For the past 20 years, Mark Kadrich has been a contributing member of the security community. His strengths are in systems-level design, policy generation, endpoint security, and risk management. Mr. Kadrich has been published numerous times and is an avid presenter.
Mr. Kadrich is presently president and CEO of The Security Consortium (TSC), a privately held company whose mission is to provide better security product knowledge to their customers. TSC performs in-depth testing and evaluation of security products and the vendors that provide them. As CEO and chief evangelist, Mr. Kadrich is responsible for ensuring that the company continues to grow successfully. After the Symantec acquisition of Sygate Technologies, Mr. Kadrich took a position as senior manager of network and endpoint security with Symantec. His role was to ensure that the Symantec business units correctly interpreted security policy during their pursuit of innovative technology solutions.
Mr. Kadrich was senior scientist with Sygate Technologies prior to the Symantec acquisition. In his role as senior scientist, Mr. Kadrich was responsible for developing corporate policies, understanding future security trends, managing government certification programs, and evangelizing on demand. Mr. Kadrich joined Sygate through the acquisition of a start-up company (AltView) of which he was a founding member. As a founding member of AltView, Mr. Kadrich was the principal architect of a system that scanned and contextualized the network, the endpoints on it, and built a detailed knowledge base. Eventually known as Magellan, the system could determine what endpoints were on a network, how the network was changing, what endpoints were manageable, and if they were being managed.
As CTO/CSO for LDT Systems, Mr. Kadrich assisted with the development and support of a Web-based system used to securely capture and track organ-donor information. Mr. Kadrich was director of technical services for Counterpane Internet Security. He was responsible for the generation of processes that supported and improved Counterpane’s ability to deploy and support customer-related security activities Mr. Kadrich was director of security for Conxion Corporation. As the director of security, his role was to plot the strategic course of Conxion’s information security solutions.
Prior to Conxion, he was a principal consultant for International Network Services (INS), for which he created a methodology for performing security assessments and interfaced with industry executives to explain the benefits of a well-implemented security program.
Mr. Kadrich is a CISSP, holds a Bachelor of Science degree in Management Information Systems from the University of Phoenix, and has degrees in Computer Engineering and Electrical Engineering (Memphis, 1979). Publications contributed to include TCP Unleashed, Publish Magazine, Planet IT, RSA, CSI, and The Black Hat Briefings.
PrefacePreface
"That was some of the best flying I've seen to date –
right up to the part where you got killed."
Jester to Maverick in the Movie Top Gun
Introduction
I suppose that's the thing that bothers me the most: the fact that we think that we're doing great right up to the moment that the network melts down. Over the years we've seen the number of security tools deployed on our networks increase to the point where we are completely surprised when our computing environments are devastated by some new worm. But how can this happen you ask? How can we be spending so much money to increase our security and still be feeling the pain of the worm de jour? And not just feeling this pain once or twice a year, we're feeling it all the time.
To begin to answer this question, all one has to do is pop 'vulnerability' into Google and sit back and wait. My wait took a mere .18 seconds and returned over 69 million hits. Adding the word 'hacker' added an additional .42 seconds but did have the benefit of reducing the pool of hits to a tad over 4.2 million. Over 4 million pieces of information in less then half a second and for free! Now that's value.
So, getting back to our problem and looking at the results pretty much sums up our present situation. We're buried under all sorts of vulnerabilities and we're constantly struggling to get on top of the things. The problem of patching vulnerabilities is so big that an entire industry has sprung up just to address the problem. The problem of analyzing and generating patches is so big that Microsoft changed its release policy from an "as needed" to a "patch Tuesdays".
What are they really trying to address with the patches? One may think that it's about protecting the endpoint. What we're going to call endpoint security. This is a big topic of discussion. If we go back to Google and type in 'endpoint security' we get a little over 2.5 million hits. We can reduce that stratospheric result by typing in the word 'solution'. Now we're down to a much more manageable 1,480,000 hits.
So what's the point? The point is that there are a lot of folks talking about the problem but they're doing it from the perspective of a vendor customer relationship: a relationship that is predicated on them selling you something, a solution, and you paying them for it. The shear motive of profit motivates vendors to produce products that they can sell. Marketing departments are geared toward understanding what people need and how to shape their product in a way that convinces you that they can fill your need. How many times have you gone back to visit a vendor web page only to be surprised that they now address your problem? Look at how many vendors moved from PKI (Public Key Infrastructure) to SSI (Single Sign On) and finally to IM (Identity Management). Why? Because nobody was buying PKI because of the enormous expense so the marketing departments decided to switch names or "repurpose" their product. Now it was about "leveraging their synergies" with the multiple sets of user credentials and promises of vastly simplified user experiences. When that tanked the marketing people invented IM. Yep, that's what I said, they invented IM so they could once again distance themselves from a failed marking ploy and get more people to give them more money. Profit.
Ask any CEO what his or her mission is and if they don't reply, "to maximize shareholder value" I'll show you a CEO soon to be looking for a new job. It's all about making sales numbers and generating profit. The more profit, the happier vendors and their shareholders are.
Now don't get me wrong, profit is a good thing. It keeps our system working and our people motivated. But when the system of generating profit still refuses to produce a good solution one must ask, "what is the real problem that we're trying to solve here?" I don't want to be part of the solution that says that the problem is how to maximize shareholder value; I want to be part of a solution that says that the problem was understanding a well defined set of criteria that ensured that my enterprise and the information that it produced were safe, trustworthy, and secure.
But for some strange vendor driven reason we can't seem to do that.
Overview
This book makes the assumption that if we've been doing the same thing for years and we continue to fail then we must be doing something wrong. Some basic assumption about what we're doing and why we're doing it is incorrect. Yes, incorrect. But we continue to behave as if nothing is wrong. The pain is there but now the problem is that it's so ubiquitous that we've become desensitized to it. Like the buzzing the florescent lights make (yes, they do make an annoying sound) or the violence on TV, we've just gotten so used to having it around we've come up with coping mechanisms to deal with it. Why hasn't anyone asked why the pain is there in the first place?
This book does.
This book is different because it uses a basic tenant of science to understand what the problem is and how to manage it. This book uses a process control model to explain why securing the endpoint is the smartest thing you can do to manage the problem of network contamination and infestation. We'll explain the differences between endpoints and how to secure them at various levels. We start with the basic tools and settings that come with each endpoint, move to those required tools such as antivirus, and progress to endpoints that have been upgraded with additional security protocols and tools, such as 802.1x and the supplicant, that enable a closed loop process control model that enforces a minimum level of security.
Intended Audience
If you're a security manager, security administrator, desktop support person, or someone that will be or is managing, responding or responsible for the security issues of the network, this book is for you. If your job depends on ensuring that the network is not just 'up' but functional as a tool for generating, sharing, and storing information, you'll want to read this book. If you've ever been fired because some script kiddie managed to gain access to the CEO's laptop, you'll want this book on your shelves. If you're worried about Barney in the cube next to yours downloading the latest 'free' video clip or the latest cool chat client, you want to buy this book and give it to your desktop administrator.
Intended Purpose
Many books describe how systems can be exploited or how vulnerabilities can be discovered and leveraged to the dismay of the system owner. If you're looking for a book on hacking, this isn't it. If that's what you want to do, this is the wrong book for you. Give it to your admin friend since I'm sure they're going to need it after you go get your book on hacking. So, Instead of the "hacker's eye" view, we're going to give you something a bit more useful to you: the practitioners eye view.
This book not only shows you what to look for, it also tells you why you should be looking for it. Yes, in some places it is somewhat of a step-by-step guide, but we believe in the axiom "give a man a fish and he eats for a day, but teach a man to fish and he eats for the rest of his life." It's a corny saying but it gets the message across pretty well.
We intend on teaching the reader how to configure his or her network to be secure by addressing the issue at its root: the endpoint.
This book also takes a look at how we got here in the hopes that we won't make the same mistakes again. Some of my reviewers took offence at chapter 2 because I placed a portion of the blame for much of our situation squarely on the shoulders of the vendors that have been crafting our solutions. Yes, there are open source security tools but they don't drive our security market.
My hope is that when you are done with this book that you will understand why I believe a closed loop process control model works and how to apply it in your day-to-day security solutions.
On Ignoring Editors, Who is "We", and "Them"
Editors are wonderful people. Many writers hate editors because they change the magnificent prose that the author has spent hours generating and refining. They reinterpret what the author has said and change the way the ideas are presented to the reader by changing the order of words or the use of tone. Some authors hate that. Not me. I'm a rookie and I'm lazy. This is a bad combination for a writer so I don't mind some constructive criticism. Usually.
We.
A simple word that when used by an author is supposed to imply that an intimacy between the author and the reader exists when the reader is engaged in the pages of the book. When an author says "we" it's supposed to mean that small group of people that the reader is tied to by the story line of the book.
That is unless the author isn't using the second person as a construct. For instance, the writer could mean the "we" of the group exclusive of the reader as in "we hacked into this computer to find evidence of kiddy porn". The reader is clearly not included in that group of "we".
So, why have I brought this up at the beginning of a book that's about endpoint security you might be asking? Because I made the mistake of using the word "we" throughout the book without explaining who "we" was each and every time. I thought it was obvious who "we" is.
My editor hated that. Politely, concisely, but nonetheless, she hated it.
Every...
