Security Monitoring Paperback – Feb 26 2009
|New from||Used from|
Customers Who Bought This Item Also Bought
No Kindle device required. Download one of the Free Kindle apps to start reading Kindle books on your smartphone, tablet, and computer.
Getting the download link through email is temporarily not available. Please check back later.
To get the free app, enter your mobile phone number.
Proven Methods for Incident Detection on Enterprise Networks
About the Author
Chris Fry has been a member of the Computer Security Incident Response Team (CSIRT) at Cisco Systems, Inc for 5 years, focusing on deployment of intrusion detection, network monitoring tools, and incident investigation. He began his career at Cisco in 1997 as an IT analyst, supporting Cisco's production services. His four years as a Network Engineer in Cisco IT's internal network support organization give him valuable knowledge about and unique insight into monitoring production enterprise networks. Chris holds a BA in Corporate Financial Analysis and an MS in Information and Communication Sciences from Ball State University.
Martin Nystrom is an InfoSec Investigations Manager for the Computer Security Incident Response Team (CSIRT) at Cisco Systems. He leads the global security monitoring team and provides guidance for incident response and security initiatives. Prior to joining Cisco's CSIRT, he was responsible for designing and consulting on secure architectures for IT projects. Martin worked as an IT architect and a Java programmer for 12 years prior, where he built his experience in the pharmaceutical and computer industries. He received a bachelor's degree from Iowa State University in 1990, a master's degree from NC State University in 2003, and his CISSP certification in 2004.
Most Helpful Customer Reviews on Amazon.com (beta)
The second chapter discusses the wide variety of approaches for selecting the policies to monitor. It then discusses the the environment in which these policies are to be applied. Chapter three explores two primary methods of learning about a network: network taxonomy and network telemetry. Chapter four provides a third and final foundation, guiding you to select broad targets on which to focus your monitoring. Deep, proactive security monitoring is overwhelming and unproductive if it isn't targeted to specific systems. By selecting monitoring targets, you can narrow your focus to the most critical systems, making the most of your security monitoring equipment and staff.
Once you've worked through the steps of defining security policies, you know your network, and you've selected your targets, you can build on that foundation by choosing your event sources. Chapter 5 provides an overview of the various device types and their event sources, how you can collect them, and how you can inspect them for security policy violations. The various choices available are collected into a subset of the best event sources to help you choose the appropriate sources quickly, without becoming overwhelmed in the sea of possibilities. Chapter 6 provides guidance on how you can carefully configure systems that fit your infrastructure, and then tune them so you can detect the real security events.Chapter 7 aims to professionalize your monitoring, preventing gaps that could allow an intrusion to succeed without notice. With these finishing touches in place, you should be able to monitor your systems with confidence.
Chapter 8 is a concluding chapter. It gives examples where monitoring ideals haven't always aligned with practical experience, including the consequences of those deviations from standard rules. It gives the results of two case studies, including how the organizations deployed targeted monitoring. It concludes by stripping down the advice of the book to bare-minimum tasks for each step, leaving you with a checklist to start your own targeted monitoring.
Appendix A gives detailed information on setting up and running a NetFlow collector based on OSU flow-tools, followed by some simple commands to enable NetFlow generation from a Cisco IOS router. OSU flow-tools is a set of open source NetFlow collection utilities.
This book is a good combination of tools, calculations, and advice on organizing your thoughts and strategy for the more advanced user who is familiar with networks and network security. I highly recommend it for that type of reader.
If you are in charge of a group of servers, especially as your company's setup becomes larger and more complex, knowing how to check for problems and intruders is vital. It is also something that can be difficult to learn because of the dearth of materials readily available. This book seeks to remedy that problem.
The authors are experienced security analysts and speakers who refined their materials over many years of giving security related presentations at conferences. They know what they are talking about, and their manner of presenting the material is clear and logical. The book's subtitle is "Proven Methods for Incident Detection on Enterprise Networks." It fits.
When I first noticed the deep ties each of the authors have with Cisco, I was concerned that the book might focus solely on their products, but they discuss software and methods from many vendors, including free and open source options. I found their discussions honest, open, and balanced.
The book begins by answering what security monitoring is, why it would be useful and desirable, and discusses several of the challenges involved in doing it well. We then move to the implementation of policies for monitoring, including a good description of the many types of monitoring that can be done, their strengths and weaknesses.
Next, we are led to know our network. This is foundational, but something that many systems administrators and IT workers don't do, either because of time constraints or they just don't think about it. However, taking the time up front to explore and really know what is in your network and how it is set up gives you a great advantage later when you receive security notices from your monitoring software--it helps you sort important things out from noise far more quickly and easily. The time savings later make this step well worth the time it takes to perform it.
Later, the book helps us select targets for monitoring, choose good sources for event collection and keep them dependable, feed and tune our netword intrusion detection systems and logging, and far more.
Each chapter and topic are demonstrated through an example that persists throughout the book, a fictional company called Blanco Wireless. As the chapters progress, we analyze and create security monitoring for the company. That was a useful thing to include.
One of my favorite features of the book is the final chapter which gives multiple real life examples through case studies and anecdotes to help illustrate moments when implementing the advice in the book would have been incredibly helpful, but when it was not done prior to an incident. The authors are very honest and humble here and own up to their humanity. Like the rest of us, they don't always do what they know should be done. Some of these are their stories of learning the hard way that you don't save time by skipping steps.
I think this book belongs on the shelf of anyone who has any responsibility for the security of systems, whether that responsibility is ultimate or partial. There is a lot in here, and anyone working in the field is sure to benefit in some way from the information.
The authors state at the outset - this is not a guide for the novice, but rather a guide for the journeyman who has a good working knowledge of network, server and database administration, as well as security tools and techniques.
The guide is as stated a professional guide, with exemplars which can be used in a sandbox, or to assist you in noodling through specific infrastructure monitoring issues - such as "tuning" so the incident logs tell you the story, and don't drown you in event data.
Their chosen format draws upon the authors' experiences and of course discusses the tools they use on a daily basis. To their credit, they also point out and list other tools which are substantially similar to those they use in their everyday work, and this alone is a benefit to the reader - you've the makings of your list of potential vendors, ready at hand.
I have the privilege of seeing the result of these gentleman's work and impact. That said, I also hear their voices clearly and distinctly in their verbiage - their articulation and emphasis is spot-on.
Worthy of the read, essential for the impact provided - a book of reference and exemplars which should be required in every incident response tool-box.
Author: Secrets Stolen, Fortunes Lost
Look for similar items by category
- Books > Business & Investing > Industries & Professions > E-commerce
- Books > Computers & Technology > Certification Central > Exams > Security+
- Books > Computers & Technology > Computer Science > Software Engineering > Information Systems
- Books > Computers & Technology > History & Culture > Privacy
- Books > Computers & Technology > Internet & Social Media
- Books > Computers & Technology > Networking & Cloud Computing > Internet, Groupware, & Telecommunications
- Books > Computers & Technology > Networking & Cloud Computing > Network Security
- Books > Computers & Technology > Networking & Cloud Computing > Networks, Protocols & APIs
- Books > Computers & Technology > Programming
- Books > Computers & Technology > Security & Encryption > Privacy & Online Safety
- Books > Computers & Technology > Web Development > Security & Encryption > Encryption
- Books > Textbooks > Computer Science & Information Systems > Networking