152
Networking: A Beginner's Guide
the employees know each other. An example of a social engineering technique is calling
an employee and posing as a network administrator who is trying to track down a
problem and who needs the employee's password temporarily. Another example is to
sort through a company's trash looking for records that might help the culprit crack a
password. Make sure to instruct your company's employees carefully to never give out
their password to anyone over the telephone and also that IT people usually never need
to ask anyone's password.
Back-Door Threats
Back-door threats are often directed at problems in the network operating system itself
or at some other point in the network infrastructure, such as its routers. The fact is
that all network operating systems and most network components have security
holes. The best thing you can do to prevent these problems is to stay current with
your software and any security-related patches that are released. You should also
periodically review new information about security holes discovered in the software
you use.
TIP
Don't rely on the vendor's web site for the best information about software security holes.
A good web site to use to stay current on security holes is the one maintained by the Computer
Emergency Response Team (CERT), located at http://www.cert.org. Aside from finding advisories on
security holes, you can also discover much valuable security information on the site.
Web servers are a frequent target for crackers. Consider the following tips to help
protect against threats to web servers:
You're better off if you can host the company's web site on an external server,
such as an Internet service provider's (ISP's) system, rather than on your own
network. Not only is an ISP better able to provide the server service 24 hours
a day, 7 days a week, but it also probably has better security. Also, you don't
need to worry about allowing web server access to your LAN from outside the
company, which can sometimes leave open other holes.
Make sure that you implement a strong firewall router for your network.
Firewall routers are discussed in more detail in Chapter 6. You should also
have someone knowledgeable about the specific firewall and web server you
implement test your configuration or help with the configuration. Remember
that firewalls also need to have their software kept current.
Make absolutely certain that you've carefully reviewed the security settings
appropriate for your web server and have implemented all of them, and that
you audit these settings occasionally.
Summary :
TIP Don't rely on the vendor's web site for the best information about software security holes. A good web site to use to stay current on security holes is the one maintained by the Computer Emergency Response Team (CERT), located at http://www.cert.org. Consider the following tips to help protect against threats to web servers: You're better off if you can host the company's web site on an external server, such as an Internet service provider's (ISP's) system, rather than on your own network.
Tags :
web,security,network,holes,serer,site,software,password,hae,need,information,current,threats