Guide to Network Security

578 Pages·2012·36.306 MB·English

by  Michael E. Whitman et al.

Guide to Network Security
Michael E. Whitman
Herbert J. Mattord
David Mackey
Andrew Green
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
This is an electronic version of the print textbook. Due to electronic rights restrictions,
some third party content may be suppressed. Editorial review has deemed that any suppressed
content does not materially affect the overall learning experience. The publisher reserves the right
to remove content from this title at any time if subsequent rights restrictions require it. For
valuable information on pricing, previous editions, changes to current editions, and alternate
formats, please visit www.cengage.com/highered to search by ISBN#, author, title, or keyword for
materials in your areas of interest.
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
GuidetoNetworkSecurity ©2013CourseTechnology,CengageLearning
MichaelWhitman,HerbertMattord, ALLRIGHTSRESERVED.Nopartofthisworkcoveredbythe
DavidMackey,AndrewGreen copyrighthereinmaybereproduced,transmitted,storedorused
inanyformorbyanymeansgraphic,electronic,ormechanical,
VicePresident,Careers&Computing:
includingbutnotlimitedtophotocopying,recording,scanning,
DaveGarza digitizing,taping,Webdistribution,informationnetworks,or
ExecutiveEditor:StephenHelba informationstorageandretrievalsystems,exceptaspermitted
underSection107or108ofthe1976UnitedStatesCopyrightAct,
Director,Development,Careers& withoutthepriorwrittenpermissionofthepublisher.
Computing:MarahBellegarde
SeniorProductManager:Michelle Forproductinformationandtechnologyassistance,contactusat
RuelosCannistraci CengageLearningCustomer&SalesSupport,1-800-354-9706
DevelopmentalEditor:KentWilliams Forpermissiontousematerialfromthistextorproduct,
submitallrequestsonlineatcengage.com/permissions
EditorialAssistant:JenniferWheaton
Furtherpermissionsquestionscanbeemailedto
Director,MarketDevelopment: [email protected]
LisaLysne
MarketDevelopmentManager: LibraryofCongressControlNumber:2012942876
MarkLinton
ISBN-13:978-0-8400-2422-0
MarketingCoordinator:
ISBN-10:0-8400-2422-3
BenjaminGenise
CourseTechnology
Director,BrandManagement:
20ChannelCenterStreet
JasonSakos
Boston,MA02210
BrandManager:KristinMcNary USA
CengageLearningisaleadingproviderofcustomizedlearning
ProductionDirector:WendyTroeger
solutionswithofficelocationsaroundtheglobe,including
ProductionManager:AndrewCrouth Singapore,theUnitedKingdom,Australia,Mexico,Brazil,and
Japan.Locateyourlocalofficeat:international.cengage.com/region
ContentProjectManager:Brooke
Greenhouse CengageLearningproductsarerepresentedinCanadabyNelson
Education,Ltd.
ArtDirector:JackPendleton
Foryourlifelonglearningsolutions,visit
CoverImage:©iStockphoto www.cengage.com/coursetechnology
Purchaseanyofourproductsatyourlocalcollegestoreoratour
preferredonlinestorewww.cengagebrain.com
Visitourcorporatewebsiteatcengage.com.
Someoftheproductnamesandcompanynamesusedinthisbookhavebeenusedforidentificationpurposesonlyandmaybetrademarksor
registeredtrademarksoftheirrespectivemanufacturersandsellers.
AnyfictionaldatarelatedtopersonsorcompaniesorURLsusedthroughoutthisbookisintendedforinstructionalpurposesonly.Atthetime
thisbookwasprinted,anysuchdatawasfictionalandnotbelongingtoanyrealpersonsorcompanies.
CourseTechnologyandtheCourseTechnologylogoareregisteredtrademarksusedunderlicense.
CourseTechnology,apartofCengageLearning,reservestherighttorevisethispublicationandmakechangesfromtimetotimeinits
contentwithoutnotice.
Theprogramsinthisbookareforinstructionalpurposesonly.Theyhavebeentestedwithcare,butarenotguaranteedforanyparticular
intentbeyondeducationalpurposes.Theauthorandthepublisherdonotofferanywarrantiesorrepresentations,nordotheyacceptany
liabilitieswithrespecttotheprograms.
Printed in the United States of America
1 2 3 4 5 6 7 16 15 14 13 12
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
To Rhonda, Rachel, Alex, and Meghan: thank you for your loving support.
MEW
To the newest addition to our clan: Ellie Hayhome.
HJM
To Andrea, Nathan, and Eli: thank you for your understanding and support on all
the days I was typing away.
DM
In memory of Christie Coggins Dover—wife, mother, teacher, and friend. You are
greatly missed by all of your family and friends. May your memory be eternal!
AG
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Brief Contents
INTRODUCTION . .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . xv
CHAPTER 1
Introductionto Information Security ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. 1
CHAPTER 2
IntroductionToNetworking.. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 37
CHAPTER 3
Cryptography... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 87
CHAPTER 4
FirewallTechnologies andAdministration.. .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 133
CHAPTER 5
NetworkAuthenticationandRemote AccessUsing VPN . ... .. ... ... .. ... ... .. ... ... .. ... 171
CHAPTER 6
NetworkMonitoringandIntrusion DetectionandPreventionSystems. .. ... ... .. ... ... .. ... 213
CHAPTER 7
WirelessNetwork Security. .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 265
CHAPTER 8
SecurityofWebApplications. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 303
CHAPTER 9
NetworkVulnerability Assessment.. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 347
CHAPTER 10
Auditing,Monitoring, andLogging . ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 395
CHAPTER 11
ContingencyPlanning andNetworking IncidentResponse... .. ... ... .. ... ... .. ... ... .. ... 441
CHAPTER 12
DigitalForensics. .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 491
GLOSSARY. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527
INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541
v
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
Table of Contents
INTRODUCTION . .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . xv
CHAPTER 1
Introductionto Information Security ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. 1
Introduction......................................................................... 2
WhatIsInformationSecurity?......................................................... 3
InformationSecurityTerminology...................................................... 3
CriticalCharacteristicsofInformation...................................................... 6
SecurityModels................................................................... 7
BalancingInformationSecurityandAccess................................................ 8
BusinessNeedsFirst................................................................ 9
ThreatstoInformationSecurity.......................................................... 10
CommonThreats................................................................. 11
AttacksonInformationSecurity ......................................................... 12
MaliciousCode .................................................................. 12
PasswordAttacks................................................................. 13
Denial-of-Service(DoS)andDistributedDenial-of-Service(DDoS)Attacks......................... 14
Spoofing ....................................................................... 15
Man-in-the-MiddleAttacks.......................................................... 15
E-MailAttacks................................................................... 16
Sniffers ........................................................................ 17
SocialEngineering ................................................................ 17
BufferOverflow.................................................................. 17
TimingAttacks .................................................................. 18
SecurityProfessionalsandtheOrganization................................................. 18
ExecutiveManagement............................................................. 18
InformationSecurityProjectTeam..................................................... 19
InformationSecurityPolicy,Standards,andPractices .......................................... 19
EnterpriseInformationSecurityPolicy(EISP) ............................................. 21
Issue-SpecificSecurityPolicy(ISSP) .................................................... 22
Systems-SpecificPolicy(SysSP) ....................................................... 24
FrameworksandIndustryStandardsinInformationSecurity..................................... 24
TheISO27000Series.............................................................. 25
NISTSecurityModels.............................................................. 27
IETFSecurityArchitecture .......................................................... 28
BenchmarkingandBestBusinessPractices ............................................... 28
ChapterSummary ................................................................... 31
ReviewQuestions.................................................................... 33
Real-WorldExercises ................................................................. 34
Hands-OnProjects................................................................... 34
Endnotes.......................................................................... 35
CHAPTER 2
IntroductionToNetworking.. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 37
Introduction........................................................................ 38
NetworkingFundamentals ............................................................. 39
ReasonstoNetwork............................................................... 39
GettingtheMessageAcross.......................................................... 40
vii
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.
viii TableofContents
CombiningMultipleSignals ......................................................... 44
ImpedancetoCommunications....................................................... 45
TypesofNetworks................................................................... 46
NetworksCategorizedbyComponents ................................................. 47
NetworksCategorizedbySize........................................................ 47
NetworksCategorizedbyTopology.................................................... 48
NetworksCategorizedbyMedia...................................................... 48
StandardsOrganizations............................................................... 48
TheInternetSociety(ISOC).......................................................... 49
InternetAssignedNumbersAuthority(IANA)............................................. 49
AmericanNationalStandardsInstitute(ANSI) ............................................ 49
InternationalTelecommunicationsUnion(ITU)............................................ 49
InstituteofElectricalandElectronicsEngineers(IEEE) ...................................... 50
TelecommunicationsIndustryAssociation(TIA)........................................... 50
InternationalOrganizationforStandardization(ISO) ....................................... 50
OSIReferenceModel................................................................. 50
PhysicalLayer ................................................................... 52
DataLinkLayer.................................................................. 58
NetworkLayer................................................................... 63
TransportLayer.................................................................. 68
SessionLayer.................................................................... 73
PresentationLayer ................................................................ 74
ApplicationLayer................................................................. 75
TheInternet,WWW,andTCP/IP........................................................ 78
TheWorldWideWeb ............................................................. 79
TCP/IP ........................................................................ 80
ChapterSummary ................................................................... 83
ReviewQuestions.................................................................... 83
Real-WorldExercises ................................................................. 84
Hands-OnProjects................................................................... 85
Endnotes.......................................................................... 85
CHAPTER 3
Cryptography.. .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. ... ... .. ... .. 87
Introduction........................................................................ 88
Terminology .................................................................... 89
HistoryofCryptology ................................................................ 90
CipherMethods..................................................................... 92
SubstitutionCipher................................................................ 92
TranspositionCipher .............................................................. 95
ExclusiveOROperation............................................................ 97
VernamCipher .................................................................. 98
BookorRunningKeyCipher ........................................................ 99
HashFunctions .................................................................. 99
CryptographicAlgorithms............................................................. 101
CryptographicNotation........................................................... 101
SymmetricEncryption............................................................. 102
AsymmetricEncryption............................................................ 104
HybridCryptographySystems....................................................... 107
EncryptionKeySize.............................................................. 108
MultipleEncryptionMethods....................................................... 110
Copyright 2012 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s).
Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.