Network Security Architectures (Hardcover)
暫譯: 網路安全架構 (精裝版)

Sean Convery

  • 出版商: Cisco Press
  • 出版日期: 2004-04-29
  • 售價: $2,560
  • 貴賓價: 9.5$2,432
  • 語言: 英文
  • 頁數: 792
  • 裝訂: Hardcover
  • ISBN: 158705115X
  • ISBN-13: 9781587051159
  • 相關分類: 資訊安全
  • 已絕版

買這商品的人也買了...

商品描述

Expert guidance on designing secure networks

  • Understand security best practices and how to take advantage of the networking gear you already have
  • Review designs for campus, edge, and teleworker networks of varying sizes
  • Learn design considerations for device hardening, Layer 2 and Layer 3 security issues, denial of service, IPsec VPNs, and network identity
  • Understand security design considerations for common applications such as DNS, mail, and web
  • Identify the key security roles and placement issues for network security elements such as firewalls, intrusion detection systems, VPN gateways, content filtering, as well as for traditional network infrastructure devices such as routers and switches
  • Learn 10 critical steps to designing a security system for your network
  • Examine secure network management designs that allow your management communications to be secure while still maintaining maximum utility
  • Try your hand at security design with three included case studies
  • Benefit from the experience of the principle architect of the original Cisco Systems SAFE Security Blueprint

Written by the principle architect of the original Cisco Systems SAFE Security Blueprint, Network Security Architectures is your comprehensive how-to guide to designing and implementing a secure network. Whether your background is security or networking, you can use this book to learn how to bridge the gap between a highly available, efficient network and one that strives to maximize security. The included secure network design techniques focus on making network and security technologies work together as a unified system rather than as isolated systems deployed in an ad-hoc way.

Beginning where other security books leave off, Network Security Architectures shows you how the various technologies that make up a security system can be used together to improve your network's security. The technologies and best practices you'll find within are not restricted to a single vendor but broadly apply to virtually any network system. This book discusses the whys and hows of security, from threats and counter measures to how to set up your security policy to mesh with your network architecture. After learning detailed security best practices covering everything from Layer 2 security to e-commerce design, you'll see how to apply the best practices to your network and learn to design your own security system to incorporate the requirements of your security policy. You'll review detailed designs that deal with today's threats through applying defense-in-depth techniques and work through case studies to find out how to modify the designs to address the unique considerations found in your network.

Whether you are a network or security engineer, Network Security Architectures will become your primary reference for designing and building a secure network.

This book is part of the Networking Technology Series from Cisco Press, which offers networking professionals valuable information for constructing efficient networks, understanding new technologies, and building successful careers.

Table of Contents

Foreword.
Preface.

I. NETWORK SECURITY FOUNDATIONS.

1. Network Security Axioms.

Network Security Is a System. Business Priorities Must Come First. Network Security Promotes Good Network Design. Everything Is a Target. Everything Is a Weapon. Strive for Operational Simplicity. Good Network Security Is Predictable. Avoid Security Through Obscurity. Confidentiality and Security Are Not the Same. Summary. Reference. Applied Knowledge Questions.

2. Security Policy and Operations Life Cycle.

You Can't Buy Network Security. What Is a Security Policy? Security System Development and Operations Overview. Summary. References. Applied Knowledge Questions.

3. Secure Networking Threats.

The Attack Process. Attacker Types. Vulnerability Types. Attack Results. Attack Taxonomy. Summary. References. Applied Knowledge Questions.

4. Network Security Technologies.

The Difficulties of Secure Networking. Security Technologies. Emerging Security Technologies. Summary. References. Applied Knowledge Questions.

II. DESIGNING SECURE NETWORKS.

5. Device Hardening.

Components of a Hardening Strategy. Network Devices. Host Operating Systems. Applications. Appliance-Based Network Services. Rogue Device Detection. Summary. References. Applied Knowledge Questions.

6. General Design Considerations.

Physical Security Issues. Layer 2 Security Considerations. IP Addressing Design Considerations. ICMP Design Considerations. Routing Considerations. Transport Protocol Design Considerations. DoS Design Considerations. Summary. References. Applied Knowledge Questions.

7. Network Security Platform Options and Best Deployment Practices.

Network Security Platform Options. Network Security Device Best Practices. Summary. Reference. Applied Knowledge Questions.

8. Common Application Design Considerations.

E-Mail. DNS. HTTP/HTTPS. FTP. Instant Messaging. Application Evaluation. Summary. References. Applied Knowledge Questions.

9. Identity Design Considerations.

Basic Foundation Identity Concepts. Types of Identity. Factors in Identity. Role of Identity in Secure Networking. Identity Technology Guidelines. Identity Deployment Recommendations. Summary. References. Applied Knowledge Questions.

10. IPsec VPN Design Considerations.

VPN Basics. Types of IPsec VPNs. IPsec Modes of Operation and Security Options. Topology Considerations. Design Considerations. Site-to-Site Deployment Examples. IPsec Outsourcing. Summary. References. Applied Knowledge Questions.

11. Supporting-Technology Design Considerations.

Content. Load Balancing. Wireless LANs. IP Telephony. Summary. References. Applied Knowledge Questions.

12. Designing Your Security System.

Network Design Refresher. Security System Concepts. Impact of Network Security on the Entire Design. Ten Steps to Designing Your Security System. Summary. Applied Knowledge Questions.

III. SECURE NETWORK DESIGNS.

13. Edge Security Design.

What Is the Edge? Expected Threats. Threat Mitigation. Identity Considerations. Network Design Considerations. Small Network Edge Security Design. Medium Network Edge Security Design. High-End Resilient Edge Security Design. Provisions for E-Commerce and Extranet Design. Summary. References. Applied Knowledge Questions.

14. Campus Security Design.

What Is the Campus? Campus Trust Model. Expected Threats. Threat Mitigation. Identity Considerations. Network Design Considerations. Small Network Campus Security Design. Medium Network Campus Security Design. High-End Resilient Campus Security Design. Summary. References. Applied Knowledge Questions.

15. Teleworker Security Design.

Defining the Teleworker Environment. Expected Threats. Threat Mitigation. Identity Considerations. Network Design Considerations. Software-Based Teleworker Design. Hardware-Based Teleworker Design. Design Evaluations. Summary. Reference. Applied Knowledge Questions.

IV. NETWORK MANAGEMENT, CASE STUDIES, AND CONCLUSIONS.

16. Secure Network Management and Network Security Management.

Utopian Management Goals. Organizational Realities. Protocol Capabilities. Tool Capabilities. Secure Management Design Options. Network Security Management Best Practices. Summary. References. Applied Knowledge Questions.

17. Case Studies.

Introduction. Real-World Applicability. Organization. NetGamesRUs.com. University of Insecurity. Black Helicopter Research Limited. Summary. Reference. Applied Knowledge Questions.

18. Conclusions.

Introduction. Management Problems Will Continue. Security Will Become Computationally Less Expensive. Homogeneous and Heterogeneous Networks. Legislation Should Garner Serious Consideration. IP Version 6 Changes Things. Network Security Is a System. Summary. References.

Appendix A: Glossary of Terms.
Appendix B: Answers to Applied Knowledge Questions.

Chapters 1-16.

Appendix C: Sample Security Policies.
Index.

商品描述(中文翻譯)

專家指導設計安全網路

- 了解安全最佳實踐以及如何利用您現有的網路設備
- 審查不同規模的校園、邊緣和遠端工作者網路設計
- 學習設備加固、第二層和第三層安全問題、拒絕服務、IPsec VPN 和網路身份的設計考量
- 了解常見應用程式(如 DNS、郵件和網頁)的安全設計考量
- 確認網路安全元素(如防火牆、入侵偵測系統、VPN 閘道、內容過濾)以及傳統網路基礎設施設備(如路由器和交換機)的關鍵安全角色和配置問題
- 學習設計網路安全系統的 10 個關鍵步驟
- 檢視安全網路管理設計,確保您的管理通訊安全,同時保持最大效用
- 嘗試三個包含的案例研究進行安全設計
- 受益於原 Cisco Systems SAFE Security Blueprint 的首席架構師的經驗

由原 Cisco Systems SAFE Security Blueprint 的首席架構師撰寫的《網路安全架構》是您設計和實施安全網路的全面指南。無論您的背景是安全還是網路,您都可以使用本書學習如何彌合高可用性、高效能網路與努力最大化安全之間的差距。所包含的安全網路設計技術專注於使網路和安全技術作為統一系統協同工作,而不是以臨時方式部署的孤立系統。

《網路安全架構》從其他安全書籍未能涵蓋的地方開始,向您展示構成安全系統的各種技術如何協同使用以改善您的網路安全。您在書中找到的技術和最佳實踐並不局限於單一供應商,而是廣泛適用於幾乎任何網路系統。本書討論安全的原因和方法,從威脅和對策到如何設置您的安全政策以與您的網路架構相匹配。在學習涵蓋從第二層安全到電子商務設計的詳細安全最佳實踐後,您將看到如何將最佳實踐應用於您的網路,並學會設計自己的安全系統以納入您的安全政策要求。您將審查詳細設計,通過應用深度防禦技術來應對當前的威脅,並通過案例研究了解如何修改設計以解決您網路中的獨特考量。

無論您是網路工程師還是安全工程師,《網路安全架構》都將成為您設計和建立安全網路的主要參考資料。

本書是 Cisco Press 的網路技術系列的一部分,為網路專業人士提供有價值的信息,以構建高效的網路、理解新技術並建立成功的職業生涯。

目錄

前言
序言

I. 網路安全基礎
1. 網路安全公理
網路安全是一個系統。商業優先事項必須放在首位。網路安全促進良好的網路設計。一切都是目標。一切都是武器。追求操作簡單性。良好的網路安全是可預測的。避免通過模糊性來實現安全。保密性和安全性並不相同。摘要。參考文獻。應用知識問題。

2. 安全政策和運營生命週期
您無法購買網路安全。什麼是安全政策?安全系統開發和運營概述。摘要。參考文獻。應用知識問題。

3. 安全網路威脅
攻擊過程。攻擊者類型。漏洞類型。攻擊結果。攻擊分類。摘要。參考文獻。應用知識問題。

4. 網路安全技術
安全網路的困難。安全技術。新興安全技術。摘要。參考文獻。應用知識問題。

II. 設計安全網路
5. 設備加固
加固策略的組成部分。網路設備。主機作業系統。應用程式。基於設備的網路服務。惡意設備檢測。摘要。參考文獻。應用知識問題。

6. 一般設計考量
物理安全問題。第二層安全考量。IP 位址設計考量。ICMP 設計考量。路由考量。傳輸協議設計考量。拒絕服務設計考量。摘要。參考文獻。應用知識問題。

7. 網路安全平台選項和最佳部署實踐
網路安全平台選項。網路安全設備最佳實踐。摘要。參考文獻。應用知識問題。

8. 常見應用設計考量
電子郵件。DNS。HTTP/HTTPS。FTP。即時消息。應用評估。摘要。參考文獻。應用知識問題。

9. 身份設計考量
基本身份概念。身份類型。身份因素。身份在安全網路中的角色。身份技術指導方針。身份部署建議。摘要。參考文獻。應用知識問題。

10. IPsec VPN 設計考量
VPN 基礎。IPsec VPN 類型。IPsec 操作模式和安全選項。拓撲考量。設計考量。站對站部署範例。IPsec 外包。摘要。參考文獻。應用知識問題。

11. 支持技術設計考量
內容。負載平衡。無線區域網。IP 語音。摘要。參考文獻。應用知識問題。

12. 設計您的安全系統
網路設計回顧。安全系統概念。網路安全對整體設計的影響。設計安全系統的十個步驟。摘要。應用知識問題。

III. 安全網路設計
13. 邊緣安全設計
邊緣是什麼?預期威脅。威脅緩解。身份考量。網路設計考量。小型網路邊緣安全設計。中型網路邊緣安全設計。高端彈性邊緣安全設計。電子商務和外部網設計的條款。摘要。參考文獻。應用知識問題。

14. 校園安全設計
校園是什麼?校園信任模型。預期威脅。威脅緩解。身份考量。網路設計考量。小型網路校園安全設計。中型網路校園安全設計。高端彈性校園安全設計。摘要。參考文獻。應用知識問題。

15. 遠端工作者安全設計
定義遠端工作者環境。預期威脅。威脅緩解。身份考量。網路設計考量。基於軟體的遠端工作者設計。基於硬體的遠端工作者設計。設計評估。摘要。參考文獻。應用知識問題。

IV. 網路管理、案例研究和結論
16. 安全網路管理和網路安全管理
烏托邦管理目標。組織現實。協議能力。工具能力。安全管理設計選項。網路安全管理最佳實踐。摘要。參考文獻。應用知識問題。

17. 案例研究
介紹。實際應用。組織。NetGamesRUs.com。不安全大學。黑色直升機研究有限公司。摘要。參考文獻。應用知識問題。

18. 結論
介紹。管理問題將持續存在。安全將變得計算上更便宜。同質和異質網路。立法應該受到認真考慮。IP 第六版改變了一切。網路安全是一個系統。摘要。參考文獻。

附錄 A:術語表
附錄 B:應用知識問題的答案
附錄 C:範例安全政策
索引