Network security assessment

Author: (USA) McNab C. Wang Jingxin
Publisher:
Publish Date: 2006-01-01
Features: This book is a theoretical monograph focused on network security assessment. It includes detailed technical information on tools used for network security assessment, testing common services like SSH, DNS, and LDAP, testing Microsoft Windows services such as NETBIOS, CIFS, and RPC, testing web applications deployed on Apache and Microsoft IIS, and more. The best way to understand the security of your system is to attack it. Many administrators conduct haphazard and unprofessional tests on their systems, while this book explains the steps used by professional network security analysts and consultants to identify and assess computer networks. You will learn the tools, tricks, and techniques used by penetration testers (typically security personnel for government, military, and commercial networks) to effectively defend against malicious intrusions, tools, and scripts in the networks you design and deploy. This thorough and insightful security assessment guide begins with an introduction to tools and quickly guides you through the methods and steps hackers use to find machines that can be used to attack target networks. The main part of the book consists of multiple chapters that focus on different network components, the services they run, and how they are attacked. Each chapter concludes with suggestions for network security personnel on how to counter hacker attacks. The topics covered in this book include: detailed technical information on tools for network security assessment; testing common services like SSH, DNS, and LDAP; testing Microsoft Windows services such as NetBIOS, CIFS, and RPC; testing web applications deployed on Apache and Microsoft IIS; assessing database services like Oracle, SQL Server, and MySQL; assessing VPN services like IPsec, FWZ, and PPTP; assessing application risks, including detailed descriptions of issues such as buffer overflows, stack overflows, integer overflows, format string bugs, and other related problems; risk mitigation information and strategies, including checklists. This book adopts the steps used by professional security analysts and consultants to identify and assess risks, and follows government standards such as CESG CHECK and NSA IAM.