Network Security Onno W. Purbo

Buku Keamanan Jaringan Internet Toko Buku Gramedia

Overview Roadmap SANS Integrating Security Into Your Site How to Get the Work Done Where to Find the Right Information Pitfalls and Vulnerabilities

Integrating Security Into Your Site

How do you justify the security infrastructure investment? How do you determine your site's security mission statement? What are the key elements of a successful security awareness training program? What are the key elements of a good security infrastructure? What are some common security problems which continue to plague many sites?

How to Get the Work Done

duties of security support personnel? ensure or document security infrastructure? types of security tools and the most popular tools in use today? Where can you find some consolidated information security vulnerabilities? find vendor-specific security patches? find many of the public domain security tools? seven items when responding to incident? five low-cost security improvements?

7 items to remember? Follow your organization’s policies and procedures. Contact incident response agencies. Communication via out-of-band (e.g., a phone call). Document your actions. Make copies of files the intruders may have left or touched & store them off-line. If you are unsure of what actions to take, seek additional help and guidance. Contact law enforcement officials.

5 low-cost improvements Document and publish what you expect. Configure your routers to deny all unnecessary incoming traffic. Keep sendmail properly configured and updated. Use freeware vulnerability assessment tools. Publish the results. Install freeware host and network based auditing and traffic analysis tools on critical hosts.

Where to Find the Right Information

What are some incident response centers? Where can you find vendor-specific security information? What are some of the good security web sites? What are some good security books? What are some good security mailing lists?

Good security web sites? ftp://ciac.llnl.gov/pub/ciac/sectools/unix / ftp://ftp.cerias.purdue.edu ftp://ftp.cert.org/pub/tools/ ftp://ftp.win.tue.nl/pub/security/ ftp://ftp.funet.fi/pub/unix/security/

Pitfalls and Vulnerabilities

What are some of the frequently targeted system binaries and directories? What are some common Internet attack methods in use today? What are some common problems with security perimeter implementations?

targeted system binaries & directories? /bin/login /usr/etc/in.telnetd /usr/etc/in.ftpd /usr/etc/in.tftpd /usr/ucb/netstat /bin/ps /bin/ls /usr/sbin/ifconfig /bin/df /usr/lib/libc.a /usr/ucb/cc /.rhosts /etc/hosts.equiv /bin/.rhosts /etc/passwd /etc/group /var/yp/* (nis maps) root environment files (.login,.cshrc,.profile,.forward)

Common Internet attack? Exploitation vulnerabilities in vendor programs. Exploitation of cgi-bin vulnerabilities. bombing, spamming & relaying. Exploitation anon-FTP & web servers. Exploitation of named/BIND vulnerabilities. Exploitation of MTA & mail readers. Denial of Services (DoS) attacks. Sending hostile code & attack programs as mail attachments.

Security perimeter implementations? Further security checks & controls are needed on internal network. Members can request analog lines at workspace & bypassing the security perimeter. Some network services (e.g., ftp, tftp, http, sendmail) destined for internal hosts are passed through the security perimeter control points unscreened.

Security perimeter implementations? The firewall hosts or routers accept connections from multiple hosts on the internal network and from hosts on the DMZ network Access lists are often configured incorrectly, allowing unknown and dangerous services to pass through freely.

Security perimeter implementations? Logging of connections through the security perimeter is either insufficient or not reviewed on a regular basis. People frequently implement encrypted tunnels through their security perimeter without fully considering the security of the endpoints of the tunnel.