Does implementing antivirus on your mail servers eliminate the need for AV on your hosts?


Absolutely not. Viruses can infect a host through other means: removable media, other Internet services, or local file system shares.


Before deploying AV for e-mail servers, what other action can provide at least as much benefit as network AV at a far lower cost?


User education. Explaining to users safe e-mail practices can significantly reduce the chance of a wide virus outbreakparticularly for zero-day viruses.


If you are providing DNS recommendations to a very small organization with only a small public web and e-mail presence hosted at its ISP, which DNS design from this chapter would you recommend?


If the company's services are hosted at its ISP and its user community is small, the company is better off hosting its DNS at a service provider rather than setting up a server locally. Its ISP probably provides recursive DNS servers, which can provide outbound resolution for the users.


When should you use HTTP as opposed to HTTPS? Does it impact the security design?


HTTPS is used instead of HTTP whenever secure communications are required. For many organizations, this is when financial or other sensitive transactions are involved. If you are just providing public information on the web, HTTPS is not necessary, but securing the web server is still required. For example, although Amazon.com sends inventory and pricing information to customers in the clear, it would be pretty unhappy if someone broke into its systems and changed the prices on some items to 1¢. HTTPS becomes a factor in security technologies that do some form of payload inspection. A firewall, for example, can't see what is going on inside the SSL connection, only that it is SSL. Network intrusion detection systems (NIDS) are in a similar situation. Some larger organizations are doing SSL offload on a network device on behalf of the servers. In this case, security technologies can be placed in the network path as long as they occur after the SSL decryption. See Chapter 11, "Supporting-Technology Design Considerations," for more information.

Part I. Network Security Foundations

Network Security Axioms

Security Policy and Operations Life Cycle

Secure Networking Threats

Network Security Technologies

Part II. Designing Secure Networks

Device Hardening

General Design Considerations

Network Security Platform Options and Best Deployment Practices

Common Application Design Considerations

Identity Design Considerations

IPsec VPN Design Considerations

Supporting-Technology Design Considerations

Designing Your Security System

Part III. Secure Network Designs

Edge Security Design

Campus Security Design

Teleworker Security Design

Part IV. Network Management, Case Studies, and Conclusions

Secure Network Management and Network Security Management

Case Studies



Appendix A. Glossary of Terms

Appendix B. Answers to Applied Knowledge Questions

Appendix C. Sample Security Policies

INFOSEC Acceptable Use Policy

Password Policy

Guidelines on Antivirus Process


Network Security Architectures
Network Security Architectures
ISBN: 158705115X
EAN: 2147483647
Year: 2006
Pages: 249
Authors: Sean Convery

Flylib.com © 2008-2020.
If you may any questions please contact us: flylib@qtcs.net