ISCWSL安全管理和报告.pptxVIP

会计学1ISCWSL安全管理和报告 Secure Management and Reporting Planning Considerations第1页/共44页 Secure Management and Reporting Planning ConsiderationsWhich are the most important logs?How are important messages separated from routine notifications?How do you prevent tampering with logs?How do you make sure time stamps match?What log data is needed in criminal investigations?How do you deal with the volume of log messages?How do you manage all the devices?How can you track changes when attacks or network failures occur?第2页/共44页 Secure Management and Reporting Architecture第3页/共44页 Secure Management andReporting Architecture第4页/共44页 Information Paths第5页/共44页 In-Band Management ConsiderationsWhich management protocols does each device support?Does the management channel need to be active at all times?Is SNMP necessary?第6页/共44页 Secure Management andReporting GuidelinesIn-band management guidelines:Apply only to devices needing to be managed or monitored. Use IPsec when possible.Use SSH or SSL instead of Telnet. Decide whether the management channel needs to be open at all times.Keep clocks on hosts and network devices synchronized.Record changes and archive configurations.OOB management guidelines:Provide highest level of security and mitigate the risk of passing insecure management protocols over the production network.Keep clocks on hosts and network devices synchronized.Record changes and archive configurations.第7页/共44页 Configuring an SSH Server for Secure Management and Reporting第8页/共44页 Configuring an SSH Server forSecure Management and ReportingAustin2#configure terminalAustin2(config)#ip domain-name Austin2(config)#crypto key generate rsa general-keys modulus 1024Sept 22 13:20:45: %SSH-5-ENABLED: SSH 1.5 has been enabledAustin2(config)#ip ssh timeout 120Austin2(config)#ip ssh authentication-retries 4Austin2(config)#line vty 0 4Austin2(config-line)#no transport input telnetAustin2(config-line)#transport input sshAustin2(config-line)#endConfigure the IP domain nameGene