Network Security Assessment: From Vulnerability to Patch (eBook)

Andrew Gold, Steve Manzuik, Ken Pfeil (Autoren)

eBook Download: PDF

2006 | 1. Auflage
500 Seiten
Elsevier Science (Verlag)
978-0-08-051253-2 (ISBN)

Infos

This book will take readers from the discovery of vulnerabilities and the creation of the corresponding exploits, through a complete security assessment, all the way through deploying patches against these vulnerabilities to protect their networks.

This is unique in that it details both the management and technical skill and tools required to develop an effective vulnerability management system. Business case studies and real world vulnerabilities are used through the book. It starts by introducing the reader to the concepts of a vulnerability management system. Readers will be provided detailed timelines of exploit development, vendors' time to patch, and corporate path installations. Next, the differences between security assessment s and penetration tests will be clearly explained along with best practices for conducting both. Next, several case studies from different industries will illustrate the effectiveness of varying vulnerability assessment methodologies. The next several chapters will define the steps of a vulnerability assessment including: defining objectives, identifying and classifying assets, defining rules of engagement, scanning hosts, and identifying operating systems and applications. The next several chapters provide detailed instructions and examples for differentiating vulnerabilities from configuration problems, validating vulnerabilities through penetration testing. The last section of the book provides best practices for vulnerability management and remediation.

* Unique coverage detailing both the management and technical skill and tools required to develop an effective vulnerability management system

* Vulnerability management is rated the #2 most pressing concern for security professionals in a poll conducted by Information Security Magazine

* Covers in the detail the vulnerability management lifecycle from discovery through patch.

Inhalt

Front Cover 1
Network Security Assessment: From Vulnerability to Patch 4
Copyright Page 5
Contents 12
Foreword 20
Chapter 1. Windows of Vulnerability 26
Introduction 27
What Are Vulnerabilities? 27
Understanding the Risks Posed by Vulnerabilities 34
Summary 40
Solutions Fast Track 40
Frequently Asked Questions 41
Chapter 2. Vulnerability Assessment 101 42
Introduction 43
What is a Vulnerability Assessment? 43
Seeking Out Vulnerabilities 49
Detecting Vulnerabilities via Security Technologies 49
The Importance of Seeking Out Vulnerabilities Looking Closer at the Numbers 59
Summary 65
Solutions Fast Track 65
Frequently Asked Questions 66
Chapter 3. Vulnerability Assessment Tools 70
Introduction 71
Features of a Good Vulnerability Assessment Tool 71
Using a Vulnerability Assessment Tool 75
Summary 87
Solutions Fast Track 87
Frequently Asked Questions 88
Chapter 4. Vulnerability Assessment: Step One 90
Introduction 91
Know Your Network 92
Classifying Your Assets 99
I Thought This Was a Vulnerability Assessment Chapter 103
Summary 107
Solutions Fast Track 107
Frequently Asked Questions 108
Chapter 5. Vulnerability Assessment: Step Two 110
Introduction 111
An Effective Scanning Program 111
Scanning Your Network 113
When to Scan 121
Summary 125
Solutions Fast Track 125
Frequently Asked Questions 126
Chapter 6. Going Further 128
Introduction 129
Types of Penetration Tests 129
Scenario: An Internal Network Attack 131
Penetration Testing 150
Vulnerability Assessment versus a Penetration Test 164
Internal versus External 166
Summary 169
Solutions Fast Track 169
Frequently Asked Questions 170
Chapter 7. Vulnerability Management 172
Introduction 173
The Vulnerability Management Plan 174
The Six Stages of Vulnerability Management 175
Governance (What the Auditors Want to Know) 183
Measuring the Performance of a Vulnerability Management Program 185
Common Problems with Vulnerability Management 189
Summary 191
Solutions Fast Track 191
Frequently Asked Questions 195
Chapter 8. Vulnerability Management Tools 196
Introduction 197
The Perfect Tool in a Perfect World 197
Evaluating Vulnerability Management Tools 199
Commercial Vulnerability Management Tools 202
Open Source and Free Vulnerability Management Tools 205
Managed Vulnerability Services 208
Summary 211
Solutions Fast Track 211
Frequently Asked Questions 213
Chapter 9. Vulnerability and Configuration Management 214
Introduction 215
What is Vulnerability Management? 215
Patch Management 215
Building a Patch Test Lab 229
Patch Distribution and Deployment 234
Configuration Management 236
Summary 241
Solutions Fast Track 241
Frequently Asked Questions 243
Chapter 10. Regulatory Compliance 246
Introduction 247
Regulating Assessments and Pen Tests 247
Drafting an Information Security Program 258
Summary 264
Solutions Fast Track 264
Frequently Asked Questions 265
Chapter 11. Tying It All Together 268
Introduction 269
A Vulnerability Management Methodology 269
Step One: Know Your Assets 270
Step Two: Categorize Your Assets 275
Step Three: Create a Baseline Scan of Assets 278
Step Four: Perform a Penetration Test on Certain Assets 281
Step Five: Remediate Vulnerabilities and Risk 284
Step Six: Create a Vulnerability Assessment Schedule 286
Step Seven: Create a Patch and Change Management Process 290
Step Eight: Monitor for New Risks to Assets 291
Summary 296
Appendix A. Legal Principles for Information Security Evaluations 298
Introduction 299
Uncle Sam Wants You: How Your Company's Information Security Can Affect U.S. National Security (and Vice Versa) 300
Legal Standards Relevant to Information Security 305
Do It Right or Bet the Company: Tools to Mitigate Legal Liability 315
What to Cover in IEM Contracts64 323
The First Thing We Do...? Why You Want Your Lawyers Involved From Start to Finish 343
Solutions Fast Track 352
Frequently Asked Questions 355
References 357
Appendix B. Examples of INFOSEC Tools by Baseline Activity 364
Index 386

Produkt-Details

• Erscheint lt. Verlag: 2.12.2006
• Sprache: englisch
• Themenwelt: Mathematik / Informatik ► Informatik ► Grafik / Design
• Themenwelt: Informatik ► Netzwerke ► Sicherheit / Firewall
• Themenwelt: Informatik ► Theorie / Studium ► Kryptologie
• Themenwelt: Wirtschaft ► Betriebswirtschaft / Management
• ISBN-10: 0-08-051253-4 / 0080512534
• ISBN-13: 978-0-08-051253-2 / 9780080512532