Download presentation
1
Chapter 5 in CompTIA Security +
Unit 5 Seminar Unit 5 Chapter 5 in CompTIA Security + Course Name – IT Introduction to Network Security Instructor – Jan McDanolds, MS, Security+ Contact Information: AIM – JMcDanolds – Office Hours: Tuesday, 7:00 PM ET or Wednesday, 8:00 PM ET
2
What we covered last week
Chapter 4 Overview What we covered last week Monitoring Activity and Intrusion Detection Monitoring the Network Understanding Intrusion Detection Systems (IDS) Working with Wireless Systems Understanding Instant Messaging Features (IM) Working with 8.3 File Naming Understanding Protocol Analyzers (sniffers) Understanding Signal Analysis and Intelligence Footprinting Scanning
3
Quick check of concepts…
Chapter 4 REVIEW Quick check of concepts… Quickly type your response to these questions: Example: type #1 and then your answer #1 What is NFS and why do we care? #2 With IDS there is a data source. What makes up the raw information in the data source? #3 Name a problem with Host-Based IDS. #4 Bonus: Why should you discard WEP for WPA2?
4
Implementing and Maintaining a Secure Network
Chapter 5 Overview Implementing and Maintaining a Secure Network Overview of Network Security Threats Defining Security Baselines Hardening the OS (operating system) and NOS Hardening Network Devices Hardening Applications
5
Network Security Threats
Chapter 5 Network Security Threats What should you do to learn about national/international security threats? CERT Coordination Center (CERT/CC) US Computer Emergency Readiness Team Field Trip….. Left side menu – go down to - Severity Metric Example: Vulnerability Note VU# Cisco Tandberg E, EX, and C Series default root credentials “An attacker may be able to gain complete administrative control of the device.”
6
Network Security Threats (continued)
Chapter 5 Network Security Threats (continued) Department of Homeland Security – Daily Reports DHS Daily Open Source Infrastructure Report “The DHS Daily Open Source Infrastructure Report is collected each business day as a summary of open-source published information concerning significant critical infrastructure issues. Each Daily Report is divided by the critical infrastructure sectors and key assets defined in the National Infrastructure Protection Plan.” Type - heading of a current Information Technology Sector issue. Select the date and when .pdf opens, go to Information Technology Sector from the Services menu
7
Network Security Threats (continued)
Chapter 5 Network Security Threats (continued) SANs – The SANS (SysAdmin, Audit, Network, Security) Institute was established in 1989 as a cooperative research and education organization – now worldwide. SANs Internet Storm Center ISC Internet Storm Center Also: Tools List - Laptop at Security Conferences (next page) Stormcasts are daily 5-10 minute threat updates. Podcast Field Trip….. ISC StormCast for Thursday, May 17th 2012
8
Network Security Threats (continued)
Chapter 5 Network Security Threats (continued) Laptop at Security Conferences Published: , Last Updated: :31:16 UTC by Chris Mohan (Version: 1) “I’m often curious what other security folks do to keep their machine safe when they go to IT conferences. I often see what looks like standard office machines being used and wonder if any precautions have been taken. So here’s what I do and I’d love to find out what other measure you take. I’m about to spend a few days a large security conference, so I’m just putting the finishing touches to laptop I’m taking with me.”
9
Network Security Threats (continued)
Chapter 5 Network Security Threats (continued) SANS – Newsletters - Spend fifteen minutes a day keeping up with the high-level perspective of all the latest security news. Field Trip….. SANS Newsbites – slide down to Archive NewsBites is a semiweekly executive summary of news articles published on computer security during the last week. @Risk – select Archive – Date and then go down page OUCH! Select Archive Disposing of computers…
10
Network Security Threats (continued)
Chapter 5 Network Security Threats (continued) SANS NewsBites Man Pleads Guilty to US $1.3 Million Phishing Scam (8th May 2012) A 31 year old US man from Atlanta, Georgia, pleaded guilty to his part in a phishing ring responsible for defrauding people of over US $1.3 million. Waya Nwaki, also known as "Shawn Conley," "USAprince12k," and "Prince Abuja", pleaded guilty to charges of wire fraud conspiracy, wire fraud, aggravated identity theft and computer fraud conspiracy. He could face up to 47 years in prison and a fine of US $250,000 for each count. According to the indictment filed with the U.S. District Court in New Jersey, Nwaki was part of an international gang of fraudsters with others named in the scheme as Karlis Karklins of Latvia; Charles Umeh Chidi of the United Kingdom; Alphonsus Osuala and Osarhieme Uyi Obaygbona of Atlanta; Marvin Dion Hill of College Park, Ga.; and Olani Yi Jones of Nigeria. a-man-admits-role-million-global-cyberscam/
11
Network Security Threats (continued)
Chapter 5 Network Security Threats (continued) Read about current topics in security magazines: SC Magazine Information Security Magazine Network Security Magazine Info Security Magazine
12
Network Security Threats (continued)
Chapter 5 Network Security Threats (continued) Listen to podcasts: (See black bar under title, hit triangle) Interview with Chris Novak (May 11, 2012) 15 minutes Improving Breach Investigations - In short, organizations need to know where data is stored and what it comprises. But Novak says most organizations have too much data and in too many places to manage. Many organizations just struggle with understanding the picture of the data problem," says Novak, a member of Verizon's investigative response team. "They don't necessarily know where they have data ... and how it's being handled." Fraud Fighters Wanted (July 5, 2011) 13 minutes Global Threats Create Boom Times for Fraud Examiners Today's top fraud threats recognize no global boundaries, says James Ratley, head of the Association of Certified Fraud Examiners. And they require a stronger global workforce than ever before.
13
Chapter 5 Nessus and NMAP Nessus - vulnerability scanner that was a free and open source vulnerability scanner until they closed the source code in 2005 and removed the free "registered feed" version in 2008 Nmap ("Network Mapper") is a free and open source utility for network exploration or security auditing.
14
Security Baselines Back to the book…pg 222 Tools to help:
Chapter 5 Security Baselines Back to the book…pg 222 What is a security baseline? “The base level of security that will be implemented and maintained.” Depending on the environment, baseline security may include layers of protection, such as encryption, filtering, access control lists, authorization and authentication, and other security functions. Tools to help: Baseline: Demo to explain product.
15
Security Baselines (continued)
Chapter 5 Security Baselines (continued) Microsoft tools for baselines: Microsoft Security TechCenter Microsoft Security Compliance Manager (SCM) “baselines are based on Microsoft Security guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats. Microsoft Baseline Security Analyzer Security Configuration Wizard (SCW) - attack-surface reduction tool included with Windows Server 2008 R2. SCW guides administrators in creating security policies based on the minimum functionality required for a server's role or roles.
16
Security Baselines Common Criteria (CC)
Chapter 5 Security Baselines Common Criteria (CC) Evaluation Assurance Levels (EALs) EAL 1 EAL 2 EAL 3 EAL 4 – Recommended for commercial systems –Windows 7 EAL 5 EAL 6 EAL 7
17
Hardening the OS and NOS
Chapter 5 Hardening the OS and NOS Configuring Network Protocols Hardening Microsoft Windows Vista/Windows 7 Hardening Microsoft Windows XP Hardening Windows Server 2003/Server 2008 Hardening Windows Server 2000 Hardening Unix/Linux Hardening Novell NetWare Hardening Apple Macintosh
18
Hardening the OS and NOS
Chapter 5 Hardening the OS and NOS Windows Service Hardening restricts critical Windows services from running abnormal activities in the file system, registry, network or other areas that could be exploited by malware. Ex: Install Windows Server 2008 as a Server Core installation. Server Core provides a minimal environment for running specific server roles, reducing maintenance and management requirements and the attack surface. Windows services represent a large percentage of the overall attack surface. Windows Server 2008 limits the number of services that are running and operational by default. Security Configuration Wizard – examines roles, adjusts to role
19
Hardening the OS and NOS
Chapter 5 Hardening the OS and NOS Hardening Filesystems NTFS, Unix NFS, Apple AFS Updating Your Operating System Hotfixes, Service Packs and Support Packs, Patches Microsoft Patch Tuesday: Monthly Security Bulletins Articles - Help: I Got Hacked. Now What Do I Do? Jesper M. Johansson, Ph.D., CISSP, MCSE, MCP+I Security Program Manager, Microsoft Corporation “After the very long Patch Management article last month, this month’s article is much shorter and to the point. Let’s just say you did not install the patches like we discussed last month. Now you got hacked. What to do?”
20
Hardening Network Devices
Chapter 5 Hardening Network Devices Updating Network Devices Configuring Routers and Firewalls Patches and Updates for Routers and Firewalls Enabling/Disabling Services and Protocols Working with Access Control Lists (ACLs)
21
Application Hardening (cont)
Chapter 5 Application Hardening (cont) Web Servers – IIS, Apache, anonymous, executable scripts, uploads, etc. DNS Servers Data Repositories Directory Services – LDAP, Active Directory, X.500, SQL
22
Application Hardening
Chapter 5 Application Hardening Web Servers Servers FTP Servers DNS Servers NNTP Servers File and Print Servers and Services DHCP Services Data Repositories
23
Unit 5 Project Assignment
Chapter 5 Unit 5 Project Assignment TWO PARTS! Essay questions 30 points for Part 1 1.1. Pick one NOS and one OS and describe the process of hardening it from attacks and intruders. (i.e. Windows XP and Windows Server 2008 or Windows 7 and Linux Ubuntu) 1.2. Pick two application server types listed in the text and describe the process of hardening them from attacks and intruders 20 points for Part paragraphs Based on the knowledge you have achieved thus far in our class, compose a brief synopsis compiling what you have learned about network security. Describe how you will use this knowledge with any other class, your present or future career, or your own personal life. APA Style for both Part 1 and Part 2.
Similar presentations
© 2025 SlidePlayer.com Inc.
All rights reserved.