Amazon no longer offers textbook rentals. We do!

Designing Network Security

by: Kaeo, Merike

Designing Network Security

by: Kaeo, Merike

ISBN 13:
9781587051173
ISBN 10:
1587051176
Edition: 2nd
Format: Hardcover
Copyright: 01/01/2004
Publisher: Cisco Press

Rent

Sorry, this item is currently unavailable.

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

Extend or Purchase Your Rental at Any Time

Need to keep your rental past your due date? At any time before your due date you can extend or purchase your rental through your account.

Summary

bull; Gain a comprehensive view of network security issues and concepts, then master specific implementations based on your network needs bull; Learn how to use new and legacy Cisco Systems equipment to secure your networks bull; Understand how to design and build security services while also learning the legal and network accessibility impact of those services

Introduction

xviii

Part I Security Fundamentals

(236)

Basic Cryptography

(32)

Cryptography

(15)

Symmetric Key Encryption

(3)

DES

(1)

3DES

(1)

RC-4

(1)

IDEA

(1)

AES

(1)

Asymmetric Encryption

(5)

Hash Functions

(1)

Digital Signatures

(3)

Authentication and Authorization

(2)

Methods of Authentication

(1)

Trust Models

(1)

Namespace

(1)

Key Management

(8)

Creating and Distributing Secret Keys

(4)

Creating and Distributing Public Keys

(1)

Digital Certificates

(1)

Certificate Authorities

(2)

Key Escrow

(2)

The Business Case

(1)

The Political Angle

(1)

The Human Element

(1)

Summary

(1)

Review Questions

(4)

Security Technologies

(98)

Identity Technologies

(35)

Secure Passwords

(1)

S/Key Password Protocol

(3)

Token Password Authentication Schemes

(3)

PPP Authentication Protocols

(2)

PPP Password Authentication Protocol

(1)

PPP Challenge Handshake Authentication Protocol

(3)

PPP Extensible Authentication Protocol

(3)

PPP Authentication Summary

(1)

Protocols Using Authentication Mechanisms

(1)

The TACACS+ Protocol

(5)

The RADIUS Protocol

(3)

The Kerberos Protocol

(6)

The Distributed Computing Environment

(1)

FORTEZZA

(2)

IEEE 802.1x

(2)

Application Layer Security Protocols

(4)

SHTTP

(1)

S/MIME

(3)

Transport Layer Security Protocols

(8)

The Secure Socket Layer/Transport Layer Security Protocol

(5)

The Secure Shell Protocol

(1)

The SOCKS Protocol

(2)

Network Layer Security

(22)

The IP Security Protocol Suite

(1)

Authentication and Encryption Services

(5)

Security Associations

(1)

Key Management

(15)

Link-Layer Security Technologies

107

(14)

The Layer 2 Forwarding Protocol

107

(1)

A Sample Scenario

108

(2)

The Point-to-Point Tunneling Protocol

110

(1)

Decoupling Traditional NAS Functionality

111

(3)

Protocol Overview

111

(2)

The Layer 2 Tunneling Protocol

113

(1)

Protocol Overview

114

(4)

A Sample Scenario

118

(2)

PPPoE

120

(1)

Protocol Overview

120

(1)

Public Key Infrastructure and Distribution Models

121

(8)

Functions of a PKI

122

(1)

A Sample Scenario Using a PKI

123

(1)

Certificates

124

(1)

The X.509 Standard

125

(1)

X.509v3 Certificate

126

(1)

X.509v2 CRL

127

(1)

Certificate Distribution

128

(1)

Lightweight Directory Access Protocol

128

(1)

Summary

129

(1)

Review Questions

130

(5)

Applying Security Technologies to Real Networks

135

(72)

Virtual Private Networks (VPNs)

135

(16)

VPN Deployment Models

135

(2)

Site-to-Site VPNs

137

(1)

Client-to-Site VPNs

138

(1)

VPNs Security

139

(1)

Tunneling Protocols

139

(2)

NAT/PAT

141

(3)

Layer 2 Tunneling Protocol (L2TP)

144

(3)

Authentication

147

(1)

VPN Security Application

148

(1)

Access VPNs

149

(1)

Intranet/Extranet VPNs

150

(1)

Wireless Networks

151

(26)

Types of Wireless Technology

151

(2)

Wireless LAN Components

153

(1)

Wireless LAN Deployment Models

153

(1)

Peer-to-Peer WLAN

153

(1)

Infrastructure Mode WLAN

154

(2)

802.11 Physical Layer Basics

156

(1)

Direct Sequencing Spread Spectrum (DSSS)

156

(1)

Frequency-Hopping Spread Spectrum (FHSS)

157

(1)

Orthogonal Frequency-Division Multiplexing (OFDM)

158

(2)

802.11 Media Access Control

160

(3)

Wireless LAN Roaming

163

(2)

Wireless LAN Security

165

(1)

Basic Security

165

(1)

WEP Encryption

166

(3)

Cryptographic Authentication

169

(1)

Security Enhancements

170

(1)

Temporal Key Integrity Protocol (TKIP)

171

(2)

802.1X ``Network Port Authentication''

173

(4)

Wireless VPN Security

177

(1)

Voice over IP (VoIP) Networks

177

(25)

IP Telephony Network Components

178

(1)

IP Telephony Deployment Models

178

(2)

VoIP Protocols

180

(1)

H.323

180

(6)

Media Gateway Control Protocol (MGCP)

186

(1)

Session Initiation Protocol (SIP)

187

(6)

VoIP Security Protocols

193

(1)

H.323 Protocol Security

193

(3)

SIP Protocol Security

196

(4)

VoIP Security Solution

200

(2)

Summary

202

(5)

Review Questions

203

(4)

Routing Protocol Security

207

(32)

Routing Basics

207

(6)

Routing Protocol Classification

208

(1)

Interior Gateway Protocols

209

(1)

Exterior Gateway Protocols

209

(1)

Routing Protocol Security

210

(1)

Authenticating Routing Protocol Updates

210

(3)

IPsec and Routing Protocols

213

(1)

Routing Protocol Security Details

213

(23)

RIP

213

(3)

RIP Authentication

216

(4)

RIPv2 and IPv6

220

(1)

EIGRP

221

(1)

Underlying Technologies

221

(1)

EIGRP Routing Concepts

222

(1)

EIGRP Packet Types

223

(1)

EIGRP Authentication

224

(1)

OSPF

224

(1)

OSPF Authentication

225

(3)

OSPF and IPv6

228

(1)

IS-IS

229

(2)

IS-IS Authentication

231

(3)

BGP-4

234

(1)

BGP-4 Authentication

234

(1)

BGP Security Futures

235

(1)

Summary

236

(1)

Review Questions

237

(2)

Part II The Corporate Security Policy

239

(136)

Threats in an Enterprise Network

241

(50)

Types of Threats

242

(15)

Unauthorized Access

242

(1)

Internet Access

242

(2)

Tapping into the Physical Wire

244

(2)

Remote Dial-In Access

246

(2)

Wireless Access

248

(2)

Impersonation

250

(3)

Denial of Service

253

(1)

DDoS

254

(3)

Motivation of Threat

257

(1)

Common Protocol Vulnerabilities

258

(17)

The TCP/IP Protocol

258

(2)

TCI/IP Connection Establishment

260

(1)

TCP/IP Sequence Number Attack

261

(2)

TCP/IP Session Hijacking

263

(1)

TCP SYN Attack

263

(1)

The Land.c Attack

264

(1)

The UDP Protocol

264

(1)

The ICMP Protocol

265

(1)

The Ping of Death

266

(1)

Smurf Attack

267

(1)

The Teardrop.c Attack

267

(1)

The DNS Protocol

268

(3)

The NNTP Protocol

271

(1)

The SMTP Protocol

271

(1)

Spam Attack

272

(1)

The FTP Protocol

272

(1)

The Remote Procedure Call (RPC) Service

273

(2)

The NFS/NIS Services

275

(1)

X Window System

275

(1)

Common Network Scenario Threats and Vulnerabilities

275

(12)

Virtual Private Networks

276

(1)

Unauthorized Access

276

(1)

Impersonation

277

(1)

Denial of Service

277

(1)

Wireless Networks

278

(1)

Unauthorized Access

278

(1)

Impersonation

279

(1)

Denial of Service

279

(1)

WEP Insecurity

280

(3)

Voice over IP Networks

283

(1)

Unauthorized Access

283

(1)

Impersonation

284

(1)

Denial of Service

284

(1)

SIP Application Layer Insecurity

284

(3)

Routing Protocols

287

(1)

Social Engineering

288

(1)

Summary

288

(1)

Review Questions

289

(2)

Considerations for a Site Security Policy

291

(22)

Where to Begin

292

(3)

Risk Management

295

(9)

Risk Assessment

295

(1)

Identify Network Assets

295

(1)

Value of Assets

296

(1)

Threats and Vulnerability

297

(2)

Evaluating Risk

299

(3)

Risk Mitigation and the Cost of Security

302

(2)

A Security Policy Framework

304

(7)

Components of an Enterprise Network

304

(2)

Elements of a Security Architecture

306

(1)

Identity

306

(1)

Integrity

307

(1)

Confidentiality

308

(1)

Availability

308

(1)

Audit

308

(1)

Additional Considerations

309

(2)

Summary

311

(1)

Review Questions

311

(2)

Design and Implementation of the Corporate Security Policy

313

(42)

Physical Security Controls

314

(8)

Physical Network Infrastructure

314

(1)

Physical Media Selection

314

(4)

Network Topography

318

(1)

Physical Device Security

319

(1)

Physical Location

319

(1)

Physical Access

320

(1)

Environmental Safeguards

321

(1)

Sample Physical Security Control Policy

322

(1)

Logical Security Controls

322

(13)

Subnet Boundaries

324

(3)

Routing Boundaries

327

(2)

VLAN Boundaries

329

(1)

Logical Access Control

330

(1)

Control and Limit Secrets

331

(1)

Authentication Assurance

331

(2)

System Greeting Messages

333

(1)

Remember the Human Factor

333

(1)

Sample Logical Security Control Policy

334

(1)

Infrastructure and Data Integrity

335

(7)

Firewalls

335

(1)

Direction of Traffic

336

(1)

Traffic Origin

337

(1)

IP Address

337

(1)

Port Numbers

337

(1)

Authentication

337

(1)

Application Content

337

(1)

Network Services

337

(2)

Authenticated Data

339

(1)

Routing Updates

339

(1)

Common Attack Deterrents

340

(1)

Attacks Against Any Random Host Behind the Firewall

340

(1)

Attacks Against Exposed Services

340

(1)

Attacks Against Internal Client Hosts

341

(1)

Spoofing Attacks

341

(1)

Sample Infrastructure and Data Integrity Policy

341

(1)

Data Confidentiality

342

(1)

Sample Data Confidentiality Policy

343

(1)

Security Policy Verification and Monitoring

343

(4)

Vulnerability Scanners

343

(1)

Accounting

344

(1)

Secure Management

344

(1)

Intrusion Detection

345

(2)

Sample Verification and Monitoring Section

347

(1)

Policies and Procedures for Staff

347

(4)

Secure Backups

347

(1)

Equipment Certification

348

(1)

Use of Portable Tools

348

(1)

Audit Trails

348

(1)

What to Collect

349

(1)

Storing the Data

349

(1)

Legal Considerations

350

(1)

Sample Policies and Procedures for Staff

350

(1)

Security Awareness Training

351

(1)

Social Engineering

352

(1)

Summary

352

(1)

Review Questions

353

(2)

Incident Handling

355

(20)

Building an Incident Response Team

358

(1)

Establishing the Core Team

359

(1)

Detecting an Incident

359

(6)

Keeping Track of Important Information

360

(1)

Intrusion Detection Systems

360

(1)

Intrusion Detection Issues in Switched Networks

361

(2)

Network Intrusion Detection System Limitations

363

(2)

Handling an Incident

365

(3)

Prioritizing Actions

366

(1)

Assessing Incident Damage

366

(1)

Reporting and Alerting Procedures

367

(1)

Incident Vulnerability Mitigation

368

(1)

Responding to the Incident

369

(3)

Keep Accurate Documentation

369

(1)

Real-World Example Scenarios

370

(1)

Scenario 1: Maliciously Internal Compromised Hosts

370

(1)

Scenario 2: Violation of Acceptble-Use Policy

370

(1)

Scenario 3: Random Network Interloping

371

(1)

Recovering from an Incident

372

(1)

Summary

372

(1)

Review Questions

373

(2)

Part III Practical Implementation

375

(234)

Securing the Corporate Network Infrastructure

377

(68)

Identity - Controlling Network Device Access

378

(30)

Basic Versus Privileged Access

379

(1)

Cisco IOS Devices

379

(10)

Cisco Switches

389

(4)

Cisco PIX Firewall

393

(2)

Line Access Controls

395

(1)

Cisco IOS

396

(5)

Cisco Switches

401

(1)

Cisco PIX Firewall

402

(3)

SNMP Security

405

(1)

HTTP Security

406

(2)

Integrity

408

(6)

Image Authentication

408

(1)

Secure Workgroup

409

(1)

Routing Authentication

410

(2)

Route Filters and Routing Believability

412

(2)

Data Confidentiality

414

(1)

Network Availability

415

(12)

Redundancy Features

416

(1)

Cisco IOS

416

(2)

Cisco Switches

418

(3)

Cisco PIX Firewall

421

(2)

Common Attack Deterrents

423

(1)

Spoofed Packets

423

(1)

Fragmentation Attacks

424

(1)

Broadcast Attacks

425

(1)

TCP SYN Attack

425

(2)

Audit

427

(8)

Configuration Verification

427

(1)

Monitoring and Logging Network Activity

427

(1)

Syslog Management

428

(3)

Intrusion Detection

431

(1)

Cisco IOS

432

(1)

PIX Firewall

433

(1)

Network Forensics

434

(1)

Implementation Examples

435

(7)

Summary

442

(1)

Review Questions

442

(3)

Securing Internet Access

445

(56)

Internet Access Architecture

445

(2)

External Screening Router Architecture

447

(12)

Cisco IOS Filters

448

(1)

Standard IP Access Control Lists

449

(2)

Extended Access Control Lists

451

(4)

Turbo Access Control Lists

455

(1)

Named Access Lists

456

(1)

Reflexive Access Lists

456

(3)

Advanced Firewall Architecture

459

(17)

Advanced Packet Session Filtering

460

(1)

TCP Protocol Traffic

460

(1)

UDP Protocol Traffic

461

(1)

Application Content Filtering

461

(1)

World Wide Web

461

(1)

Java Applets

461

(1)

URL Filtering/Blocking

462

(1)

E-mail and SMTP

462

(1)

Other Common Application Protocols

462

(4)

Application Authentication/Authorization

466

(1)

Encryption

467

(5)

Network Address Translation

472

(1)

Public Versus Private IP Addresses

472

(2)

NAT Functionality

474

(2)

Implementation Examples

476

(22)

Cisco IOS Firewall

476

(1)

Content-Based Access Control

476

(4)

Sample Cisco IOS Firewall Configuration

480

(5)

PIX Firewall

485

(1)

Controlling Inbound Access

486

(2)

Controlling Outbound Access

488

(1)

Cut-Thru-Proxy Feature

488

(2)

Advanced Features

490

(1)

Sample Configuration of PIX Firewall with Screening IOS Router

490

(8)

Summary

498

(1)

Review Questions

498

(3)

Securing Remote Dial-In Access

501

(74)

Dial-In Security Concerns

502

(1)

Authenticating Dial-In Users and Devices

503

(12)

Simple Dial-In Environments

504

(6)

Complex Dial-In Environments

510

(1)

TACACS+ and RADIUS Authentication

510

(5)

Authorization

515

(7)

TACACS+ and RADIUS Authorization

516

(1)

Service Types

516

(1)

Authorization Methods

517

(3)

Sample TACACS+ Database Syntax

520

(2)

Accounting and Billing

522

(3)

TACACS+ and RADIUS Accounting

522

(2)

Centralized Billing

524

(1)

Using AAA with Specific Features

525

(14)

The Lock-and-Key Feature

526

(1)

Lock-and-Key Authentication

526

(1)

Lock-and-Key Operation

526

(2)

Lock-and-Key Examples

528

(4)

Double Authentication/Authorization

532

(4)

Automated Double Authentication

536

(3)

Encryption for Virtual Dial-In Environments

539

(33)

GRE Tunneling and CET

539

(1)

GRE Tunneling

540

(1)

Cisco Encryption Technology (CET)

540

(8)

IPsec

548

(1)

Configuring IPsec

548

(6)

L2TP with IPsec

554

(18)

Summary

572

(1)

Review Questions

573

(2)

Securing VPN, Wireless, and VolP Networks

575

(34)

Virtual Private Networks

575

(17)

Identity

577

(1)

Authentication

577

(1)

What Do You Authenticate

577

(2)

How Do You Authenticate

579

(6)

Additional Authentication Considerations

585

(1)

Access Control

586

(2)

Integrity

588

(1)

Confidentiality

589

(1)

Availability

589

(1)

Audit

590

(1)

VPN Design Examples

590

(2)

Wireless Networks

592

(5)

Identity

592

(1)

Authentication

593

(1)

Access Control

593

(1)

Integrity

594

(1)

Confidentiality

594

(1)

Availability

594

(1)

Audit

595

(1)

Wireless Network Design Examples

596

(1)

Voice over IP Networks

597

(9)

Identity

597

(1)

Authentication

597

(2)

Access Control

599

(4)

Integrity

603

(1)

Confidentiality

603

(1)

Availability

604

(1)

Audit

605

(1)

VoIP Network Design References

605

(1)

Summary

606

(1)

Review Questions

606

(3)

Part IV Appendixes

609

(88)

Appendix A Sources of Technical Information

611

(4)

Appendix B Reporting and Prevention Guidelines: Industrial Espionage and Network Intrusions

615

(14)

Appendix C Port Numbers

629

(4)

Appendix D Mitigating Distributed Denial-of-Service Attacks

633

(32)

Appendix E Answers to Review Questions

665

(32)

Glossary

697

(14)

Index

711

Amazon no longer offers textbook rentals. We do!

Designing Network Security

Designing Network Security

9781587051173

1587051176

Summary

Table of Contents

Supplemental Materials

Write a Review

Amazon no longer offers textbook rentals. We do!

Designing Network Security

Designing Network Security

9781587051173

1587051176

Summary

Table of Contents

Supplemental Materials

Write a Review

Related Products