Policies define standards for secure network design and defensive actions, allowing network managers to incorporate a consistent multilayer defense strategy into their procedures. For example, using firewalls and access control lists to segment corporate finance, the executive staff, and production networks can go a long way toward limiting the amount of information intruders could gather or the damage vandals could do. Comprehensive security policies should also contain action checklists that network administrators can follow to allay attacks in progress. Many attacks can be prevented or curbed through disciplined systems administration procedures. Reconnaissance attacks use sniffers, scanners, and other tools to gather information that could be used to compromise assets later.
Many crackers run such tools continuously and sort data to identify vulnerable hosts.
Most reconnaissance attacks can be deflected through conscientious router and server configurations to turn off unneeded services, especially where they are exposed to the Internet. Using such tools, the Cisco Secure Consulting Services group has been able to crack 53 percent of passwords obtained from compromised networks. Preventive actions against access attacks include using strong passwords that combine letters and numbers, protecting Internet mail servers using proxy devices such as firewalls, and filtering incoming TCP requests by allowing only those services that are needed. Both services are rarely deployed over the Internet but are often allowed through Internet filtering devices. Web services are particularly vulnerable to access attacks.