Table of Contents

Protect Your Windows Network From Perimeter to Data
By Jesper  M.  Johansson, Steve  Riley
...............................................
Publisher: Addison Wesley Professional
Pub Date: May 20, 2005
ISBN: 0-321-33643-7
Pages: 608

Table of Contents    Index    Examples

		Copyright
		Praise for Protect Your Windows Network
		Acknowledgments
		About the Authors
			Jesper M. Johansson
			Steve Riley
		Preface
			Target Audience and Objective
			What Is on the CD
		Part  I.   Introduction and Fundamentals
			Chapter  1.   Introduction to Network Protection
				Why Would Someone Attack Me?
				Nobody Will Ever Call You to Tell You How Well the Network Is Working
				Introduction to the Defense-in-Depth Model
				The Defender's Dilemma
				Summary
				What You Should Do Today
				Endnote   Endnotes
			Chapter  2.   Anatomy Of A HackThe Rise And Fall Of Your Network
				What a Penetration Test Will Not Tell You
				Why You Need To Understand Hacking
				Target Network
				Network Footprinting
				Initial Compromise
				Elevating Privileges
				Hacking Other Machines
				Taking Over the Domain
				Post-mortem
				How to Get an Attacker Out of Your Network
				Summary
				What You Should Do Today
			Chapter  3.   Rule Number 1: Patch Your Systems
				Patches Are a Fact of Life
				Exercise Good Judgment
				What Is a Patch?
				Patch Management Is Risk Management
				Tools to Manage Security Updates
				Advanced Tips and Tricks
				Slipstreaming
				Summary
				What You Should Do Today
		Part  II.   Policies, Procedures, and User Awareness
			Chapter  4.   Developing Security Policies
				Who Owns Developing Security Policy
				What a Security Policy Looks Like
				Why a Security Policy Is Necessary
				Why So Many Security Policies Fail
				Analyzing Your Security Needs to Develop Appropriate Policies
				How to Make Users Aware of Security Policies
				Procedures to Enforce Policies
				Dealing with Breaches of Policy
				More Information
				Summary
				What You Should Do Today
			Chapter  5.   Educating Those Pesky Users
				System Administration Security Administration
				Securing People
				The Problem
				Protecting People
				Plausibility + Dread + Novelty = Compromise
				Things You Should Do Today
		Part  III.   Physical and Perimeter Security: The First Line of Defense
			Chapter  6.   If You Do Not Have Physical Security, You Do Not Have Security
				But First, a Story
				It's a Fundamental Law of Computer Security
				The Importance of Physical Access Controls
				Protecting Client PCs
				The Case of the Stolen Laptop
				The Family PC
				No Security, Physical or Otherwise, Is Completely Foolproof
				Things You Should Do Today
			Chapter  7.   Protecting Your Perimeter
				The Objectives of Information Security
				The Role of the Network
				Start with (What's Left of) Your Border
				Next, Use the Right Firewall
				Then, Consider Your Remote Access Needs
				Finally, Start Thinking About "Deperimeterization"
				Things You Should Do Today
				Endnote   Endnotes
		Part  IV.   Protecting Your Network Inside the Perimeter
			Chapter  8.   Security Dependencies
				Introduction to Security Dependencies
				Administrative Security Dependencies
				Service Account Dependencies
				Mitigating Service and Administrative Dependencies
				Other Security Dependencies
				Summary
				What You Should Do Today
			Chapter  9.   Network Threat Modeling
				Network Threat Modeling Process
				Document Your Network
				Segment Your Network
				Restrict Access to Your Network
				Summary
				What You Should Do Today
			Chapter  10.   Preventing Rogue Access Inside the Network
				The Myth of Network Sniffing
				Network Protection at Layers 2 and 3
				Using 802.1X for Network Protection
				Using IPsec for Network Protection
				Network Quarantine Systems
				Summary
				What You Should Do Today
			Chapter  11.   Passwords and Other Authentication MechanismsThe Last Line of Defense
				Introduction
				Password Basics
				Password History
				What Administrators Need to Know About Passwords
				Password Best Practices
				Recommended Password Policy
				Better Than Best PracticesMultifactor Authentication
				Summary
				What You Should Do Today
		Part  V.   Protecting Hosts
			Chapter  12.   Server and Client Hardening
				Security Configuration Myths
				On to the Tweaks
				Top 10 (or so) Server Security Tweaks
				Top 10 (or so) Client Security Tweaks
				The Caution ListChanges You Should Not Make
				Security Configuration Tools
				Summary
				What You Should Do Today
		Part  VI.   Protecting Applications
			Chapter  13.   Protecting User Applications
				Patch Them!
				Make Them Run As a Nonadmin
				Turn Off Functionality
				Restrict Browser Functionality
				Attachment Manager
				Spyware
				Security Between Chair and Keyboard (SeBCAK)
				Summary
				What You Should Do Today
			Chapter  14.   Protecting Services and Server Applications
				You Need a Healthy Disrespect for Your Computer
				Rule 1: All Samples Are Evil
				Three Steps to Lowering the Attack Surface
				What About Service Accounts?
				Privileges Your Services Do Not Need
				Hardening SQL Server 2000
				Hardening IIS 5.0 and 6.0
				Summary
				What You Should Do Today
			Chapter  15.   Security for Small Businesses
				Protect Your Desktops and Laptops
				Protect Your Servers
				Protect Your Network
				Keep Your Data Safe
				Use the Internet Safely
				Small Business Security Is No Different, Really
				What You Should Do Today
			Chapter  16.   Evaluating Application Security
				Caution: More Software May Be Hazardous to Your Network Health
				Baseline the System
				Things to Watch Out For
				Summary
				What You Should Do Today
		Part  VII.   Protecting Data
			Chapter  17.   Data-Protection Mechanisms
				Security Group Review
				Access Control Lists
				Layers of Access Control
				Access Control Best Practices
				Rights Management Systems
				Incorporating Data Protection into Your Applications
				Protected Data: Our Real Goal
				What You Should Do Today
				Endnote   Endnotes
		Appendix  A.   How to Get Your Network Hacked in 10 Easy Steps
		Appendix  B.   Script To Revoke SQL Server PUBLIC Permissions
		Appendix  C.   HOSTS file to Block Spyware
		Appendix  D.   Password Generator Tool
			g (Generate Password Based on Known Input)
			r (Generate Random Password)
			s (Set a Password on an Account and/or Service)
			Security Information
			Usage Scenarios
		Appendix  E.   10 Immutable Laws of Security
			Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore
			Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore
			Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore
			Law #4: If you allow a bad guy to upload programs to your Web site, it's not your Web site any more
			Law #5: Weak passwords trump strong security
			Law #6: A computer is only as secure as the administrator is trustworthy
			Law #7: Encrypted data is only as secure as the decryption key
			Law #8: An out-of-date virus scanner is only marginally better than no virus scanner at all
			Law #9: Absolute anonymity isn't practical, in real life or on the Web
			Law #10: Technology is not a panacea
		Index