Cisco Network Security (Hardcover)
暫譯: 思科網路安全 (精裝版)

James Pike

Cisco Network Security (Hardcover)
  • 出版商: Prentice Hall
  • 出版日期: 2001-09-06
  • 定價: $1,650
  • 售價: 6.0 折 $990
  • 語言: 英文
  • 頁數: 320
  • 裝訂: Hardcover
  • ISBN: 0130915181
  • ISBN-13: 9780130915184
  • 相關分類: Cisco、資訊安全

    • 立即出貨(限量) (庫存=4)

買這商品的人也買了...

商品描述

The practical, authoritative Cisco network security implementation guide!

Finally, there's a single source for practical, hands-on guidance on implementing and configuring the most important elements of Cisco network security!

Leading network security consultant James Pike offers step-by-step guidance for implementing and configuring key Cisco security products-including in-depth guidance on using PIX firewalls. Coverage includes:

  • Essential Cisco security terminology, technologies, and design criteria
  • Comprehensive, start-to-finish techniques for deploying IPSec security in VPN environments
  • Easy to understand introductions to Cisco Secure IDS/Net Ranger intrusion detection, Cisco Secure Scanner/NetSonar scanning, and Cisco Secure Access Control System access control

No other book brings together this much Cisco security information: step-by-step tutorials, in-depth reference material, critical data for configuration, and expert guidance for decision making. Whatever your role in securing Cisco networks, Cisco Network Security will instantly become your #1 resource.

Table of Contents

1. Understanding Security Risk and Threats.

Technology Weaknesses. Protocol. Operating Systems. Networking Equipment. Firewall “Holes” . Configuration Weaknesses. Policy Weaknesses. Sources of Security Threats. Thrill Seekers and Adventurers. Competitors. Thieves. Enemies or Spies. Hostile Employees. Hostile Former Employer. Other Employee Sources. Threats to Network Security. Electronic Eavesdropping. Denial of Service. Unauthorized Access. Session Replay. Session Hijacking. Impersonation. Malicious Destruction. Repudiation. Viruses, Trojan Horses, and Worms. Rerouting. What Are We To Do? What Needs Protection? What Is the Nature of the Risk? What Kind of Protection Is Necessary? How Much Can You Afford to Spend?


2. Security Architecture.

Goals of the Security Policy. Confidentiality and Privacy of Data. Availability of the Data. Integrity of the Data. Identity Authentication and Authorization. Nonrepudiation. Physical Security. Cabling. Switches. Routers. Basic Network Security. Passwords. Network Security Solutions. Perimeter Routers—First Layer of Defense. Firewalls—Perimeter Reinforcement. Virtual Private Networks. Data Privacy and Integrity. Vulnerability Assessment. Intrusion Detection. Access Controls and Identity. Security Policy Management and Enforcement.


3. First Line of Defense—The Perimeter Router.

Passwords. Privileged Users. Basic Users. Disable EXEC-Mode. Establish a Line-Specific Password. Establish User-Specific Passwords. Limit Access Using Access Lists as Filters. Other Issues. Router Services and Protocols. Simple Network Management Protocol. HTTP. TCP/IP Services. Disable IP Source Route. Disable Non-Essential TCP and UDP Services. Disable the Finger Service. Disable Proxy ARP. Disable Directed Broadcasts. Disable the Cisco Discovery Protocol. Disable ICMP Redirects. Disable the Network Time Protocol. Disable ICMP Unreachables Messages. Traffic Management. Access Control Lists (ACL). Router-Based Attack Protection. Routing Protocols. Audit Trails and Logging.


4. Firewalls.

The Protocols of the Internet. IP—The Internet Protocol. TCP—The Transmission Control Protocol. UDP—The User Datagram Protocol. TCP and UDP Ports. What Is a Network Firewall? What Kind of Protection Does a Firewall Provide? Protection and Features a Firewall Can Provide. What a Firewall Doesn't Protect Against. Firewall Design Approaches. Network Level Firewalls. Application Layer Firewalls. Network Design with Firewalls. The Classic Firewall Design. The Contemporary Design. Router-Based Firewalls.


5. The Cisco Secure PIX Firewall.

Security Levels. The Adaptive Security Algorithm. Network Address Translation. PIX Firewall Features. Defense Against Network Attacks. Special Applications and Protocols. Controlling Traffic through the PIX Firewall. Controlling Inbound Traffic with Conduits. Cut-Through-Proxy. AAA Support via RADIUS and TACACS+.


6. Configuring the PIX Firewall.

Getting Started. Provision for Routing. Configuring the PIX Firewall. Identifying the Interfaces. Permitting Access from the Inside. Establish PIX Firewall Routes. Permitting Access from the Outside. Testing and Remote Administration. Controlling Outbound Access. Java Applet Filtering. Authentication and Authorization. Inbound Connections. Outbound Connections. Logging Events. Syslog. Standby PIX Firewalls with Failover.


7. Router-Based Firewalls.

Access Lists. Standard Access Lists. Extended Access Lists. Guidelines for Access Lists. Cisco Secure Integrated Software. Cisco Secure Integrated Software Architecture. CBAC and Stateful Packet Filtering. CBAC Supported Applications. Other Restrictions of CBAC. CSIS—Other Features. Configuring CBAC. Other Considerations.


8. Introduction to Encryption Techniques.

Symmetric Key Encryption. Data Encryption Standard. Advanced Encryption Standard and Others. Key Management. Asymmetric Key Encryption. How Public-Key Encryption Works. Comparing Symmetric versus Asymmetric Methods. The Diffie-Hellman Algorithm. Perfect Forward Secrecy. RSA Public-Key Encryption. Message Authentication Codes.


9. Introduction to IPSec.

Where to Apply Encryption. Data Link Layer. Network Layer. Transport Layer. Application Layer. Goals. Overview of IPSec. IPSec Details. AH—The Authentication Header. ESP—The Encapsulating Security Payload. Modes. SA, SPI, and SPD Defined. Key Management. Internet Key Exchange. IKE, ISAKMP, OAKLEY, and the DOI. Basic Key Exchange. IKE Phase 1. IKE Phase 2. IPSec Documentation.


10. Configuring IPSec.

Step 1—Planning for IPSec. Step 2—Configuring Internet Key Exchange (IKE). Configuring Manual Keys. Dynamic Key Management. PFS and SA Lifetimes. Other IKE Configuration Options. Command Syntax for IKE. Step 3—Defining Transform Sets. Configuring Transform Sets. Step 4—Create Crypto Access lists. Step 5—Creating Crypto Maps. Step 6—Applying Crypto Maps to an Interface. Step 7—Test and Verify. Sample Configurations. Sample Configuration #1—IPSec Manual Keys. Sample Configuration #2—IKE with PreShared Key.


11. Virtual Private Networks—VPNs.

Motivation for VPNs. Why VPNs. VPN Applications. VPN Technologies. PPTP. L2TP. IPSec. Authentication Limitations.


12. Cisco's Other Security Products.

Access Control. Vulnerability Assessment. Phase One—Network Mapping. Phase Two—Data Collection. Phase Three—Data Analysis. Phase Four—Vulnerability Confirmation. Phase Five—Data Presentation and Navigation. Phase Six—Reporting. Intrusion Detection. Reacting to Alerts.


Index.

商品描述(中文翻譯)

實用且權威的 Cisco 網路安全實作指南！

終於，有了一個單一來源，提供有關實作和配置 Cisco 網路安全最重要元素的實用、動手指導！

知名網路安全顧問 James Pike 提供逐步指導，幫助您實作和配置關鍵的 Cisco 安全產品，包括對 PIX 防火牆的深入指導。內容涵蓋：

- 基本的 Cisco 安全術語、技術和設計標準
- 從頭到尾的 IPSec 安全在 VPN 環境中的部署技術
- 容易理解的 Cisco Secure IDS/Net Ranger 入侵檢測、Cisco Secure Scanner/NetSonar 掃描和 Cisco Secure Access Control System 存取控制的介紹

沒有其他書籍能夠匯集這麼多的 Cisco 安全資訊：逐步教程、深入的參考資料、配置的關鍵數據，以及專家的決策指導。無論您在保護 Cisco 網路中扮演什麼角色，《Cisco 網路安全》將立即成為您的首要資源。

目錄

1. 理解安全風險和威脅。

技術弱點。協議。作業系統。網路設備。防火牆「漏洞」。配置弱點。政策弱點。安全威脅的來源。刺激尋求者和冒險者。競爭者。小偷。敵人或間諜。敵對員工。敵對前雇主。其他員工來源。對網路安全的威脅。電子竊聽。拒絕服務。未經授權的存取。會話重播。會話劫持。冒充。惡意破壞。否認。病毒、木馬和蠕蟲。重新路由。我們該怎麼做？需要保護什麼？風險的本質是什麼？需要什麼樣的保護？您能花多少錢？

2. 安全架構。

安全政策的目標。數據的機密性和隱私。數據的可用性。數據的完整性。身份驗證和授權。不可否認性。物理安全。布線。交換機。路由器。基本網路安全。密碼。網路安全解決方案。邊界路由器——第一道防線。防火牆——邊界加固。虛擬私人網路。數據隱私和完整性。脆弱性評估。入侵檢測。存取控制和身份。安全政策管理和執行。

3. 第一防線——邊界路由器。

密碼。特權用戶。基本用戶。禁用 EXEC 模式。建立特定於行的密碼。建立特定於用戶的密碼。使用存取列表作為過濾器限制存取。其他問題。路由器服務和協議。簡單網路管理協議。HTTP。TCP/IP 服務。禁用 IP 源路由。禁用非必要的 TCP 和 UDP 服務。禁用指紋服務。禁用代理 ARP。禁用定向廣播。禁用 Cisco 發現協議。禁用 ICMP 重定向。禁用網路時間協議。禁用 ICMP 無法到達消息。流量管理。存取控制列表 (ACL)。基於路由器的攻擊保護。路由協議。審計跟蹤和日誌記錄。

4. 防火牆。

互聯網的協議。IP——互聯網協議。TCP——傳輸控制協議。UDP——用戶數據報協議。TCP 和 UDP 端口。什麼是網路防火牆？防火牆提供什麼樣的保護？防火牆可以提供的保護和功能。防火牆不保護的內容。防火牆設計方法。網路層防火牆。應用層防火牆。帶有防火牆的網路設計。經典防火牆設計。當代設計。基於路由器的防火牆。

5. Cisco Secure PIX 防火牆。

安全級別。自適應安全算法。網路地址轉換。PIX 防火牆功能。防範網路攻擊。特殊應用和協議。通過 PIX 防火牆控制流量。通過管道控制入站流量。切穿代理。通過 RADIUS 和 TACACS+ 的 AAA 支持。

6. 配置 PIX 防火牆。

開始使用。路由配置。配置 PIX 防火牆。識別介面。允許內部存取。建立 PIX 防火牆路由。允許外部存取。測試和遠端管理。控制外發存取。Java Applet 過濾。身份驗證和授權。入站連接。出站連接。日誌事件。Syslog。具備故障轉移的備用 PIX 防火牆。

7. 基於路由器的防火牆。

存取列表。標準存取列表。擴展存取列表。存取列表的指導方針。Cisco Secure Integrated Software。Cisco Secure Integrated Software 架構。CBAC 和狀態包過濾。CBAC 支持的應用。CBAC 的其他限制。CSIS——其他功能。配置 CBAC。其他考量。

8. 加密技術介紹。

對稱密鑰加密。數據加密標準。先進加密標準及其他。密鑰管理。非對稱密鑰加密。公鑰加密的工作原理。對稱與非對稱方法的比較。Diffie-Hellman 算法。完美前向保密。RSA 公鑰加密。消息認證碼。

9. IPSec 介紹。

加密的應用場景。數據鏈路層。網路層。傳輸層。應用層。目標。IPSec 概述。IPSec 詳情。AH——身份驗證標頭。ESP——封裝安全有效載荷。模式。SA、SPI 和 SPD 的定義。密鑰管理。互聯網密鑰交換。IKE、ISAKMP、OAKLEY 和 DOI。基本密鑰交換。IKE 第一階段。IKE 第二階段。IPSec 文檔。

10. 配置 IPSec。

步驟 1——規劃 IPSec。步驟 2——配置互聯網密鑰交換 (IKE)。配置手動密鑰。動態密鑰管理。PFS 和 SA 生命週期。其他 IKE 配置選項。IKE 的命令語法。步驟 3——定義轉換集。配置轉換集。步驟 4——創建加密存取列表。步驟 5——創建加密映射。步驟 6——將加密映射應用於介面。步驟 7——測試和驗證。範例配置。範例配置 #1——IPSec 手動密鑰。範例配置 #2——使用預共享密鑰的 IKE。

11. 虛擬私人網路——VPN。

VPN 的動機。為什麼選擇 VPN。VPN 應用。VPN 技術。PPTP。L2TP。IPSec。身份驗證限制。

12. Cisco 的其他安全產品。

存取控制。脆弱性評估。第一階段——網路映射。第二階段——數據收集。第三階段——數據分析。第四階段——脆弱性確認。第五階段——數據呈現和導航。第六階段——報告。

索引。

類似商品

最後瀏覽商品 (17)