Encryption
Encryption is the process of encoding information in such a way that unauthorized individuals cannot view it. Encryption is needed because there is plenty of information that organizations must ensure is kept private and confidential. Some of this information includes the following:
- Bank-account information
- Credit-card information
- Private correspondence
- Personal details
- Privileged information
- Sensitive company information
- Social Security numbers
- Trade secrets
Encryption is performed by using the science of cryptography. Cryptography is a vast and complex subject. An in-depth understanding of it is beyond the scope of this book. Therefore, this section does not discuss how encryption works. What is important to know is that just about all organizations need to use encryption. Many are already using encryption, but others will wait until they suffer through a bad experience or have to comply with new laws that mandate the protection of personal data. Encryption's role in the organization includes the following:
- Authentication Services such as Challenge Handshake Authentication Protocol (CHAP) and Extensible Authentication Protocol (EAP) make use of authentication.
- Data encryption Information in storage can be encrypted to protect it from prying eyes. Microsoft's Encrypted File System (EFS) is one such example.
- IPSec IPSec can be used to provide confidentiality and/or integrity to information in transit. It is widely used to help implement virtual private networks (VPNs).
- Public Key Infrastructure (PKI) This is a widely used system to verify and authenticate the validity of each individual involved in an Internet transaction.
- Pretty Good Privacy (PGP) PGP is as close to military-grade encryption as a private individual can get, and it works well at securing email. Unlike public key infrastructure (PKI), PGP works by using a web of trust. Users distribute and sign their own public keys. It can be used to encrypt information in storage or in transit.
- Secure Shell (SSH) This application-layer protocol can provide secure communications and is a good replacement for Telnet and FTP.
- Secure Sockets Layer (SSL) An application-independent protocol that was developed to encrypt information in transit.
- Transport Layer Security (TLS) A protocol that guarantees privacy and data integrity between client/server applications.
As shown in the preceding list, encryption can be used at all levels of a security infrastructurefrom protection to network communications over the Internet to encrypting data on a drive. Encryption can provide confidentiality, authentication, integrity, and nonrepudiation for information in storage or in transit.
Introduction to Assessing Network Vulnerabilities
- Introduction to Assessing Network Vulnerabilities
- What Security Is and Isnt
- Process for Assessing Risk
- Four Ways in Which You Can Respond to Risk
- Network Vulnerability Assessment
Foundations and Principles of Security
- Foundations and Principles of Security
- Basic Security Principles
- Security Requires Information Classification
- The Policy Framework
- The Role Authentication, Authorization, and Accountability Play in a Secure Organization
- Encryption
- Security and the Employee (Social Engineering)
Why Risk Assessment
- Why Risk Assessment
- Risk Terminology
- Laws, Mandates, and Regulations
- Risk Assessment Best Practices
- Understanding the IT Security Process
- The Goals and Objectives of a Risk Assessment
Risk-Assessment Methodologies
- Risk-Assessment Methodologies
- Risk-Assessment Terminology
- Quantitative and Qualitative Risk-Assessment Approaches
- Best Practices for Quantitative and Qualitative Risk Assessment
- Choosing the Best Risk-Assessment Approach
- Common Risk-Assessment Methodologies and Templates
Scoping the Project
- Scoping the Project
- Defining the Scope of the Assessment
- Reviewing Critical Systems and Information
- Compiling the Needed Documentation
- Making Sure You Are Ready to Begin
Understanding the Attacker
- Understanding the Attacker
- Who Are the Attackers?
- What Do Attackers Do?
- Reducing the Risk of an Attack
- How to Respond to an Attack
Performing the Assessment
- Performing the Assessment
- Introducing the Assessment Process
- Level I Assessments
- Level II Assessments
- Level III Assessments
Tools Used for Assessments and Evaluations
- Tools Used for Assessments and Evaluations
- A Brief History of Security Tools
- Putting Together a Toolkit
- Determining What Tools to Use
Preparing the Final Report
- Preparing the Final Report
- Preparing for Analysis
- Ranking Your Findings
- Building the Final Report
- Contents of a Good Report
- Determining the Next Step
- Audit and Compliance
Post-Assessment Activities
- Post-Assessment Activities
- IT Security Architecture and Framework
- Roles, Responsibilities, and Accountabilities
- Security Incident Response Team (SIRT)
- Vulnerability Management
- Training IT Staff and End Users
Appendix A. Security Assessment Resources
Appendix B. Security Assessment Forms
- Information Request Form
- Document Tracking Form
- Critical Systems and Information Forms
- Level II Assessment Forms
Appendix C. Security Assessment Sample Report
- Appendix C. Security Assessment Sample Report
- Notice
- Executive Summary
- Statement of Work
- Analysis
- Recommendations
- Conclusions
Appendix D. Dealing with Consultants and Outside Vendors
- Appendix D. Dealing with Consultants and Outside Vendors
- Procurement Terminology
- Typical RFP Procurement Steps
- Procurement Best Practices
Appendix E. SIRT Team Report Format Template
EAN: 2147483647
Pages: 138
