Managing A Network Vulnerability Assessment 1st Edition Thomas R. Peltier
Managing A Network Vulnerability Assessment 1st Edition Thomas R. Peltier
com
https://ebookname.com/product/managing-a-network-
vulnerability-assessment-1st-edition-thomas-r-peltier/
OR CLICK BUTTON
DOWNLOAD EBOOK
https://ebookname.com/product/information-security-fundamentals-2nd-
edition-thomas-r-peltier/
ebookname.com
https://ebookname.com/product/assessment-of-vulnerability-to-natural-
hazards-a-european-perspective-1st-edition-david-alexander/
ebookname.com
https://ebookname.com/product/dionysius-the-areopagite-between-
orthodoxy-and-heresy-filip-ivanovic/
ebookname.com
Food Fight The Inside Story of the Food Industry America s
Obesity Crisis and What We Can Do About It 1st Edition
Kelly D. Brownell
https://ebookname.com/product/food-fight-the-inside-story-of-the-food-
industry-america-s-obesity-crisis-and-what-we-can-do-about-it-1st-
edition-kelly-d-brownell/
ebookname.com
https://ebookname.com/product/bacterial-pangenomics-methods-and-
protocols-1st-edition-alessio-mengoni/
ebookname.com
https://ebookname.com/product/numerical-methods-for-chemical-
engineering-applications-in-matlab-1st-edition-kenneth-j-beers/
ebookname.com
https://ebookname.com/product/practical-program-evaluation-for-
criminal-justice-1st-edition-gennaro-f-vito/
ebookname.com
https://ebookname.com/product/triathlon-starting-out-training-for-
your-first-competition-3rd-edition-edition-frey/
ebookname.com
Understanding Adaptability Volume 6 A Prerequisite for
Effective Performance within Complex Environments Advances
in Human Performance and Cognitive Engineering Research
1st Edition C. Shawn Burke
https://ebookname.com/product/understanding-adaptability-
volume-6-a-prerequisite-for-effective-performance-within-complex-
environments-advances-in-human-performance-and-cognitive-engineering-
research-1st-edition-c-shawn-burke/
ebookname.com
Managing a Network Vulnerability Assessment
by Thomas R. Peltier, Justin ISBN:0849312701
Peltier and John A. Blackley
Auerbach Publications © 2003 (291 pages)
In this text, the author describes steps necessary to manage
an assessment, from development of a scope statement to
production of a response report, and details the use of
commercial, freeware, and shareware tools for an
assessment.
Table of Contents
(alk. paper)
TK5105.59.P453 2003
005.8--dc21
2003041801
This book contains information obtained from authentic and highly regarded
sources. Reprinted material is quoted with permission, and sources are
indicated. A wide variety of references are listed. Reasonable efforts have
been made to publish reliable data and information, but the author and the
publisher cannot assume responsibility for the validity of all materials or for
the consequences of their use.
Neither this book nor any part may be reproduced or transmitted in any form
or by any means, electronic or mechanical, including photocopying,
microfilming, and recording, or by any information storage or retrieval
system, without prior permission in writing from the publisher.
The consent of CRC Press LLC does not extend to copying for general
distribution, for promotion, for creating new works, or for resale. Specific
permission must be obtained in writing from CRC Press LLC for such
copying.
Direct all inquiries to CRC Press LLC, 2000 N.W. Corporate Blvd., Boca
Raton, Florida 33431.
Dedication
To Lisa, Julie, and Amanda, our teammates and better halves.
Acknowledgments
People who take sole credit for any task completed or process "developed"
have forgotten where they came from and who helped them get to where
they are now. When discussing network vulnerability assessment, many
people do not want to have their names associated in any way with the
process. However, this is one of those tasks that needs to be done, and the
best way to do it is to make the task as simple as possible. Over the years
we have been able to learn the process of network vulnerability assessment
from the best teachers around, our peers.
First on our list of acknowledgments is our mentor and friend, John O'Leary,
the Director of the Computer Security Institute's Education Resource Center.
One of the first training sessions I attended as a neophyte security
professional was John's "Computer and Network Security" class. This class
laid the foundation for my understanding that a network is a scary place, but
that with proper review and attention it can serve us well.
The next two people who need to be acknowledged are Dr. Dan Webb and
Dr. Peter Stephenson. Dr. Dan showed me the fundamentals of vulnerability
assessment, and Dr. Stephenson helped me fine-tune the process we
worked on together for just over two years. Dr. Stephenson's books on
computer forensics are used as industry benchmarks for all security
professionals. His willingness to share ideas and his findings has helped
move our profession forward.
Michael Cannon, Larry Degg, Gene Traylor, and John Riske helped me
begin the process of assessing network vulnerabilities. We worked together
for seven years and drew up the prototype for a business-based information
security program.
Justin would like to acknowledge his dad, for all his loving support and the
opportunity to be part of this industry; Dr. Peter Stephenson, for patiently
teaching him how to correctly perform a vulnerability assessment; Paul Immo
and Marc Harwin for their friendship and support; and Julie, for being the
love of his life and taking care of him so well.
Who can leave out their publisher? Certainly not us! Rich O'Hanley has
taken the time to discuss security issues with numerous organizations to
understand what their needs are and then presented these findings to us. A
great deal of our work here is a direct result of what Rich discovered that the
industry wanted. Rich O'Hanley, not only the world's best editor and task
master, but a good friend and source of knowledge. Thanks Rich!
John has published a number of articles in the business press and has been
a speaker at conferences and seminars around the world. He teaches on
subjects such as privacy management, policy creation and implementation,
risk management, and information security awareness. In addition, John's
classes and seminars address organization and management issues relating
to the practice of information security.
Over the past decade, Tom has averaged four published articles a year on
various computer and information security issues, including developing
policies and procedures, disaster recovery planning, copyright compliance,
virus management, and security controls. He has had four books published:
Policies, Standards, Guidelines and Procedures: Information Security Risk
Analysis; Information System Security Policies and Procedures: A
Practitioners' Reference; The Complete Manual of Policies and Procedures
for Data Security and is the co-editor and contributing author for the CISSP
Prep for Success Handbook; and a contributing author for the Computer
Security Handbook, 3rd and 5th editions, and Data Security Management.
Tom has been the technical advisor on a number of security films from
Commonwealth Films. He is the past chairman of the Computer Security
Institute (CSI) advisory council, the chairman of the 18th Annual CSI
Conference, founder and past-president of the Southeast Michigan
Computer Security Special Interest Group, and a former member of the
board of directors for (ISC)2, the security professional certification
organization. He conducts numerous seminars and workshops on various
security topics and has led seminars for CSI, Crisis Management, American
Institute of Banking, the American Institute of Certified Public Accountants,
Institute of Internal Auditors, ISACA, and Sungard Planning Solutions. Tom
was also an instructor at the graduate level for Eastern Michigan University.
Chapter 1: Introduction
Overview
The growth of distributed computing has been one of the major drivers of
network security. With the exponential growth of networks, the ease with
which information can be shared between and among computers makes
security more important but more difficult to implement and manage. Also,
computers are no longer connected to one trusted network; they are
potentially connected to every other network and its computers in the world,
with or without security implementations of their own.
Most of the networks that are being evaluated today are Internet Protocol
(IP)-based networks. For knowledge of IP networks, one must be familiar
with subnetting and common IP subnet ranges, the basics of routing and
routing protocols, and an understanding of how to use a network sniffer.
While most networks are going to be IP based, not all networks are. There is
still a pretty fair amount of networks that run the Internet Packet Exchange
(IPX) protocol used by Novell servers and clients. While there are other
networks types, the vast majority are IP-based networks, so this is where we
focus most of our efforts in the book.
What Specific Skills Are Needed?
From a technical perspective, a number of different skills may be required,
but the most essential role in the NVA will be project management. It is not
uncommon to see a skilled security practitioner lose all track of dates and
times, as he is off delving deeper and deeper into the security mysteries of
the network. That same security engineer might also have a genetic
predisposition to perform tasks of slightly less importance to the NVA, such
as playing online fantasy football. Good project management can help fight
all of this.
MINSTRELSY
C’est une étrange entreprise que celle de faire rire les
honnêtes gens.—J.-B. Poquelin de Molière.
Molière est un infâme histrion.—J.-B. Bossuet.
CHAPTER I
THE FALL OF THE THEATRES