Common Security Scenarios in .NET framework

Draw Code 128B in .NET framework Common Security Scenarios

chapter talked about some of the Microsoft products and tools that have been developed to help you ensure that the computers on your network stay up to date when something new is released. One last product not covered in this chapter is Network Access Protection (NAP). You can use NAP to ensure that all home computers that connect to your network via a VPN connection have a set level of updates installed before they are allowed on the network. For more information on using NAP to control the update level of home computers connecting to your network, see 5, Windows Firewall(s).

Microsoft Corporation (2008). Security Guidance for Patch Management, at http://www.microsoft.com/technet/security/guidance/patchmanagement.mspx. Microsoft Corporation (2007). Patch Management Process, at http://www.microsoft.com/technet/security/guidance/patchmanagement/ secmod193.mspx. Microsoft Corporation (2008). Microsoft Update Catalog, at http://catalog.update.microsoft.com/v7/site/Home.aspx. Microsoft Corporation (2008). Microsoft Download Center, at http://download.microsoft.com. Microsoft Corporation (2008). Microsoft Baseline Security Analyzer, at http://www.microsoft.com/mbsa. Microsoft Corporation (2008). Update Management Center, at http://technet.microsoft.com/en-us/library/bb466251.aspx. Microsoft Corporation (2008). Microsoft Update, at http://update.microsoft.com. Microsoft Corporation (2008). Windows Server Software Update Services, at http://technet.microsoft.com/en-us/wsus/default.aspx. Microsoft Corporation (2008). System Center Essentials 2007, at http://www.microsoft.com/sce. Microsoft Corporation (2008). Microsoft Security Tools, at http://www.microsoft.com/ technet/security/tools/default.mspx.

13

Jesper M. Johansson In this chapter: Introduction to Security Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 Types of Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 Mitigating Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 Additional Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 I am often asked how to protect workstations on a network. More specifically, the question is framed against the latest attack-du-jour that was demonstrated at some conference. For example, many people are currently extremely concerned about USB Flash Memory those incredibly handy little finger-sized, solid-state memory devices that are now available in capacities bordering the ludicrous. People are worried about an attack that starts with the attacker inserting a USB Flash Drive into a computer, or causing the user to do so. The USB Flash Drive is laden with malware that either automatically or with minimal user interaction executes on the computer. The problem with this preoccupation with USB Flash Drives is that it is an extremely narrow view of a much larger removable-device problem that also includes CDs, DVDs, FireWire drives, parallel port devices (does anyone still have these ), and just about any other port on the computer that can be used to access external content. Too often, people are only worried about workstations and not the rest of the network. I believe that the question is not how you keep workstations from getting hacked, but how you keep the rest of the network from falling like dominos once they do. Let s look at the math. If you have 10,000 end users in a network, what are the chances that you can keep all the workstations secure Let s assume that each of those workstations is up to date with security updates, fully managed, and operated by users who are savvy enough about security to not run malicious content 99.99 percent of the time. Ignore the complete unrealism of these numbers for a moment and focus on the math. With 10,000 workstations, these numbers mean you have a 37 percent chance of having a secure network at any given time. With 20,000 workstations, your chances are about 13 percent. Add in a more realistic probability of each of your workstations being secure, and you will find that the probability of keeping all of them simultaneously secure asymptotically approaches zero as your network grows in size.

Part III: