- Copyright
- About the Lead Author
- About the Contributing Authors
- Acknowledgments
- We Want to Hear from You!
- Reader Services
- Introduction
- I. Security Concepts
- 1. Building a Roadmap for Securing Your Enterprise
- 2. The State of the Net: A World at War
- 3. Hackers and Crackers
- 4. Mining the Data Monster
- 5. Internal Security
- II. Hacking 101
- 6. A Brief TCP/IP Primer
- 7. Spoofing Attacks
- 8. Personal Privacy
- 9. Dispelling Some of the Myths
- When Can Attacks Occur?
- What Kinds of Attackers Exist?
- Operating Systems Used by Crackers
- Is There a Typical Attack?
- Who Gets Targeted Most Frequently?
- What Is the Motivation Behind Attacks?
- Summary
- III. A Defender’s Toolkit
- 10. Firewalls
- What Is a Firewall?
- Other Features Found in Firewall Products
- Firewalls Are Not Bulletproof
- A Look Under the Hood of Firewalling Products
- Programmers Bypassing the Firewall
- Pitfalls of Firewalling
- Firewall Appliances
- Building Firewalls in the Real World
- Sample Failures of Firewall Technology
- Commercial Firewalls
- Summary
- 11. Vulnerability Assessment Tools (Scanners)
- 12. Intrusion Detection Systems
- 13. Logging Tools
- 14. Password Security
- 15. Sniffers
- Sniffers as Security Risks
- What Level of Risk Do Sniffers Represent?
- Has Anyone Actually Seen a Sniffer Attack?
- What Information Do Sniffers Capture?
- Where Is One Likely to Find a Sniffer?
- Where Can I Get a Sniffer?
- Commercial Sniffers
- Sniffer Technologies and Products from Network Associates
- Finisar-Systems Surveyor
- PacketView by Klos Technologies
- Ranger Network Probe from Network Communications
- LANWatch by Precision Guesswork
- EtherPeek and AiroPeek from WildPackets Inc.
- NetMinder Ethernet by Neon Software
- LinkView Classic Network Analyzer by Acterna
- ProConvert from WildPackets, Inc.
- LANdecoder32 by Triticom
- Vericept
- Freely Available Sniffers
- Commercial Sniffers
- Defeating Sniffer Attacks
- Summary
- Further Reading on Sniffers
- 10. Firewalls
- IV. Weapons of Mass Destruction
- 16. Denial-of-Service Attacks
- 17. Viruses and Worms
- 18. Trojans
- V. Architecture, Platforms, and Security
- 19. Network Architecture Considerations
- 20. Microsoft
- Windows 9x and Windows Me
- Windows NT
- Internal Windows NT Security
- Windows 2000
- Improvements to Security
- Windows 2000 Distributed Security Overview
- General Windows 2000 Security Vulnerabilities
- The Malformed Data Transfer Request Vulnerability
- The Windows 2000 Directory Service Restore Mode Password Vulnerability
- The Netmon Protocol Parsing Vulnerability
- The Network Dynamic Data Exchange (DDE) Agent Request Vulnerability
- The Phone Book Service Buffer Overflow Vulnerability
- The Telnet Client NTLM Authentication Vulnerability
- The Telnet Server Flooding Vulnerability
- Summary of Windows 2000
- Windows XP
- Modern Vulnerabilities in Microsoft Applications
- Microsoft Internet Explorer
- Microsoft Exchange Server
- Microsoft Exchange Encapsulated SMTP Address Vulnerability
- Microsoft Exchange Malformed MIME Header Vulnerability
- Microsoft Exchange NNTP Denial-of-Service Vulnerability
- Microsoft Exchange SMTP Denial of Service Vulnerability
- Microsoft Exchange Error Message Vulnerability
- Microsoft Exchange User Account Vulnerability
- Internet Information Server
- Buffer Overrun in HTR ISAPI Extension Vulnerability
- Cross-Site Scripting in IIS Help File Search Facility Vulnerability
- The IIS Cross-Site Scripting Vulnerabilities
- The IIS Malformed Web Form Submission Vulnerability
- The IIS New Variant of File Fragment Reading via .HTR Vulnerability
- The IIS Session ID Cookie Marking Vulnerability
- The IIS Web Server File Request Parsing Vulnerability
- The Invalid URL Vulnerability
- The Myriad Escaped Characters Vulnerability
- The Web Server Folder Traversal Vulnerability
- Tools
- Access Control Software
- Good Online Sources of Information
- The Windows NT Security FAQ
- NTBugTraq
- NTSECURITY.com for Windows 2000 and Windows NT
- Expert Answers for Windows XP, Windows 2000, Windows NT, and Windows 9x/Me
- Windows IT Security (Formerly NTSecurity.net)
- “An Introduction to the Windows 2000 Public Key Infrastructure”
- Windows and .NET Magazine Online
- Securing Windows NT Installation
- Checklist for Upgrading to Windows 2000 Server
- The University of Texas at Austin Computation Center NT Archive
- Books on Windows 2000 and Windows NT Security
- Summary
- 21. Unix
- A Whistle-Stop Tour of Unix History
- Classifying Unix Distributions
- Security Considerations in Choosing a Distribution
- Unix Security Risks
- Breaking set-uid Programs for Fun and Profit
- Rootkits and Defenses
- Host Network Security
- Telnet
- An Essential Tool: Secure Shell
- FTP
- The r Services
- REXEC
- SMTP
- DNS
- finger
- SNMP
- Network File System
- The Caveats of chroot
- Better the Daemon You Know…
- Assessing Your Unix Systems for Vulnerabilities
- Summary
- 22. Novell NetWare
- The OS Facts of Life
- Watching the Big Three
- Server Environment
- Client Environment
- Novell Directory Services (NDS) Environment
- A Good Start: Intruder Detection
- User Names: Admin
- Guest and Other No-Password Users
- Understanding and Applying NDS “Best Practices”
- NDS Auditing Tools
- AuditWare for NDS
- bv-Control for NDS
- JRButils
- LT Auditor+ 8.0
- Commercial Secure Remote Control Products
- SecureConsole for NetWare 3.4
- AdRem sfConsole
- Useful Freeware
- Further Reading
- Summary
- 23. Routers, Switches, and Hubs
- 24. Macintosh
- Mac OS X—Apple’s New Operating System
- Establishing the Macintosh as a Server
- Vulnerabilities on the Macintosh Platform
- About File Sharing and Security
- Server Management and Security
- Firewall Protection
- Internal Security
- Mac OS X Screensaver Password Protection
- Mac OS X Login
- BootLogger
- DiskLocker
- Empower
- Ferret
- Filelock
- FullBack
- Invisible Oasis
- TypeRecorder
- KeysOff and KeysOff Enterprise
- LockOut
- OnGuard Emergency Passwords
- Password Key
- Password Security Control Panel Emergency Password
- Aladdin Secure Delete
- SecurityWare Locks
- Stealth Signal
- Mac OS X Single User Root Mode
- Super Save 2.02
- SubRosa Utilities
- Open Firmware Password Protection
- Password Crackers and Related Utilities
- Anonymous Email and Mailbombing
- Macintosh Viruses, Worms, and Antivirus Solutions
- Spyware and Detection
- Resources
- 25. Policies, Procedures, and Enforcement
- VI. Security and Integrated Services
- 26. Secure Application Development, Languages, and Extensions
- 27. Wireless Security Auditing
- VII. References
- A. Security Bibliography—Further Reading
- B. How to Get More Information
- C. Vendor Information and Security Standards
- D. What’s on the CD-ROM
- Glossary
- 28. CD-ROM
Anonymous is a self-described Unix and Perl fanatic who lives in southern California with his wife Michelle and a half-dozen computers. He currently runs an Internet security consulting company and is at work building one of the world’s largest computer security archives. He also moonlights doing contract programming for several Fortune 500 firms.
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.