Sometime after the laws of security had been published.
Scott Kulp devised another version specifically for your administrator's benefit these laws are still
valid as well.
We'll just mention them for informative purposes.
The first law states nobody believes anything bad can happen to them until it does.
The rule describes a kind of wishful thinking.
No one ever thinks that his or her network could be attacked or that their computer may be broken into
reality proves that private computers are targeted by attackers and broken into research indicates that
in Eastern Europe three computers out of ten are infected with malware.
One third of the users open programs from untrusted sources.
We already know that if someone runs his or her program on your computer it's no longer solely your
computer.
The second real security only works at the secure way also happens to be the easy way.
One of the largest modules in the seminar was devoted to security policy.
When you create security policy the biggest mistake is to pit security against functionality you want
to achieve complete security if you force users to use a 24 character long randomly generated password
that you won't allow them to write down and then make them authenticate their identity every time they
leave their computer idle.
The third law if you don't keep up with security fixes your network won't be yours for a long.
It's very easy to break into a computer that's not regularly updated.
And one of the modules to come we will learn how to make updates completely automatic.
If you don't download the latest updates your network won't stay your property.
It doesn't do much good to install security fixes on a computer that was never secure to begin with.
That's the next law.
When it comes to massive attacks there are two main attack vectors none Apptd it systems or applications
and typical configuration mistakes.
These vectors are independent of each other and fixing one problem want to eliminate the other.
The fifth law states external vigilance is the price of security.
The greatest challenge for any administrator is that he or she must protect the network 24 hours a day
against all kinds of attacks.
If the administrator fails to detect just one attack the attack will succeed.
The attacker can attack whenever he wants just one undetected attack is a success for the attacker.
The next flaw there really is someone out there trying to guess your passwords.
Many people still use weak passwords start one two three pass and password are among the most popular.
They're still used by System users the attackers always try them first.
The more secure network is a well administered one.
That's the next one to control all network operations.
The administrator must have a clear network design.
If he doesn't you won't be able to detect an attack if the attack goes undetected.
It cannot be stopped.
This is connected with the next law.
The difficulty of defending a network is directly proportional to its complexity.
You might have heard someone saying that his or her network was so complex that even they didn't know
what was going on there.
So how was the tech successful.
This is a false premise.
Security isn't about risk avoidance it's about risk management.
During one of the other modules we analyzed the risk assessment model this mentioned the need to assess
the threat correctly and act correspondingly.
You cannot pretend that the threats don't exist.
If you start believing this premise you stop protecting your computer system.
The final law technology is not panacea was discussed before in this module re-analyzed ten immutable
laws of security that have been created more than a decade ago by Scott holp none of them are still
valid and don't need any adjustment only one of them.
The one concerning Web site security needs slight adjustment.
This means that computer system security is not a technological issue.
Technology has changed completely in recent years.
There is an enormous gap between Windows 95 and Windows 7.
Nevertheless the principle is valid then are still valid Now this means that the module devoted to attack
in defense methodology is crucial for security.
It's essential that you know various configuration and implementation issues and even if you're experts
in the field it doesn't mean that you know how to effectively secure your computer systems methodological
knowledge is crucial.
Thank you for your attention.