Ajouter à une liste

Librairie Eyrolles - Paris 5e
Indisponible

Essential Guide to Information Security

Paul E. Proctor, F. Christian Byrnes

304 pages, parution le 21/03/2002

Ajouter à une liste

Indisponible

Résumé

Securing your key digital and information assets in an age of insecurity.

Securing enterprise data, applications, and intellectual property has become THE criticalissue for business decision-makers in this era of hackers and potential cyberterrorism. Butuntil now, most books on information security have been written for programmers andnetworking professionals, not business people. The Secured Enterprise: Protecting YourInformation Assets fills the gap, delivering a non-technical, business-focused briefing onevery key aspect of information security: frompeople to process to technology.

A guide to today's security threats—including cyberterrorism
How to establish effective, realistic security policies
The tools for defending your information assets
Effective mechanisms for identification, authentication, and access control
What firewalls can—and cannot—do
Vulnerability scanners, virus detectors, and intrusion detection systems
Virtual private networks: leveraging the cost savings without exposing your data to risk
Securing B2B and B2C e-commerce
How to evaluate third-party security products and services
New security options for wireless applications

Security has gotten more complex with time, and it has become more difficult to distill it. After readingthis book you will understand security better and be more prepared to apply it in your enterprise.

Contents

Foreword.
Acknowledgments.
Introduction: How to Read This Book.

I. INTRODUCTION TO SECURITY.

1. Introduction to Security.

Objectives of Computer Security. Confidentiality. Integrity. Availability. Nonrepudiation. Who is responsible for security? Why me? Relative security. Organizing security: Roles and responsibilities. What do You need to know? The role of the business manager. The need for policy. Enforcement technology. Operations technology. Security services. Summary.

2. Threat Briefing.

Csi/Fbi StudY. Threats. Misuse Examples. Insider Threats. Hacker Threats. Social Engineering. Network Vulnerabilities. Loss of Brand Equity. Graffiti (Web Site Defacing). Denial of Service. Security and Return on Investment. Quantifying Risk. Summary.

3. Security Policies.

Nontechnology-related Security Topics. Business Policy. Why are policies important? How can one policy work for everyone? Policy Guidance. Secure Communications Policy. Isolation Infrastructure Policy. Identity Infrastructure Policy. Permission Infrastructure Policy. Configuration Management Policy. User Management Policy. Threat Management and Monitoring Policy. Conformance Monitoring Policy. Application Architecture Policy. What does a security policy look like? How are policies applied and enforced? Who is responsible for security policies? Summary.

4. Authentication, Authorization, Access Control.

The AAA Disciplines. Access Control. Authentication/Identification. Who Are You Really? Authorization. Assembling the Pieces. The Ultimate Solution. The Real World for the Next Few Years. Summary.

II. SECURITY TECHNOLOGIES.

5. Firewalls.

What is a firewall? Uses for Firewalls. Types of Firewalls and How They Operate. Network Layer Firewalls. Application Layer Firewalls. Hybrid Firewalls. Working with Firewalls. Access Rules. Architecting a Firewall Solution. Internet Firewalls. Extranets. The DMZ. Firewalls and Dial-Ups. High Availability. Managing Firewalls. Firewalls and Operating Systems. Firewall Logging and Reporting. Business Application. Summary.

6. Vulnerability Scanners.

Your computers are NOT configured securely. Proper Configuration Is Difficult. Consistency Is Hard in Large Enterprises. Enterprises Are Living, Breathing, and Changing Things. Vendors Delivered Insecure Software to You. Keeping Up on Patches and Updates Is Very Difficult. Poor Administrators Change Things Unintentionally. Hackers and Insiders Change Things Intentionally. Vulnerability Scanners. Network-Based Scanners. Host-Based Scanners. Port Scanners. Commercial Scanner Products. Free Vulnerability Scanners. Winfingerprint. SAINT. Cerberus Information Scanner. Vulnerability Databases. Security Process and Procedures for Scanners. Summary.

7. Virus Detection and Content Filters.

Viruses. The Virus Threat. The Wild List. How Viruses Work. How Viruses Spread. The Virus Calendar. Virus Mutation. Common Virus Types. Virus Detection. Tips to Protect Against Viruses. Enterprise Virus Protection. Content Filters. How Content Filtering Works. Email Content Tracking. Malicious Code Filters. URL Filters. Incident Response for Content Filtering. Summary.

8. Intrusion Detection.

The Case for Intrusion Detection. What is Intrusion Detection? The Most Common Intrusion Detection. Network versus Host-Based Intrusion Detection. Anatomy of an Intrusion Detection System. Command Console. Network Sensor. Alert Notification. Response Subsystem. Database. Target Agents. Anatomy of an Intrusion Detection Process. Intrusion Detection Myths. Myth #1: The Network Intrusion Detection Myth. Myth #2: The False-Positive Myth. Myth #3: The Automated Anomaly Detection Myth. Myth #4: The Real-Time Requirement Myth. Myth #5: The Automated Response Myth. Myth #6: The Artificial Intelligence Myth. Summary.

9. Public Key Infrastructure and Encryption.

Encryption Basics. Secret Key Encryption. Public Key Encryption. Key Lengths and Security Strength. Public Keys as Infrastructure. The Benefits of PKI. The Problems of PKI. Summary.

10. Encrypted Communications.

What is a Virtual Private Network? A Brief History of VPNs. VPN Technology in Business. VPN Technology. Point-to-Point VPNs. Client-to-Server VPNs. Application-Level VPNs. Secure Sockets Layer. SSL Example. Secure Shell. SSH Example. Summary.

11. Mobile Workers and Wireless LANs.

Mobile Users and Security. Physical Security Issues in Mobile Computing. Wireless Networks. Wireless over Long Distances (Miles). Wireless LANs (in the Same Building). Personal LANs (Within 10 Meters). Security in the Wireless World. Security in Radiospace. Securing Your WLAN. Security and Bluetooth. Cellular Security. Wireless and Mobile Computing in the Future. Summary.

12. Single Signon.

What is SSO? Why SSO Fails. Too Many Account Names. Too Many Passwords. Frequent Re-Entry. Password Resets. User Account Management. Should Your Organization Address SSO? Summary.

13. Digital Signatures and Electronic Commerce.

E-Commerce. Electronic Signatures. E-SIGN. Transactional Security. Identrus: A Transactional Security Infrastructure. Smart Cards in Electronic Commerce. Visa Compliance Standards. Summary.

III. IMPLEMENTATION.

14. Establishing a Security Program.

Step One: Define Responsible Personnel. Step Two: Establish Core Processes. The Risk Assessment/Data Classification Process. The User Administration Process. The Policy Definition Process. Technical Implementation, Planning, and Design. Step Three: Define Requirements. Step Four: Communicate! The Awareness Program. The Executive Communication Program. Step Five: Audit and Monitor. Configuration Control and Audit. Intrusion Monitoring and Vulnerability Scanning. Intrusion Response and Forensics. Security Performance Reporting. Summary.

15. Security Assessments.

What is Assessment? Penetration Testing. Vulnerability Assessment. Security Posture Review. Security Audit. Risk Assessment. Problems with Quantitative Risk Assessment. Summary.

16. Managed Security Services.

What Is MSS? The Business Case for Outsourcing. How Much Should You Outsource? Security Elements You Can Outsource. Perimeter Protection. Firewalls. Client-Side Firewalls. Virus Detection. VPNs. Vulnerability Assessments/Penetration Testing. Web Filtering. Intrusion Detection/Monitoring. Incident Response. Selecting a Managed Security Service Provider. Service Offerings. Service Level Agreements. SOCs. History. The Growing Market. Summary.

17. Response and Recovery.

Incident Response. Escalation Procedures. Incident Triage. Business Continuity. Elements of Business Continuity. CERT. National Coordination CERTs. The CERT Inside Your Company. Summary.

18. Implementing Web and Internet Security.

Establishing the Policy Base. Appropriate Use. Privacy. Data Location and Protection. Application Design. Authentication Requirements. Authorization and Scalability. Secure Code. Infrastructure Design. The DMZ of the Firewall. Server Connectivity. Operating System Configuration. Security Operations. Virus Scanners and Content Filters. Vulnerability Scanners. Intrusion Detection Tools. Change Control Process. Operating System Maintenance. More Than the Sum of its Parts. Summary.

IV. ODDS AND ENDS.

19. Legal Issues.

Introduction. Computer Crime Laws. Law Enforcement/Criminal Prosecutions. Tort Litigation. Negligence Litigation. Better Technology. Corporate Reluctance to Prosecute. Attacking Back. Liability When Your Network is Used to Attack Others. Standard of Due Care. Responsibilities. Evidentiary Issues. Rules of Evidence. Accuracy. Chain of Custody. Transparency. Case Study. Organizations. National White Collar Crime Center. National Cybercrime Training Partnership. High-Technology Crime Investigators Association. Government Regulation of Information Security. European Data Privacy Initiatives and U.S. Department of Commerce Safe Harbor. The Gramm-Leach-Bliley and Health Insurance Portability and Accountability Acts. Government Information Services Reform Act. Going Forward. Summary. Resources.

20. Putting It All Together.

Communication (again). Understand Your Company's Business. Advice on Politics. Protect Yourself. A Final Word.

Glossary.
Index.

L'auteur - F. Christian Byrnes

F. CHRISTIAN BYRNES leads Meta Group's security coverage. He is the author of Security in Enterprise Computing: A Practical Guide. In recognition of his expertise in intellectual property concerns, he was appointed to the US Congress advisory committee that produced an extensive report to guide congress in planning future laws. Mr. Byrnes was CEO at Centrax Corporation, a security software vendor acquired by CyberSafe.

Caractéristiques techniques

	PAPIER
Éditeur(s)	Prentice Hall
Auteur(s)	Paul E. Proctor, F. Christian Byrnes
Parution	21/03/2002
Nb. de pages	304
Format	17,6 x 23,4
Couverture	Broché
Poids	630g
Intérieur	Noir et Blanc
EAN13	9780130619068