What method of security policy enforcement would be most effective at ensuring that employees have the latest version of virus-scanning software?

Although nontechnical compliance checking would be the easiest, it would likely yield results indicating that almost everyone is without an up-to-date virus signature file. More effective would be the deployment of virus signature file distribution by network login. This way, as users log on to the network, the latest virus definitions are automatically installed. Some newer antivirus software can do something similar by using the web as well.

What would be the best way to represent a policy for WLAN access in your organization? Should it be done through a policy, standard, or guideline?

A policy is the best choice because you don't want to tie it too close to the technology, which might change. In this policy, you could describe minimum requirements, such as frame encryption and authentication, methods for detecting rogue access points (APs), and policies for user access when connected by wireless. A standard for WLAN can also be written. In it you could include methods for hardening the APs you have selected to use in your environment. Such a policy for WLAN should reference an acceptable encryption standard to define the cryptographic protections necessary for transmission over the air.

If you don't have the resources to track busy mailing lists such as BugTraq, is there an easier way to keep track of the high-profile attacks and vulnerabilities of which you should be aware?

Although lists such as BugTraq and vuln-dev often discuss a vulnerability in the raw, any high-profile issue is also sent out as a advisory from the Computer Emergency Response Team (CERT). CERT can be found at http://www.cert.org, and subscribing to its notification list will ensure that you see any new high-profile issue.

What are some ways to keep track of security best practices as they evolve?

Although this book contains many security best practices, over time new technologies and threats will likely subtly or dramatically alter certain best practices. On an ongoing basis, you should stay current with these new trends in some of the following ways:

• Attend ongoing training in new technologies (security related and security impacting).
• Participate in online discussions through mailing lists or discussion forums.
• Read industry trade journals.
• Network with your peers in other organizations and by attending industry conferences.
• Stay current with new technologies and security techniques that might someday become best practices.

Outline your organization's primary business needs. Are there any unique aspects of your organization that would require a different approach to security?

Put yourself in the shoes of a resourceful attacker. What damage could such a person with lots of free time and patience do to your organization's network? Would it matter where the attacker was located on the network?

Based on your answers to questions 5 and 6, what is your organization's greatest weakness in terms of network security? Is there something that should be changed right away?

Find and read your company's security policies (assuming they exist). Do they directly aid you in designing your security system? What policies are missing? When is the last time policies were updated? If you were in charge of rewriting the policies, would you make significant changes or only minor tweaks?

Is there an area in your own network where the user community is somehow avoiding the security decisions that have been made?

Role-play the scenario of your website being defaced. How would your organization respond to the incident? How would you resolve the desire to catch the attacker with your desire to get the website back up and running?