Table of Contents

Part I: Do This Now! Chapter 1: Do These 7 Things Before You Do Anything Else Part II: Take it From the Top. Systematically Hardening Your Enterprise Chapter 2: Break the Network into Areas of Common Functionality Chapter 3: Hardening with Identity Management Systems Chapter 4: Hardening Cross Platform Authentication Chapter 5: Implement Secure Centralized Authentication Mechanisms Chapter 6: Mobile Authentication Considerations Chapter 7: Beyond Access Controls - Protecting Stored Data Chapter 8: Hardening Database Access Chapter 9: Hardening Cross Platform Access Controls Chapter 10: Hardening Data Transport Using Encryption Chapter 11: Hardening Remote Clients (Windows, Mac, *nix) Chapter 12: Hardening Wireless Chapter 13: Hardening a Mixed Unix Network Chapter 14: Intrusion Detection and Response Chapter 15: Managing Malicious Code Chapter 16: Hardening Wetware Part III: Once is Never Enough Chapter 17: Auditing and Testing Security Chapter 18: Change Management Chapter 19: Security Patching Chapter 20: Security Review Part IV: How to Succeed at Hardening Chapter 21: Politics of Security Management Chapter 22: Security Agnostics

About the Author

John Mallery is a Managing Consultant at BKD, LLP, and a veteran security specialist. Previously, he was CTO of Clarence M. Kelley and Associates, Inc, a private investigation and security consulting company founded by the former director of the FBI. John is a nationally recognized public speaker and trainer in the area of computer forensics and computer security. He has developed continuing legal education programs for the legal community and POST accredited programs for law enforcement. His presentations always receive excellent evaluations at national conferences.
John draws upon his unique experiences as an investigator, network security consultant, and comedian to provide presentations that are both informative and entertaining. John is a member of the Information Technology Security Council for ASIS International, a member of the High Technology Crime Investigation Association, Infragard, and a contributing editor for Security Technology and Design magazine.
Jason Zann, CISSP, is currently an Information Security Consultant for DST Systems, Inc. With over nine years as an information security professional, he has been responsible for management, operational, and technical developments for information security products, systems, networks, and processes on a global scale. He has worked for corporate, product, and consulting organizations delivering a range of information security concepts and solutions. Patrick W. Kelly, CISSP, CCSE, MCSE, MCP+I, currently serves as Information Assurance Engineer for ComGlobal Systems, Inc. Patrick has more than 15 years of combined application development and network security experience. In his current position he is responsible for Enterprise Security Awareness Programs, Vulnerability and Risk Assessment, and Security Component Design and Build. Throughout his career, Patrick has been responsible for implementation and development of network security programs. Some of these projects include: Intrusion Detection and Reaction Systems, Firewall Technology Design and Implementation Wesley J. Noonan (Houston, TX), MCSE, CCNA, CCDA, NNCSS, Security +, has been working in the computer industry for more than 11 years, specializing in Windows-based networks and network infrastructure design and implementation. He is a Senior Network Consultant for Collective Technologies, LLC (http://www.colltech.com), a company that specializes in storage, server and network design, architecture, implementation, and security. Wes got his start in the United States Marine Corps working on its Banyan VINES network, and has since worked on building and designing secure networks ranging in size from 25 to 25,000 users. Wes prreviously worked in R&D for BMC Software, Inc., on their PATROL management solutions, architecting and testing their network and application management products. Wes is also an active trainer, developing and teaching his own custom, Cisco-based routing and switching curriculum. He has spoken at a number of technical conferences and user groups and is a member of the Ask the Experts panel at http://searchwindowssecutiry.techtarget.com. Wes is also the author of Hardening Network Infrastructure (McGraw-Hill/Osbourne, 2004). Eric S. Seagren,(Missouri City, TX), CISSP, ISSAP, SCNP, CCNA, CNE, MCP+I, MCSE, has nine years of experience in the computer industry, with the last eight years spent in the financial services industry working for a fortune 100 company. Eric started his computer career working on Novell servers and performing general network troubleshooting for a small Houston-based company. While working in the financial services industry, his duties have included server administration, disaster recovery responsibilities, business continuity coordinator, and Y2K remediation responsibilities. He has spent the last four years as an IT architect, designing secure, scalable, and redundant networks. His design experience includes the implementation of intrusion detection systems, and the security evaluation of network designs and network device configurations.
Paul Love, CISSP, CISA, CISM, Security +, is a Security Manager for a large financial institution and has been in the IT field for 15 years. Paul holds a master of science degree in network security and a bachelor’s degree in information systems. He is a coauthor of the book Hardening Linux (McGraw-Hill/Osborne, 2004) and has been the technical editor for over ten best-selling Linux and Unix books. Paul ran a successful Linux portal site during the dot com era. Rob Kraft is the director of software development for KCX, Inc. Rob spent two years as a Microsoft Certified Trainer teaching classes on SQL Server and Visual Basic. He is also certified by IBM to teach DB2 and WebSphere. In addition to teaching, Rob spent 15 years developing applications on a range of platforms, development languages, and database management systems. Rob coauthored books on Microsoft SQL Server and has presented SQL Server, Internet Security, and Visual Basic at conferences and seminars. In his spare time, Rob assists local nonprofits with IT and other needs. You may contact Rob at http://www.RobKraft.org. Mark O’Neill is the principal author of Web Services Security (McGraw-Hill/Osborne, 2003). Mark has written on the topic of XML and web services security in magazines such as Web Services Journal, XML Journal, Java Pro, Enterprise Architect, Infoconomy, and Technology for Finance. As Chief Technical Officer at Vordel, a pioneering vendor of XML security products, Mark has met many early adopters of XML, gathering and synthesizing their security requirements. Mark regularly presents training courses on web services security in London, California, and on the U.S. East Coast. For the past four years, he has been chosen as a speaker on the topic of XML security at the RSA Conference, the infosec industry’s largest annual conference. Mark lives in an old house in Boston’s up-and-coming Roslindale neighborhood, with Kristen and their two-year-old son Ben.