Chapter 12: Network Security

This chapter covered something of a "pet subject" of mine - network security. The fact of the matter is that the modern computing world is analogous to a bad neighborhood and if one isn't careful, horrible fates can befall any network out there.

The weakest link in many networks is often the group of people using it, either the authorized users or outside intruders. Problems can arise from user negligence, policy problems, or deliberate outside attacks. Things as simple as weak passwords or infrequently changed ones can turn into serious security breaches. For example:

Bad Password: "Rover" (The name of the user's dog) - short, a word from a dictionary, and easily discovered through social engineering.
Good Password: 7391-d4V3*ln80 - long, special characters, no recognizable words. In this case, it could be the first 4 digits from the user's library card, a password set on a Wednesday, after the user bought his third Volkswagen and his wife's maiden initials and birth year. If you knew everything about the user and his life, the contents of his wallet, and so forth, you might be able to guess this, but it would be hard.
Excellent password: "xq'@R$JD/W`hn`.*;XvHULwbv+CFP9Y.H<"C$]4lR6(ci/nAhuvU;Yg&Z.rM3S;" - long, random, derived from a random password generator rather than a human mind, uses the full ASCII set, nearly impossible to brute force

There are also risks associated with the equipment itself. Easily-accessed ports or terminals just invite an attack. Wireless signals can be captured and spoofed. Improperly-configured firewalls and routers can be bypassed.

And then there are software risks. TCP/IP wasn't designed with security in mind, so it has several holes. No NOS is completely bulletproof (even the most secure versions of BSD have had one or two successful attacks over the years) and even one improper setting can provide a malicious hacker an entry point.

To combat all of this, good security policies need to be in place. The goal of these policies is to prevent unauthorized access and damage to hardware or software, intentional or unintentional, from happening. Securing data and providing for what to do when an attack inevitably happens should also be on the list of goals for a security policy. Also important is a clear definition of what "confidential" means in an organization.

The chapter also covered encryption, authentication protocols, and wireless network security.