Security Tool Websites
Having the right tool can make the testing and analysis of infrastructure security much easier. Listed next are some sites that maintain various security tools:
DumpSec is a GUI Windows-based enumeration tool that can provide account information, RID information, open shares, and more. The link is shown as follows:
www.somarsoft.com
A nice list of bootable Linux CDs is available at the following address. Many of these have really good distributions of tools preconfigured and ready to go that will be of aid to those doing security work.
www.frozentech.com/content/livecd.php
Cain and Abel is a GUI Windows-based password cracking and enumeration tool that is free to download at
www.oxid.it
NetStumbler is the leading wireless scanning tool used to identify and enumerate 802.11 wireless networks. You can download it at
www.netstumbler.org
Nmap is an open source Windows and Linux scanning tool. To learn more about it or download the tool, visit the following link:
www.insecure.org
SuperScan is a Windows scanning tool for TCP and UDP. It's available for free from Foundstone at
www.foundstone.com/resources/freetools.htm
Scanrand is another useful security tool that is free to download from the following url:
www.lurhq.com/scanrand_dissected.pdf
TCH-Amap is a valuable scanning tool that is free to download at
http://thc.org/thc-amap/
John the Ripper is a Linux and Windows password-cracking tool that can be used to audit the strength of your passwords. It can be downloaded from
www.openwall.com/john
SNORT is a great open source IDS tool available for Windows and Linux. SNORT can be downloaded at the following site:
www.snort.org
Packetyzer is Ethereal with a new interface. It's free to download from:
www.networkchemistry.com/products/packetyzer
Rainbowcrack is a password-cracking tool that works off of the fast time-memory trade-off technique. You can download it at
www.antsight.com/zsl/rainbowcrack
Ophcrack is another password-cracking tool that uses the fast time-memory trade-off technique. You can download it from the following site:
http://lasecwww.epfl.ch/~oechslin/projects/ophcrack/
Nessus is one of the premiere open source scanning tools. You can download it from the following site:
www.nessus.org
Metasploit is an exploit and vulnerability assessment tool. You can download it at:
www.metasploit.com
Introduction to Assessing Network Vulnerabilities
- Introduction to Assessing Network Vulnerabilities
- What Security Is and Isnt
- Process for Assessing Risk
- Four Ways in Which You Can Respond to Risk
- Network Vulnerability Assessment
Foundations and Principles of Security
- Foundations and Principles of Security
- Basic Security Principles
- Security Requires Information Classification
- The Policy Framework
- The Role Authentication, Authorization, and Accountability Play in a Secure Organization
- Encryption
- Security and the Employee (Social Engineering)
Why Risk Assessment
- Why Risk Assessment
- Risk Terminology
- Laws, Mandates, and Regulations
- Risk Assessment Best Practices
- Understanding the IT Security Process
- The Goals and Objectives of a Risk Assessment
Risk-Assessment Methodologies
- Risk-Assessment Methodologies
- Risk-Assessment Terminology
- Quantitative and Qualitative Risk-Assessment Approaches
- Best Practices for Quantitative and Qualitative Risk Assessment
- Choosing the Best Risk-Assessment Approach
- Common Risk-Assessment Methodologies and Templates
Scoping the Project
- Scoping the Project
- Defining the Scope of the Assessment
- Reviewing Critical Systems and Information
- Compiling the Needed Documentation
- Making Sure You Are Ready to Begin
Understanding the Attacker
- Understanding the Attacker
- Who Are the Attackers?
- What Do Attackers Do?
- Reducing the Risk of an Attack
- How to Respond to an Attack
Performing the Assessment
- Performing the Assessment
- Introducing the Assessment Process
- Level I Assessments
- Level II Assessments
- Level III Assessments
Tools Used for Assessments and Evaluations
- Tools Used for Assessments and Evaluations
- A Brief History of Security Tools
- Putting Together a Toolkit
- Determining What Tools to Use
Preparing the Final Report
- Preparing the Final Report
- Preparing for Analysis
- Ranking Your Findings
- Building the Final Report
- Contents of a Good Report
- Determining the Next Step
- Audit and Compliance
Post-Assessment Activities
- Post-Assessment Activities
- IT Security Architecture and Framework
- Roles, Responsibilities, and Accountabilities
- Security Incident Response Team (SIRT)
- Vulnerability Management
- Training IT Staff and End Users
Appendix A. Security Assessment Resources
Appendix B. Security Assessment Forms
- Information Request Form
- Document Tracking Form
- Critical Systems and Information Forms
- Level II Assessment Forms
Appendix C. Security Assessment Sample Report
- Appendix C. Security Assessment Sample Report
- Notice
- Executive Summary
- Statement of Work
- Analysis
- Recommendations
- Conclusions
Appendix D. Dealing with Consultants and Outside Vendors
- Appendix D. Dealing with Consultants and Outside Vendors
- Procurement Terminology
- Typical RFP Procurement Steps
- Procurement Best Practices
Appendix E. SIRT Team Report Format Template
EAN: 2147483647
Pages: 138
