial with the network, as it usually can't block the network when in parallel. But if the NIDS server can log onto the managed switch or router, it can disable the connection on an intrusion being detected. If it's sniffing the packets on the regular network only (ie: not providing any service to the network), it can't be seen or disabled.
If servers on the network aren't intended for outside use, make them IPv6-only and either make the router an IPv4/IPv6 gateway or use IPv6 tunnels to the extranets of interest. You can't crack what you can't connect to, putting those servers out of reach.
PAM supports OPIE and S/KEY, so you can always make passwords MUCH harder to obtain or crack. Kerberos V is also good for that.
Banning open protocols and .rhosts, requiring SSH or SSL/TLS-based protocols would likely do wonders for security as well. Even if passwords are technically encrypted, you can learn a huge amount from the rest of a session if it's not encrypted. Ergo, mandate encryption.
Next, as far as possible, servers should use mandatory access controls (to limit the use of any bugs for escalation) and software that has been as audited as possible (to minimize the risks of such bugs existing in the first place). The greater the risk of holes, the less the value of protecting all the other avenues that could be used for attack.
Finally, password files and other authentication data should be protected by means of strong encryption or strong cryptographic hashes according to requirements. That way, if a service ends up proving exploitable or some other hole is discovered, an attacker can't use such data to access the system with greater rights.
Sure, this is (a) imperfect, (b) clock-cycle expensive and (c) costly if done right, but it WILL be better than any firewall on its own, no matter how good the firewall.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Mmmmmmonster Kill!
That's why you have restrictions on what users can do with their machines, especially non technical users.
Oh, sorry Mr Marketing guy, you can't install new software, you don't need it.
No, you're not authenticated for full office network access mr homeworker, not until your machine's been fully scanned. Until then you can access your mail account and the web from this sandbox area.
Uh, no, mr software developer, you can't have root access to the main source repository...
There are many things you can do to protect yourself from the ID-10-T problem.
The use of one vendor for all security products is not a good idea. To truly have defense in depth, there needs to be variety in your security products across your system or infrastructure. If all your security products have a common base (Cisco IOS, in this case), then one security vulnerability in the IOS software can render most or all of your defense useless. As an example, I might have a network built on Cisco Catalyst switches, with a Cisco VPN concentrator, Cisco Secure IDS, and a PIX firewall. I might have another that has a Checkpoint Firewall, with a Sonicwall VPN device, Snort IDS running on Linux, and Cisco routers with 3Com Switches. All of a sudden, an exploit comes out for IOS that allows full enable/administrator access via a specially crafted packet. Which network is more secure?
From the review, I can not tell if the author suggests this at all. If he does not, then he is missing one very important part of security...don't put all your eggs in one basket!