tailieunhanh - The CERT® Guide to System and Network Security Practices

Cyber is a major national security issue. Top government, intelligence, and military leaders often point to cyber as the issue that worries them the most – partly because it touches every aspect of American life (and of military operations) and partly because our laws and policies clearly have not kept up with the rapid changes in technology. Earlier this year, CIA Director Leon Panetta testified about his fear of a “cyber Pearl Harbor.” | Chapter 1 The CERT Guide to System and Network security Practices The Problem In the Large1 Networks have become indispensable for conducting business in government commercial and academic organizations. Networked systems allow you to access needed information rapidly improve communications while reducing their cost collaborate with partners provide better customer services and conduct electronic commerce. Many organizations have moved to distributed client-server architectures where servers and workstations communicate through networks. At the same time they are connecting their networks to the Internet to sustain a visible business presence with customers partners and suppliers. While computer networks have revolutionized the way companies do business the risks they introduce can be devastating. Attacks on networks can lead to lost money time products reputation sensitive information and even lives. The 2000 Computer Security Institute FBI Computer Crime and Security Survey CSI 00 indicates that the number of computer crime and other information security breaches is still on the rise and that their cost is increasing. For example 70 percent of the 585 respondents reported computer security breaches within the last 12 months 1. This Problem description is directly quoted from Allen 00a . 1 2 THE CERT GUIDE TO SYSTEM AND NETWORK SECURITY PRACTICES up from 62 percent in 1999. Furthermore the financial losses for the 273 organizations that were able to quantify them totaled 265 586 240 more than double the 1999 figure of 123 779 000. Engineering for ease of use is not being matched by engineering for ease of secure administration. Today s software products workstations and personal computers bring the power of the computer to increasing numbers of people who use that power to perform their work more effectively. Products are so easy to use that people with little technical knowledge or skill can install and operate them on their desktop computers. Unfortunately it is