Securing Resources and Services

Securing each resource and service is key to implementing an effective security system. This step involves some or all of the following actions:

1. Changing server and system defaults
2. Removing extraneous services
3. Constantly monitoring public connections (VPNs, modem banks, and Web and FTP servers)
4. Ensuring physical security
5. Locking down registry keys and password file

One of the more important concepts in securing resources is the ability to coordinate methods and techniques so that if a hacker defeats one method, your system can counter with another. As you coordinate services, address each one separately and change the default settings. Network security systems should not depend upon only one type of security such as authentication, encryption, or auditing.

• Hard disk configuration: Configure your hard disk for optimum security. Typically, a hard disk is configured so that
  1. One partition can be used for the operating system only
  2. Another hard disk can be used for the services or daemons running on the server
  3. A third partition or disk can be used only for data storage

The following section discusses combining security techniques.

A successful security system is a matrix, or a combination of individual methods, techniques, and subsystems. Whenever possible, you want to use as many security principles and techniques as possible to protect each resource. For instance, a network that relies solely upon authentication is not nearly as secure as one that combines authentication, access control, and encryption. Similarly, your site is better protected by packet filtering at the router combined with a firewall backed up by user authentication and intrusion detection.

• Intrusion Detection: Intrusion Detection (IDS) comprises several key elements that work together to identify and alert on potential security threats. The main components of an IDS include:
  1. Sensors: Collect network traffic or log data from various sources, such as network devices, servers, or endpoints.
  2. Analysis Engine: Examines the collected data using rules, signatures, and anomaly detection techniques to identify potential threats.
  3. Signature Database: Contains known attack patterns and signatures, which are used to match against collected data.
  4. Anomaly Detection: Uses machine learning or statistical methods to identify unusual behavior that may indicate a threat.
  5. Event Management: Handles and processes alerts, including filtering, prioritization, and notification.
  6. Reporting and Visualization: Provides graphical interfaces and reports to help analysts understand and respond to detected threats.
  7. Response Mechanisms: Triggers actions, such as blocking traffic or alerting security teams, in response to detected threats.
  8. Integration: Combines with other security tools, like firewalls and security information and event management (SIEM) systems, to enhance overall security posture.
  
  These elements work together to detect and alert on potential security threats, enabling organizations to respond quickly and effectively to potential intrusions. Detecting and responding to network attacks and malicious code is one of the principal responsibilities of information security professionals. Formal techniques and procedures have been developed by expert practitioners in the field to provide a structured approach to this difficult problem.

Malicious code is intended to harm, disrupt, or circumvent computer and network functions. This code can be mobile, such as Java applets or code in the Active X environment. It can also attach itself to legitimate code and propagate. In addition, it can lurk in useful applications or replicate itself across the Internet. The following sections describe these different types of malware.

• Viruses: A virus is code that attaches to a host program and propagates when the infected program is executed. Thus, a virus is self-replicating and self-executing. Viruses are transmitted in a variety of ways, including as part of files downloaded from the Internet or as e-mail attachments.

Increase Security