Thinking Security: Stopping Next Year’s Hackers

Description

If you’re a security or network professional, you already know the “do’s and don’ts”: run AV software and firewalls, lock down your systems, use encryption, watch network traffic, follow best practices, hire expensive consultants . . . but it isn’t working. You’re at greater risk than ever, and even the world’s most security-focused organizations are being victimized by massive attacks. In Thinking Security, author Steven M. Bellovin provides a new way to think about security. As one of the world’s most respected security experts, Bellovin helps you gain new clarity about what you’re doing and why you’re doing it. He helps you understand security as a systems problem, including the role of the all-important human element, and shows you how to match your countermeasures to actual threats. You’ll learn how to move beyond last year’s checklists at a time when technology is changing so rapidly. You’ll also understand how to design security architectures that don’t just prevent attacks wherever possible, but also deal with the consequences of failures. And, within the context of your coherent architecture, you’ll learn how to decide when to invest in a new security product and when not to. Bellovin, co-author of the best-selling Firewalls and Internet Security, caught his first hackers in 1971. Drawing on his deep experience, he shares actionable, up-to-date guidance on issues ranging from SSO and federated authentication to BYOD, virtualization, and cloud security. Perfect security is impossible. Nevertheless, it’s possible to build and operate security systems far more effectively. Thinking Security will help you do just that. Contents Preface I: Defining the Problem 1 Introduction 1.1 Changes 1.2 Adapting to Change 1.3 Security Analysis 1.4 A Few Words on Terminology 2 Thinking About Security 2.1 The Security Mindset 2.2 Know Your Goals 2.3 Security as a Systems Problem 2.4 Thinking Like the Enemy 3 Threat Models 3.1 Who's Your Enemy? 3.2 Classes of Attackers 3.3 Advanced Persistent Threats 3.4 What's at Risk? 3.5 The Legacy Problem II: Technologies 4 Antivirus Software 4.1 Characteristics 4.2 The Care and Feeding of Antivirus Software 4.3 Is Antivirus Always Needed? 4.4 Analysis 5 Firewalls and Intrusion Detection Systems 5.1 What Firewalls Don't Do 5.2 A Theory of Firewalls 5.3 Intrusion Detection Systems 5.4 Intrusion Prevention Systems 5.5 Extrusion Detection 5.6 Analysis 6 Cryptography and VPNs 6.1 Cryptography, the Wonder Drug 6.2 Key Distribution 6.3 Transport Encryption 6.4 Object Encryption 6.5 VPNs 6.6 Protocol, Algorithm, and Key Size Recommendations 6.7 Analysis 7 Passwords and Authentication 7.1 Authentication Principles 7.2 Passwords 7.3 Storing Passwords: Users 7.4 Password Compromise 7.5 Forgotten Passwords 7.6 Biometrics 7.7 One-Time Passwords 7.8 Cryptographic Authentication 7.9 Tokens and Mobile Phones 7.10 Single-Sign-On and Federated Authentication 7.11 Storing Passwords: Servers 7.12 Analysis 8 PKI: Public Key Infrastructures 8.1 What's a Certificate? 8.2 PKI: Whom Do You Trust? 8.3 PKI versus pki 8.4 Certificate Expiration and Revocation 8.5 Analysis 9 Wireless Access 9.1 Wireless Insecurity Myths 9.2 Living Connected 9.3 Living Disconnected 9.4 Smart Phones, Tablets, Toys, and Mobile Phone Access 9.5 Analysis 10 Clouds and Virtualization 10.1 Distribution and Isolation 10.2 Virtual Machines 10.3 Sandboxes 10.4 The Cloud 10.5 Security Architecture of Cloud Providers 10.6 Cloud Computing 10.7 Cloud Storage 10.8 Analysis III: Secure Operations 11 Building Secure Systems 11.1 Correct Coding 11.2 Design Issues 11.3 External Links 11.4 Trust Patterns 11.5 Legacy Systems 11.6 Structural Defenses 11.7 Security Evaluations 12 Selecting Software 12.1 The Quality Problem 12.2 Selecting Software Wisely 13 Keeping Software Up to Date 13.1 Holes and Patches 13.2 The Problem with Patches 13.3 How to Patch 14 People 14.1 Employees, Training, and Education 14.2 Users 14.3 Social Engineering 14.4 Usability 14.5 The Human Element 15 System Administration 15.1 Sysadmins: Your Most Important Security Resource 15.2 Steering the Right Path 15.3 System Administration Tools and Infrastructure 15.4 Outsourcing System Administration 15.5 The Dark Side Is Powerful 16 Security Process 16.1 Planning 16.2 Security Policies 16.3 Logging and Reporting 16.4 Incident Response IV: The Future 17 Case Studies 17.1 A Small Medical Practice 17.2 An E-Commerce Site 17.3 A Cryptographic Weakness 17.4 The Internet of Things 18 Doing Security Properly 18.1 Obsolescence 18.2 New Devices 18.3 New Threats 18.4 New Defenses 18.5 Thinking about Privacy 18.6 Putting It All Together References Index A B C D E F G H I J K L M N O P Q R S T U V W X Y Z