Network Security Intruders

Intruders’ Technical Knowledge
Intruders are demonstrating increased understanding of network topology, operations, and protocols, resulting in the infrastructure attacks described in the previous section on Internet infrastructure attacks.
Instead of simply exploiting well-known vulnerabilities, intruders examine source code to discover weaknesses in certain programs, such as those used for electronic mail. Much source code is easy to obtain from programmers who make their work freely available on the Internet. Programs written for research purposes (with little thought for security) or written by naive programmers become widely used, with source code available to all. Moreover, the targets of many computer intrusions are organizations that maintain copies of proprietary source code (often the source code to computer operating systems or key software utilities). Once intruders gain access, they can examine this code to discover weaknesses.
Intruders keep up with new technology. For example, intruders now exploit vulnerabilities associated with the World Wide Web to gain unauthorized access to systems.
Other aspects of the new sophistication of intruders include the targeting of the network infrastructure (such as network routers and firewalls) and the ability to cloak their behavior. Intruders use Trojan horses to hide their activity from network administrators; for example, intruders alter authentication and logging programs so that they can log in without the activity showing up in the system logs. Intruders also encrypt output from their activity, such as the information captured by packet sniffers. Even if the victim finds the sniffer logs, it is difficult or impossible to determine what information was compromised.
Techniques to Exploit Vulnerabilities
As intruders become more sophisticated, they identify new and increasingly complex methods of attack. For example, intruders are developing sophisticated techniques to monitor the Internet for new connections. Newly connected systems are often not fully configured from a security perspective and are, therefore, vulnerable to attacks.
The most widely publicized of the newer types of intrusion is the use of the packet sniffers described in the section above on packet sniffers. Other tools are used to construct packets with forged addresses; one use of these tools is to mount a denial-of-service attack in a way that obscures the source of the attack. Intruders also “spoof” computer addresses, masking their real identity and successfully making connections that would not otherwise be permitted. In this way, they exploit trust relationships between computers.
With their sophisticated technical knowledge and understanding of the network, intruders are increasingly exploiting network interconnections. They move through the Internet infrastructure, attacking areas on which many people and systems depend. Infrastructure attacks are even more threatening because legitimate network managers and administrators typically think about protecting systems and parts of the infrastructure rather than the infrastructure as a whole.
In the first quarter of 1996, 7.5% of 346 incidents handled by the CERT Coordination Center involved these new and sophisticated methods, including packet sniffers, spoofing, and infrastructure attacks. A full 20% involved the total compromise of systems, in which intruders gain system-level, or root, privileges. This represents a significant increase in such attacks over previous years’ attacks, and the numbers are still rising. Of 341 incidents in the third quarter of 1996, nearly 9% involved sophisticated attacks, and root compromises accounted for 33%.
Intruders’ Use of Software Tools
The tools available to launch an attack have become more effective, easier to use, and more accessible to people without an in-depth knowledge of computer systems. Often a sophisticated intruder embeds an attack procedure in a program and widely distributes it to the intruder community. Thus, people who have the desire but not the technical skill are able to break into systems. Indeed, there have been instances of intruders breaking into a UNIX system using a relatively sophisticated attack and then attempting to run DOS commands (commands that apply to an entirely different operating system).
Tools are available to examine programs for vulnerabilities even in the absence of source code. Though these tools can help system administrators identify problems, they also help intruders find new ways to break into systems.
As in many areas of computing, the tools used by intruders have become more automated, allowing intruders to gather information about thousands of Internet hosts quickly and with minimum effort. These tools can scan entire networks from a remote location and identify individual hosts with specific weaknesses. Intruders may catalog the information for later exploitation, share or trade with other intruders, or attack immediately. The increased availability and usability of scanning tools means that even technically naive, would-be intruders can find new sites and particular vulnerabilities.
Some tools automate multiphase attacks in which several small components are combined to achieve a particular end. For example, intruders can use a tool to mount a denial-of-service attack on a machine and spoof that machine’s address to subvert the intended victim’s machine. A second example is using a packet sniffer to get router or firewall passwords, logging in to the firewall to disable filters, then using a network file service to read data on an otherwise secure server.
The trend toward automation can be seen in the distribution of software packages containing a variety of tools to exploit vulnerabilities. These packages are often maintained by competent programmers and are distributed complete with version numbers and documentation.
A typical tool package might include the following:
network scanner
password cracking tool and large dictionaries
packet sniffer
variety of Trojan horse programs and libraries
tools for selectively modifying system log files
tools to conceal current activity
tools for automatically modifying system configuration files
tools for reporting bogus checksums

Top 10 Network Security Mistakes

Businesses use networking to connect their employees to one another and create a productive shared work environment. However, in their haste to get the network up and running, some businesses do not take the time to make sure all security measures are in place.

Here are a few common network security mistakes:

1. Improper password use. Passwords are the simplest form of security. By leaving passwords blank or simple (i.e., password or admin), unauthorized users are practically invited to view sensitive data. Passwords are more secure when they contain both letters and numbers in a combination of upper-case and lower-case characters, and they should be changed periodically.
2. Lack of education. Educate users in the use of their software, especially with regard to e-mail, attachments, and downloads. They need to know exactly what kinds of threats are out there. Uneducated computer users are often those who fall victim to viruses, spyware, and phishing attacks, all of which are designed to corrupt systems or leak personal information to a third party without the user’s consent.
3. No backups. Laziness is one of the biggest security threats. It’s considerably more difficult to completely re-create a crippled system than it is to take the time to create proper backups. Create backups often, and do not immediately overwrite them with the next set of backups. In addition, make copies and keep them off-site in case of emergency.
4. Plug and surf. Unfortunately, computers are not designed to be connected to the Internet straight out of the box. Before a phone line, Ethernet cable, or wireless card is anywhere near a new computer, install a line of defensive software. Ideally, this should include virus protection, multiple spyware scanners, and a program that runs in the background to prevent malicious software from ever being installed.
5. Not updating. What good are all those virus and spyware scanners if they’re not updated? It’s crucial to update what are called the “virus/spyware definitions” every week. This keeps the scanners up-to-date to detect the latest malicious software.
6. Ignoring security patches. Security holes may exist in your operating system. No software is perfect. Once an imperfection or hole is found, it’s usually exploited within a very short period of time. Therefore, it is imperative to install security patches as soon as possible.
7. Trust. Ads on the Internet have become devious and deceptive. They now appear as “urgent system messages” and warnings designed to scare users into clicking. As a rule of thumb, if a popup window contains an ad claiming to end popups, chances are it’s a scam of some sort.
8. Not using encryption. Encryption is especially important when dealing with banking and credit cards. Storing and transferring unencrypted data is the equivalent of posting that data for everyone to see. If you’re not comfortable implementing encryption technology, have an IT specialist assist you.
9. Trying to do it all yourself. Setting up a network, applying proper security measures, and downloading and installing software can be tricky. Large companies have IT departments. Small business owners should also ask for advice or even hire help. It’s worth the extra cost.
10. Proper instruction. Security measures are most effective if everyone is aware of how the system operates. Give employees a brief overview of the security measures they’re expected to follow.

How a UTM Appliance Can Help Increase Your Network’s Security and Decrease Vulnerability

 If there is one thing that companies these days rely on, it is the information that they have on their databases and the information stored in the individual computers on the network that help their businesses run smoothly. If there is any attempt to access the data that is found on these computers and the breach of the security of the network, you may find yourself with a very big problem that can cost the company a huge amount of money and a host of other problems. This is where a UTM appliance is needed and will be very handy. The use of a UTM appliance to increase application security is a measure that companies these days often look into when they need their databases and their information protected.

What exactly is a UTM appliance and what can it do for your system and network? A UTM appliance is a combination of hardware and software that are made for the security of your network and your system and is installed to help keep your network of computers, the data in them, and the data in your server protected from outside forces that wish to get information from you that they can use to further their means or to simply bring you and your company down. A UTM is essentially a Unified Threat Management system that allows you to protect everything on the network from viruses, spyware, malware, and hackers that may want to get into your system. A UTM is also easily called application security since it protects the applications your computers use from prying eyes outside of your office.

When you use a UTM appliance and increase application security on your network, you will not only be able to protect your computers and your database from outside forces that are out to get information from you in order for them that they can use to make money from it or to inject malicious programs that will drive your system and your network haywire. You can also get the opportunity to control the content and the websites that your employees can access. This means that you can easily increase the security of your network and your system tenfold since you will be able to avoid websites and other web sources like emails and such that may bring malware, viruses, and spyware that can cause you and your business problems.

Not only does a UTM appliance and an increase in application security benefit you, it also benefits your employees since the restriction of the opening of certain sites on the computers connected to your network helps them focus on what needs to be done and not get distracted by other things on the web. This does not mean however that they cannot access certain safe sites and cannot connect with anyone outside of the network via email. They still can but with certain safeguards in place to help protect their computers and the network from problems that can come from the outside.

Linux Server and Network Security

The most dangerous threat to internal networks are Internet gateways. Gateways are systems (or other hardware devices) with a minimum of two network interfaces where one interface is connected to the Internet (via an ISP connection) and at least one interface is connected to an internal LAN segment. Just as a gateway allows traffic to go out from your LAN onto the Internet, it also allows traffic from the Internet onto your LAN. The trick is to only let the traffic you want onto your LAN, and it’s no easy feat.

You could be legally liable if someone hacks their way into your LAN and steals confidential data (social security numbers, credit card numbers, etc) that you maintain on your clients or customers. Worms or trojans could be planted that send passwords or other sensitive information out onto the Internet to a waiting sniffer. The risks are many and the consequences could threaten the very existance of your company. It’s not uncommon for large institutions like banks and insurance firms to decline pressing charges against a hacker simply because they don’t want the negative press and loss of confidence they would suffer as the result of a public prosecution by a district attorney.

“Multi-homed” (multi-connection) systems such as gateways are not the only security risk. A server that is only connected to the Internet, such as a Web server, is also at risk of being hacked. You may not care if some hacker cracks his way in and defaces your Web pages. You just reload the pages. But there are other, more hideous, attacks that are not uncommon:

• Your server can be used as a base from which attacks on other systems can be launched.
• Your e-mail server could be used as a relay for spammers.
• Your system can be surreptitiously used as an IRC (chat) server or for some other band-width intensive application that steals performance from both your server and your Internet connection.
• Your could be the target of DoS (Denial of Service) attacks which renders your servers (e-mail or Web), and your Internet connection, useless.
• Internet servers that use SSL to collect sensitive information such as credit card numbers or account numbers and passwords can be targets of hackers in order to try and gain access to the devices where this data is stored. (SSL only protects in-transit HTTP traffic. It does nothing for operating system or server security.)

Addressing security issues is one of those cases where “an ounce of prevention is worth a pound of cure”. A hacker could do untold damage if they get into your system or network. And because hackers learn their trade in underground electronic communities, if one finds a way into your system you can bet that they’ll let everyone else know about it.

If your company has public address space with an available IP you may want to try a little test just for grins. Do a full-boat install of Debian (including all Internet-related apps you can think of) and put the system on the Internet. It doesn’t need a domain name with a DNS record, just a static public IP address. Set it up with the Apache, Sendmail, wu_ftpd, telnet, and any other services running and just leave it sit there. Check the /var/log/messages file every week or so and see how long it takes for the hackers to find it and start playing around with it. When I tried this they took all of two weeks. Since there’s no way of telling what they did during their visits, you’d be wise to totally wack the partitions on the hard-drive and do an install from scratch when you do want to re-use the system as a production server.

Setting up a system like this is actually a new security tool that’s emerging. It’s called setting up a “honey-pot”. The hackers are drawn to the the honey-pot because it’s the most responsive, and are drawn away from your production servers. Before you deploy your honey-pot you may want to hang a tape drive on the system and do a full backup so you can go back to square one once it gets compromised. Again, thre’s no way to really know everything that a hacker may have done to your system once they get in so the only safe thing to do is start over. Monitoring your honey-pot on a regular basis will let you know when things are happening so you can keep an even closer eye on your production servers.

Don’t always assume that the “untrusted” network you’re trying to protect yourself from is the Internet. If you have VPNs or other types of network connectivity established with business partners or even other divisions within the same company, you must be watchful for unauthorized access attempts from these networks as well. “Trust no one” is a good rule to follow when it comes to system and network security.

Along with the benefits of having your own Internet servers comes the responsibility of being knowledgable on how to secure those servers. Covering this subject beyond anything other than a superficial manner is beyond the scope of any single Web page. Here we only present an overview of some of the common tools used to help secure an Internet-connected server. It is by no means comprehensive and should only serve as an introduction to the topic.

Security measures can be categorized into the following four broad classifications:

• OS configuration – “hardening” the operating system
• Application configuration – making sure the server applications you do make available do only what they’re supposed to do
• Perimeter security – configuring your network infrastructure with firewalls and DMZs
• Physical security – only authorized users and systems should have access to the network infrastructure

Different publications may categorize things differently but that’s of little consequence. The important thing is that doing so allows you to take a “divide and conquer” approach to addressing all of the various aspects involved in securing a network, its servers, and the information contained on them.

Network Security

In the field of networking, the specialist area of network security consists of the provisions made in an underlying computer network infrastructure, policies adopted by the network administrator to protect the network and the network-accessible resources from unauthorized access, and consistent and continuous monitoring and measurement of its effectiveness (or lack) combined together.

The First Step to Information Security

The terms Network Security and Information Security are often used interchangeably. Network Security is generally taken as providing protection at the boundaries of an organization by keeping out intruders (hackers). Information Security, however, explicitly focuses on protecting data resources from malware attack or simple mistakes by people within an organization by use of Data Loss Prevention (DLP) techniques. One of these techniques is to compartmentalize large networks with internal boundaries. Employees have to cross these boundaries and be authenticated when attempting to access protected information.

Network security concepts

Network security starts from authenticating the user, commonly with a username and a password. Since this requires just one thing besides the user name, i.e. the password which is something you ‘know’, this is sometimes termed one factor authentication. With two factor authentication something you ‘have’ is also used (e.g. a security token or ‘dongle’, an ATM card, or your mobile phone), or with three factor authentication something you ‘are’ is also
used (e.g. a fingerprint or retinal scan).

Once authenticated, a firewall enforces access policies such as what services are allowed to be accessed by the network users. Though effective to prevent unauthorized access, this component may fail to check potentially harmful content such as computer worms or Trojans being transmitted over the network. Anti-virus software or an intrusion prevention system (IPS) help detect and inhibit the action of such malware. An anomaly-based intrusion detection system may also monitor the network and traffic for unexpected (i.e. suspicious) content or behaviour and other anomalies to protect resources, e.g. from denial of service attacks or an employee accessing files at strange times. Individual events occurring on the network may be logged for audit purposes and for later high level analysis.

Communication between two hosts using the network could be encrypted to maintain privacy. Honeypots, essentially decoy network-accessible resources, could be deployed in a network as surveillance and early-warning tools. Techniques used by the attackers that attempt to compromise these decoy resources are studied during and after an attack to keep an eye on new exploitation techniques. Such analysis could be used to further tighten security of the actual network being protected by the honeypot.

A useful summary of standard concepts and methods in network security is given by in the form of an extensible ontology of network security attacks.

Security management

Security Management for networks is different for all kinds of situations. A small home or an office would only require basic security while large businesses will require high maintenance and advanced software and hardware to prevent malicious attacks from hacking and spamming.

Small homes

• A basic firewall like COMODO Internet Security or a unified threat management system.
• For Windows users, basic Antivirus software like AVG Antivirus, ESET NOD32 Antivirus,Kaspersky, McAfee, or Norton AntiVirus.
• An anti-spyware program such as Windows Defender or Spybot would also be a good idea. There are many other types of antivirus or anti-spyware programs out there to be considered.
• When using a wireless connection, use a robust password. Also try to use the strongest security supported by your wireless devices, such as WPA or WPA2 with AES encryption.
• If using Wireless: Change the default SSID network name, also disable SSID Broadcast; as this function is unnecessary for home use. (However, many security experts consider this to be relatively useless. http://blogs.zdnet.com/Ou/index.php?p=43 )
• Enable MAC Address filtering to keep track of all home network MAC devices connecting to your router.
• Assign STATIC IP addresses to network devices.
• Disable ICMP ping on router.
• Review router or firewall logs to help identify abnormal network connections or traffic to the Internet.
• Use passwords for all accounts.
• Have multiple accounts per family member, using non-administrative accounts for day-to-day activities. Disable the guest account (Control Panel> Administrative Tools> Computer Management> Users).
• Raise awareness about information security to children.

Medium businesses

• A fairly strong firewall or Unified Threat Management System
• Strong Antivirus software and Internet Security Software.
• For authentication, use strong passwords and change it on a bi-weekly/monthly basis.
• When using a wireless connection, use a robust password.
• Raise awareness about physical security to employees.
• Use an optional network analyzer or network monitor.
• An enlightened administrator or manager.

Large businesses

• A strong firewall and proxy to keep unwanted people out.
• A strong Antivirus software package and Internet Security Software package.
• For authentication, use strong passwords and change it on a weekly/bi-weekly basis.
• When using a wireless connection, use a robust password.
• Exercise physical security precautions to employees.
• Prepare a network analyzer or network monitor and use it when needed.
• Implement physical security management like closed circuit television for entry areas and restricted zones.
• Security fencing to mark the company’s perimeter.
• Fire extinguishers for fire-sensitive areas like server rooms and security rooms.
• Security guards can help to maximize security.

School

• An adjustable firewall and proxy to allow authorized users access from the outside and inside.
• Strong Antivirus software and Internet Security Software packages.
• Wireless connections that lead to firewalls.
• Children’s Internet Protection Act compliance.
• Supervision of network to guarantee updates and changes based on popular site usage.
• Constant supervision by teachers, librarians, and administrators to guarantee protection against attacks by both internet and sneakernet sources.

Large Government

• A strong firewall and proxy to keep unwanted people out.
• Strong Antivirus software and Internet Security Software suites.
• Strong encryption.
• Whitelist authorized wireless connection, block all else.
• All network hardware is in secure zones.
• All host should be on a private network that is invisible from the outside.
• Put web servers in a DMZ, or a firewall from the outside and from the inside.
• Security fencing to mark perimeter and set wireless range to this.

The Best Security for Wireless Networks

Securing a wireless network isn’t a hard task. The cheat sheet is relatively small. However, the technical press continues to be flooded with articles and blogs containing technical mistakes.

Take, for example, everyone’s trusted information source, Consumer Reports Magazine. I’m a big fan of the magazine, having subscribed to the hard copy edition for years. But they seem out of their league, when it comes to computers.

On August 6, 2009 a blog posting at the magazine’s website suggested using WEP security for wireless networks. This is very poor advice. A week after the posting, an editor corrected it, to say they recommend WPA security. This too, is not the best option. Even after being shamed into a correction, they still got it wrong. So, let me try to offer up just what most people (and Consumer Reports) need to know about securing a wireless network.

Starting at the Beginning

To begin with, there are four types of Wi-Fi networks (A, B, G and N). But the security is not tied to any one type. If you can connect to a wireless network without entering a password, then there is no security. In this context, the term “security” refers to encrypting data as it travels over the air.

The idea being to prevent a bad guy from capturing all the information coming into and out of a victims’ computer and, in effect, looking over their shoulder despite being a few hundred feet away. Wi-Fi networks offer three security options: WEP, WPA and WPA2. As a simplistic introduction, think of WEP as bad, WPA as just fine and WPA2 as great.

WEP is the oldest security option and it has been shown to be very weak. It may be better than no security at all, but not by much. Don’t use it. Other than Consumer Reports magazine, the last recommendation to use WEP was issued in 2005.

WPA is technically a certification, not a security standard, but since it includes only one security protocol, TKIP, they are often confused. When people refer to WPA security, they are really referring to the TKIP protocol.

The combination of WPA and TKIP is not the best, but it’s reasonably good. If you have a choice, you should opt for the best security (next topic), but if you don’t have a choice (more later) TKIP is reasonably strong.

WPA2 is also, technically, a certification rather than a security standard. WPA2 includes two security standards: TKIP and CCMP. If you are using TKIP, it doesn’t matter whether the router is WPA or WPA2. TKIP is TKIP either way.

The best security option is CCMP and it’s only available in WPA2, so, here again, the security protocol is often confused with the certification. When people refer to WPA2 security, they are really referring to CCMP.

But no one refers to CCMP (don’t ask what it stands for). For whatever reason, the CCMP security protocol is referred to, incorrectly, as AES. So, when you are configuring a router, you need to first select WPA2, then you need to select AES (rather than TKIP) to get the best possible security and encryption.

WPA TKIP Flaws

The TKIP security protocol (often referred to as WPA) is flawed. The first flaw came to light in November 2008, the second one just last month. But neither flaw is serious.

The first flaw can be defended against simply by disabling Quality of Service (QOS) in your router. Very few people make use of QOS.

The second flaw was described by security expert Steve Gibson as mostly theoretical. For example, it requires that the victim’s computer be out of radio reception range from the router. The bad guy has to connect to the router on one side and the victim on the other side. The bad guy has to be logically and physically positioned between the victim and the router.

Neither flaw lets the bad guy recover the password and they only support decrypting very small data packets. None of these small packets will contain any of your data.

Protecting Your Network from Hackers, Viruses and Malicious Software

If you have a server-based network, it’s critically important to protect your server from hackers,

viruses, and other malicious software.If your server is compromised, it can jeopardize the safety

and security of your company’s entire network and all its data. Here are some ways you

can protect your network against attack:

Your server has built-in security features. Use them. If configuring your server’s security settings is beyond 
the scope of your technical expertise, hire an expert to do it. While this will cost you a little more up front,
 the price you’ll pay to secure your network is miniscule when compared to the cost of responding to and 
recovering from a hacked server.
Firewalls are essential. Software firewalls are sufficient for small networks, but if your network is large or
 spread out, you may want to run a hardware firewall in conjunction with your server. A hardware firewall
 will control access to your network’s computers from a single point, making it easier to monitor, and 
theoretically, more secure. But at the bare minimum, your server needs a software firewall.
Software patches are vital to server and network security. When a new threat emerges, be it a virus, worm, 
or Trojan horse, antivirus software developers issue software patches, or updates, that close up the security
 hole that the malicious program has exploited. If you’re running an old version of a server operating system,
 your server could be vulnerable to attack. Not having the latest version of your server’s software installed
 is akin to not getting immunized against eradicated diseases; the cure is out there, but you just haven’t
 bothered to take your medicine.
Unrestricted server permissions and passwords should be given to as few people as possible. Use strong 
passwords, and keep them strictly confidential. (For more information on developing password protocol
for your business, check out Five Rules for Developing Safe and Sane Password Protocol for Your Small
Business.)
Physical security is just as important as password security, if not more so. Protecting your servers from 
the elements — and criminals — is essential. A closet is usually perfect for one or two servers; no windows 
and a single locking door reduce the chance of your servers being damaged. Lock up the room or closet 
whenever it’s not in use, and distribute keys only to employees who absolutely need them. Also, store your 
server computers up off the floor, either on special racks designed for that purpose, or in some other manner,
to keep them from being damaged by floods or leaks.

How to Conduct Internal And External Network Security Audits

According to a recent survey of IT executives and network administrators by VanDyke Software Inc., 46% of companies that undertake internal security audits find that the tests result in the identification of significant security problems. That’s close to half, and the number rises to 54% for external network security audits conducted by outside companies.

Think of it like this: There’s at least a 50/50 chance you have one or more significant network security problems, and an audit is good way to find them. In fact, 43% of survey respondents felt their organizations should audit their networks more frequently.

However, it’s a good bet that some people reading this article work for companies where network security is still not audited on a regular basis, probably because such audits are seen as an unwelcome interference with day-to-day network administration. But an audit should not be seen as a chore. Think of it as a process that others have found useful for ensuring their organization is adequately protecting itself from data loss and related complications, such as litigation, which may ensue. In this tip, let’s review what is required to conduct a systematic examination and verification of network security, which can serve as a potent control while also providing vital feedback on the state of an organization’s security strategy.

Setting the network security baseline

To be effective, an audit must be performed against a defined set of standards: an organization’s data security, integrity and availability policies and procedures, applicable regulatory requirements, and industry best practices. Data gathered during the audit is compared against these to check “what is” against “what should be.”

It may sound like a daunting process, but if some baseline network audit processes are conducted on a regular basis, you can make any major audit less onerous. The first step? Establish a baseline of the network. A good tool for this is Nmap, the free open source utility for network inventory and security auditing. Nmap can inventory network devices and reveal what services they run, as well as what OS and application versions are installed.

Once the network has been mapped, future scan results can be compared against this known and accepted baseline. Any scan results including, for instance, unauthorized applications or never-before-seen devices should serve as red flags. Of course, any such changes should be investigated and resolved, i.e. either remediated or added to your baseline. Prohibited applications discovered by a scan may include peer-to-peer networking, instant messaging, Skype or social media file sharing.

Because network threats constantly evolve, certain baseline checks should be carried out on a weekly, if not daily, basis. Intruders always look to exploit open ports because they are an easy gateway to your systems. Therefore, port scans that identify open ports and the services running on them should be among the most frequently conducted scans. An Nmap scan can also check trust relationships that exist on a network and find connections that violate security policy.

Regular Reviews
Another network element in constant flux is the user base. Regular reviews of network accounts and privileges against HR records are essential to ensure unused accounts are terminated and rights are appropriately assigned. You can combine this with other employee-related checks, such as ensuring separation of duties and compliance with password policies like aging and complexity.

Not every network security control needs checking with equal frequency, but all controls should be reviewed on a regular basis, including basics like physical security, document backup and destruction, and patching. Are backups being performed according to policy and regulatory requirements? Is data destroyed in accordance with its classification? Have backup and restore processes been tested recently to make sure they’re working? Are automated patching processes functioning correctly and deploying updates within an acceptable timeframe?

If you’re in charge of network security, then making these checks part of the regular work cycle will make life much easier when the time comes for a major network audit. The internal assessments you perform to prepare for a big audit only need to cover areas outside your regular monitoring routine.

These include evaluating patch processes, validating that backups perform per policy, assessing the effectiveness of physical security controls, and ensuring compliance with the requirements of relevant regulatory standards.

For some companies, auditing is not always optional. If your systems need to be compliant with a particular standard — such as the PCI Data Security Standard — then an audit by external auditors will be necessary. Even without such requirements, an external network security audit may be the best, or only option if there is suspicion of an internal threat, such as a malicious administrator, or if an organization has too many remote offices for qualified internal staff to ensure policies have been implemented at all sites.

Finally, a few words of caution about one oft-cited reason for security auditing. No audit, internal, external or compliance-related, can by itself ensure a network is secure. Just because a network has been audited does not mean it is, or will remain, secure. The real benefit of an audit comes from implementing its recommendations on how security controls can be improved, dealing with any concerns reported, and more closely aligning information security needs and risk mitigation with business goals. All of which makes the network security audit a worthwhile undertaking.

RAID

How to Implement RAID0?

http://www.youtube.com/v/AH2nWSW9E_Q&color1=0xb1b1b1&color2=0xcfcfcf&hl

How to Unconfiguring RAID0?

http://www.youtube.com/v/EZ42aa0Aj8Y&color1=0xb1b1b1&color2=0xcfcfcf&hl

How to Implement RAID1?

http://www.youtube.com/v/PrxkE2TKvdI&color1=0xb1b1b1&color2=0xcfcfcf&hl

How to Unconfiguring RAID1?

http://www.youtube.com/v/o3sNky6zmDs&color1=0xb1b1b1&color2=0xcfcfcf&hl

How to Implement RAID5?

http://www.youtube.com/v/gWEm1JulAvg&color1=0xb1b1b1&color2=0xcfcfcf&hl

How to Unconfiguring RAID5?

http://www.youtube.com/v/1J9UX75tRfA&color1=0xb1b1b1&color2=0xcfcfcf&hl

How to implement RAID10?

RAID10 can be implemented by first implement RAID1(ie mirring) then implementing RAID0(stripeset on different disks) on it.

Configuring RAID10

Step1:Get the info who many devices are participating, for example here we taken 4 disks(/dev/sda1,/dev/sdb1,/dev/sdc1,/dev/sdd1).

Step2:Implement RAID1 on four drives(taking 2 each)

#mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sd[ab]1
#mdadm --create /dev/md1 --level=1 --raid-devices=2 /dev/sd[cd]1

Step3:Now implement RAID0 on two of RAID1 devices(/dev/md0,/dev/md1)

#mdadm --create /dev/md2 --chunk=64 --level=0 --raid-devices=2 /dev/md[01]

Step4:Format the RAID10 device with ext3 and mount the device

#mke2fs -j /dev/md2

#mkdir /store

#mount /dev/md2 /store

Unconfiguring RAID10

Step1:Unmount the RAID device /dev/md2

#umount /dev/md2 or #umount /store

Step2:Stop the RAID device

#mdadm --manage /dev/md2 --stop

#mdadm --manage /dev/md1 --stop

#mdadm --manage /dev/md0 --stop

Step3:Remove the Disks(/dev/sda1,/dev/sdb1,/dev/sdc1,/dev/sdd1) by using fdisk utility

RAID01 Vs RAID10

So what is the difference between RAID01 and RAID10?
This is bit tricky question, Recently I came to know about this one in an interview. so do both are same?
No both are not same.

When we are dealing with RAID01 we are actually implementing RAID0 first then RAID1 on it. Ok little bit confused?
Let me put it in this way RAID0 is nothing but stripeset writing of data and RAID1 is Mirring of data on to disks.For example lets take 8 disks, so first we are writing whole data on 4 disks then we are mirring it on to remaining disks.
Where as in RAID10 we are first mirring disk and then striping data on mirrered disks
In general RAID01 is "a mirrior of 2 strips" and RIAD10 is "a single strip on mirrered disks"

So here one more question arises... which one is good?
RAID10 is good, the difference is that the chance of system failure with two drive failures in a RAID 0+1 system with two sets of drives is (n/2)/(n - 1) where "n" is the total number of drives in the system. The chance of system failure in a RAID 1+0 system with two drives per mirror is 1/(n - 1). So, using the 8 drive systems shown in the diagrams, the chance that loosing a second drive would bring down the RAID system is 4/7 with a RAID 0+1system and 1/7 with a RAID 1+0 system.