The Business Case for Network Security Advocacy, Governance, and ROI

by Paquet, Catherine; Saxe, Warren

• ISBN13: 9781587201219
• ISBN10: 1587201216
• Edition: 1st
• Format: Paperback
• Copyright: 2004-12-13
• Publisher: Cisco Press

Summary

Understand the total cost of ownership and return on investment for network security solutions Understand what motivates hackers and how to classify threats Learn how to recognize common vulnerabilities and common types of attacks Examine modern day security systems, devices, and mitigation techniques Integrate policies and personnel with security equipment to effectively lessen security risks Analyze the greater implications of security breaches facing corporations and executives today Understand the governance aspects of network security to help implement a climate of change throughout your organization Learn how to qualify your organizationrs"s aversion to risk Quantify the hard costs of attacks versus the cost of security technology investment to determine ROI Learn the essential elements of security policy development and how to continually assess security needs and vulnerabilities The Business Case for Network Security: Advocacy, Governance, and ROIaddresses the needs of networking professionals and business executives who seek to assess their organizationrs"s risks and objectively quantify both costs and cost savings related to network security technology investments. This book covers the latest topics in network attacks and security. It includes a detailed security-minded examination of return on investment (ROI) and associated financial methodologies that yield both objective and subjective data. The book also introduces and explores the concept of return on prevention (ROP) and discusses the greater implications currently facing corporations, including governance and the fundamental importance of security, for senior executives and the board. Making technical issues accessible, this book presents an overview of security technologies that uses a holistic and objective model to quantify issues such as ROI, total cost of ownership (TCO), and risk tolerance. This book explores capital expenditures and fixed and variable costs, such as maintenance and upgrades, to determine a realistic TCO figure, which in turn is used as the foundation in calculating ROI. The importance of security policies addressing such issues as Internet usage, remote-access usage, and incident reporting is also discussed, acknowledging that the most comprehensive security equipment will not protect an organization if it is poorly configured, implemented, or used. Quick reference sheets and worksheets, included in the appendixes, provide technology reviews and allow financial modeling exercises to be performed easily. An essential IT security-investing tool written from a business management perspective,The Business Case for Network Security: Advocacy, Governance, and ROIhelps you determine the effective ROP for your business. This volume is in the Network Business Series offered by Cisco Pressreg;. Books in this series provide IT executives, decision makers, and networking professionals with pertinent information about todayrs"s most important technologies and business strategies.

Author Biography

Catherine Paquet is a freelancer in the field of internetworking and return on security investment. Catherine has in-depth knowledge of security systems, remote access, and routing technology. She is a Cisco Certified Security Professional (CCSP™) and a Cisco Certified Network Professional (CCNP®). Her internetworking career started as a LAN manager; she then moved to MAN manager and eventually became the nationwide WAN manager. Catherine was also a certified Cisco Systems instructor with the largest Cisco® training partner, serving as the course director/ master instructor for security and remote access courses. Most recently she held the position of director of technical resources for Canada, where she was responsible for instructor corps and equipment offerings, including Cisco courses. In 2002 and 2003, Catherine volunteered with the UN mission in Kabul, Afghanistan, to train Afghan public servants in the area of networking. Catherine has an MBA with a major in management information systems (MIS).

 

Catherine coauthored the Cisco Press books Building Scalable Cisco Networks, CCNP Self-Study: Building Scalable Cisco Internetworks (BSCI), and CCNP Self-Study: Building Scalable Cisco Internetworks (BSCI), Second Edition, and she edited Building Cisco Remote Access Networks.

 

Warren Saxe has an extensive background in profit and loss (P&L) management as general manager for a Fortune 1000 semiconductor distributor. As a top- and bottom-line-focused senior manager, he brings a unique perspective to this business decision maker—oriented book. He applies an overriding business strategy to drive IT decisions by utilizing a value-driven approach. He has extensive background in sales management, marketing management, and demand creation fundamentals. He directed a large multidisciplinary team composed of managers, engineers, sales, and marketing professionals. He was responsible for strategic and tactical planning, and he negotiated directly with CxO-level executives, both internally and with customers across many industries. He is currently focusing in the areas of security governance, risk management, and return on security investment planning. He earned his degree at McGill University.

 

 

Table of Contents

Introduction	xix
Part I Vulnerabilities and Technologies	1	(136)
Hackers and Threats	3	(18)
Contending with Vulnerability	4	(4)
Realizing Value in Security Audits	6	(2)
Analyzing Hacking	8	(7)
Assessing Vulnerability and Response	8	(1)
Hackers: Motivation and Characteristics	9	(2)
The Enemy Within: Maliciousness and Sloppiness	11	(4)
Threats Classification	15	(2)
The Future of Hacking and Security	17	(1)
Summary	18	(1)
End Notes	18	(3)
Crucial Need for Security: Vulnerabilities and Attacks	21	(44)
Recognizing Vulnerabilities	22	(5)
Design Vulnerabilities Issues	23	(1)
Human Vulnerability Issues	24	(1)
Implementation Vulnerability Issues	25	(2)
Categories of Attacks	27	(13)
The Human Component in Attacks	28	(1)
Reconnaissance Attacks	29	(4)
Access Attacks	33	(1)
Denial of Service Attacks	34	(6)
Additional Common Attacks	40	(8)
Footprinting	40	(1)
Scanning and System Detailing	41	(1)
Eavesdropping	41	(2)
Password Attacks	43	(1)
Impersonating	43	(1)
Trust Exploitation	44	(1)
Software and Protocol Exploitation	45	(1)
Worms	45	(1)
Viruses	46	(1)
Trojan Horses	46	(1)
Attack Trends	46	(2)
Wireless Intrusions	48	(3)
Wireless Eavesdropping	48	(1)
Man-in-the-Middle Wireless Attacks	49	(1)
Walk-By Hacking	50	(1)
Drive-By Spamming	50	(1)
Wireless Denial of Service	50	(1)
Frequency Jamming	51	(1)
The Hapless Road Warrior	51	(1)
Social Engineering	51	(3)
Examples of Social Engineering Tactics	52	(2)
Summary of Attacks	54	(4)
Cisco SAFE Axioms	58	(5)
Routers Are Targets	59	(1)
Switches Are Targets	59	(2)
Hosts Are Targets	61	(1)
Networks Are Targets	61	(2)
Applications Are Targets	63	(1)
Summary	63	(2)
Security Technology and Related Equipment	65	(56)
Virus Protection	66	(2)
Traffic Filtering	68	(9)
Basic Filtering	69	(4)
Advanced Filtering	73	(4)
Filtering Summary	77	(1)
Encryption	77	(7)
Encrypted VPN	78	(3)
SSL Encryption	81	(2)
File Encryption	83	(1)
Authentication, Authorization, and Accounting: AAA	84	(6)
Authentication	85	(4)
Authorization	89	(1)
Accounting	89	(1)
Public Key Infrastructure	90	(3)
From Detection to Prevention: Intrusion-Detection Systems and Intrusion-Prevention Systems	93	(8)
IDS Overview	93	(3)
Network- and Host-Based IDS	96	(1)
IPS Overview	97	(3)
Target-Based IDS	100	(1)
Content Filtering	101	(6)
URL Filtering	101	(5)
E-Mail Content Filtering	106	(1)
Assessment and Audit	107	(7)
Assessment Tools	107	(3)
Audit Tools	110	(4)
Additional Mitigation Methods	114	(5)
Self-Defending Networks	114	(1)
Stopping a Worm with Network-Based Application Recognition	115	(1)
Automated Patch Management	116	(2)
Notebook Privacy Filter	118	(1)
Summary	119	(1)
End Notes	120	(1)
Putting It All Together: Threats and Security Equipment	121	(16)
Threats, Targets, and Trends	122	(1)
Lowering Risk Exposure	123	(3)
Security Topologies	126	(9)
SAFE Blueprints	127	(1)
SAFE Architecture	128	(3)
Using SAFE	131	(4)
Summary	135	(2)
Part II Human and Financial Issues	137	(118)
Policy, Personnel, and Equipment as Security Enablers	139	(30)
Securing the Organization: Equipment and Access	141	(2)
Job Categories	141	(1)
Departing Employees	141	(1)
Password Sanctity	142	(1)
Access	142	(1)
Managing the Availability and Integrity of Operations	143	(1)
Implementing New Software and Privacy Concerns	144	(2)
Custom and Vendor-Supplied Software	144	(2)
Sending Data: Privacy and Encryption Considerations	146	(1)
Regulating Interactivity Through Information and Equipment Control	146	(2)
Determining Levels of Confidentiality	146	(1)
Inventory Control: Logging and Tagging	147	(1)
Mobilizing the Human Element: Creating a Secure Culture	148	(2)
Employee Involvement	148	(1)
Management Involvement: Steering Committee	149	(1)
Creating Guidelines Through the Establishment of Procedural Requirements	150	(2)
Policy Fundamentals	151	(1)
Determining Ownership	151	(1)
Determining Rules and Defining Compliance	152	(3)
Corporate Compliance	152	(1)
User Compliance	153	(2)
Securing the Future: Business Continuity Planning	155	(1)
Ensuring a Successful Security Policy Approach	156	(5)
Security Is a Learned Behavior	157	(1)
Inviting the Unknown	158	(1)
Avoiding a Fall into the Safety Trap	158	(1)
Accounting for the Unaccountable	159	(1)
Workflow Considerations	160	(1)
Striving to Make Security Policies More Efficient	160	(1)
Surveying IT Management	161	(6)
The Need for Determining a Consensus on Risk	161	(1)
Infosec Management Survey	162	(4)
Infosec Management Quotient	166	(1)
Summary	167	(2)
A Matter of Governance: Taking Security to the Board	169	(16)
Security---A Governance Issue	170	(1)
Directing Security Initiatives	171	(3)
Steering Committee	172	(1)
Leading the Way	173	(1)
Establishing a Secure Culture	174	(6)
Securing the Physical Business	174	(1)
Securing Business Relationships	175	(2)
Securing the Homeland	177	(3)
Involving the Board	180	(3)
Examining the Need for Executive Involvement	180	(2)
Elements Requiring Executive Participation	182	(1)
Summary	183	(1)
End Notes	184	(1)
Creating Demand for the Security Proposal: IT Management's Role	185	(30)
Delivering the Security Message to Executive Management	186	(1)
Recognizing the Goals of the Corporation	187	(6)
Knowing How the Organization Can Use ROP	187	(1)
Understanding the Organization's Mandate and Directives	188	(1)
Acknowledging the Organization's Imperatives and Required Deliverables	189	(2)
Establishing an Appropriate Security Posture	191	(2)
Outlining Methods IT Managers Can Use to Engage the Organization	193	(13)
Lobbying Support	194	(12)
Assessing Senior Business Management Security Requirements	206	(7)
Every Question Counts: Delivering the Survey to Respondents	208	(1)
Infosec Operational Survey	209	(3)
Infosec Operational Quotient	212	(1)
Summary	213	(2)
Risk Aversion and Security Topologies	215	(18)
Risk Aversion	216	(4)
The Notion of Risk Aversion	216	(2)
Determining Risk Tolerance	218	(1)
What Assets to Protect	219	(1)
Short-Term and Long-Term Risks	219	(1)
Risk-Aversion Quotient	220	(3)
Calculating the Risk-Aversion Quotient	221	(1)
Risk-Aversion Quotient and Risk Tolerance	222	(1)
Using the Charts	222	(1)
Security Modeling	223	(6)
Topology Standards	223	(1)
One Size Rarely Fits All	224	(1)
Security Throughout the Network	225	(4)
Diminishing Returns	229	(2)
Summary	231	(2)
Return on Prevention: Investing in Capital Assets	233	(22)
Examining Cost of Attacks	234	(6)
Determining a Baseline	234	(2)
Providing Alternatives	236	(4)
Budgeting for Security Equipment	240	(6)
Total Cost of Ownership	241	(2)
Present Value	243	(3)
Analyzing Returns on Security Capital Investments	246	(7)
Net Present Value	246	(3)
Internal Rate of Return	249	(1)
Return on Investment	250	(1)
Payback Period	251	(1)
The Bottom Line	252	(1)
Acknowledging Nonmathematical Security Fundamentals	253	(1)
Summary	254	(1)
End Notes	254	(1)
Part III Policies and Future	255	(66)
Essential Elements of Security Policy Development	257	(38)
Determining Required Policies	259	(1)
Constructing Reliable and Sound Policies	259	(2)
Reliability	260	(1)
Access	260	(1)
Constancy	260	(1)
Answerability	260	(1)
Using Policy Tools and Policy Implementation Considerations	261	(2)
Useful Policy Tools	261	(1)
Policy Implementation	262	(1)
Performing Comprehensive Monitoring	263	(2)
Knowing Policy Types	265	(28)
Physical Security Policies	265	(1)
Access-Control Policies	266	(3)
Dialup and Analog Policies	269	(2)
Remote-Access Policies	271	(1)
Remote Configuration Policies	272	(1)
VPN and Encryption Policies	273	(2)
Network Policies	275	(9)
Data Sensitivity, Retention, and Ethics Policies	284	(5)
Software Policies	289	(4)
Summary of Policy Types	293	(1)
Handling Incidents	293	(1)
Summary	294	(1)
Security Is a Living Process	295	(26)
Security Wheel	296	(9)
Secure	297	(3)
Monitor	300	(2)
Test	302	(1)
Improve	303	(2)
Scalability	305	(1)
Jurisprudence	306	(6)
Hacking	307	(1)
Internal Issues	307	(1)
Negligence	308	(1)
Privacy	309	(1)
Integrity	310	(1)
Good Netizen Conduct	311	(1)
SWOT: Strengths, Weaknesses, Opportunities, and Threats	312	(6)
Strengths	313	(1)
Weaknesses	314	(1)
Opportunities	315	(2)
Threats	317	(1)
Summary	318	(1)
End Note	319	(2)
Part IV Appendixes	321	(20)
Appendix A References	323	(4)
Appendix B OSI Model, Internet Protocol, and Packets	327	(2)
Appendix C Quick Guides to Security Technologies	329	(8)
Appendix D Return on Prevention Calculations Reference Sheets	337	(4)
Glossary	341	(22)
Index	363