Windows IT Library Update--April 19, 2006

Subscribe to Windows IT Pro: http://list.windowsitpro.com/t?ctl=27609:610453

Make sure your copy of Windows IT Library UPDATE doesn't get mistakenly blocked by antispam software! Be sure to add Windows_IT_Library_UPDATE@list.windowsitpro.com to your list of allowed senders and contacts.

This email newsletter comes to you free and is supported by the following advertisers, which offer products and services in which you might be interested. Please take a moment to visit these advertisers' Web sites and show your support for Windows IT Library UPDATE.

Free Windows Server 2003 Training CD (MCSE/MCSA) http://list.windowsitpro.com/t?ctl=27613:610453

Try it Free: Access & Control PCs from your USB http://list.windowsitpro.com/t?ctl=275FC:610453

==================== 1. Book Review - Securing Storage: A Practical Guide to SAN and NAS Security

2. New from Windows IT Library - Penetration Testing and Network Defense - How to Cheat at Designing Security for a Windows Server 2003 Network 3. New Books in Print - Designing Content Switching Solutions - Effective Software Project Management

4. New Windows IT Pro eBooks - Email Discovery and Compliance - Safeguarding Your Windows Servers - Fax Servers: Integrate. Automate. Communicate. - HA Solutions for Windows, SQL, and Exchange Servers - Ensuring High Availability with Microsoft Exchange Server 5. Windows IT Library Editor's Picks - Managing Spam - Migrating from Legacy Exchange - Secure Web Services with WS-Security

==== Sponsor: AppDev ====

Free Windows Server 2003 Training CD (MCSE/MCSA)

Become MCSE or MCSA 2003 certified with training from AppDev, award-winning provider of technical training. See AppDev quality for yourself! We'll send you a free CD taken directly from our new "Managing and Maintaining Windows Server 2003" course (exam 70-290). Click below to get your free CD -- a $115 value! http://list.windowsitpro.com/t?ctl=27613:610453

==================== ==== 1. Book Review ====

Securing Storage: A Practical Guide to SAN and NAS Security Author: Himanshu Dwivedi Publisher: Addison-Wesley Professional (http://list.windowsitpro.com/t?ctl=27614:610453 ) Published: November 2005 ISBN: 0321349954 Format: Hard cover, 560 pages Price: $49.99

Securing Storage

It sounds obvious that having secure data storage is an integral part of having a watertight system or network that is immune from attack or misuse. But what may appear at first to be a clear-cut issue is not always that easy to implement.

"Securing Storage: A Practical Guide to SAN and NAS Security" was written to help professionals responsible for safeguarding their company's IT infrastructure. The book addresses the technical issues involved in two particular types of storage set-ups: SANs (Storage Area Networks) and NAS (Network Attached Storage).

Before delving into the book's contents, it is worth pointing out that it is no accident that the picture of an elephant is featured on the front cover. The book's author, Himanshu Dwivedi, says the elephant is there to remind readers that, "storage security is the two-ton secret in your data center. It is the big white elephant that you walk by every day - you can see it from your desktop, you look for it on your servers, and you even rest your coffee mug on it every now and then."

Dwivedi says that, "despite the fact that the elephant is very large, heavy (two tons), albino (white), and sitting in the middle of the data center, it is the dirty little secret that no one speaks about. So why do people ignore such a large entity that can significantly damage their enterprise?"

Dwivedi's book is dedicated to answering that question, and learning how to deal with the elephant of storage security in a logical and effective manner. "Securing Storage: A Practical Guide to SAN and NAS Security" begins with an introduction of the six major concepts of security: authentication; authorization; auditing; integrity; encryption; and availability of resources. The chapter also covers scenarios of typical storage attacks, such as Common Internet File System (CIFS) attacks.

One of the most interesting aspects of this part of the book is that Dwivedi has incorporated answers to questions that have been posed by actual SAN and NAS administrators. For example, here are two of those questions from a NAS administrator: "We have firewalls, router ACLs, and encryption devices on our front end IP network, so wouldn't it be virtually impossible for a hacker to get into our NAS storage system?"; and "Wouldn't a hacker need a significant amount of information to actually attack my NAS storage architecture?"

The remainder of the book is divided into five parts. The first part is comprised of three chapters and looks at SAN weaknesses and security attacks from the perspectives of fibre channel security; LUN (Logical Unit Number) masking attacks and HBA (Host Bus Adapters) security; and zone and switch security, risks, and possible attacks.

When exploring the vulnerabilities of storage systems, Dwivedi emphasizes the importance of identifying "the ability to perform the attack, the ease of the attack, the risk the attack offers, the likelihood of the attack, and to understand the possible mitigation(s) of the attack."

The next part of the book examines security risks that are associated with NAS. And while it is true that these risks are similar in some ways to SANs risks, Dwivedi warns that "NAS environments can be more susceptible due to their use of IP and Ethernet, equating to more accessibility to unauthorized users."

He is quick to add that the "reliance of protocols such as Common Internet File System and Network File System, which includes an enormous amount of security issues, makes these environments vulnerable to basic security attacks."

The third section of the book focuses on iSCSI (Internet Small Computer Systems Interface) security, and includes examples of iSCSI security basics, enumeration, mutual authentication, and iSCSI node names.

To ensure that his book remains practical, Dwivedi has incorporated a large number of different types of exercises into his text. For instance, in this third part of the book there are a couple of exercises respectively based around domain hopping attacks and encryption.

In part four of "Securing Storage: A Practical Guide to SAN and NAS Security", the focus turns to storage defenses. Dwivedi's objective when writing this section of his book was to both "discuss and demonstrate the existing features, tools, and configurations available in storage networks that can mitigate the security weaknesses and attacks," discussed earlier in the book.

In order to meet that objective, three chapters in this part of the book explain, in turn, storage defense strategies for securing fibre channel SANs, NAS, and iSCSI storage environments.

The fifth and final part of the book is where you learn about the important skills that are needed to conduct security audits on storage networks, and how to secure storage devices, for example, NAS devices. This section also investigates SAN/NAS policies and trends. So regardless of whether you are your company's IT manager, storage system administrator, security expert, or network administrator, it is essential that you stay up to date with the latest government regulations and how they affect storage systems, especially SANs and NAS.

This section of the book features three case studies, representing real world storage networks in a typical deployment environment. Dwivedi believes that these studies clearly demonstrate how each of the storage networks can be "secured while providing the same amount of capacity, availability, and performance."

The content associated with each of these case studies has been broken down into the following stages: 1) business requirements, security attacks, and regulations; 2) the security solution; and 3) a results checklist, presented in a tabular format, that summarizes how successful the solution was in terms of the different security settings and features that were suggested.

Unless you can physically pick up a book in a book store and thumb through its contents, the next best way of working out if a book can be useful to you is to read a chapter or two of the book over the Internet. The second chapter of "Securing Storage: A Practical Guide to SAN and NAS Security", titled "SANs: Fibre Channel Security," is available online for reading on the Web site of the publisher Addison-Wesley Professional (http://list.windowsitpro.com/t?ctl=27614:610453 ).

I recommend too that you pay a visit to the book's companion Web site (http://list.windowsitpro.com/t?ctl=27611:610453 ). When you do, you will find a link there that will take you to a collection of handy storage security tools.

As you can imagine, any book, such as this one, that tackles a dry subject like storage security can be a long, boring and tough read unless the book is written in a good style. Fortunately "Securing Storage: A Practical Guide to SAN and NAS Security" is very readable, and its layout contains plenty of diagrams, tables, and screen shots to stop readers from being overwhelmed with too much text.

Once you have read this book, you will be in a position to tap into the knowledge and advice it contains to carry out a thorough risk analysis of your own company's storage environment, and most importantly, to devise a workable strategy for protecting that environment.

In conclusion, when it comes to storage security, bear in mind the quote from Mahatma Gandhi that Dwivedi has included in the preface to his book: "Whatever you do will be insignificant, but it very important that you do it."

While it can often seem that the process of securing storage is one that's without end, and also a process that requires constant attention to detail, the alternative of leaving your storage systems open to unauthorized access and data compromise is too frightening to contemplate.

For more book reviews, visit the Windows IT Library Web site. http://list.windowsitpro.com/t?ctl=27610:610453

==== Sponsor: CrossTec ==== Try it Free: Access & Control PCs from your USB NetOp Remote Control provides the most complete, scalable, and secure remote control software available. Access & support PCs & servers behind your corporate firewall from your desktop, CE device or launch it on your USB drive! Now, with the NEW NetOp On Demand option, users outside your environment can request help and be assisted via a tiny, temporary, download ? no installation or firewall configuration and NO per session or recurring charges. Trust NetOp security including 256-bit encryption, centralized audit logs, and NetOp's unique Security & Gateway server modules. Free support & evaluation. http://list.windowsitpro.com/t?ctl=275FC:610453

==== Events and Resources ==== (A complete Web and live events directory brought to you by Windows IT Pro: http://list.windowsitpro.com/t?ctl=2760F:610453 )

Industry guru Randy Franklin Smith helps you identify what you should do to leverage your mobile and wireless infrastructure, how to pick devices that are right for you, and more! http://list.windowsitpro.com/t?ctl=27600:610453

Learn about the advantages of each alternative to traditional file servers and tape storage solutions, and make the best choice for your enterprise needs. http://list.windowsitpro.com/t?ctl=275FF:610453

Gain control of your messaging data with step-by-step instructions for complying with the law, ensuring your systems are working properly, and ultimately making your job easier. http://list.windowsitpro.com/t?ctl=27602:610453

Learn to gather evidence of compliance across multiple systems and link the data to regulatory and framework control objectives. http://list.windowsitpro.com/t?ctl=275FE:610453

Learn how application packaging can cut your OS migration time while maintaining error-free deployment. http://list.windowsitpro.com/t?ctl=27601:610453

==== Featured White Paper ====

Secure Your Online Data Transfer with SSL Increase your customers' confidence and your business by securely collecting sensitive information online. In this free white paper you'll learn about the various applications of SSL certificates and how to deploy them appropriately, along with details of how to test SSL on your Web server. http://list.windowsitpro.com/t?ctl=27603:610453

==== 2. New from Windows IT Library ====

Penetration Testing and Network Defense Penetration Testing and Network Defense is specifically geared towards penetration testing by demonstrating how to detect an attack on a live network. By detailing the method of an attack and how to spot an attack on your network, this book better prepares you to guard against hackers. It also includes important information about liability issues and ethics as well as procedures and documentation. http://list.windowsitpro.com/t?ctl=27605:610453

How to Cheat at Designing Security for a Windows Server 2003 Network This book shows readers how to create secure and available remote access to their network. Most managers in small to medium-sized enterprises, have very little time for designing their Windows Server 2003 network when their primary objective is to get users up and running as quickly as possible. The book uses a Best Practices approach to provide busy managers with clear, succinct instruction for a successful network design. http://list.windowsitpro.com/t?ctl=27604:610453

~~~~Hot Spot: Macrovision ~~~~

Strategically manage your organization's software licenses with a 5-step program to help save time and cut costs by centralizing licensing operations. http://list.windowsitpro.com/t?ctl=275FD:610453

==== 3. New Books in Print ====

Designing Content Switching Solutions Designing Content Switching Solutions helps you understand content switching solutions using Cisco content switching products. You'll get a thorough grounding in the theories and concepts behind content switching and then examine specific solutions through case studies. The case studies in Designing Content Switching Solutions emulate real-world scenarios for the solutions covering some of the common features and functionality deployed in production networks. http://list.windowsitpro.com/t?ctl=27612:610453

Effective Software Project Management For some time, the fields of project management, computer science, and software development have been growing rapidly and concurrently. Effective support for the enterprise demands the merging of these efforts into a coordinated discipline, one that incorporates best practices from both systems development and project management life cycles. Robert K. Wysocki creates that discipline in this book-a ready reference for professionals and consultants as well as a textbook for students of computer information systems and project management. http://list.windowsitpro.com/t?ctl=27606:610453

==== 4. New Windows IT Pro eBooks ====

Email Discovery and Compliance You know you need to manage your email data; how do you do it? What steps are you taking? What additional measures should you enact? What shouldn't you do? This eBook answers these questions and helps you get control of your vital messaging data. This eBook assumes that readers have Microsoft Exchange. Chapter 4 is now available for download.

http://list.windowsitpro.com/t?ctl=275FA:610453

Safeguarding Your Windows Servers How do you prepare for disaster? Do you have procedures in place to properly create and restore a full backup...just in case? Whether you're managing as few as 5 servers or as many as 5000, you need to prepare for the worst. SafeGuarding Your Windows Servers provides a collection of the best resources for planning and implementing high availability as well as the proper tools and procedures for recovering from a disaster. This eBook provides useful guidelines for safeguarding your Windows file-and-print servers, Microsoft Exchange Server, SQL Server, and more. An assortment of tips will also help you tie it all together and get the most out of your high- availability solutions. The entire book is now available for download.

http://list.windowsitpro.com/t?ctl=275F9:610453

Fax Servers: Integrate. Automate. Communicate. While considered by many to be the last remnant of antique information transmission technology, faxing is still one of the most used methods of getting information into the hands of business users. The latest advances in faxing technology make it even easier and more cost effective to integrate faxing into your business process. This eBook will share the current state of the art in faxing technology, show you how to improve business processes by minimizing manual faxing, and demonstrate how to make faxing an integrated component of your business workflow. Chapter 6 is now available for download.

http://list.windowsitpro.com/t?ctl=275F8:610453

HA Solutions for Windows, SQL, and Exchange Servers It's 2:00 A.M. on a Monday morning, and your cell phone rings. The water fountain on the floor directly over your server room has malfunctioned, and your organization's servers and routers are standing in water, as are most of your employees' workstations. The office opens at 8:00 A.M. What do you do in the meantime? This eBook offers solutions for Windows, SQL, and Exchange servers. The entire book is now available for download.

http://list.windowsitpro.com/t?ctl=275F7:610453

Ensuring High Availability with Microsoft Exchange Server Email is an essential service for most businesses today and, for many good reasons, Microsoft Exchange is one of the most widely deployed messaging platforms. In addition to providing the fundamental capabilities of email messaging, Exchange often is responsible for enabling business-critical functions such as workflow routing, calendaring and document storage. In this eBook, you'll learn new ways to improve Exchange recoverability and availability by exploring Exchange Server clusters, Exchange data management, Volume Shadow Copy Service (VSS), and Exchange availability tips and tricks. The entire book is now available for download. http://list.windowsitpro.com/t?ctl=275FB:610453

==== 5. Windows IT Library Editor's Picks ==== Managing Spam In this chapter from "Privacy: What Developers and IT Professionals Should Know," you'll learn the origins of spam, how to address spam as a privacy issue, how to fight back against spammers, and how to send commercial email without becoming a bane of society. http://list.windowsitpro.com/t?ctl=2760C:610453

Migrating from Legacy Exchange In this chapter from "Learning Exchange Server 2003," you'll learn how to update a production environment that contains legacy Exchange servers. http://list.windowsitpro.com/t?ctl=2760B:610453

Secure Web Services with WS-Security In this chapter from "Expert Service-Oriented Architecture in C#," you'll learn about the WS-Security specification and how to use this specification to provide an extensible security implementation that will evolve as Web services technology becomes more sophisticated. http://list.windowsitpro.com/t?ctl=2760D:610453

==== Announcements ==== (from Windows IT Pro and its partners)

Exclusive Spring Savings Subscribe to SQL Server Magazine and SAVE 58%! Along with your 12 issues, you'll get FREE access to the entire SQL Server Magazine online article archive, which houses more than 2,300 helpful articles. This is a limited-time offer, so order now: http://list.windowsitpro.com/t?ctl=27608:610453

Save 44% off the Windows IT Security Newsletter For a limited time, order the Windows IT Security newsletter and SAVE up to $80! You'll get 12 helpful issues loaded with endless fundamentals on building and maintaining a secure enterprise, in-depth product coverage of the best security tools available, and expert advice on the best way to implement various security components. Subscribe now: http://list.windowsitpro.com/t?ctl=2760A:610453

==== Contact Us ==== About the newsletter--letters@windowsitpro.com About technical questions--http://list.windowsitpro.com/t?ctl=2760E:610453 About product news--products@windowsitpro.com About your subscription--windowsitproupdate@windowsitpro.com About sponsoring this UPDATE--emedia_opps@windowsitpro.com.com ==============================

This email newsletter is brought to you by Windows IT Pro, the leading publication for IT professionals deploying Windows and related technologies. Subscribe today. http://list.windowsitpro.com/t?ctl=27607:610453 Manage Your Account You are subscribed as news-and-stuff@arconati.us. You are receiving this email message because you subscribed to this newsletter on our Web site. To unsubscribe, click the unsubscribe link:

http://list.windowsitpro.com/u?id=28351AE7DCFB1F6CA32168B7D5CEC0CD

View the Windows IT Pro Privacy policy at: http://www.windowsitpro.com/AboutUs/Index.cfm?action=privacy Windows IT Pro is a division of Penton Media Inc. 221 East 29th Street, Loveland, CO 80538 Attention: Customer Service Department Copyright 2006, Penton Media, Inc. All rights reserved.