Now let's move on to the letters of the host and network.
The first rule of operating system protection is regular updates.
The second requires us to assess the level of operating system security for that purpose.
We can use dedicated tools recommended by the systems manufacturer for small networks based on Microsoft
software.
We can use Microsoft baseline security analyzer this program will tell you what you're doing wrong.
It's also advisable to try out programs used by the attackers.
These programs identify weak spots of the system security.
If you find these weak spots before the attackers do you will have the chance to repair them.
Following the principle of least privilege is another rule.
The principle states that each user must be granted only such privileges that are essential to the user's
work.
In particular the user shouldn't be given administrator privileges.
The principle is straightforward.
But the attempts to implement it always face opposition.
There are many reasons for it and we will discuss them during later parts of our seminar
real time system monitoring is also crucial.
Most systems come with tools dedicated for that purpose and we will discuss them later.
Network protection is easier if you divide it into subnets.
This is not strictly speaking a security solution.
But helps to limit the consequences of a potential attack.
A couple of years ago in a certain large company a person who was responsible for the management of
all computers there and thus had maximum privileges open to malicious attachment the effects were disastrous.
That person uses company computer which had administrator privileges to check his email.
It was one of those companies located in a modern premises with transparent glass walls because the
company network wasn't divided into subnets.
The malicious program had from the very beginning access to every computer one by one every monitor
in the room turned off one program started on the computer by the person who had unlimited access privileges
managed to turn off all the computers in the company
managing a network.
We should ensure data confidentiality.
This could be achieved through data encryption by means of proven solutions.
At the application layer this is achieved through SSL and at the network layer by IP SEC
a common method for an attack on computer networks is impersonating a trusted host we'll elaborate on
that later on.
It's relatively easy to prevent this type of an attack updating operating systems improve security because
this problem either doesn't exist at all in the case of newer systems or is limited mutual authentication
between computers the exchange data with one another is an alternative way of preventing such attacks.
Many modern operating systems give you that option.
However it needs to be configured correctly because it's not a default system option.
Network intrusion detection systems should also be used to monitor threats just as was the case with
the layers were discussed before.
We now proceed to the perimeter layer and physical access layer the perimeter is the point of contact
between the relatively secure private network and the non-secure network of the Internet.
Network firewalls used to be reliable protection against attacks at this layer of firewall just like
a literal wall of fire would block all network traffic it prevented any network user from connecting
to the internet and anyone from the internet from connecting with network users.
This was back in the 80s then Web sites came along companies noticed that it was easier to obtain personal
data through the Internet than through a phone call or direct conversation.
Anti-deps started to unblock one direction of communication from the secure computers to the untrusted
ones.
This meant the firewall less tight.
However it still served its purpose and made the network relatively secure.
Later companies decided they wanted their own Web sites and the company internal communication should
take place via emails.
From that point onward each company network included a web server and an e-mail server this required
configuration of the firewall so that it allowed communication from untrusted computers.
This is how the situation looks today.
Network firewalls are still needed because they protect against certain attacks but they no longer guarantee
security.
The so-called demilitarized zone is a better solution.
It's a special kind of sudden that that can easily be accessed by external parties all servers providing
external facing services should be included in the DMZ.
Of course you should monitor the network user's activity nonetheless.
This involves monitoring both incoming and outgoing network traffic.
The latter you can do through proxy servers.