Catherine Paquet - The Business Case for Network Security: Advocacy, Governance, and ROI

[]abuseaccessaccess cardsaccess control listsaccess cradsaccess integrityaccess pointswireless networksaccess policiesaccess warningsanalog Internet accessanalysisangry employeesannual-loss expectancy (ALE) [See ]annualized rate of occurrence (ARO) [See ]application layer attacksapplicationsdesign issuesassetsprotectionvalue estimationsabuseapplication layer attackscalssifyingcostsdetectionexploitation attacksIP spoofingman-in-the-middle attacksnetwork reconnaissancepacket sniffersport redirection attackspreventingreportingrisk exposurerisk tolerancetrust exploitation attacksUnited Stateswar-dialersauditingAVmultiple brandsavailabilityequipmentawareness levels []baselinesattack costsbraggartsbuffer overflowbusiness relationships []CAcalculatingcarelss employeescassificationattacksCCNP Self-Studycertificate authority (CA) [See ]certificatesCAcollateral damagecommunicationspeer groupscomplianceconfidentialityconfidentiality levelscorporate compliancecorporate organizationscostsattacksculturessecuritycustom-written software []data collectiondata transfersdeliverablesdemilitarized-zone (DMZ) web server [See ]departing employeesdepartmentssecurity incidentsdesign issuesvulnerabilitiesdetectionIDSs (intrusion-detection systems)devicesavailabilityhardening devicesunsecured devicesdialup Internet accessdialup workstationsdiminishing returnsdirectivesdiscount factordisgruntled employeesDMZ (demilitarized-zone) web serversDMZ servers []e-mailcontentemployee sabotageemployeesbusiness relationshipssecure culturesCAkeysenvironmentssecurityequipmentavailabilityexecutive involvementexploitation attacksexposure factorextranetsextrapolating policy intent []false positivesIPS sensorsfax linesfilteringfiltersprivacy filtersfinance departmentsecurity incidentsfirewallingforensic analysisformer employees []governanceguidelinescreating []hackingHacking Exposedhardening devicesinstallationhashinghomelandhostshuman issuesvulnerabilities []attacksIDSs (intrusion-detection systems)IM (Infosec management) quotient surveysimperativesimplementationimplementation issuesvulnerabilitiesimprove componentinbound dialingInfosec management (IM) quotient surveysInfosec operational (IO) quotient surveys]initiativesintegrityintegrity issuesinteractivityintitiativesintrusion-detection systems (IDSs) [See ]intrusion-prevention systems (IPSs) [See ]inventory controlinvestmentsreturnsROPinvestor relations departmentsecurity incidentsIO (Infosec operational) quotient surveysIO quotientIO surveyrespondentssenior management requirementsIP spoofingattackssensorsIPSs (intrusion-prevention systems)ISDsIT managementcorporates mandatesdeliverablesimperativesorganizationsROPROP (return on prevention) []job categories []keys []LANsPVLANslaptop computerslaw of diminishing returnslicensinglifetimeslobbying supportlog analysislogginglogistics departmentsecurity incidents []MAC addressesmanagement server consolesmanagerssecure culturesmandatesmarketing departmentsecurity incidentsmitigationthreat mitigationmobile accessmobile employeespoliciesmobile employessmonitormonitoring []negligencenetwork interface cards (NICs) [See ]network reconnaissance attacksnetwork testingnetwork vunerability scannersnetworksNewton's Telecom DictionaryNICsNIDSnormalizationnotebook computers []one-time passwordspoliciesonline bankingoperating systemsdesign issuesoperating sytemsoperation integrityopportunitiesdeterminingOTPs (one-time passwords)outgoing traffic monitoringoutgoing-traffic administration []packet snifferspacketspassword attackspoliciessanctitystoringstrong passwordsweak passwordspatchespathspeer groupscommunicationspenetrable analysisperimeter routersadjustingefficiencyencryption policiesenforcementextrapolating policy intentincidentsIT managementpasswordsprocedural requirementsrequired policiessenior management requirementsport redirection attacksport securitypresent valuespresentationsprivacyconfidentiality levelsprivacy breachesprivacy filtersprivate virtual LANs (PVLANs) [See ]procedural requirementsproduction departmentsecurity incidentspropagationproposalsprotocolsdesign issuesvulnerabilitiesproxy serverspublic key infrastructure (PKI) [See ]PVLANs []quality auditssecurity auditsquestions []rating scaleremote accessreportingattacksrequired policiesretention]returnsrisksexposureroconnaissance attackscorporate goalsmandates and directivestraffic filtering []SAA Security Blueprint for Enterprise Networks (SAFEExtending the Security Blueprint to Small, Midsize, and Remote-User Networks (SAFEIDS Deployment, Tuning, and Logging in Depth (SAFEIP Telephony Security in Depth (SAFEVPN IPSec Virtual Private Networks in Depth (SAFEWireless LAN Security in Depth (SAFEWorm Mitigation (SAFEsales departmentsecurity incidentsscalabilityscanningvunerability scanssecure culturessecurityquality auditsUnited Statessecurity initiativesrequirementsSecurity Surveysenior managementsecurity incidentssecurity requirementssensorsIPS sensorsserversservice level agreements (SLAs) [See ]single-loss expectancy (SLE) [See ]SLAsAVinstallationSSH (secure shell)SSL (secure sockets layer)stateful firewallingstatus quosteering committeeopportunitiesstrengthsthreatsweaknessessteering committeessecure culturesstrengthsdeterminingstrong passwordssupportlobbyingPVLANs (private virtual LANs)traffic filtering []taggingtargetsTCO (total cost of ownership)testing componentthreadsthreat mitigationthreatsapplication layer attacksdeterminingDoS attacksIP spoofingman-in-the-middle attacksnetwork reconnaissance attackspacket snifferspassword attacksport redirection attacksrisk exposurerisk tolerancerisksTrojan horsestrust exploitation attacksunauthorized access attacksviruseswar-dialerswormsticket assignmentstokenstoolstopologiestotal cost of ownership (TCO) [See ]traffic efficacytrainingtrendstrojan horses []unsecured devicesunsecured user accountsURLsuser accountsunsecure user accountsuser complianceuser software []vendor-based softwarevirus protectionAVVLANsPVLANsVPNsvunerability patchingvunerability scannersvunerability scansvunerable points []war dialerspolicieswar-dialersweak passwordsweaknessesdeterminingweb siteswokflowpoliciesworkforcebusiness relationshipsWorld Wide Webstopping []abuseaccessaccess cardsaccess control listsaccess cradsaccess integrityaccess pointswireless networksaccess policiesaccess warningsanalog Internet accessanalysisangry employeesannual-loss expectancy (ALE) [See ]annualized rate of occurrence (ARO) [See ]application layer attacksapplicationsdesign issuesassetsprotectionvalue estimationsabuseapplication layer attackscalssifyingcostsdetectionexploitation attacksIP spoofingman-in-the-middle attacksnetwork reconnaissancepacket sniffersport redirection attackspreventingreportingrisk exposurerisk tolerancetrust exploitation attacksUnited Stateswar-dialersauditingAVmultiple brandsavailabilityequipmentawareness levels

This appendix lists books, websites, and other resources that are referred to throughout this book, along with resources that were used during the research process.

NOTE

The website references in this book were accurate upon publication; however, they might have since changed. If the website is unavailable, you might want to conduct a search using a powerful search engine such as Google (http://www.google.com) and entering the document title as key words.