|
|
ix | |
Preface |
|
xiii | |
|
Exploring Library Technology |
|
|
1 | (14) |
|
Common Technologies in Libraries |
|
|
1 | (5) |
|
Integrated Library Systems |
|
|
1 | (2) |
|
|
3 | (2) |
|
|
5 | (1) |
|
Computer Security and Access |
|
|
6 | (5) |
|
Basic Security Considerations for Desktop/Laptop Computers |
|
|
7 | (1) |
|
|
8 | (3) |
|
|
11 | (1) |
|
Key Points and Conclusion |
|
|
12 | (1) |
|
|
13 | (2) |
|
Examining Library Security Principles |
|
|
15 | (6) |
|
Understanding Library Security |
|
|
15 | (1) |
|
Implementing Library Security |
|
|
16 | (2) |
|
Security Principles and Inventory |
|
|
16 | (1) |
|
Security Principles and Policies |
|
|
17 | (1) |
|
Policy Implementation and Enforcement |
|
|
17 | (1) |
|
Access-level, Physical-level, and Software-level Security |
|
|
18 | (1) |
|
|
19 | (1) |
|
Key Points and Conclusion |
|
|
19 | (1) |
|
|
20 | (1) |
|
Performing a Technology Inventory |
|
|
21 | (10) |
|
Beginning the Inventory: What Should Be Recorded? |
|
|
21 | (2) |
|
Media Access Control Addresses |
|
|
22 | (1) |
|
Compiling a Comprehensive Technology Inventory |
|
|
23 | (6) |
|
|
29 | (1) |
|
Key Points and Conclusion |
|
|
29 | (1) |
|
|
30 | (1) |
|
Creating a Network Security Policy |
|
|
31 | (42) |
|
Building a Written Policy for Library Security |
|
|
31 | (1) |
|
|
32 | (2) |
|
Classification of Information |
|
|
32 | (2) |
|
|
34 | (13) |
|
|
35 | (2) |
|
|
37 | (3) |
|
|
40 | (3) |
|
Security Patches and Software Upgrades |
|
|
43 | (1) |
|
Authority and Responsibility Delegation |
|
|
43 | (1) |
|
Personnel Additions, Departures, and Terminations |
|
|
44 | (3) |
|
Staff Technology Policy: Desktops, Laptops, Printers |
|
|
47 | (6) |
|
Technology Security Leader |
|
|
48 | (1) |
|
|
49 | (1) |
|
|
50 | (1) |
|
|
50 | (1) |
|
|
51 | (2) |
|
Public Technology Policy: Desktops, Laptops, Printers |
|
|
53 | (4) |
|
Definition of Valid Patron or User |
|
|
53 | (1) |
|
|
54 | (1) |
|
|
54 | (1) |
|
|
55 | (1) |
|
Personally Owned Computers/Laptops/Wireless Products |
|
|
56 | (1) |
|
|
56 | (1) |
|
|
56 | (1) |
|
Network Policy: Routers, Firewalls, Switches, Wireless Access, Monitoring Software/Appliances |
|
|
57 | (13) |
|
|
62 | (1) |
|
|
62 | (1) |
|
|
62 | (1) |
|
|
63 | (1) |
|
|
63 | (2) |
|
|
65 | (1) |
|
Inappropriate Employee or Patron Conduct |
|
|
66 | (1) |
|
|
67 | (1) |
|
Official Law Enforcement Investigation |
|
|
67 | (3) |
|
|
70 | (1) |
|
Key Points and Conclusion |
|
|
70 | (3) |
|
Understanding Threats from Hackers and Malcontents |
|
|
73 | (26) |
|
|
73 | (1) |
|
|
74 | (3) |
|
1960s: The Dawn of Hackers |
|
|
74 | (1) |
|
1970s: Innovation and Creativity |
|
|
75 | (1) |
|
1980s: Hacker Clubs and Movies |
|
|
75 | (1) |
|
|
76 | (1) |
|
Hackers of the Twenty-first Century |
|
|
77 | (1) |
|
|
77 | (1) |
|
|
78 | (3) |
|
Additional Hacker Methodology |
|
|
80 | (1) |
|
Network Infrastructure Vulnerabilities |
|
|
81 | (7) |
|
|
81 | (2) |
|
Wireless Local Area Networks |
|
|
83 | (1) |
|
|
84 | (1) |
|
Vulnerabilities of Other Operating Systems |
|
|
85 | (1) |
|
|
86 | (1) |
|
Application Hacks: E-mail, Instant Messaging, and Voice-over Internet Protocol |
|
|
86 | (1) |
|
Vulnerabilities of Web Servers |
|
|
87 | (1) |
|
|
88 | (5) |
|
|
89 | (1) |
|
Current Top Virus Threats |
|
|
90 | (3) |
|
|
93 | (3) |
|
|
94 | (1) |
|
|
94 | (2) |
|
|
96 | (1) |
|
Key Points and Conclusion |
|
|
96 | (1) |
|
|
97 | (2) |
|
Planning for Security Implementation and Auditing Weaknesses |
|
|
99 | (16) |
|
Determining Security Needs |
|
|
104 | (1) |
|
Security Audit: Finding Security Weaknesses |
|
|
104 | (1) |
|
Security Audit Tools and Techniques |
|
|
105 | (6) |
|
|
105 | (3) |
|
|
108 | (1) |
|
|
109 | (1) |
|
Web Application Assessment Proxy |
|
|
110 | (1) |
|
|
110 | (1) |
|
Building a Plan to Implement the Audit |
|
|
111 | (2) |
|
|
113 | (1) |
|
Key Points and Conclusion |
|
|
114 | (1) |
|
|
114 | (1) |
|
Implementing Policies for Secure Public Technology |
|
|
115 | (14) |
|
Background for a Sound Security Foundation |
|
|
115 | (2) |
|
Library Security Profile and Checklist |
|
|
116 | (1) |
|
Public Access Computing Policies |
|
|
117 | (2) |
|
|
117 | (1) |
|
Public Access Security for Patron Laptops |
|
|
118 | (1) |
|
|
119 | (2) |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
Software for Phishing Protection |
|
|
120 | (1) |
|
Protecting Patron Privacy with Library Technology |
|
|
121 | (2) |
|
|
122 | (1) |
|
|
122 | (1) |
|
|
122 | (1) |
|
|
122 | (1) |
|
Public Access Security Solutions |
|
|
123 | (4) |
|
Microsoft Windows SteadyState |
|
|
123 | (1) |
|
|
124 | (2) |
|
|
126 | (1) |
|
|
127 | (1) |
|
Key Points and Conclusion |
|
|
127 | (1) |
|
|
128 | (1) |
|
Developing Security for Library Office Technology |
|
|
129 | (14) |
|
Securing Staff Computers: Best Practices |
|
|
129 | (6) |
|
Provide Security Training for Staff |
|
|
129 | (2) |
|
Monitor Computer Abuse by Library Staff |
|
|
131 | (1) |
|
Provide Employee Compliance Checks |
|
|
132 | (1) |
|
|
132 | (1) |
|
Emphasize Safe Internet Browsing Habits |
|
|
133 | (1) |
|
|
133 | (1) |
|
Keep the Computer Up to Date with Patches |
|
|
134 | (1) |
|
|
135 | (3) |
|
|
135 | (2) |
|
|
137 | (1) |
|
|
138 | (3) |
|
|
139 | (1) |
|
|
139 | (2) |
|
|
141 | (1) |
|
Key Points and Conclusion |
|
|
141 | (1) |
|
|
142 | (1) |
|
Establishing Server Security |
|
|
143 | (24) |
|
Understanding Servers and How They Work |
|
|
143 | (2) |
|
|
145 | (3) |
|
|
146 | (1) |
|
HTTPS: Secure Web Servers |
|
|
147 | (1) |
|
FTP: File Transfer Protocol |
|
|
147 | (1) |
|
|
148 | (1) |
|
Microsoft Domain Controllers and Active Directory |
|
|
148 | (10) |
|
|
149 | (6) |
|
|
155 | (2) |
|
|
157 | (1) |
|
|
158 | (1) |
|
|
158 | (1) |
|
Exchange Server; E-mail/Calendar Servers |
|
|
159 | (1) |
|
Microsoft Exchange Server |
|
|
160 | (1) |
|
|
160 | (4) |
|
|
164 | (1) |
|
Key Points and Conclusion |
|
|
164 | (1) |
|
|
165 | (2) |
|
Securing the Library Network from External Threats |
|
|
167 | (22) |
|
Access to the Internet: A Brief Review |
|
|
167 | (2) |
|
Using Firewalls for External Protection |
|
|
169 | (10) |
|
Firewalls and Data Transmission |
|
|
169 | (2) |
|
|
171 | (3) |
|
Specifications for Firewall Location |
|
|
174 | (1) |
|
Obtaining and Configuring the Firewall |
|
|
174 | (5) |
|
Local Computer-level Protections from Internet Threats |
|
|
179 | (1) |
|
|
180 | (6) |
|
|
180 | (6) |
|
Linux, Red Hat, and Other Flavors of Operating Systems |
|
|
186 | (1) |
|
|
186 | (1) |
|
Key Points and Conclusion |
|
|
187 | (1) |
|
|
188 | (1) |
|
Securing the Library Network from Internal Threats |
|
|
189 | (16) |
|
LAN Design and Configuration |
|
|
189 | (5) |
|
Wireless Access Points and Wireless Security |
|
|
194 | (4) |
|
|
194 | (1) |
|
Using Routers for Internal Protection |
|
|
195 | (2) |
|
Using Firewalls for Internal Protection |
|
|
197 | (1) |
|
Public Access Systems: Securing Workstations |
|
|
198 | (1) |
|
Protecting the Internal Network from Patron Laptops |
|
|
199 | (1) |
|
Securing Staff Systems from Internal Threats |
|
|
200 | (3) |
|
Security Considerations for Staff Laptops |
|
|
202 | (1) |
|
|
203 | (1) |
|
Key Points and Conclusion |
|
|
204 | (1) |
Appendix A. Links to State Laws on Cyber or Computer Crime |
|
205 | (6) |
Appendix B. Vendor or Software Web Sites |
|
211 | (2) |
Glossary |
|
213 | (24) |
Index |
|
237 | (8) |
About the Authors |
|
245 | |