Introduction to Network Security
Information security organizations

There are many organizations that provide useful information for security professionals. These organizations provide information on detecting and responding to both established and emerging information security threats. Information about operating system weaknesses, best practices for security, and security training and certification information is also available. Independent security evaluations have arisen to provide organizations with an unbiased and objective review of security products. For example, Common Criteria, FIPS 140, and ICSA are some of the independent certifications and evaluations .

CERT/CC
The CERT Coordination Center (CERT/CC) is a reporting center for Internet security issues. The CERT/CC plays a major role in coordinating responses to Internet security threats. The CERT/CC is located at the Software Engineering Institute (SEI) operated by Carnegie Mellon University.

US-CERT
The United States Computer Emergency Readiness Team (US-CERT) is a partnership between the Department of Homeland Security and the public and private sectors. US-CERT was established in 2003 to protect the nation's Internet infrastructure by coordinating defense against and responses to Internet security threats.

US-CERT is responsible for:

  • analyzing and reducing cyber threats and vulnerabilities
  • disseminating cyber threat warning information
  • coordinating incident response activities

SANS Institute
The SysAdmin, Audit, Network, Security (SANS) Institute was established in 1989 as a cooperative research and education organization. The SANS Institute develops and maintains research documents about various aspects of information security. These documents are available at no cost. SANS also operates the Internet Storm Center, an early warning system for Internet security issues.

(ISC)2
The International Information Systems Security Certification Consortium, Inc. (ISC)2 is a non-profit organization that maintains a collection of industry best practices for information security. The (ISC)2 has created two certifications that align to these best practices, the Systems Security Certified Practitioner (SSCP) and the Certified Information Systems Security Professional (CISSP).

Common Criteria
The Common Criteria is an international standard for evaluating IT security. It was developed by a consortium of fourteen countries to replace a number of existing country-specific security assessment and was intended to establish a single high-quality standard for international use. Although there are seven security levels defined for the Common Criteria evaluation process, Evaluation Assurance Level 4 (EAL4) is the highest universal evaluation level implemented under the Common Criteria today .

FIPS
The Federal Information Processing Standard (FIPS) 140 is a US and Canadian Government standard that specifies security requirements for cryptographic modules. FIPS 140 has four levels of assurance: Level 1 is the lowest and Level 4 is the most stringent. Each level builds upon the one below it, so a Level 2 certification means that a product meets the requirements for both Level 1 and Level 2 .

ICSA
ICSA Labs tests firewalls against a standard set of functional and assurance criteria elements. ICSA Labs is presently testing firewalls against the Modular Firewall Product Certification Criteria version 4.0. ICSA also test VPN devices for IPSec interoperability. IPSec interoperability testing validates a product or set of products that use cryptography to provide effective security services. ICSA Certification exists to provide a set of measurable, public-domain standards for commercial security products.


Web Links