Secure Your Network for Free

Eric Seagren

• Publisher: Syngress
• Year: 2011
• Print ISBN: 9781597491235
• eBook ISBN: 9780080516813
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

This is the only book to clearly demonstrate how to get big dollar security for your network using freely available tools. This is a must have book for any company or person with a limited budget.Network security is in a constant struggle for budget to get things done. Upper management wants thing to be secure but doesn't want to pay for it. With this book as a guide, everyone can get what they want. The examples and information will be of immense value to every small business. It will explain security principles and then demonstrate how to achieve them using only freely available software. - Teachers you how to implement best of breed security using tools for free - Ideal for anyone recomending and implementing new technologies within the company

Chapter 1

Presenting the Business Case for Free Solutions

Solutions in this chapter:

■ The Costs of Using Free Security Solutions?

■ The Savings of Using Free Security Solutions?

■ Comparing Free Solutions with Commercial Solutions

■ “Selling” a Free Solution

☑ Summary

☑ Solutions Fast Track

☑ Frequently Asked Questions

Introduction

You may be looking for inexpensive ways to solve a security problem and want to know more about the free tools that are available. This book will guide you to some of the best free solutions. In some environments, taking the initiative and implementing any type of security measures can get you in trouble; even with the best planning, problems can arise. This chapter will help you gain the support you need in order to implement a cost saving solution.

Whether you are the person implementing the changes and need to “sell” the solution to your manager, or you’re the person making the decisions and need to understand the true implications of a particular “free” solution, this chapter will help you find solutions to your security problems. This chapter discusses some of the hidden costs associated with free solutions and clarifies what comes from those solutions. This chapter also addresses the fact that in most cases, an apples-to-apples comparison between a free package and a commercial product is not feasible. With all of this information, you should be in a good position to propose a solution and back up your choice with some compelling business arguments.

The Costs of Using Free Security Solutions

In the case of security solutions, few things in life are free. And while you may not pay for a security solution itself, there are costs associated with implementing a solution that are not obvious. In most cases, your security needs dictate which solutions are appropriate; if there is not a free solution available, you have to use commercial tools. Fortunately, there are a lot of high-quality free solutions available. The cross section included in subsequent chapters is aimed at providing a spectrum of solutions with a variety of sophistication levels. If you dive headlong into implementing a free solution without adequate knowledge and research, it could end up costing you more than if you had purchased a commercial solution.

Training Costs

Training costs are one of the biggest expenses when it comes to implementing a free solution. First are the direct training expenses (e.g., sending someone for classroom instruction). Your options may be limited when it comes to training for free software solutions. In most cases, training does not exist in a focused format (i.e., you probably won’t find a class on netfilter firewalls). Instead, you may be able to find applicable training indirectly, such as in classes on general Linux use or administration.

Another training cost is materials (e.g., books). Aside from this book, there will likely be areas where you want more specialized information. For example, if you are implementing a Snort intrusion detection system (IDS), this book walks you through setting up Snort. A small library covering the specific software you have deployed is a worthwhile investment.

You will also incur training costs, such as not having access to an employee during training. This time away from work is an expense, because you are paying for an asset that isn’t available. The same is true if the employee is on-site and “self-training.”

Hardware Costs

A security appliance is a device that doesn’t require a computer and is only used for its intended purpose, while all of the free solutions require a system to run on. Luckily, the requirements are usually minimal; therefore, you can often use an old PC. However, connectivity requirements could make using the system in a nondedicated configuration a security risk. Rarely does a system require enough resources to make using the same host for any other function impractical (e.g., the Snort IDS logging capability can quickly eat up disk space, leaving little to no resources for other programs).

If there are no old systems available, there are many online retailers offering older systems at affordable rates. A large portion of the cost for low-end PC’s is often for the operating system. Many retailers offer affordable systems that either include Linux as the operating system, or come without an operating system installed. These allow you to purchase a relatively modern system cheaply, and then install your own OS on it. This can be a viable option for running security tools and providing user workstations.

Consulting Costs

You must carefully weigh and balance where you spend your money. Too little training and you will end up hiring consultants. Implementing, configuring, or fixing your free firewall can cost a lot, more than if you had bought a firewall. With small commercial firewalls costing around $500.00, it doesn’t take long before free isn’t so free.

With that said, don’t be afraid to call a consultant if necessary. Having a well-paid consultant configure your free solution and make sure that it’s implemented using best practices is a steal compared to implementing some proprietary solutions. A consultant can also act as a trainer. You can shadow the consultant and see how and what is being done, and you can ask questions and learn why things are done a certain way. In this way you can have your solution set up by someone who is knowledgeable and experienced, and provide training and guidance to the in-house personnel.

If you have ever had to rely on consultants, you probably know they are not always a “good buy.” Sometimes they are not as knowledgeable as you were led to believe. The key is to communicate with the consulting firm, being very clear about what your needs are. A good consultant can save the day.

Warning

You should always be careful when cutting consulting budgets. I have seen attempts to save money end up costing more. In almost all cases, getting a consultant in quickly is the best course of action and the most cost effective in the long run. If you find a skilled consultant you like, a monthly retainer might be a good investment.

Hidden Costs

What are all the costs of a free solution? For starters, power consumption. I had a Windows 98 system that was only being used as a print server. It occurred to me that the PC cost me approximately $7 per month in electricity. With a dedicated print server costing only about $30.00 and using virtually no electricity, I would save money within five months by buying the print server. The Pentium II running Windows 98 was technically “free,” but paying for electricity to keep it running was not the most cost-effective choice. Some security tools are not offered as a commercial appliance, and some are (e.g., small, low cost firewalls that use far less power than a standard desktop PC are available from several manufacturers). Your cost for electricity will vary. Based on your electric bill, you can calculate with a high degree of accuracy what a given device costs.

Another consideration is heating, ventilation, and air-conditioning (HVAC) costs. HVAC is basically the climate controls. Additional computers create additional heat, which costs more money for air conditioning. The same considerations apply as for power consumption. If a stand-alone appliance is not an option, the additional HVAC requirements are an unavoidable cost; however, in those cases where more efficient appliance-based solutions exist, they almost always produce less heat than a normal workstation. This also applies to the difference between an older computer and a newer computer. Newer systems that demand more power and cooling when they are being heavily utilized often incorporate energy-saving characteristics that are superior to those of the older systems.

There is also the cost of real estate. A decommissioned full-sized tower PC takes up a lot more space than a new commercial appliance the size of a cigar box. You may have plenty of room now, but as the server room gets more and more crowded, space could become an issue. A keyboard, video, and mouse (KVM) switch might save more in space than it costs to buy. As the servers become increasingly tightly packed, good air flow and adequate cooling will be inhibited, and physical access to the systems for operation or maintenance will also be difficult.

Inefficiency is another cost of free solutions with respect to the fact that the support staff are likely unfamiliar with the new free solutions. When a staff member performs a task on a new firewall, it takes longer to do than if they are familiar with the firewall. This inefficiency typically costs only the time to complete a task; however, if an outage or business disruption occurs, this delay could result in lost profit or business. These delays must also be accounted for when planning projects and other activities.

Free solutions are usually produced by small organizations or by an individual. These solutions may do an excellent job in their assigned roles, but may not be well known. This could be a liability if the individual who configured your free solution leaves or is otherwise unavailable. If you have a PIX firewall that needs work, you probably would not have a hard time locating a resource. On the other hand, if you need someone to take over the administration of an obscure free solution, finding someone could be difficult. This difficulty could manifest itself as a hidden cost by increasing the delay before a problem can be addressed, having to pay a premium for a consultant, or any number of other inefficiencies.

The Savings of Using Free Security Solutions

The following section discusses how a free security solution can save you money. The primary savings is obvious: you didn’t pay for the product; however, there are additional benefits. This section offers a detailed look into the benefits of using free software. By evaluating the expected savings and costs, you can form a more practical, accurate picture of what will be gained by implementing a free security solution.

Purchase Costs

The purchase cost is one of the single largest cost savings of using free software. The best example of this is with firewalls. A small Linksys or Netgear firewall costs around $20.00 to $50.00. They use almost no power, support port forwarding, perform Network Address Translation (NAT), act as a Dynamic Host Configuration Protocol (DHCP) server, and are stateful packet filters. Suppose you use Linux and netfilter to run a firewall for free. Odds are it will cost more to pay for the employee’s time to set up the Linux firewall than the Linksys would cost to buy. Firewalls are one of the best examples of how readily available affordable commercial solutions can be.

You can still save money on purchases. Some types of products, particularly IDSes, network analysis and reporting tools, and commercial virtual private network (VPN) solutions can cost staggering amounts of money. When comparing prices, come as close as possible to comparing like products. Using the most expensive “deluxe” software suite available as the price for decision making is misleading. The free solution will not have the same features and capabilities as the commercial version. Look at the features you think you need as a starting point for which commercial products would be viable options. Use the costs of those products as your basis for determining what the free solution will save you.

Maintenance Costs

Maintenance can be expensive; it is not uncommon for a yearly maintenance contract to cost 10 percent of the purchase price. This price will also fluctuate, as almost all vendors have various support tiers with varying response times and service level agreements (SLAs). The reality is, however, if you opt for the free solution and spend the 10 percent on training instead, you would probably have a very high level of responsi...

Table of contents

• Cover image
• Title page
• Table of Contents
• Copyright page
• Lead Author
• Technical Editors
• Companion Web Site
• Chapter 1: Presenting the Business Case for Free Solutions
• Chapter 2: Protecting Your Perimeter
• Chapter 3: Protecting Network Resources
• Chapter 4: Configuring an Intrusion Detection System
• Chapter 5: Managing Event Logs
• Chapter 6: Testing and Auditing Your Systems
• Chapter 7: Network Reporting and Troubleshooting
• Chapter 8: Security as an Ongoing Process
• Index