Descripciones mejoradas de Syndetics:

Publisher's Note: Products purchased from Third Party sellers are not guaranteed by the publisher for quality, authenticity, or access to any online entitlements included with the product. Security Smarts for the Self-Guided IT Professional

Defend your network against a wide range of existing and emerging threats. Written by a Certified Information Systems Security Professional with more than 20 years of experience in the field, Network Security: A Beginner's Guide , Third Edition is fully updated to include thelatest and most effective security strategies.

You'll learn about the four basic types of attacks, how hackers exploit them, and how to implement information security services to protect information and systems. Perimeter, monitoring, and encryption technologies arediscussed in detail. The book explains how to create and deploy an effective security policy, manage and assess risk, and perform audits. Information security best practices and standards, including ISO/IEC 27002, arecovered in this practical resource.

Network Security: A Beginner's Guide , ThirdEdition features:

Lingo --Common security terms defined so that you're in the know on the job IMHO --Frank and relevant opinions based on theauthor's years of industry experience Budget Note --Tips for getting security technologies and processes into your organization's budget In Actual Practice --Exceptions to the rules of security explained in real-world contexts Your Plan --Customizable checklists you can use on the job now Into Action --Tips on how, why, and when to applynew skills and techniques at work

Tabla de contenidos provista por Syndetics

• Acknowledgments(p. xvii)
• Introduction(p. xix)
• About the Series(p. xxi)
• Part I Information Security Basics
• 1 What is Information Security?(p. 3)
• Where Sorcery Is Traded for Fallible, Manageable Realities(p. 4)
• A Retrospective Look at Security(p. 5)
• Define Security as a Process, Not as Point Products(p. 13)
• And-virus Software(p. 13)
• Access Controls(p. 13)
• Firewalls(p. 13)
• Smart Cards(p. 14)
• Biometrics(p. 15)
• Intrusion Detection and Prevention(p. 16)
• Policy Management(p. 16)
• Vulnerability Scanning(p. 16)
• Encryption(p. 17)
• Data Loss Prevention(p. 17)
• Physical Security Mechanisms(p. 17)
• 2 Types of Attacks(p. 19)
• Access Attacks(p. 21)
• Snooping(p. 21)
• Eavesdropping(p. 22)
• Interception(p. 23)
• How Access Attacks Are Accomplished(p. 23)
• Modification Attacks(p. 27)
• Changes(p. 28)
• Insertion(p. 28)
• Deletion(p. 28)
• How Modification Attacks Are Accomplished(p. 28)
• Denial-of-Service Attacks(p. 29)
• Denial of Access to Information(p. 30)
• Denial of Access to Applications(p. 30)
• Denial of Access to Systems(p. 30)
• Denial of Access to Communications(p. 30)
• How Denial-of-Service Attacks Are Accomplished(p. 30)
• Repudiation Attacks(p. 32)
• Masquerading(p. 32)
• Denying an Event(p. 32)
• How Repudiation Attacks Are Accomplished(p. 32)
• 3 Hacker Techniques(p. 35)
• A Hacker's Motivation(p. 37)
• Challenge(p. 37)
• Greed(p. 38)
• Malicious Intent(p. 39)
• Hacking Techniques(p. 40)
• Bad Passwords(p. 40)
• Open Sharing(p. 41)
• Software Vulnerabilities(p. 43)
• Network Hacking(p. 47)
• Social Engineering(p. 53)
• Denial-of-Service(p. 54)
• Malicious Software(p. 58)
• Methods of the Untargeted Hacker(p. 61)
• Targets(p. 61)
• Reconnaissance(p. 61)
• Attack Methods(p. 64)
• Use of Compromised Systems(p. 64)
• Methods of the Targeted Hacker(p. 69)
• Targets(p. 70)
• Reconnaissance(p. 70)
• Attack Methods(p. 74)
• Use of Compromised Systems(p. 76)
• 4 Information Security Services(p. 79)
• The Confidentiality Service(p. 80)
• Confidentiality of Files(p. 81)
• Confidentiality of Information in Transmission(p. 82)
• Traffic Flow Confidentiality(p. 84)
• Attacks That Can Be Prevented(p. 85)
• The Integrity Service(p. 85)
• Integrity of Files(p. 86)
• Integrity of Information During Transmission(p. 87)
• Attacks That Can Be Prevented(p. 87)
• The Availability Service(p. 87)
• Backups(p. 88)
• Fail-Over(p. 88)
• Disaster Recovery(p. 89)
• Attacks That Can Be Prevented(p. 89)
• The Accountability Service(p. 89)
• Identification and Authentication(p. 90)
• Audit(p. 91)
• Attacks That Can Be Prevented(p. 92)
• Part II Groundwork
• 5 Policy(p. 97)
• Why Policy Is Important(p. 98)
• Defining What Security Should Be(p. 99)
• Putting Everyone on the Same Page(p. 99)
• The Various Policies Used by Organizations(p. 99)
• Information Policy(p. 100)
• Security Policy(p. 103)
• Acceptable Use Policy(p. 108)
• Internet Use Policy(p. 109)
• E-mail Policy(p. 110)
• User Management Procedures(p. 110)
• System Administration Procedure(p. 112)
• Backup Policy(p. 114)
• Incident Response Procedure(p. 115)
• Configuration Management Procedure(p. 118)
• Design Methodology(p. 119)
• Disaster Recovery Plans(p. 121)
• Creating Appropriate Policy(p. 123)
• Defining What Is Important(p. 123)
• Defining Acceptable Behavior(p. 124)
• Identifying Stakeholders(p. 124)
• Defining Appropriate Outlines(p. 124)
• Policy Development(p. 125)
• Deploying Policy(p. 125)
• Gaining Buy-In(p. 125)
• Education(p. 126)
• Implementation(p. 126)
• Using Policy Effectively(p. 126)
• New Systems and Projects(p. 127)
• Existing Systems and Projects(p. 127)
• Audits(p. 127)
• Policy Reviews(p. 127)
• 6 Managing Risk(p. 129)
• Defining Risk(p. 130)
• Threat(p. 131)
• Vulnerability(p. 137)
• Consequences(p. 138)
• Countermeasures(p. 141)
• Measuring Risk(p. 142)
• Probabilistic(p. 144)
• Maximum Impact(p. 146)
• A Hybrid Approach(p. 147)
• 7 The Information Security Process(p. 149)
• Conducting an Assessment(p. 152)
• Network(p. 154)
• Physical Security(p. 156)
• Policies and Procedures(p. 158)
• Precautions(p. 159)
• Awareness(p. 160)
• People(p. 161)
• Workload(p. 162)
• Attitude(p. 162)
• Adherence(p. 162)
• Business(p. 163)
• Assessment Results(p. 163)
• Developing Policy(p. 164)
• Choosing the Order of Policies to Develop(p. 165)
• Updating Existing Policies(p. 166)
• Implementing Security(p. 166)
• Security Reporting Systems(p. 167)
• Use-Monitoring(p. 167)
• System Vulnerability Scans(p. 167)
• Policy Adherence(p. 168)
• Authentication Systems(p. 169)
• Perimeter Security(p. 169)
• Network Monitoring Systems(p. 170)
• Encryption(p. 170)
• Physical Security(p. 171)
• Staff(p. 171)
• Awareness Training(p. 172)
• Employees(p. 172)
• Administrators(p. 173)
• Developers(p. 173)
• Executives(p. 173)
• Security Staff(p. 173)
• Audits(p. 174)
• Policy Adherence Audits(p. 175)
• Periodic and New Project Assessments(p. 175)
• Penetration Tests(p. 175)
• 8 Information Security Best Practices(p. 179)
• Administrative Security Practices(p. 180)
• Policies and Procedures(p. 181)
• Resources(p. 182)
• Responsibility(p. 185)
• Education(p. 186)
• Contingency Plans(p. 189)
• Security Project Plans(p. 191)
• Technical Security Practices(p. 193)
• Network Controls(p. 193)
• Malicious Code Protection(p. 194)
• Authentication(p. 195)
• Monitoring(p. 196)
• Encryption(p. 198)
• Patching Systems(p. 198)
• Backup and Recovery(p. 199)
• Physical Security(p. 199)
• Making Use of ISO 27002(p. 201)
• Key Concepts of the Standard(p. 202)
• How This Standard Can Be Used(p. 203)
• Part III Network Security Technology
• 9 Perimeter Technology(p. 207)
• Perimeters and Perimeter Policy Basics(p. 209)
• Perimeter Controls(p. 210)
• Routers(p. 210)
• Firewalls(p. 211)
• Network Intrusion Prevention Systems(p. 213)
• Web Application Firewalls(p. 215)
• Proxies and URL Filters(p. 216)
• Data Loss Prevention(p. 216)
• Anti-malware Controls(p. 217)
• Virtual Private Networks(p. 218)
• Physical Separation(p. 219)
• Defense-in-Depth(p. 220)
• Creating a Perimeter Architecture(p. 221)
• DMZ Perimeter Architecture(p. 222)
• Employee Perimeter Architecture(p. 225)
• 10 Monitoring Technology(p. 229)
• The Purposes of Monitoring(p. 230)
• Monitoring Technologies(p. 231)
• Intrusion Detection Systems(p. 232)
• Network Behavior Analysis(p. 233)
• Network Forensics(p. 234)
• System Logs(p. 235)
• Application Logs(p. 236)
• Vulnerability Scanning(p. 236)
• Creating a Monitoring Architecture(p. 237)
• Correlating Events(p. 240)
• Separation of Duties(p. 241)
• 11 Encryption Technology(p. 245)
• Basic Encryption Concepts(p. 247)
• Encryption Terms(p. 247)
• Attacks Against Encryption(p. 248)
• Symmetric Key Encryption(p. 250)
• Substitution Ciphers(p. 251)
• One-Time Pads(p. 252)
• Data Encryption Standard(p. 253)
• Password Encryption(p. 254)
• The Advanced Encryption Standard: Rijndael(p. 255)
• Public Key Encryption(p. 256)
• Diffie-Hellman Key Exchange(p. 258)
• RSA(p. 259)
• Other Public Key Algorithms(p. 261)
• Digital Signatures(p. 262)
• Secure Hash Functions(p. 263)
• Key Management(p. 264)
• Key Creation(p. 265)
• Key Distribution(p. 266)
• Key Certification(p. 267)
• Key Protection(p. 267)
• Key Revocation(p. 268)
• Key Recovery(p. 269)
• Trust in the Encryption System(p. 270)
• Other Considerations(p. 274)
• The Supporting Cast(p. 274)
• Availability(p. 275)
• Glossary(p. 279)
• Index(p. 293)

Notas de autor provistas por Syndetics

Eric Maiwald, CISSP , is a Research Vice President with Gartner, Inc., where he focuses on enterprise security infrastructure and mobility technologies. He is the author of Fundamentals of Network Security and coauthor of Security Planning and Disaster Recovery .