Network security assessment doesn't have to rely on expensive automated tools. In this tip, learn how to use data from freely available tools to produce a comprehensive view of network security.
An IT administrator can deafen his staff to the powerful temptation to use automated assessment technology by showing that performing security assessments using freely available network analysis tools can be instructive, effective and -- admittedly, in a nerdy way -- fun.
Ignore the sirens
The temptation to deploy and rely on automated monitoring, analysis and response technologies can be as overwhelming to network administrators today as the sirens' calls were to Ulysses and his crew during the Golden age of Greece. There's little danger that modern-day IT staff will perish if they trust the fate of their networks to automation, but organizations that rely too heavily on automation may fall prey to the "out of sight, out of mind" syndrome, and attacks may go unobserved. IT's analysis skills may erode over time as staff are diverted to other tasks. Users may introduce unauthorized applications that disrupt essential business applications before they are identified, and either accommodated or removed.
Many of today's sophisticated security and network products have their origins in command line applications and scripts that innovative IT administrators developed to monitor, collect, analyze and respond to security-related events before anyone thought to introduce commercial solutions that automate these processes. Variants and descendants of these applications are readily available as open source software, freeware or shareware. Preparing a toolkit composed of feature-rich traffic generation, capture and analysis tools is simple and inexpensive.
A starter kit for security assessments
Consider some of the security assessment activities you can perform using free or inexpensive network analysis tools:
T
To continue reading for free, register below or login
To read more you must become a member of SearchNetworking.com
his handful of possibilities hardly does justice to the power and flexibility of such toolkits. The assessment activities you and your staff can perform are bounded only by your imagination and willingness to experiment with Internet protocols and applications. And your organization's collective familiarity and expertise with Internet protocols will improve each time you assess your networks in this fashion.
A strategy for improving your organization's assessment skills
Nurturing assessment skills among your IT staff can begin with simple exercises and gradually become more challenging. A popular introductory exercise is to have staff learn the information-gathering techniques attackers use. Have your staff begin by performing ping scans and port scans using nmap. As they become familiar with nmap, encourage them to try such advanced techniques as OS and service fingerprinting. Encourage them to share their experiences. Schedule a bag lunch conference where staff can discuss the methodologies and speculate how information gathering might be exploited on your network. Have them assess whether current security measures provide adequate defense.
What's the ROI?
An important outcome of encouraging such activities is that expertise becomes a core competency and core value in your organization. The organization is also less likely to become so dependent on automation that it cannot isolate and remedy problems for which automated response is not provided.
Automated assessment improves with each generation of analysis technology developed, and though many may argue that automation is necessary, it is still not sufficient to protect an organization from all threats, known and as-yet unforeseen. Developing security expertise by employing basic network analysis tools complements automated assessments and enhances your organization's ability to analyze, anticipate and respond to security problems.
Learn more about open source network security tools
About the contributor: David M. Piscitello is president of Core Competence Inc. He has been involved in internetworking technology for 30 years and is an internationally recognized leader in internetworking and fast packet technology. Dave is currently serving as a Security and Stability Advisory Committee fellow for ICANN (Internet Corporation for Assigned Names and Numbers).
