164 lines
12 KiB
HTML
164 lines
12 KiB
HTML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<!DOCTYPE html
|
||
|
|
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||
|
|
<html lang="en-us" xml:lang="en-us">
|
||
|
|
<head>
|
||
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||
|
|
<meta name="security" content="public" />
|
||
|
|
<meta name="Robots" content="index,follow" />
|
||
|
|
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
||
|
|
<meta name="DC.Type" content="concept" />
|
||
|
|
<meta name="DC.Title" content="The layered defense approach to security" />
|
||
|
|
<meta name="abstract" content="Your security policy defines what you want to protect and what you expect of your system users." />
|
||
|
|
<meta name="description" content="Your security policy defines what you want to protect and what you expect of your system users." />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zssecurityplanning.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj4securityreadiness.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zgiptraffic.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zrscenario1risks.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zhcryptointro.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj40j0securitypolco.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zgiptraffic.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zoemail.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="../rzalx/rzalxsecterms.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="../rzaja/rzajagetstart.htm" />
|
||
|
|
<meta name="DC.Relation" scheme="URI" content="rzaj45zpftpsolutions.htm" />
|
||
|
|
<meta name="copyright" content="(C) Copyright IBM Corporation 1999, 2006" />
|
||
|
|
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 1999, 2006" />
|
||
|
|
<meta name="DC.Format" content="XHTML" />
|
||
|
|
<meta name="DC.Identifier" content="rzaj40a0internetsecurity" />
|
||
|
|
<meta name="DC.Language" content="en-us" />
|
||
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
||
|
|
<!-- US Government Users Restricted Rights -->
|
||
|
|
<!-- Use, duplication or disclosure restricted by -->
|
||
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
||
|
|
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
||
|
|
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
||
|
|
<title>The layered defense approach to security</title>
|
||
|
|
</head>
|
||
|
|
<body id="rzaj40a0internetsecurity"><a name="rzaj40a0internetsecurity"><!-- --></a>
|
||
|
|
<!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
||
|
|
<h1 class="topictitle1">The layered defense approach to security</h1>
|
||
|
|
<div><p>Your <strong>security policy</strong> defines what you want to protect and
|
||
|
|
what you expect of your system users.</p>
|
||
|
|
<div class="p"> It provides a basis for security planning when you design new applications
|
||
|
|
or expand your current network. It describes user responsibilities, such
|
||
|
|
as protecting confidential information and creating nontrivial passwords.
|
||
|
|
<div class="note"><span class="notetitle">Note:</span> <img src="./delta.gif" alt="Start of change" />You need to create and enact a security policy for your
|
||
|
|
organization that minimizes the risks to your internal network. The inherent
|
||
|
|
security features of iSeries™, when properly configured, provide you with
|
||
|
|
the ability to minimize many risks. When you connect your iSeries system
|
||
|
|
to the Internet, however, you need to provide additional security measures
|
||
|
|
to ensure the safety of your internal network.<img src="./deltaend.gif" alt="End of change" /></div>
|
||
|
|
</div>
|
||
|
|
<p>Many risks are associated with using Internet access to conduct business
|
||
|
|
activities. Whenever you create a security policy, you must balance providing
|
||
|
|
services against controlling access to functions and data. With networking
|
||
|
|
computers, security is more difficult because the communication channel itself
|
||
|
|
is open to attack.</p>
|
||
|
|
<p>Some Internet services are more vulnerable to certain types of attacks than others. Therefore, it is critical that you understand
|
||
|
|
the risks that are imposed by each service you intend to use or provide. In
|
||
|
|
addition, understanding possible security risks helps you to determine a clear
|
||
|
|
set of security objectives.</p>
|
||
|
|
<p><img src="./delta.gif" alt="Start of change" />The Internet is home to a variety of individuals who pose
|
||
|
|
threat to the security of Internet communications. The following list describes
|
||
|
|
some of the typical security risks you may encounter:<img src="./deltaend.gif" alt="End of change" /></p>
|
||
|
|
<ul><li><strong><img src="./delta.gif" alt="Start of change" />Passive attacks<img src="./deltaend.gif" alt="End of change" /></strong>: In a passive attack, the perpetrator
|
||
|
|
monitors your network traffic to try to learn secrets. Such attacks can be
|
||
|
|
either network-based (tracing the communications link) or system-based (replacing
|
||
|
|
a system component with a Trojan horse program that captures data insidiously).
|
||
|
|
Passive attacks are the most difficult to detect. Therefore, you should assume
|
||
|
|
that someone is eavesdropping on everything you send across the Internet.</li>
|
||
|
|
<li><strong>Active
|
||
|
|
attacks:</strong> In an active attack, the perpetrator is trying to break through
|
||
|
|
your defenses and get into your network systems. There are several types of
|
||
|
|
active attacks: <ul><li>In <strong>system access attempts</strong>, the attacker attempts to exploit security
|
||
|
|
loopholes to gain access and control over a client or server system. </li>
|
||
|
|
<li>In <strong>spoofing</strong> attacks,
|
||
|
|
the attacker attempts to break through your defenses by masquerading as a
|
||
|
|
trusted system, or a user persuades you to send secret information to him.</li>
|
||
|
|
<li>In <strong>denial of service attacks</strong>, an attacker tries to interfere with or shut
|
||
|
|
down your operations by redirecting traffic or bombarding your system with
|
||
|
|
junk.</li>
|
||
|
|
<li>In <strong>cryptographic attacks</strong>, an attacker will attempt to guess, or
|
||
|
|
steal your passwords, or will use specialized tools to try to decrypt encrypted
|
||
|
|
data.</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<div class="section"><h4 class="sectiontitle">Multiple layers of defense</h4><p>Because potential Internet
|
||
|
|
security risks can occur at a variety of levels, you need to set up security
|
||
|
|
measures that provide multiple layers of defense against these risks. In general,
|
||
|
|
when you connect to the Internet, you should not wonder <strong>if</strong> you will
|
||
|
|
experience intrusion attempts or denial of service attacks. Instead, you should
|
||
|
|
assume that you <strong>will</strong> experience a security problem. Consequently, your
|
||
|
|
best defense is a thoughtful, proactive offense. Using a layered approach
|
||
|
|
when you plan your Internet security strategy ensures that an attacker who
|
||
|
|
penetrates one layer of defense will be stopped by a subsequent layer.</p>
|
||
|
|
<p><img src="./delta.gif" alt="Start of change" />Your security strategy should include measures that provide protection
|
||
|
|
across the following layers of the traditional network computing model. Generally,
|
||
|
|
you should plan your security from the most basic (system level security)
|
||
|
|
through the most complex (transaction level security).<img src="./deltaend.gif" alt="End of change" /></p>
|
||
|
|
<dl><dt class="dlterm">System level security</dt>
|
||
|
|
<dd>Your system security measures represent your last line of defense against
|
||
|
|
an Internet-based security problem. <span>Consequently,
|
||
|
|
your first step in a total Internet security strategy must be to properly
|
||
|
|
configure <a href="rzaj4securityreadiness.htm#rzaj4securityreadiness">iSeries basic
|
||
|
|
system security settings</a>.</span> </dd>
|
||
|
|
<dt class="dlterm">Network level security</dt>
|
||
|
|
<dd><a href="rzaj45zgiptraffic.htm#rzaj45zgiptraffic">Network security</a> measures
|
||
|
|
control access to your iSeries and other network systems. When you connect
|
||
|
|
your network to the Internet, you should ensure that you have adequate network
|
||
|
|
level security measures in place to protect your internal network resources
|
||
|
|
from unauthorized access and intrusion. A firewall is the most common means
|
||
|
|
for providing network security. Your Internet Service Provider (ISP) can and
|
||
|
|
should provide an important element in your network security plan. Your network
|
||
|
|
security scheme should outline what security measures your ISP will provide,
|
||
|
|
such as filtering rules for the ISP router connection and public Domain Name
|
||
|
|
Service (DNS) precautions. </dd>
|
||
|
|
<dt class="dlterm">Application level security</dt>
|
||
|
|
<dd><img src="./delta.gif" alt="Start of change" /><a href="rzaj45zrscenario1risks.htm#rzaj45zrscenario1risks">Application
|
||
|
|
level security</a> measures control how users can interact with specific
|
||
|
|
applications. In general, you should configure security settings for each
|
||
|
|
application that you use. However, you should take special care to set up
|
||
|
|
security for those applications and services that you will be using from or
|
||
|
|
providing to the Internet. These applications and services are vulnerable
|
||
|
|
to misuse by unauthorized users looking for a way to gain access to your network
|
||
|
|
systems. The security measures that you decide to use need to include both
|
||
|
|
server-side and client-side security exposures. <img src="./deltaend.gif" alt="End of change" /></dd>
|
||
|
|
<dt class="dlterm">Transmission level security</dt>
|
||
|
|
<dd><img src="./delta.gif" alt="Start of change" /><a href="rzaj45zhcryptointro.htm#rzaj45zhcryptointro">Transmission
|
||
|
|
level security</a> measures protect data communications within and across
|
||
|
|
networks. When you communicate across an untrusted network like the Internet,
|
||
|
|
you cannot control how your traffic flows from source to destination. Your
|
||
|
|
traffic and the data it carries flows through a number of different servers
|
||
|
|
that you cannot control. Unless you set up security measures, such as configuring
|
||
|
|
your applications to use the Secure Sockets Layer (SSL), your routed data
|
||
|
|
is available for anyone to view and use. Transmission level security measures
|
||
|
|
protect your data as it flows between the other security level boundaries. <img src="./deltaend.gif" alt="End of change" /></dd>
|
||
|
|
</dl>
|
||
|
|
<p>When developing your overall Internet security policy, you
|
||
|
|
should develop a security strategy for each layer individually. Additionally,
|
||
|
|
you should describe how each set of strategies will interact with the others
|
||
|
|
to provide a comprehensive security safety net for your business.</p>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<div>
|
||
|
|
<div class="familylinks">
|
||
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzaj45zssecurityplanning.htm" title="Use this information to gain a general understanding of the strengths of iSeries security for e-business and the iSeries security offerings available to you.">Planning Internet security</a></div>
|
||
|
|
</div>
|
||
|
|
<div class="relconcepts"><strong>Related concepts</strong><br />
|
||
|
|
<div><a href="rzaj4securityreadiness.htm" title="Use this information to learn what system security you should have in place before you connect to the Internet.">Security levels for basic Internet readiness</a></div>
|
||
|
|
<div><a href="rzaj45zgiptraffic.htm" title="Use this information to learn about the network level security measures that you should consider using to protect your internal resources.">Network security options</a></div>
|
||
|
|
<div><a href="rzaj45zrscenario1risks.htm" title="Use this information to learn about common Internet security risks for a number of popular Internet applications and services and measures that you can take to manage these risks.">Application security options</a></div>
|
||
|
|
<div><a href="rzaj45zhcryptointro.htm" title="Use this information to learn about the security measures that you can use to protect your data as it flows across an untrusted network, such as the Internet. Learn more about security measures for using the Secure Sockets Layer (SSL), iSeries Access Express, and Virtual Private Network (VPN) connections.">Transmission security options</a></div>
|
||
|
|
<div><a href="rzaj40j0securitypolco.htm" title="Defining what to protect and what to expect of users.">Security policy and objectives</a></div>
|
||
|
|
<div><a href="rzaj45zoemail.htm" title="Using e-mail across the Internet or other untrusted network imposes security risks against which using a firewall may not protect.">E-mail security</a></div>
|
||
|
|
<div><a href="../rzaja/rzajagetstart.htm">Virtual private network (VPN)</a></div>
|
||
|
|
<div><a href="rzaj45zpftpsolutions.htm" title="FTP (File Transfer Protocol) provides the capability of transferring files between a client (a user on another system) and your server.">FTP security</a></div>
|
||
|
|
</div>
|
||
|
|
<div class="relref"><strong>Related reference</strong><br />
|
||
|
|
<div><a href="../rzalx/rzalxsecterms.htm">Security terminology</a></div>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
</body>
|
||
|
|
</html>
|