4. Security is a Complete System, not a product Requires objectives and clear focus
5. Firewall
Control inbound and outbound access
Log traffic
Deter and block attacks
Generate alarms
6. Intrusion Detection
Hackers
Crackers
Denial of Service, DDOS attacks
Protection versus Internal & External Attacks and Threats
7. VPN
Authentication
Encryption
Client to Site
Site to Site
Extranet
8. Authentication & Identity
Passwords
Tokens
Biometrics & Multifactor Authentication
Digital Certificates
SSL
Directories & LDAP
Single Sign-On
9. Bandwidth Management
Control prioritization of data through the pipe
Assess needs for additional bandwidth
Track and Enforce SLAs
10. Content Management
Viruses
Vandals (Java, ActiveX)
Worms
Trojan Horses
Scripts
11. VPN & Authentication Best Practices
12. Define Business Objectives
Define Remote Access Needs specifically
Define key applications and data access
Define Goals cost reduction? user empowerment?
13. Management
Get buy-in on objectives
Get input on security versus access trade-off, in advance on a scale of 1-10, with 1 being most access, least secure, and 10 being minimal access, most secure, where should we be?
Develop & get sign-off on security policy
14. Keep It Simple
Centralize Management
Integrate Directories & Authentication Leverage Your Directory!
Seamless User Experience
Minimize client side deployment of software (intrusiveness, licensing fees)
15. Leverage the Directory!
LDAP
RADIUS
Manage one set of passwords please!
16. Client Side Setup
Use Personal Firewall to defend at all vulnerability points, and lock down if not
Standardize client install process (cookbook) and deploy with CD/diskettes with all required files (or from web server)
Schedule Installation Appointments to proactively manage client PC setup issues
17. General Issues
Ensure private addresses are non-conflicting
Control synchronization (Domain, etc.) and similar traffic over low bandwidth lines
Implement bandwidth management
Dont span the WAN design similarly
Centralize Management of VPN, remote resources
Use NFuse and RSA ACE Server for browser based authentication & access from non-VPN (Internet terminals)
18. Authentication
Define and enforce password rules and changes
Implement single sign-on solution to minimize passwords users need to track each one is a vulnerability
