This book is targeted at anyone who has the unfortunate yet delightful task of having to manage the security of a computer system or network of systems. Because we deal almost exclusively with relatively large networks running primarily some flavor of Microsoft Windows, the book focuses on that type of environment. However, we hope that just about anyone involved in managing security will find something of value in these pages.
Security in information technology is an evolving field; so evolving, in fact, that there is not really a clear name for it. Some people, ourselves included sometimes, call it information security (infosec). We like that term , because protecting information is the ultimate goal. However, it is also important to protect the data before it becomes information, and it is important to protect the resources and functionality provided by the systems in the network, and infosec does not capture that very well. Computer security gives us a connotation of protecting a single computer, and single computers simply are not that interesting today. Others call the field distributed systems security . However, as we explain in Chapter 1, "Introduction to Network Protection," we think distributed systems is a terrible idea from a security perspective and we want to avoid that term. Thus, we stuck with network security , which means protecting all the assets in the network.
Just as with the name of the field, many other issues are up for debate in network security. Therefore, what you will find in these pages is often our opinion of what is correct. Nowhere is this more pronounced than in Chapter 12, "Server and Client Hardening," but you will find the same phenomenon elsewhere. You may already have an opinion that is not the same as ours, or you may not. The point is not so much to persuade you that our opinion is correct as it is to make you think about the whole picture. If you do that, and come to a conclusion that is different from ours, then our objective has been met. We simply are trying to make you challenge the perceived (often outdated ) wisdom and form a conclusion that helps you better protect your network.