>> After we've hardened the facility,
the next step is to harden the network.
Now, we've already talked about every item listed here.
I'll just remind you of the basic things.
Make sure your network devices are physically secure.
Make sure the doors are locked for access.
If you're going to allow remote administration,
makes sure you're forcing a protocol that's secure.
Don't allow rlogin or Telnet or FTP.
Instead, use SSH or SSL to connect.
Then there's also SNMP for network monitoring.
If you're going to do that, make sure
you were using Version 3.
Separate your network.
Isolate trusted from untrusted.
Make sure all your sensitive info
is going across the network encrypted.
That doesn't happen by default,
so you need to put something in place like SSL or SSH,
or perhaps even IPSec.
Using HTTPS means you are using TLS SSL.
Scan your network. We're going to talk
about that in a bit, monitor your network.
Limit remote access.
Obviously, we can't get along today
without allowing remote access.
But limit this as much as you
can and make it as strong as you can.
Make sure you have strong authentication with
at least two factors of authentication.
If it's not necessary, get rid of it.
That being said, we don't just make changes
haphazardly to a system or a system baseline.
But when we determine that we aren't
using a system or service anymore,
we need to act to make sure
that system or hardware can be removed.
It needs to go through
>> the proper change control process.
>> It's like IPV6.
Many people don't think they are
using IPV6 on their network.
But they may be because there are a lot of
name resolution services and
other services that require IPV6,
so it may be in use.
To make sure the system is secure,
always apply the latest updates,
service packs, and patches.
Be sure to change your default settings and
configurations because those are
so easy for an attacker to find and exploit.
Make sure the security tools that
are there are being used.
Turn on auditing and firewall tools.
Don't forget physical security
>> like we already discussed.
>> Make sure you have captured an image of your system,
so you have a baseline of
the system in case you need to reinstate it.
We talked about how people often
don't create secure applications.
We need to start planning for a secure product from
the beginning instead of trying to
secure one after it's already been developed.
How do we do this?
Secure the software development lifecycle.
Start talking about security from
the beginning and continue
all the way to the product's end of life.
Implement security in the design.
One of the most important security features
in software development is to validate input.
That way you don't have garbage in, garbage out.
The garbage tends to come in through your web forms,
which allows people to enter
directly into your back-end database.
Validation will return an error if
the user enters something that
>> doesn't meet requirements.
>> Sanitation will clean up when
a person enters to fit the rules.
Fuzzing tests are tests that determine
whether a proper input validation is occurring.
But an attacker can also use fuzzing to
determine vulnerabilities in the application.
It's best to use it in an
offensive matter to prevent that.
Certification and accreditation
>> ensures that software has
>> been built to the requirements,
including security requirements.