Increasing Operations Security

Evaluating Network Security

To verify that a network's security solutions are acting as expected, you should test them occasionally. This network security evaluation typically occurs during the implementation phase and the operations and maintenance phase of SDLC.

During the implementation phase you should evaluate network security on individual system components, in addition to the overall system. By performing a network security evaluation during the implementation stage, you are better able to discover any flaws in your security design, implementation strategy, or operational strategy. You can also get a sense of whether your security solution will meet the guidelines of your security policy.

After a system enters its operation and maintenance phase, you should continue to perform periodic security evaluations to verify the performance of your security solution. In addition to regularly scheduled evaluations, Cisco recommends that evaluations be performed after you add a component (for example, a web server) to the information system.

The results of your security evaluations can be used for a variety of purposes:

■ Creating a baseline for the information system's level of protection

■ Identifying strategies to counter identified security weaknesses

■ Complementing other SDLC phases, such as performing risk assessments

■ Conducting a cost/benefit analysis when evaluating additional security measures

A variety of network evaluation techniques are available. Some of them can be automated, and others are manual procedures. Consider the following approaches to evaluating network security:

■ Scanning a network for active IP addresses and open ports on those IP addresses

■ Scanning identified hosts for known vulnerabilities

■ Using password-cracking utilities

■ Reviewing system and security logs

■ Performing virus scans

■ Performing penetration testing (perhaps by hiring an outside consultant to see if he or she can compromise specific systems)

■ Scanning for wireless SSIDs to identify unsecured wireless networks

Several tools and utilities are available for performing a security evaluation. Some are available as freeware, and other packages require the purchase of a license. The following is a sample of these tools and utilities:

■ GFI LANguard

■ Tripwire

■ Metasploit

■ SuperScan by Foundstone, a division of McAfee

Nmap

To gain a sense of the features available in such evaluation tools, consider the Nmap utility.

Nmap is a publicly available scanner that can be downloaded from http://

www.insecure.org/nmap. Nmap offers features such as the following:

■ It has scanning and sweeping features that identify services running on systems in a specified range of IP addresses.

■ It uses a stealth approach to scanning and sweeping, making the scanning and sweeping less detectible by hosts and IPS technology.

■ It uses operating system (OS) fingerprinting technology to identify an operating system running on a target system (including a percentage of confidence that the OS was correctly detected).

Figure 2-1 shows a GUI version of Nmap called Zenmap, which can be downloaded from the link just provided.

Figure 2-1 Nmap

Disaster Recovery Considerations

With the potential for natural disasters (such as hurricanes, floods, and earthquakes) and man-made disasters (such as terrorist attacks) looming over today's networks, network administrators need to have contingency plans in place. Although these plans are sometimes called business continuity plans or disaster recovery plans, disaster recovery planning tends to address actions taken during and immediately after a disaster.

Specifically, disaster recovery (which is just a subset of business continuity planning) is concerned with allowing personnel to again access the data, hardware, and software they need to do their jobs. Also keep in mind that although a disaster recovery plan often conjures up thoughts of redundant hardware and backup facilities, a comprehensive disaster recovery plan also considers the potential loss of key personnel.

The two primary goals of business continuity planning are

■ Moving critical business operations to another facility while the original facility is under repair

■ Using alternative forms of internal and external communication

The overall goal of these plans is to allow an organization to perform critical business operations after a disaster. Three phases of recovery include

■ Emergency response phase

" f Key

\ Topic

■ Recovery phase

■ Return to normal operations phase

Because these plans cannot possibly address all conceivable scenarios, disaster recovery and business continuity plans typically target the events that are most likely to occur. To illustrate the severity of a critical data loss, consider that some companies reportedly spend approximately 25 percent of their IT budget on business continuity and disaster recovery plans. Cisco also offers the following statistics about companies that lose most of their computerized records:

■ 43 percent never reopen.

■ 51 percent close within two years.

■ 6 percent survive long-term.

Types of Disruptions

Business continuity and disaster recovery plans should address varying levels of disruptions by specifying different responses based on the severity of the disruption. To assist you in quantifying a disruption, consider the categories presented in Table 2-3.