- Amazon Student members save an additional 10% on Textbooks with promo code TEXTBOOK10. Enter code TEXTBOOK10 at checkout. Here's how (restrictions apply)
Security Power Tools Paperback – Sep 6 2007
|New from||Used from|
Special Offers and Product Promotions
Customers Who Bought This Item Also Bought
No Kindle device required. Download one of the Free Kindle apps to start reading Kindle books on your smartphone, tablet, and computer.
To get the free app, enter your e-mail address or mobile phone number.
About the Author
Bryan Burns is the technical editor and general project leader of this book. He is the Chief Security Architect for Juniper Networks with more than a decade of experience in the security networking field and with numerous posts at leading network security companies.All other contributors are security engineers and researchers working at Juniper Networks in various posts both in the security network lab and in the field.
Dave Killion (NSCA, NSCP) is a senior security research engineer with Juniper Networks, Inc. Formerly with the U.S. Army's Information Operations Task Force as an Information Warfare Specialist, he currently researches, develops, and releases signatures for the NetScreen Deep Inspection and Intrusion Detection and Prevention platforms. Dave has also presented at several security conventions including DefCon and ToorCon, with a proof-of-concept network monitoring evasion device in affiliation with several local security interest groups that he helped form. Dave lives south of Silicon Valley with his wife Dawn and two children, Rebecca and Justin.
Nicolas Beauchesne is a network security engineer specializing in network penetration. He has worked with Juniper Networks for the past two years.
Eric Moret is originally from France and lives with his wife and two children in the San Francisco Bay Area. He obtained his Masters degree in Computer Sciences in 1997. He currently works at Juniper Networks where he manages a team dedicated to testing and releasing network protocol decoders for security appliance products. In addition to writing he enjoys traveling the world, photography and, depending on the season, snow boarding the Sierra Nevada or scuba diving Mexican caves.
Julien Sobrier is a network security engineer at Zscaler. He works on the web security in the cloud. He was previously working for Juniper Networks. His experience was on the Intrusion Detection and Preventions systems. He is also the creator of http://safe.mn/, a URL shortener focused on security.
Michael Lynn is a network security engineer at Juniper Networks. He has worked there for the past two years.
Eric Markham is a security engineer. He has been with Juniper Networks for the past five years.
Chris Iezzoni has been a security researcher and signature developer with Juniper's security team for several years.
Philippe Biondi is a research engineer at EADS Innovation Works. He works in the IT security lab, and is the creator of many programs like Scapy or ShellForge.
Jennifer Stisa Granick is the Civil Liberties Director at the Electronic Frontier Foundation. Before EFF, Granick was a Lecturer in Law and Executive Director of the Center for Internet and Society at Stanford Law School where she taught Cyberlaw and Computer Crime Law. She practices in the full spectrum of Internet law issues including computer crime and security, national security, constitutional rights, and electronic surveillance, areas in which her expertise is recognized nationally.
Before teaching at Stanford, Jennifer spent almost a decade practicing criminal defense law in California. She was selected by Information Security magazine in 2003 as one of 20 "Women of Vision" in the computer security field. She earned her law degree from University of California, Hastings College of the Law and her undergraduate degree from the New College of the University of South Florida.
Steve Manzuik has more than 13 thirteen years of experience in the information technology and security industry. Steve founded and was the technical lead for Entrench Technologies. Prior to Entrench, Mr. Manzuik was a manager in Ernst & Young's Security & Technology Solutions practice. Steve co-authored Hack Proofing Your Network, Second Edition (Syngress, 1928994709).
Paul Guersch is a security technical writer and one of the developmental editors of Security Power Tools (O'Reilly). He has been with Juniper Networks for a year and a half.
Inside This Book(Learn More)
Most Helpful Customer Reviews on Amazon.com (beta)
I'll begin with my favorite sections. SPT started very strongly with Jennifer Grannick's chapter on law as it pertains to security issues. She is an excellent writer and I would like to see her create her own book on the same subject. I liked Philippe Biondi's work in Ch 6 (Custom Packet Generation) although his coverage of Scapy (while great) is not for the beginner. (Just try as many examples as you can -- Scapy is cool.) Ch 7 (Metasploit) provided a great discussion of Metasploit 3; I learned quite a bit. I was pleasantly surprised by Ch 15 (Securing Communications). It was very practical. I should mention that some of the chapters appeared to be good, but they were outside my expertise and beyond my skill level. These included Ch 10 (Custom Exploitation), Ch 22 (Application Fuzzing) and Ch 23 (Binary Reverse Engineering). I was initially inclined to skip the section on BO2k in Ch 11 (Backdoors), but I didn't know the tool had been updated in Mar 07 and could be considered "viable" in the age of botnets.
Readers may also like SPT because it mixes coverage of open source and commercial tools. For example, Ch 9 (Exploitation Framework Applications) covers CORE IMPACT and Immunity CANVAS. Ch 3 (Vulnerability Scanning) describes WebInspect. Ch 17 (Device Security Testing) describes Traffic IQ Pro. Other commercial tools are mentioned in SPT but these were covered with more than a cursory overview.
The major problems I had with SPT involved indications of old material and lack of originality. Ch 20 (Host Monitoring) doesn't include any URLs for the tools it mentions. Tool versions are incredibly out-of-date, with references to 2006 or even 2005, despite versions from early 2007 (pre-publication) being available. (Examples: Afick 2.10-1, 17 May 07; Samhain 2.3.4, 1 May 07; Tripware Open Source 184.108.40.206, 18 Apr 07). Ch 19 (Network Monitoring) mentions ACID as a Snort console; BASE replaced ACID in Sep 04! The script to download and update Snort rules uses snortrules.tar.gz, which also (besides not working now) dates it to late 2004. Ch 22 says @Stake's WebProxy is a great tool, but it's been unavailable for several years. Ch 23 mentions SoftIce, but it was discontinued in Apr 06. (Unfortunately the same chapter neglects covering PaiMei "since it will probably change" -- although the Web page lists 22 May 07 as the last update.) Ch 2 (Network Scanning) lists PortSentry, but that tool hasn't been supported since '03 and is now replaced by Mike Rash's Psad. Ch 13 spends a lot of time talking about IPFW as a BSD firewall, even though Pf has been the preferred tool for several years. Ch 5 (Wireless Reconnaissance) seems to ignore that AirPcap is a viable solution for wireless sniffing on Windows. Ch 21 (Forensics) offered absolutely nothing new or advanced.
Overall, you will probably find something to really like about SPT. I would take a much different approach in the future. Trying to coordinate so many authors probably resulted in some authors finishing their sections in late '05 or early '06. They waited until the remainder finished so the book could be published in Aug 07. I am not convinced another mammoth book is needed -- maybe smaller books on focused topics would be worthwhile. I would also not bother to cover tools addressed elsewhere --especially in other O'Reilly books.
Beginners will like the logical structure, beginning with ethical issues and progressing through Reconnaissance, Penetration, Control, Defense, Monitoring and Discovery. This is a logical sequence that closely follows how a new security analyst would actually learn security topics. In particular I thought part II, Reconnaissance, was well-written and clear, covering all the major tools and explaining the complex topics in a way that should be very clear to the newbie.
Experts will like it as a good, and very up-to-date, survey of all the major tools and techniques. I learned quite a bit in the Penetration section that I didn't know before, such as the section on MOSDEF and Canvas. The index is very good, so even if you don't read through this cover-to-cover it's a good reference on tools and common techniques.
The book is edited well and meets my high expectations for an O'Reilly book. Graphics and screenshots are liberally shown throughout, and callout boxes explain advanced topics in many sections. Although there are a bunch of authors the editorial style is pretty consistent and it doesn't feel like a mishmash.
Overall this is a great book for security researchers at any level, and it compares well with my favorite O'Reilly security book, the venerable Building Internet Firewalls.
If you like this book you'd probably also like the excellent Network Warrior by Gary Donahue. This book is a good general survey of everything in security, while Gary's book is a more of a personal testimonial from a professional security researcher about how he does his job. Both are useful in their own way.
The huge range of security tools covered along with how to use them should be of great use to anyone looking to improve their system security. Unfortunately some of the sections discuss tools that are perhaps more useful for breaking into systems than defending them (hopefully no would be crackers will buy the book - the established crackers probably already have those products).
The first chapter doesn't really fit with the rest of the book either. While the rest of the book covers security in general - both how to set it up and how to break through it where possible, the first chapter concerns itself with US law and ethics. Not only is the US not the only part of the world where computer security is relevant (and the rest of the world have different laws) but also the ethical views expressed in that chapter are not lived up to in all of the rest of the book and some of the chapters cross the line from white hat security into black hat.
The other issue that I had with this book is that the huge size of the book makes the binding a problem. The first time I put the book downwith it open, the binding split almost half way up the page meaning that the first few dozen pages in my copy are now only partly attached to the rest of the book.
Having said that, I really enjoyed reading this book. I read it nearly cover-to-cover, and while I was at least familiar with most of the material in the book, I was still able to find gems of knowledge, even in tools that I work with on a daily basis. Expect to read about some tools that you may already know about, like Nmap, Nessus, and The Metasploit Framework, but keep reading for a heap of other useful applications that you may not be familiar with.
One of the strengths of the book is the varying backgrounds of its contributing authors; just as the book covers a diverse tool set, the expertise of the authors is also diverse. The book was written collaboratively by twelve individuals, made up primarily of Juniper Networks' J-Security team […]. Despite an opportunity for vendor-bias towards Juniper products, the book remained vendor-neutral. The majority of the book focuses on open-source and free-ware applications, although there is commercial software covered as well. In fact, Chapter 9 - Exploitation Framework Applications covers Canvas […] and Core Impact […] exclusively; both commercial applications.
One of the chapters that makes this book unique is the chapter on Law and Ethics, written by Jennifer Stisa Granick. You may recognize Ms Granick from her representation of Michael Lynn in during the Cisco Gate ordeal at Black Hat 2005 (coincidentally, Michael Lynn is also one of the contributing authors of this book). She provides an insightful discussion on not only the legal implications of security work, but also the role that ethics plays in some of those "gray" areas that security professionals may find themselves in.
Another chapter that sets this book apart is Chapter 6 - Custom Packet Generation, which primarily focuses on the use of Scapy. The chapter is written by Phillipe Biondi, the author of Scapy, and he provides an excellent argument to "Decode, Do Not Interpret". He discusses the advantages of writing tools that will provide you with raw decoded information, without an interpretation of that information. For instance, if you scanned a port on a remote host, Biondi would argue that it would be better for your tool to tell you that the remote host returned a RST packet rather than telling you that the port is closed. Beyond this valuable discussion, Biondi provides a very thorough discussion of the uses of Scapy, along with several good examples. This chapter alone makes this book worth buying.
While I liked this book, there were also some problems that prevented me from giving it a 5-star rating. For starters, the preface describes the overwhelming amount of content that was edited out of this book to keep it within size constraints, yet there was quite a bit of content that detracted from the value-density of the book. As I mentioned previously, the majority of SPT is a security primer and should not be considered a reference. Given this position, I believe that there was too much step-by-step installation and setup content. As an example, Chapter 16 - E-Mail Security and Anti-Spam covered the installation and management of the Norton Anti-Virus client. I can appreciate the security-related value of anti-virus software, but I felt that a step-by-step walk through of a Norton product was irrelevant.
Additionally, while I previously stated that the diverse expertise of the authors was a benefit, the varied writing style detracted from the readability of the book. Content aside, I found some chapters to be fun to read while others were boring, due to a particular author's writing style.
In summary, I would recommend this book to anyone interested in an overview of where to get started in researching security tools for a particular purpose. While none of the discussions in the book are exhaustive, they will definitely get you started and arm you with enough information to know what you want and where to get it.
Look for similar items by category
- Books > Business & Investing > Industries & Professions > E-commerce
- Books > Computers & Technology > Certification Central > Exams > Security+
- Books > Computers & Technology > Networking & Cloud Computing > Internet, Groupware, & Telecommunications
- Books > Computers & Technology > Networking & Cloud Computing > Network Security
- Books > Computers & Technology > Programming
- Books > Computers & Technology > Security & Encryption
- Books > Textbooks > Computer Science & Information Systems > Computer Science