18 Chapter 1 Introduction to Network Security

The Corporate Security Policy

Whew! You made it through the introduction to network security! Great—so now that you understand all the problems associated with equipment, networks, and people, what do you do with all this information? The first step is to begin protecting your corporate network by creating and deploying a security policy that includes each and every way that you and everyone else in the company is going to guard your oh-so-sensitive data!

RFC 2196 states that a security policy is a formal statement of the rules by which people who are given access to an organization’s technology and information assets must abide. A corporate security policy is basically a document that summarizes how the company will use and protect its computing and network resources.

When you are creating a security policy, it is important to be ever mindful of that fine balancing act between ease of use and the level of security actually needed to adequately protect corporate network services. You do a disservice to the client by locking everything down as tightly as possible and/or spending too much money on a network that really doesn’t need 007-level security.

A security policy defines the following criteria:

What’s important to the enterprise

What the company is willing to spend (in terms of dollars, personnel, and time) to protect what it has deemed important

What level of risk it’s willing to tolerate

Sounds good, but do you really need to bother with a security policy? Is creating a security policy actually worth the time, money, and effort required? Absolutely! Here’s a short list of why Cisco says doing so is such a good idea. A corporate security policy

Provides a process to audit existing network security.

Defines which behavior is and is not allowed.

Provides a general security framework for implementing network security.

Often determines which tools and procedures are needed for the organization.

Communicates consensus among a group of key decision-makers and defines the responsibilities of users and administrators.

Defines a process for handling network security incidents.

Enables global security implementation and enforcement. Computer security is now an enterprise-wide issue, and computing sites are expected to conform to the network security policy.

Creates a basis for legal action if necessary.

Now that you know the basics of creating and implementing a formal security policy in your company, where do you get the rest of the information you need so that you can implement it properly? Good question. This book will seriously strengthen your security grip by showing you how to configure Cisco hardware—a crucial capability you just can’t do without today.

For an in-depth description of those all-important security policies, refer to www.sybex.com for information about Sybex’s Study Guides on the CCSP exams. They will provide you with everything you need to create your own tailor-made and tight policy.

Summary

A corporate security policy is a declaration of the systems and rules needed to have a secure IT structure. Various weaknesses, holes, and chinks are typically found in the armor of security policies and in the network’s security itself. These vulnerabilities fall into three major categories: technology weaknesses, configuration weaknesses, and policy weaknesses.

It’s very important to understand the fundamentals and characteristics of all the different weaknesses inherent to a security policy. There are specific protocols for dealing with each special type of weakness, so you should develop solid solutions to secure your system from those vulnerabilities.

Creating a corporate security policy is not easy, and implementing one is even harder. However, a solid security policy is something your organization cannot live without. There are many different types of attacks that hackers have in their arsenal; eavesdropping and denial-of-service attacks are just two of the most popular types of attacks for people who want to steal from your network and cause problems for your organization.

You can develop and implement strategies to guard against these attacks with a PIX firewall or the Cisco IOS Firewall Feature Set, which is what the rest of this book is about. By combining this understanding with your newfound appreciation of corporate security policies, you will be empowered to create and maintain a sturdy, intelligent, and cost-effective policy that’s tailormade to meet the needs of your company and its network.

In the next chapter, you’ll learn how to configure Authentication, Authorization, and Accounting (AAA) services as part of the Cisco NAS interface.

Exam Essentials

Understand the three typical types of weaknesses in any network implementation. The three typical types of weaknesses found in a network implementation are technology, configuration, and policy weaknesses.

Know which attacks can occur because of TCP/IP’s weaknesses. There are many attacks that can occur because of TCP/IP’s inherent weaknesses. The most important attacks to remember are IP spoofing, man-in-the-middle, and session replaying.

20 Chapter 1 Introduction to Network Security

Remember the different problems described as configuration weaknesses. Understand the difference between configuration weaknesses and policy weaknesses. Configuration weaknesses include problems such as unsecured user accounts, system accounts with easily guessed passwords, misconfigured Internet services, unsecured default settings in products, and misconfigured network equipment.

Understand what types of issues are considered policy weaknesses. Policy weaknesses involve problems with the corporate security policy such as the absence of a written security policy, organization politics, lack of business continuity, lax security administration, software and hardware that’s installed without following the stated installation policy, and the absence of a disaster recovery plan.

Key Terms

Before you take the exam, be certain you are familiar with the following terms:

Written Lab

This section asks you 10 write-in-the-answer questions to help you understand the technology that you need to know in order to pass the SECUR exam.

1.What two common terms are used to describe eavesdropping?

2.Most network implementations have three typical security weaknesses. What are they?

3.Improper change control and no disaster recovery plan demonstrate what type of weakness?

4.An attacker tries to steal an IP address in which type of attack?

5.Unsecured user accounts are what type of weakness?

6.What are the three technology weaknesses that can affect security?

7.No disaster recovery plan and high turnover in the technical support department are examples of which type of weakness?

8.Session replaying, SNMP, and SMTP are examples of what type of weakness?

9.List three options for countering an unauthorized access attempt.

10.Which feature protects a server from TCP SYN-flooding attacks?