Addison Wesley - Protect Your Windows Network From Perimeter to Data

• Protect Your Windows Network From Perimeter to Data
• Table of Contents
• Copyright
• Praise for Protect Your Windows Network
• Acknowledgments
• About the Authors
  • Jesper M. Johansson
  • Steve Riley
• Preface
  • Target Audience and Objective
  • What Is on the CD
• Part I. Introduction and Fundamentals
  • Chapter 1. Introduction to Network Protection
    • Why Would Someone Attack Me?
    • Nobody Will Ever Call You to Tell You How Well the Network Is Working
    • Introduction to the Defense-in-Depth Model
    • The Defender's Dilemma
    • Summary
    • What You Should Do Today
    • Endnote  Endnotes
  • Chapter 2. Anatomy Of A HackThe Rise And Fall Of Your Network
    • What a Penetration Test Will Not Tell You
    • Why You Need To Understand Hacking
    • Target Network
    • Network Footprinting
    • Initial Compromise
    • Elevating Privileges
    • Hacking Other Machines
    • Taking Over the Domain
    • Post-mortem
    • How to Get an Attacker Out of Your Network
    • Summary
    • What You Should Do Today
  • Chapter 3. Rule Number 1: Patch Your Systems
    • Patches Are a Fact of Life
    • Exercise Good Judgment
    • What Is a Patch?
    • Patch Management Is Risk Management
    • Tools to Manage Security Updates
    • Advanced Tips and Tricks
    • Slipstreaming
    • Summary
    • What You Should Do Today
• Part II. Policies, Procedures, and User Awareness
  • Chapter 4. Developing Security Policies
    • Who Owns Developing Security Policy
    • What a Security Policy Looks Like
    • Why a Security Policy Is Necessary
    • Why So Many Security Policies Fail
    • Analyzing Your Security Needs to Develop Appropriate Policies
    • How to Make Users Aware of Security Policies
    • Procedures to Enforce Policies
    • Dealing with Breaches of Policy
    • More Information
    • Summary
    • What You Should Do Today
  • Chapter 5. Educating Those Pesky Users
    • System Administration Security Administration
    • Securing People
    • The Problem
    • Protecting People
    • Plausibility + Dread + Novelty = Compromise
    • Things You Should Do Today
• Part III. Physical and Perimeter Security: The First Line of Defense
  • Chapter 6. If You Do Not Have Physical Security, You Do Not Have Security
    • But First, a Story
    • It's a Fundamental Law of Computer Security
    • The Importance of Physical Access Controls
    • Protecting Client PCs
    • The Case of the Stolen Laptop
    • The Family PC
    • No Security, Physical or Otherwise, Is Completely Foolproof
    • Things You Should Do Today
  • Chapter 7. Protecting Your Perimeter
    • The Objectives of Information Security
    • The Role of the Network
    • Start with (What's Left of) Your Border
    • Next, Use the Right Firewall
    • Then, Consider Your Remote Access Needs
    • Finally, Start Thinking About "Deperimeterization"
    • Things You Should Do Today
    • Endnote  Endnotes
• Part IV. Protecting Your Network Inside the Perimeter
  • Chapter 8. Security Dependencies
    • Introduction to Security Dependencies
    • Administrative Security Dependencies
    • Service Account Dependencies
    • Mitigating Service and Administrative Dependencies
    • Other Security Dependencies
    • Summary
    • What You Should Do Today
  • Chapter 9. Network Threat Modeling
    • Network Threat Modeling Process
    • Document Your Network
    • Segment Your Network
    • Restrict Access to Your Network
    • Summary
    • What You Should Do Today
  • Chapter 10. Preventing Rogue Access Inside the Network
    • The Myth of Network Sniffing
    • Network Protection at Layers 2 and 3
    • Using 802.1X for Network Protection
    • Using IPsec for Network Protection
    • Network Quarantine Systems
    • Summary
    • What You Should Do Today
  • Chapter 11. Passwords and Other Authentication MechanismsThe Last Line of Defense
    • Introduction
    • Password Basics
    • Password History
    • What Administrators Need to Know About Passwords
    • Password Best Practices
    • Recommended Password Policy
    • Better Than Best PracticesMultifactor Authentication
    • Summary
    • What You Should Do Today
• Part V. Protecting Hosts
  • Chapter 12. Server and Client Hardening
    • Security Configuration Myths
    • On to the Tweaks
    • Top 10 (or so) Server Security Tweaks
    • Top 10 (or so) Client Security Tweaks
    • The Caution ListChanges You Should Not Make
    • Security Configuration Tools
    • Summary
    • What You Should Do Today
• Part VI. Protecting Applications
  • Chapter 13. Protecting User Applications
    • Patch Them!
    • Make Them Run As a Nonadmin
    • Turn Off Functionality
    • Restrict Browser Functionality
    • Attachment Manager
    • Spyware
    • Security Between Chair and Keyboard (SeBCAK)
    • Summary
    • What You Should Do Today
  • Chapter 14. Protecting Services and Server Applications
    • You Need a Healthy Disrespect for Your Computer
    • Rule 1: All Samples Are Evil
    • Three Steps to Lowering the Attack Surface
    • What About Service Accounts?
    • Privileges Your Services Do Not Need
    • Hardening SQL Server 2000
    • Hardening IIS 5.0 and 6.0
    • Summary
    • What You Should Do Today
  • Chapter 15. Security for Small Businesses
    • Protect Your Desktops and Laptops
    • Protect Your Servers
    • Protect Your Network
    • Keep Your Data Safe
    • Use the Internet Safely
    • Small Business Security Is No Different, Really
    • What You Should Do Today
  • Chapter 16. Evaluating Application Security
    • Caution: More Software May Be Hazardous to Your Network Health
    • Baseline the System
    • Things to Watch Out For
    • Summary
    • What You Should Do Today
• Part VII. Protecting Data
  • Chapter 17. Data-Protection Mechanisms
    • Security Group Review
    • Access Control Lists
    • Layers of Access Control
    • Access Control Best Practices
    • Rights Management Systems
    • Incorporating Data Protection into Your Applications
    • Protected Data: Our Real Goal
    • What You Should Do Today
    • Endnote  Endnotes
• Appendix A. How to Get Your Network Hacked in 10 Easy Steps
• Appendix B. Script To Revoke SQL Server PUBLIC Permissions
• Appendix C. HOSTS file to Block Spyware
• Appendix D. Password Generator Tool
  • g (Generate Password Based on Known Input)
  • r (Generate Random Password)
  • s (Set a Password on an Account and/or Service)
  • Security Information
  • Usage Scenarios
• Appendix E. 10 Immutable Laws of Security
  • Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore
  • Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore
  • Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore
  • Law #4: If you allow a bad guy to upload programs to your Web site, it's not your Web site any more
  • Law #5: Weak passwords trump strong security
  • Law #6: A computer is only as secure as the administrator is trustworthy
  • Law #7: Encrypted data is only as secure as the decryption key
  • Law #8: An out-of-date virus scanner is only marginally better than no virus scanner at all
  • Law #9: Absolute anonymity isn't practical, in real life or on the Web
  • Law #10: Technology is not a panacea
• Index
  • SYMBOL
  • A
  • B
  • C
  • D
  • E
  • F
  • G
  • H
  • I
  • K
  • L
  • M
  • N
  • O
  • P
  • Q
  • R
  • S
  • T
  • U
  • V
  • W
  • X
  • Z