Hacking ebook securityde engineering

324 51 0
Hacking ebook securityde engineering

Đang tải... (xem toàn văn)

Tài liệu hạn chế xem trước, để xem đầy đủ mời bạn chọn Tải xuống

Thông tin tài liệu

As hacker organizations surpass drug cartels in terms of revenue generation, it is clear that the good guys are doing something wrong in information security Providing a simple foundational remedy for our security ills, Security De-Engineering: Solving the Problems in Information Risk Management is a definitive guide to the current problems impacting corporate information risk management It explains what the problems are, how and why they have manifested, and outlines powerful solutions • Outlines six detrimental security changes that have occurred in the past decade • Examines automated vulnerability scanners and rationalizes the differences between their perceived and actual value • Considers security products—including intrusion detection, security incident event management, and identity management The book provides a rare glimpse at the untold stories of what goes on behind the closed doors of private corporations It details the tools and products that are used, typical behavioral traits, and the two types of security experts that have existed since the mid-nineties—the hackers and the consultants that came later Answering some of the most pressing questions about network penetration testing and cloud computing security, this book provides you with the understanding and tools needed to tackle today’s risk management issues as well as those on the horizon K13108 Security De-Engineering Ian Tibble delves into more than a decade of experience working with close to 100 different Fortune 500s and multinationals to explain how a gradual erosion of skills has placed corporate information assets on a disastrous collision course with automated malware attacks and manual intrusions Presenting a complete journal of hacking feats and how corporate networks can be compromised, the book covers the most critical aspects of corporate risk information risk management TIBBLE Information Technology / IT Management Security De-Engineering Solving the Problems in Information Risk Management IAN TIBBLE ISBN: 978-1-4398-6834-8 90000 www.crcpress.com 781439 868348 w w w.auerbach-publications.com K13108 PB mech.indd 11/14/11 3:12 PM '%74+6; 'g 0)+0''4+0) 1.8+0)6*'41$.'/5+0 0(14/#6+10+5-#0#)'/'06 This page intentionally left blank '%74+6; 'g 0)+0''4+0) 1.8+0)6*'41$.'/5+0 0(14/#6+10+5-#0#)'/'06 IAN TIBBLE CRC Press Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2012 by Taylor & Francis Group, LLC CRC Press is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S Government works Version Date: 20110815 International Standard Book Number-13: 978-1-4398-6835-5 (eBook - PDF) This book contains information obtained from authentic and highly regarded sources Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint Except as permitted under U.S Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers For permission to photocopy or use material electronically from this work, please access www.copyright com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400 CCC is a not-for-profit organization that provides licenses and registration for a variety of users For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com Contents P R E FA C E ix ACKNOWLEDGMENTS xvii INTRODUCTION xix AUTHOR SECTION CHAPTER xxxvii PEOPLE AND BLAME W H O M D O YO U B L A M E ? The Buck Stops at the Top? Managers and Their Loyal Secretaries Information Security Spending—Driving Factors in the Wild Do Top-Level Managers Care about Information Security? Ignoring the Signs Summary CHAPTER TH E H A C K E R S Hat Colors and Ethics “Hacker” Defined Zen and the Art of Remote Assessment The Hacker through the Looking Glass Communication, Hyper-Casual Fridays, and “Maturity” Hacker Cries Wolf Unmuzzled Hackers and Facebook Summary CHAPTER CHECKLISTS AND S TA N D A R D S E VA N G E L I S T S Platform Security in HELL v 3 10 12 14 17 17 20 25 29 35 38 40 42 47 54 vi C O N T EN T S CASE Survival Guidelines CASEs and Network Security Security Teams and Incident Investigation Vulnerability/Malware Announcements This Land Is Our Land Common CASE Assertions Summary SECTION CHAPTER TH E D E -E N G I N E E R I N G OF 58 60 61 63 65 67 68 SECURIT Y HOW SECURIT Y CHANGED POST 20 0 Migrating South: Osmosis of Analysis Functions to Operations Teams The Rise of the Automated Vulnerability Scanner The Rise of the Checklist Incident Response and Management—According to Best Practices “Best Practices” in Security Service Provision Tip of the Iceberg—Audit-Driven Security Strategy Summary CHAPTER A U T O M AT E D V U L N E R A B I L I T Y S C A N N E R S Law of Diminishing Enthusiasm False Positive Testing Revelations The Great Autoscanning Lottery Judgment Day Automation and Web Application Vulnerability Assessment Web Application Security Source Code Testing Summary CHAPTER TH E E T E R N A L YAW N : C A R E E R S SECURITY IN P E N E T R AT I O N TE S T I N G — O L D AND Testing Restrictions Restriction 1: Source IP Address Restriction 2: Testing IP Address Range(s) Restriction 3: Exploits Testing Penetration Testing—The Bigger Picture Summary 75 83 89 93 98 99 106 111 115 121 125 129 132 136 137 I N F O R M AT I O N Information Security and Strange Attractors Specialization in Security The Instant Manager The Technical Track Summary CHAPTER 75 NEW 143 145 146 151 154 160 169 170 171 173 175 179 186 v ii C O N T EN T S CHAPTER TH E L O V E O F C L O U D S A N D I N C I D E N T S — TH E VA I N S E A R C H F O R VA L I D AT I O N Love of Incidents The Love of Clouds Summary SECTION CHAPTER SECURIT Y PRODUCTS INTRUSION DETECTION 213 216 216 217 218 218 220 222 223 Tuning/Initial Costs Belt and Suspenders? NIDS and Denial of Service Hidden Costs Return on Investment Network Intrusion Prevention Systems Summary A Final Note C H A P T E R 10 OTHER PRODUCTS Identity Management Security Information Event Management Solutions Summary SECTION C H A P T E R 11 TH E R E -E N G I N E E R I N G OF 225 226 231 240 SECURIT Y O N E P R O F E S S I O N A L A C C R E D I TAT I O N P R O G R A M T O B I N D TH E M A L L C-Levels Do Not Trust Us Infosec Vocational Classifications Requirements of an Infosec Manager The Requirements of a Security Analyst Regaining the Trust: A Theoretical Infosec Accreditation Structure Summary INDEX 193 195 200 206 251 254 256 257 260 270 278 285 This page intentionally left blank Preface Security de-engineering is for anyone with an interest in security, but the focus is on the aspects of security that matter to businesses and how businesses security It is clear that the good guys have been doing something wrong in security There are increasing levels of fear and insecurity in the world as a result of almost daily news headlines relating to new acts of skullduggery by financially motivated bad guys Large-scale incidents now regularly make headline news even in financial publications— this is because the bottom line is now being impacted Smaller-scale malware attacks gnaw at corporate balance sheets and lead to identity theft These attacks have led to botnetz-r-us criminal gangs surpassing drug cartels in terms of revenue generation One can be led to think the world is falling apart with so many credit card fraud horror stories and so on But are we getting closer to a solution for corporate security? Not really, because we have not yet identified the problems There is no secret that the security world and its customers are in something of a quagmire All large organizations of more than 10,000 nodes will have been the victims of advanced persistent threat (APT) in some form or another Indeed, most of them are already “owned.” In Security De-Engineering, I give a simple foundational remedy for our security ills, but in order to give a prescription, one must first ix ... Government works Version Date: 20110815 International Standard Book Number-13: 978-1-4398-6835-5 (eBook - PDF) This book contains information obtained from authentic and highly regarded sources... Communication, Hyper-Casual Fridays, and “Maturity” Hacker Cries Wolf Unmuzzled Hackers and Facebook Summary CHAPTER CHECKLISTS AND S TA N D A R D S E VA N G E L I S T S Platform Security in... 200 206 251 254 256 257 260 270 278 285 This page intentionally left blank Preface Security de -engineering is for anyone with an interest in security, but the focus is on the aspects of security

Ngày đăng: 05/11/2019, 21:34

Từ khóa liên quan

Mục lục

  • Front Cover

  • Contents

  • Preface

  • Acknowledgments

  • Introduction

  • Author

  • SectIon 1: People and Blame

    • Chapter 1: Whom Do You Blame?

    • Chapter 2: The Hackers

    • Chapter 3: Checklists and Standards Evangelists

    • SectIon 2: The De-EngIneering of Security

      • Chapter 4: How Security Changed Post 2000

      • Chapter 5: Automated Vulnerability Scanners

      • Chapter 6: The Eternal Yawn: Careers in Information Security

      • Chapter 7: Penetration testing—Old and New

      • Chapter 8: The Love of Clouds and Incidents—The vain search for validation

      • SectIon 3: Security Products

        • Chapter 9: Intrusion Detection

        • Chapter 10: Other Products

        • SectIon 4: The Re-Engineering of Security

          • Chapter 11: One Professional accreditation Program to Bind Them All

Tài liệu cùng người dùng

  • Đang cập nhật ...

Tài liệu liên quan