The Top Ten of Security

1
The Top Ten of Security
2

• Ten best practices for securing your network.
• Ten best security web sites.
• Eight certifications.

3
Best Practices

• Educate users and use strong passwords
• Users need to know the rules and the reasons for
  them
• Use anti-virus software it works (update at
  least once a week)
• Never accept default installations default
  settings are always the weakest change default
  password.
• Dont run unnecessary services web server, ftp,
  telnet, SMTP

4
Best Practices (cont)

• Install security patches immediately.
• Back up your data and protect against power
  surges
• Know who you trust give each user only the
  level of access they need to accomplish their
  tasks and no more.
• Enable logging and review them regularly

5
Best Practices (cont)

• Expect protection to fail. Firewalls, routers,
  IDS, access control mechanisms often fail without
  warning. Have layers of protection. Have a plan
  B and C.
• Manage user accounts. Disable or delete unneeded
  accounts immediately. They are fertile ground for
  crackers.

6
Ten Best Security Web Sites

• www.cert.org
• Computer Emergency Response Team at Carnegie
  Mellon
• Current vulnerabilities,background info
• http//online.securityfocus.com
• Like a library of information
• http//rr.sans.org
• The reading room for SANS, a large computer
  security training organization.

7
Web Sites

• www.antionline.com
• Hackers know the weaknesses in your system,
  shouldnt you?
• www.ciac.org
• Computer Incident Advisory Capability
• U.S. Dept of Energy
• www.theregister.co.uk
• Good for getting a different viewpoint

8
Web Sites

• www.cerias.purdue.edu/hotlist
• Portal to many other good web sites
• www.infosecuritymag.com/
• Online magazine
• www.secinf.net
• Network Security Library
• http//csrc.nist.gov/
• Computer security resource center of the national
  institute of standards and technology

9
Top (8) Security Certifications

• CISSP Certified information systems security
  professional general security knowledge
  www.isc2.org
• SSCP Systems security certified practitioner
  more technical than cissp
• CISA Certified information systems auditor
  www.isaca.org
• CPP Certified Protection Professional
  security management www.asisonline.org

10

• GIAC Global information assurance certification
  multilevel certification by SANS www.giac.org
• Security Certified Network Architect/ Network
  Professional www.securitycertified.net/certifica
  tions.htm
• Cisco certifications proficiency with Cisco
  products www.cisco.com
• Microsoft certifications proficiency with
  Microsoft products www.microsoft.com