This chapter explains the various types of network threats such as Distributed Denial of Service Attack (DDoS), Reflection Denial of Service (DoS) Attack, Cross Site Forgery Request (CSFR or XSFR), and Session Hijacking. It describes the various Client authentication techniques, Input Data validation, security setting of Internet Explorer, Browser hijacking and lists browser security settings. This chapter also describes the Plug-ins, types of plug-ins, Common Gateway Interface (CGI) and CGI Operations.
E-mails have become the primary source of communication on the Internet. Many organizations have been using it as a means to formally communicate with their employees. In this context, it is very much essential to secure the emails.
This chapter primarily discusses an overview, history, basics, types of e-mail, and web-based versus Pop3 e-mail. It explains the components of e-mail such as headers, opening attachments, reading e-mails for different clients, field names and values, address lists, recipients and senders, Response Targets and Threading. This chapter also describes the E-Mail Servers, Core Elements of E-Mail Encryption, Protocols and Security Risks.
This chapter describes the concept of authentication and methods, Encryption systems and algorithms, and types of encryptions. This chapter also describes the concept of cryptography, Math and algorithm, concept of message authentication. It explains the use of Digital Certificates, the difference between physical and Digital Certificates, Digital Signatures, and the features of Digital Signature Key Management Protocols.
Patch management is the process of controlling the deployment and maintenance of interim software.In the early days of its development, the VPN made use of leased lines, frame relay PVCs, Remote Access Servers (RAS), and Asynchronous Transfer Mode (ATM). Presently, VPNs use the Internet and networking with Internet Protocol (IP).
This chapter describes about the Virtual Private Network (VPN), its types, and Tunneling protocols, Layer Two Tunneling Protocol (L2TP), VPN Security, Setting up VPN. It explains how to install IAS and configure the VPN Server. This chapter also describes the VPN policies, risks, Product testing and explains the Insecure Storage of Authentication Credentials by VPN Clients.
Many levels of fault tolerance exist including the capacity to work normally despite events like power failure, software failure, hardware failure, etc. It is defined as “The capability of a system to react elegantly to an unpredicted hardware or software failures”.
This chapter discusses the planning for fault tolerance, network security, the concept of fault tolerant network, the reasons for network and system failures and types of preventive measures. This chapter also discusses the anatomy of auditing, auditing mechanism, audit browsing, investigation of security breaches, review of audit files and logs and explains the processes of Verification, Validation, Testing, and Evaluation.
Incident response is an action or measure taken against the occurrence of an unexpected event. An incident can be described as a security breach. Response can be any measure or step taken by the security team to reduce the damages and ensure data integrity of the restored files.
This chapter describes the categories of incidents, types, managing incidents, and explains the step by step procedure for handling incidents. This chapter also describes the Incident Response architecture, six step approach for Incident Handling. It explains the Incident Handling Process, Incident Response Team and discusses the obstacles in building a successful Incident Response Team.
IT disaster recovery training is the operation of restoring record collections and related operations after a disaster where as Risk Analysis is the method that defines procedures through which an organization can survive or reduce the probability of risks.
This chapter describes the principles of disaster recovery, types of disaster recovery systems, emergency management, disaster recovery plan and Testing, Contingency planning/disaster recovery. It discusses the guidelines determining the critical and essential workload. This chapter also describes about the Cost/Benefit analysis of controls in risk analysis, and implementation of cost-effective controls. It explains the risk management process and explains the roles and responsibilities of all the players in the risk analysis process.
A vulnerability assessment is the procedure of identifying and logging vulnerabilities. It helps in understanding and resolving problems before the vulnerability affects a person or some device.
This chapter describes the goals and features of a good vulnerability assessment training. It explains the Network Vulnerability Assessment timeline, vulnerability classes, source of vulnerabilities, and choice of personnel for the Network Vulnerability Assessment Team (NVAT). This chapter also discusses the various phases of Network Vulnerability Assessment Methodology such as Acquisition, Identification, Analyzing, Evaluation, and Generating Reports and provides a list of vulnerability assessment tools.