Practical Network Security

Introduction

Basics of Information Security

• Why Information Security
• What is Information Security
• Goals
• Methods
• Tools
• Beyond Confidentiality Integrity Availability (CIA)
• Responsibility of Information Security
• Perspective of Information Security

Threat Paradigm

• Threats Paradigm
• Attackers or Threat agents
• Threat Motivation
• Threat Impact
• Types of Attacks

Information Security Controls

• Information Security Controls
• Examples of Information Security Controls

Decoding Policies Standards Procedures& Guidelines

• Documents Hierarchy
• Policy
• Standards
• Procedures and Guidelines
• Document Format
• Decoding Policies and Standards

Network Security Design

• Network Security Design Principles
• Defense in Depth
• Security Zones And Network Segmentation
• Secure Remote Access
• Secure Third Party Access
• Least Privilege
• Segregation Of Duties
• Encryption
• High Availability
• Network Access Control (NAC)
• Security Of Test Environment

Know Your Assets

• Identifying Assets
• Different Types of Assets
• Asset Responsibility
• Asset Valuation
• Asset Classification/Rating Review
• Audit Requirement

Implementing Network Security

• Introducing Assets to Production Environment
• Pre-Production Check List
• Best Practices for Network Design
• Best Practices for Firewall
• Best Practices For Router And Switches
• Best Practices for VPN
• Best Practices For Wireless Network

Secure Change Management

• Change Management
• Secure Change Management Process
• Audit Requirements

Vulnerability and Risk Management

• Vulnerability and Risk Management
• Common vulnerabilities found in Network Environment
• Vulnerability and Risk Management Process
• Handling Zero Day
• Audit Requirements

Access Control

• Introduction
• Identification
• Authentication
• Authorization
• Accounting
• Access Control Policies And Procedures
• Access Control Implementation
• User Registration And De-Registration
• Password Management
• Asset Classification
• Access Provisioning
• Network Admission Control (NAC)
• Privilege User Access Management
• Remote Access Management
• Third Party Access Management
• User Access Review
• Audit Requirements

Capacity Management

• Capacity Management
• Documented Policies and Procedures
• Capacity Management Process
• Audit Requirements

Log Management

• Logging
• Log Management Process and Documentation
• Log Generation
• Log Transmission
• Log Storage
• Log Analysis
• Log Disposal
• Audit Requirements

Network Monitoring

• Monitoring
• Physical, Environmental And Content Monitoring
• System Monitoring Standards and Procedures
• Traffic Monitoring
• Device Monitoring
• Log Monitoring - Security Information and Event Management
• Audit Requirements

Information Security Audit

• Information Security Audit
• Audit Management From Auditor’s Side
• Audit Management From Auditee's Side

Technical Compliance Audit

• Technical Compliance Audit
• Technical Compliance Audit from Auditor's Point of view
• Technical Compliance Audit from Auditee's Point of View
• Good Practices To Avoid Compliance Findings

Penetration Testing

• Penetration Testing (Pen Test)
• Stages of Penetration testing
• Pen-Testing vs. Vulnerability Assessment
• Pen Testing from Auditee's Point
• Good Practices to Avoid Vulnerabilities