The following questions are designed to test your knowledge of network security practices. You might find that a question has more than one possible answer. The answers provided in Appendix B are intended to reinforce best practices that you can apply in your own networking environment.
In this chapter, questions 1 to 4 relate to concepts you read about. The remaining questions are offered as exercises for you to apply in your own organization. There is no one correct answer for any of these.
1: |
What method of security policy enforcement would be most effective at ensuring that employees have the latest version of virus-scanning software? |
2: |
What would be the best way to represent a policy for WLAN access in your organization? Should it be done through a policy, standard, or guideline? |
3: |
If you don't have the resources to track busy mailing lists such as BugTraq, is there an easier way to keep track of the high-profile attacks and vulnerabilities of which you should be aware? |
4: |
What are some ways to keep track of security best practices as they evolve? |
5: |
Outline your organization's primary business needs. Are there any unique aspects of your organization that would require a different approach to security? |
6: |
Put yourself in the shoes of a resourceful attacker. What damage could such a person with lots of free time and patience do to your organization's network? Would it matter where the attacker was located on the network? |
7: |
Based on your answers to questions 5 and 6, what is your organization's greatest weakness in terms of network security? Is there something that should be changed right away? |
8: |
Find and read your company's security policies (assuming they exist). Do they directly aid you in designing your security system? What policies are missing? When is the last time policies were updated? If you were in charge of rewriting the policies, would you make significant changes or only minor tweaks? |
9: |
Is there an area in your own network where the user community is somehow avoiding the security decisions that have been made? |
10: |
Role-play the scenario of your website being defaced. How would your organization respond to the incident? How would you resolve the desire to catch the attacker with your desire to get the website back up and running? |
Part I. Network Security Foundations
Network Security Axioms
Security Policy and Operations Life Cycle
Secure Networking Threats
Network Security Technologies
Part II. Designing Secure Networks
Device Hardening
General Design Considerations
Network Security Platform Options and Best Deployment Practices
Common Application Design Considerations
Identity Design Considerations
IPsec VPN Design Considerations
Supporting-Technology Design Considerations
Designing Your Security System
Part III. Secure Network Designs
Edge Security Design
Campus Security Design
Teleworker Security Design
Part IV. Network Management, Case Studies, and Conclusions
Secure Network Management and Network Security Management
Case Studies
Conclusions
References
Appendix A. Glossary of Terms
Appendix B. Answers to Applied Knowledge Questions
Appendix C. Sample Security Policies
INFOSEC Acceptable Use Policy
Password Policy
Guidelines on Antivirus Process
Index