One area evolving almost faster than you can imagine is the variety of threats to your infrastructure. Several years ago the threats most prevalent were from unsophisticated attackers whose main goal was to accomplish something they could brag about in chat rooms with their buddies. Today, organized crime has zeroed in on the huge amounts of money to be made in computer hacking. We now see targeted attacks against specific industries and companies, viruses that target credit card numbers, bank account information and Social Security numbers, and rootkits that, once installed on a computer, turn it into a host the attacker can control remotely to attack other systems and networks. Some attackers will threaten to crash networks with denial of service attacks, unless the system owner pays extortion money—the high-tech equivalent of a protection racket.

In the future, you will see more resilient networks that will mitigate the risk of traffic-based attacks, more secure operating systems and applications to resist malware, and intrusion prevention systems that will respond instantly to attacks, choking them off before they can damage your infrastructure.

Firewalls have been adding capabilities since they were first introduced. Early firewalls contained some limited filtering and NAT capabilities and not much else. You will learn about the wide range of today's firewall capabilities and specialties later in this chapter.

Encryption is a constantly evolving standard. In 1977, the Data Encryption Standard (DES) was specified in the Federal Information Processing Standards (FIPS) Publications. It became a national standard. We have gone from DES, a 56-bit algorithm, to 3DES, an effective 168-bit algorithm, to the algorithm encryption standard (AES), which supports a 256-bit algorithm. The problem with encryption is the constantly improving processing power of computers. As computers get faster and more capable, with bigger and bigger memory space, encryption algorithms become easier and easier to break, through brute force and other techniques.

Encryption's popularity has grown as concerns about protecting data at rest, in transit, and while archived have come to the forefront of many industries. How many stories have you seen about the stolen laptop with 100,000 Social Security numbers on it or an application compromised by an attacker able to read data directly from a hard drive because it was stored in clear text? Today, some government agencies (the Department of Defense, for example) require full-drive encryption for all laptops.

Recognizing the growing need for encryption, the industry is responding quickly. The AES standard was designated as the replacement for DES. It is designed to scale upward with longer keys. Keep in mind as you look into encryption solutions whether they support AES or an equivalent algorithm and be sure that you encrypt your data everywhere it's vulnerable. The days of relying on your VPN as the only data protection are gone. You need to secure data with encryption everywhere it can be accessed.

Another area where you can expect to see dramatic changes in future capabilities is in authentication, especially with respect to identity and access management. In the past, much of user security was based on a user ID and password. Years were spent trying to teach users what a strong password is, why they need a strong password, and why they need to change their passwords every 90 days. The effort has been largely ineffective. Users still choose poor passwords, and even when they select strong passwords, the passwords can still be cracked with sufficient computer power.

The other challenge associated with authentication is actually a user-management issue. All too often in a complex environment, the creation, permissioning, management, and eventual retiring of user accounts doesn't work. Accounts retain permissions long after users move on to other roles, accounts remain on systems long after employees have left the organization, and, in many cases, no auditing of actions using privileged accounts takes place. Collectively, these critical tasks are known as identity and access management.

How will these challenges evolve in the future? One trend is moving away from passwords to tokens, smart cards, and biometric authentication as a replacement to user ID and password solutions.

On the identity and account management front, a number of solutions automate these activities, providing full account life-cycle management and the associated auditing capabilities many companies look for. The one challenge with these solutions is that, due to the sophistication of most corporate computing environments, they are very complex to install and maintain. It's not just a matter of automating the creation of Active Directory accounts in most cases. Companies have multiple application systems and authentication requirements. Making all of these components work together is not easy. Once you get them working together, however, you've removed a significant threat to your security landscape.

One of the biggest complaints from CIOs about information security is the lack of measures for the success of a program. Information security has moved from being an esoteric discipline practiced by a few misunderstood experts to a core business function vital to support the bottom line. While this evolution has been long overdue, today management expects you to quantify your contribution to the company and justify the expenditures they make to support security.

The good news is that the industry has been moving this direction for some time and has developed a number of performance metrics. The most popular is the Information Technology Infrastructure Library (ITIL), which is a set of concepts you can use to formalize your security management practice and the associated reporting. In addition, a number of solutions allow you to automate not only these processes, but also the associated measurements.

Another area of significant evolution in information security is in the nature of what you are trying to protect. Initially, information security was all about keeping the bad guys out of your network. As a result, companies invested significant amounts of money in firewalls and other network security technologies.

Then focus shifted from the network to the host, however, and organizations focused more on managing patches, hardening operating systems, and installing host-based firewalls.

Once the industry secured the host, attackers shifted to threatening the applications running on those hosts. IT then started focusing on integrating security into the software development lifecycle, testing and evaluating code, hiring penetration testers to try to break our code deliberately, and deploying firewalls and proxy servers specifically to secure applications.

The next shift in focus for information security is a growing focus on what is truly valuable—the data itself. Ultimately, all the measures developed to date, from the network firewalls, to the host hardening, to the penetration testing, have all been about securing the data. The industry is now moving toward a data-centric security model, which is a significant paradigm shift from previous models. A data-centric model will force companies to focus on classifying and applying values to their data. While this will undoubtedly be a painful process for many companies, this approach will ultimately yield a much more secure environment.

Cloud computing is a relatively new phenomenon in computing infrastructure that involves moving computing resources out to the Internet. Resources are then shared by multiple applications and, in many cases, shared by multiple corporations. Think of how the phone networks or the electrical grid operates. These clouds are typically built using virtualization that allows for exceptional efficiencies, but also opens up a number of new security challenges.

First, to leverage the true benefits of cloud computing, you have to trust the vendor providing your cloud. This requires a shift in focus from deploying security technologies to ensuring that your vendors are contractually obligated and physically able to keep your data secure. You also need to be able to evaluate vendors to determine how trustworthy they are. If you have the available resources, you should be auditing the vendor(s) to ensure they consistently keep your data secure.

You'll learn about the security challenges specific to virtualization later in the chapter.

A rapidly growing sector of the end user computing space is the use of mobile devices like smart phones, netbooks, or tablet computers. These devices present some unique challenges. Think about how many people today receive e-mail on their smart phone. Or ran out to get a new iPad and are now reviewing confidential documents while riding the train to work. How do you secure these devices?

The good news is that once the industry identifies issues like these, it concentrates resources to work and ultimately solve the problem. The computer security industry has very few "unsolvable" issues. Already virus protection, mobile device management, and encryption applications are available for mobile devices. The challenge you'll typically see in both current and future technology is that these types of devices are frequently overlooked or discounted when documenting security risks. Be sure to keep these devices on your list of risks. They possess an alarming amount of storage and processing capacity, which makes it easy for an employee to inadvertently place confidential information on them.

Commercial software remains the choice of corporations everywhere, and this won't be changing any time in the future. A number of reasons account for the dominance of commercial solutions in the information security industry. They include:

While it is pretty common to see companies embrace commercial tools in their production environments, you can't discount the sheer innovation available in the open-source community. Most of the tools referenced in this book are open-source, and you can expect to see continued development on most of them.

Keep in mind a couple of other advantages to open-source tools as you build your security tool kit. First, working with open-source tools is a great way to build your information security skill set. Most security professionals cannot afford to purchase multiple commercial security applications to learn with, so leveraging open-source is a cost-effective career builder.

The other value that open-source security tools bring to a security professional is that these are the same tools many of the people attacking your network will use. One of the most important skills you can develop is the ability to understand the people trying to get into your systems. Learning the tools and techniques they may use by developing parallel expertise will take you far in your career. Commercial applications seldom offer the same learning opportunities. Attackers generally are not using commercial applications in their attacks, and they typically don't draw from the same community available with open-source solutions as you will to help your learning.

If you look back to the first uses of network security, security professionals essentially put a firewall between the corporate network and the Internet. That firewall marked the perimeter of the network. As networks have become more complex, companies started finding they were connecting to the Internet in more locations, so more firewalls were installed. The perimeter remained the demarcation between the Internet and the corporate network. Today, the vanishing perimeter has been the subject of many presentations, white papers, and sales pitches, as vendors try to convince organizations to invest to protect their perimeter-less environments.

VPNs extended the internal network outside the nice, neat network perimeter defined by the firewall/Internet interface. Suddenly your network could be in any hotel or coffee shop in the country, as your employees discovered the benefits of mobile computing. To make matters worse, high capacity drives and portable storage meant that not only was your network being extended into places that you had never imagined, but you data storage was no longer contained within your office space. Critical information could be stored easily anywhere your employees wanted.

Unfortunately, that wasn't the end of the challenges you face as an information security professional. In addition to your employees taking your network and data anywhere they wanted, your business discovered the benefits of interconnecting with customers, vendors, suppliers, and partners. Each of these groups needed varying levels of access to your systems, networks, and data.

In addition to all the challenges with connections and data beyond your network, businesses also discovered the benefits of online commerce over the Internet. That seems harmless enough, until you realize that to do business on the Internet, you need to punch holes in the network perimeter to provide access from the Internet to your systems, networks, and data. It's a little like installing skylights in your roof: you want the benefit of the sunlight in the house, but you don't want leaks when it rains.

In a perfect world, your upper-level management would have consulted with you before they embarked on these projects. They would have given you an unlimited budget to deploy network zones separating each of the different types of data, with firewalls and intrusion detection deployed at each level, and enough staff to monitor all the infrastructure to ensure nothing is getting past your security measures.

In reality, the first few connections were most likely put in without input from security, and these might not even be firewalled. It's so much easier than having to justify purchasing firewalls, setup firewall rules, monitor logs, and all the other things an organization needs to do as it opens holes in its protective perimeter.

What's needed in this case is a clear, well-established policy with strong senior management support. The appropriate controls should be put in place to re-establish your perimeter. If you treat the risk of all these new technologies connecting to your network the same way you treat the risks posed by the Internet, you'll mitigate the risks associated the increasingly fluid perimeter you will be dealing with.

Two other security technologies available to secure networks are intrusion detection systems (IDS) and intrusion prevention systems (IPS). An IDS detects unauthorized user activities, attacks, and network compromises. IDSs come in two types, host-based and network-based.

Figure 15-1. IDS detects an attack, and alerts operators—manual intervention needed.

Figure 15-2. IPS detects attack, alerts operators, and then modifies firewall and router configuration to address the attack.

An intrusion prevention system (IPS) is very similar to an IDS, except that in addition to detecting and alerting, an IPS can also take action to prevent a breach from occurring.

Two common deployment methods are used when placing an IDS/IPS for protecting a network from the Internet. Each has its own advantages and disadvantages.

An unfiltered IDS/IPS installation examines the raw Internet data stream before it crosses the firewall. This provides the highest amount of visibility to attacks, but also means that a significantly higher volume of data will be monitored, with a higher possibility of false positives. During periods of high traffic, the IDS/IPS might not be able to process all the packets, and attacks can be missed.

Figure 15-3. Placement of the Intrusion Detection System so it gets unfiltered traffic for analysis.

Figure 15-4. An Intrusion Detection System deployed behind a screening firewall.

A screened IDS/IPS solution monitors traffic that gets through the screening firewall. The advantage to this model is it dramatically reduces the amount of traffic to be monitored, reducing the chances of false positives and lost packets during high traffic volumes. A loss of visibility accompanies this model, as you cannot see attacks blocked by the screening firewall.

You learned about IPv6 in some detail in Chapter 12, VPN Technologies, so you should be aware that IPv6 is the next-generation IP version and the successor to IPv4. While the main driving force for the redesign of Internet Protocol was the rapidly approaching exhaustion of IPv4 addresses, IPv6 has significant implications to future information security professionals.

IPv6 includes a native information security framework (IPsec) that provides for both data and control packets. This means that what you currently do with a traditional VPN you will be able to do natively with any IPv6 device. At a high level, that means you can run your IPsec VPN without requiring a client, but the implications are significantly more profound than just that.

In a fully IPv6 environment, any connection can use an IPsec connection. This means that any connection from a user to an application, host-to-host, or even peer-to-peer connection authenticate and encrypt as it passes across the network.

While the thought of a network featuring nothing but secure connections seems like a security professional's dream configuration, you should also consider some drawbacks before kicking off your IPv6 migration project. One of the challenges with encryption is that it not only secures data from the bad guys, but it also secures the data from the good guys. A number of security technologies like IDS/IPS, content filtering, network-based antivirus, data leakage prevention, and even firewall technologies rely on being able to look at packets as they cross the network to determine how to handle them. Once those packets are encapsulated in a secure IPsec connection, all the security tools you have relied on stop working.

With the limited deployment of IPv6, significant development on solutions to overcome these challenges hasn't occurred yet, but it will be a subject of great interest as the use of IPv6 expands.

Chapter 12, VPN Technologies, looked at some of the types of virtualization and how they impact the current use of VPNs. You should think about some additional areas that look to the future of virtualization.

Virtualization and VPN deployment are examples—some SSL VPNs have the ability to provide a unique virtual VPN configuration for each individual user group. Much like other types of virtualization, a virtualized SSL VPN allows you to separate the physical and logical use of the VPN. In the future, this capability could extend to IPsec VPNs, as well. While this technology offers some unique abilities when configuring secure VPN contexts for different user groups, the additional complexity is something you need to know. A misconfigured virtual VPN context could expose parts of your network to groups that should not have access to them. For example, if you are using a virtualized VPN to provide customers access to a help desk ticketing system, and you inadvertently grant that context access to your intranet where all your pricing information resides, you expose the organization's proprietary data to unnecessary risk.

Firewalls are another technology that is starting to permit virtualization. Currently some firewalls on the market can partition into multiple virtual firewalls. Each virtual firewall appears to be a separate firewall with its own security policy, interfaces, and configuration. This allows you to use your firewall hardware more efficiently than you might otherwise, but once again additional risks occur with the deployment of virtual firewalls.

First, while firewalls exist that support this technology, not all of them support all their features in the virtualized environment. Before you deploy a virtualized firewall, be sure it supports all the features you need to meet your business and security requirements. While this is a very promising technology, it's also very new, and sometimes early adopters can find themselves encountering issues the vendor didn't discover during their quality assurance processes.

Next, you are relying on logical segregation of firewalls rather than the physical separation offered by multiple physical firewalls. While this technology remains new, do some testing before deploying virtual firewalls into a critical environment. Finding that there's a way to bypass the virtual security and move from one virtual environment to another would not be good if you are using the firewall to separate two customers connected to your network.

Finally, this model suffers from the same complexity challenges with respect to the virtual VPNs. Any time you have a solution that offers greater flexibility, you also open the possibility for greater complexity. Complex environments are almost always more difficult to secure, monitor, and manage than simple environments.

However, assuming all the challenges associated with virtualizing security technologies like VPN and firewalls, a compelling business case exists for leveraging hardware more effectively in a virtualized environment. Be sure you understand the technology thoroughly before deploying it. Information security is seldom a forgiving field for learning as you go.

Steganography is the art and science of writing hidden messages so that only the sender and intended recipient know a message exists. Steganography is the ultimate security through obscurity technology.

Probably the most well known technique for steganography in the modern era is the embedding of additional information in a digital image. An image before and after a message has been embedded in it appears unchanged to the naked eye. In reality, run the image through the proper program and the secret message appears. However, steganography has been around a lot longer than digital images, and it can take many forms. Simply writing a message in invisible ink on the page of a book is a form of steganography.

The main advantage of steganography is that messages do not arouse suspicion. If you encrypt an e-mail message and send it, and the message is intercepted, then whoever intercepted the message assumes there's something sensitive in the message. If however, you send a copy of a picture of your kids at the amusement park with a message embedded in the photo, unless the intercepting party knows the coded message is coming, they will not give it any special attention. Encrypted messages protect the message. Steganographic messages protect the data as well as the intentions of the sender and the receiver.

The final topic for discussion in this chapter is the use of anti-forensics. Anti-forensics are a series of techniques designed to try to frustrate forensic investigators and their digital forensic techniques.

Forensic techniques are well known to the information security community, and by extension, to the hacker community, as well. As a result, hackers have developed an arsenal of counter-techniques they use to foil investigations. If they can prevent the investigator from recovering usable evidence, they stand a better chance of avoiding discovery or prosecution. Some of these techniques are also used to hide rootkits and other malware.

Some examples of anti-forensic tools and techniques include:

You should be familiar with the concepts associated with anti-forensics, but unless you are planning on becoming a forensic investigator you probably won't encounter any of these except possibly securely overwriting data.