Fundamentals of Network Security: Table of Contents

• Critical Skill 1.1 Define Information Security
• Brief History of Security
• Critical Skill 1.2 Define Security as a Process, Not Point Products
• Anti-virus Software
• Access Controls
• Firewalls
• Smart Cards
• Biometrics
• Intrusion Detection
• Policy Management
• Vulnerability Scanning
• Encryption
• Physical Security Mechanisms
• Project 1 Examine Computer Security Certifications

• Critical Skill 2.1 Define Access Attacks
• Snooping
• Eavesdropping
• Interception
• How Access Attacks Are Accomplished
• Critical Skill 2.2 Define Modification Attacks
• Changes
• Insertion
• Deletion
• How Modification Attacks Are Accomplished
• Critical Skill 2.3 Define Denial-of-Service Attacks
• Denial of Access to Information
• Denial of Access to Applications
• Denial of Access to Systems
• Denial of Access to Communications
• How Denial-of-Service Attacks Are Accomplished
• Critical Skill 2.4 Define Repudiation Attacks
• Masquerading
• Denying an Event
• How Repudiation Attacks Are Accomplished
• Project 2 Look at Your Vulnerabilities

• Critical Skill 3.1 Identify a Hacker's Motivation
• Challenge
• Greed
• Malicious Intent
• Critical Skill 3.2 Learn Historical Hacking Techniques
• Open Sharing
• Bad Passwords
• Programming Flaw
• Social Engineering
• Buffer Overflows
• Denial of Service
• Critical Skill 3.3 Learn Advanced Techniques
• Sniffing Switch Networks
• IP Spoofing
• Critical Skill 3.4 Identify Malicious Code
• Viruses
• Trojan Horses
• Worms
• Critical Skill 3.5 Identify Methods of the Untargeted Hacker
• Targets
• Reconnaissance
• Attack Methods
• Use of Compromised Systems
• Critical Skill 3.6 Identify Methods of the Targeted Hacker
• Targets
• Reconnaissance
• Attack Methods
• Use of Compromised Systems
• Project 3 Conduct Reconnaissance of Your Site

• Critical Skill 4.1 Define Confidentiality
• Confidentiality of Files
• Confidentiality of Information in Transmission
• Traffic Flow Confidentiality
• Attacks that Can Be Prevented
• Critical Skill 4.2 Define Integrity
• Integrity of Files
• Integrity of Information During Transmission
• Attacks that Can Be Prevented
• Critical Skill 4.3 Define Availability
• Backups
• Fail-Over
• Disaster Recovery
• Attacks that Can Be Prevented
• Critical Skill 4.4 Define Accountability
• Identification and Authentication
• Audit
• Attacks that Can Be Prevented
• Project 4 Protect Your Information

• Critical Skill 5.1 Understand U.S. Criminal Law
• Computer Fraud and Abuse (18 US Code 1030)
• Credit Card Fraud (18 US Code 1029)
• Copyrights (18 US Code 2319)
• Interception (18 US Code 2511)
• Access to Electronic Information (18 US Code 2701)
• Other Criminal Statutes
• Patriot Act
• Homeland Security Act
• Critical Skill 5.2 Understand State Laws
• Critical Skill 5.3 Understand Laws of Other Countries
• Australia
• Brazil
• India
• The People's Republic of China
• United Kingdom
• Critical Skill 5.4 Understand Issues with Prosecution
• Evidence Collection
• Contacting Law Enforcement
• Critical Skill 5.5 Understand Civil Issues
• Employee Issues
• Downstream Liability
• Critical Skill 5.6 Understand Privacy Issues
• Customer Information
• Health Insurance Portability and Accountability Act
• Addressable vs. Required Components
• Requirements of the Security Rule
• The Graham-Leach-Bliley Financial Services Modernization Act
• Project 5 Prosecute the Offender

• Critical Skill 6.1 Understand Why Policy Is Important
• Defining What Security Should Be
• Putting Everyone on the Same Page
• Critical Skill 6.2 Define Various Policies
• Information Policy
• Security Policy
• Computer Use Policy
• Internet Use Policy
• E-mail Policy
• User Management Procedures
• System Administration Procedure
• Backup Policy
• Incident Response Procedure
• Configuration Management Procedure
• Design Methodology
• Disaster Recovery Plans
• Critical Skill 6.3 Create Appropriate Policy
• Defining What Is Important
• Defining Acceptable Behavior
• Identifying Stakeholders
• Defining Appropriate Outlines
• Policy Development
• Critical Skill 6.4 Deploy Policy
• Gaining Buy-In
• Education
• Implementation
• Critical Skill 6.5 Use Policy Effectively
• New Systems and Projects
• Existing Systems and Projects
• Audits
• Policy Reviews
• Project 6 Develop an Internet Use Policy

• Critical Skill 7.1 Define Risk
• Vulnerability
• Threat
• Threat + Vulnerability = Risk
• Critical Skill 7.2 Identify the Risk to an Organization
• Identifying Vulnerabilities
• Identifying Real Threats
• Examining Countermeasures
• Identifying Risk
• Critical Skill 7.3 Measure Risk
• Money
• Time
• Resources
• Reputation
• Lost Business
• Methodology for Measuring Risk
• Project 7 Identifying Electronic Risks to Your Organization

• Critical Skill 8.1 Conduct an Assessment
• Network
• Physical Security
• Policies and Procedures
• Precautions
• Awareness
• People
• Workload
• Attitude
• Adherence
• Business
• Assessment Results
• Critical Skill 8.2 Develop Policy
• Choosing the Order of Policies to Develop
• Updating Existing Policies
• Critical Skill 8.3 Implement Security
• Security Reporting Systems
• Authentication Systems
• Internet Security
• Intrusion Detection Systems
• Encryption
• Physical Security
• Staff
• Critical Skill 8.4 Conduct Awareness Training
• Employees
• Administrators
• Developers
• Executives
• Security Staff
• Critical Skill 8.5 Conduct Audits
• Policy Adherence Audits
• Periodic and New Project Assessments
• Penetration Tests
• Project 8 Develop a Security Awareness Program

• Critical Skill 9.1 Understand Administrative Security
• Policies and Procedures
• Resources
• Responsibility
• Education
• Contingency Plans
• Security Project Plans
• Critical Skill 9.2 Understand Technical Security
• Network Connectivity
• Malicious Code Protection
• Authentication
• Monitoring
• Encryption
• Patching Systems
• Backup and Recovery
• Physical Security
• Critical Skill 9.3 Make Use of ISO 17799
• Key Concepts of the Standard
• How this Standard Can Be Used
• Project 9 Conduct a Gap Analysis

• Critical Skill 10.1 Define the Types of Firewalls
• Application Layer Firewalls
• Packet Filtering Firewalls
• Hybrids
• Critical Skill 10.2 Develop a Firewall Configuration
• Architecture #1: Internet Accessible Systems Outside the Firewall
• Architecture #2: Single Firewall
• Architecture #3: Dual Firewalls
• Critical Skill 10.3 Design a Firewall Rule Set
• Project 10 Examine the Differences Between Firewall Types

• Critical Skill 11.1 Define Virtual Private Networks
• Critical Skill 11.2 Deploy User VPNs
• Benefits of User VPNs
• Issues with User VPNs
• Managing User VPNs
• Critical Skill 11.3 Deploy Site VPNs
• Benefits of Site VPNs
• Issues with Site VPNs
• Managing Site VPNs
• Critical Skill 11.4 Understand Standard VPN Techniques
• VPN Server
• Encryption Algorithms
• Authentication System
• VPN Protocol
• Critical Skill 11.5 Understand the Types of VPN Systems
• Hardware Systems
• Software Systems
• Web-based Systems
• Project 11 Examine the Differences Between VPN Types

• Critical Skill 12.1 Understand Basic Encryption Concepts
• Encryption Terms
• Attacks Against Encryption
• Critical Skill 12.2 Understand Private Key Encryption
• What Is Private Key Encryption?
• Substitution Ciphers
• One-Time Pads
• Data Encryption Standard
• Triple DES
• Password Encryption
• The Advanced Encryption Standard: Rijndael
• Other Private Key Algorithms
• Critical Skill 12.3 Understand Public Key Encryption
• What Is Public Key Encryption?
• Diffie-Hellman Key Exchange
• RSA
• Other Public Key Algorithms
• Critical Skill 12.4 Understand Digital Signatures
• What Is a Digital Signature?
• Secure Hash Functions
• Critical Skill 12.5 Understand Key Management
• Key Creation
• Key Distribution
• Key Certification
• Key Protection
• Key Revocation
• Critical Skill 12.6 Understand Trust in the System
• Hierarchy
• Web
• Project 12 Design an Encryption System

• Critical Skill 13.1 Define the Types of Intrusion Detection Systems
• Host-Based IDS
• Network-Based IDS
• Is One Type of IDS Better?
• Critical Skill 13.2 Set Up an IDS
• Defining the Goals of the IDS
• Choosing What to Monitor
• Choosing How to Respond
• Setting Thresholds
• Implementing the System
• Critical Skill 13.3 Manage an IDS
• Understanding What an IDS Can Tell You
• Investigating Suspicious Events
• Critical Skill 13.4 Understand Intrusion Prevention
• How Intrusions Can Be Prevented Using IDS
• Issues with Intrusion Prevention
• Project 13 Deploy a Network IDS

• Critical Skill 14.1 Protect Against Malicious Code
• Issues with Viruses, Trojan Horses, and Worms
• Using Anti-virus Software Effectively
• Critical Skill 14.2 Use the Internet
• Connecting to the Internet
• Sharing Files
• Critical Skill 14.3 Protect Against Physical Tampering
• Desktop Encryption
• Being Watchful
• Project 14 Test a Personal Firewall

• Critical Skill 15.1 Set Up the System
• Startup Files
• Services to Allow
• System Configuration Files
• Patches
• Critical Skill 15.2 Perform User Management
• Adding Users to the System
• Removing Users from the System
• Critical Skill 15.3 Perform System Management
• Auditing a System
• Log Files
• Hidden Files
• SUID and SGID Files
• World-Writable Files
• Looking for Suspicious Signs
• Project 15 Audit a Unix System

• Critical Skill 16.1 Set Up the System
• Registry Settings
• System Configuration Settings
• Critical Skill 16.2 Manage Users
• Adding Users to the System
• Setting File Permissions
• Removing Users from the System
• Critical Skill 16.3 Manage the System
• Auditing a System
• Log Files
• Looking for Suspicious Signs
• Project 16 Configure a Windows NT System

• Critical Skill 17.1 Set Up the System
• Local Security Policy Settings
• System Configuration
• Special Configuration Issues for Windows 2003
• Critical Skill 17.2 Manage Users
• Adding Users to the System
• Setting File Permissions
• Removing Users from the System
• Critical Skill 17.3 Manage the System
• The secedit Command
• Auditing a System
• Log Files
• Looking for Suspicious Signs
• Critical Skill 17.4 Use Active Directory
• Secure Setup and Installation
• Administration
• Group Policy and Security
• AD User and Group Management
• Project 17 Use secedit to Manage Windows 2000 Security Configurations

• Critical Skill 18.1 Learn about What Services to Offer
• Mail
• Encrypted E-mail
• Web
• Internal Access to the Internet
• External Access to Internal Systems
• Control Services
• Critical Skill 18.2 Learn about What Services Not to Offer
• Critical Skill 18.3 Develop a Communications Architecture
• Single-Line Access
• Multiple-Line Access to a Single ISP
• Multiple-Line Access to Multiple ISPs
• Critical Skill 18.4 Design a Demilitarized Zone
• Defining the DMZ
• Systems to Place in the DMZ
• Appropriate DMZ Architectures
• Critical Skill 18.5 Understand Network Address Translation
• What Is Network Address Translation?
• Private Class Addresses
• Static NAT
• Dynamic NAT
• Critical Skill 18.6 Design PARTner Networks
• Use of PARTner Networks
• Setup
• Addressing Issues
• Project 18 Create an Internet Architecture

• Critical Skill 19.1 Understand E-Commerce Services
• Differences Between E-Commerce Services and Regular DMZ Services
• Examples of E-Commerce Services
• Critical Skill 19.2 Understand the Importance of Availability
• Business-to-Consumer Issues
• Business-to-Business Issues
• Global Time
• Client Comfort
• Cost of Downtime
• Solving the Availability Problem
• Critical Skill 19.3 Implement Client-Side Security
• Communications Security
• Saving Information on the Client System
• Repudiation
• Critical Skill 19.4 Implement Server-Side Security
• Information Stored on the Server
• Protecting the Server from Attack
• Critical Skill 19.5 Implement Application Security
• Proper Application Design
• Proper Programming Techniques
• Showing Code to the World
• Configuration Management
• Critical Skill 19.6 Implement Database Server Security
• Database Location
• Communication with the E-Commerce Server
• Internal Access Protection
• Critical Skill 19.7 Develop an E-Commerce Architecture
• Server Location and Connectivity
• Availability
• Vulnerability Scanning
• Audit Information and Problem Detection
• Project 19 Design an E-Commerce Architecture

• Critical Skill 20.1 Understand Current Wireless Technology
• Standard Architectures
• Transmission Security
• Authentication
• Critical Skill 20.2 Understand Wireless Security Issues
• WLAN Detection
• Eavesdropping
• Active Attacks
• Potential Legal Issues
• Critical Skill 20.3 Deploy Wireless Safely
• Access Point Security
• Transmission Security
• Workstation Security
• Site Security
• Project 20 Implementing a Wireless LAN