The Tao of Network Security Monitoring: Beyond Intrusion Detecti

Description

*******************************************************************************

The Tao of Network Security Monitoring: Beyond Intrusion Detection

*******************************************************************************



-------------------------------------------------------------------------------

General Information

-------------------------------------------------------------------------------

Type.................: Ebook

Part Size............: 16,217,260 bytes









-------------------------------------------------------------------------------

Post Information

-------------------------------------------------------------------------------

Posted by............: ~tqw~



-------------------------------------------------------------------------------

Release Notes

-------------------------------------------------------------------------------

From the Publisher



"The book you are about to read will arm you with the knowledge you need to

defend your network from attackersΓ??both the obvious and the not so obvious....

If you are new to network security, don't put this book back on the shelf! This

is a great book for beginners and I wish I had access to it many years ago. If

you've learned the basics of TCP/IP protocols and run an open source or

commercial IDS, you may be asking 'What's next?' If so, this book is for you."



Γ??Ron Gula, founder and CTO, Tenable Network Security, from the Foreword



"Richard Bejtlich has a good perspective on Internet securityΓ??one that is

orderly and practical at the same time. He keeps readers grounded and addresses

the fundamentals in an accessible way."



Γ??Marcus Ranum, TruSecure



"This book is not about security or network monitoring: It's about both, and in

reality these are two aspects of the same problem. You can easily find people

who are security experts or network monitors, but this book explains how to

master both topics."



Γ??Luca Deri, ntop.org



"This book will enable security professionals of all skill sets to improve their

understanding of what it takes to set up, maintain, and utilize a successful

network intrusion detection strategy."

Γ??Kirby Kuehl, Cisco Systems



Every network can be compromised. There are too many systems, offering too many

services, running too many flawedapplications. No amount of careful coding,

patch management, or access control can keep out every attacker. If prevention

eventually fails, how do you prepare for the intrusions that will eventually

happen?



Network security monitoring (NSM) equips security staff to deal with the

inevitable consequences of too few resources and too many responsibilities. NSM

collects the data needed to generate better assessment, detection, and response

processesΓ??resulting in decreased impact from unauthorized activities.



In The Tao of Network Security Monitoring, Richard Bejtlich explores the

products, people, and processes that implement the NSM model. By focusing on

case studies and the application of open source tools, he helps you gain

hands-on knowledge of how to better defend networks and how to mitigate damage

from security incidents.



Inside, you will find in-depth information on the following areas.



* The NSM operational framework and deployment considerations.

* How to use a variety of open-source toolsΓ??including Sguil, Argus, and

EtherealΓ??to mine network traffic for full content, session, statistical, and

alert data.

* Best practices for conducting emergency NSM in an incident response

scenario, evaluating monitoring vendors, and deploying an NSM architecture.

* Developing and applying knowledge of weapons, tactics, telecommunications,

system administration, scripting, and programming for NSM.

* The best tools for generating arbitrary packets, exploiting flaws,

manipulating traffic, and conducting reconnaissance.



Whether you are new to network intrusion detection and incident response, or a

computer-security veteran, this book will enable you to quickly develop and

apply the skills needed to detect, prevent, and respond to new and emerging

threats.



;. IEEE CIPHER



"Well constructed, readable and useful. The approach is a good one and the

initial challenge of going beyond ID was successfully met by Bejtlich. It is a

book that can be recommended without reservation.



Table of Contents

Ch. 1 The security process 3

Ch. 2 What is network security monitoring? 25

Ch. 3 Deployment considerations 45

Ch. 4 The reference intrusion model 105

Ch. 5 Full content data 119

Ch. 6 Additional data analysis 173

Ch. 7 Session data 211

Ch. 8 Statistical data 247

Ch. 9 Alert data : Bro and Prelude 285

Ch. 10 Alert data : NSM using Sguil 317

Ch. 11 Best practices 347

Ch. 12 Case studies for managers 385

Ch. 13 Analyst training program 405

Ch. 14 Discovering DNS 433

Ch. 15 Harnessing the power of session data 473

Ch. 16 Packet monkey heaven 491

Ch. 17 Tools for attacking network security monitoring 521

Ch. 18 Tactics for attacking network security monitoring 583

Epilogue : the future of network security monitoring 651

App. A Protocol header reference 663

App. B Intellectual history of network security monitoring 685

App. C Protocol anomaly detection 757



Product Details



* ISBN: 0321246772

* ISBN-13: 9780321246776

* Format: Paperback, 798pp

* Publisher: Addison-Wesley

* Pub. Date: July 2004



-------------------------------------------------------------------------------

Install Notes

-------------------------------------------------------------------------------

CHM FIle

Disclaimer:
Contents of this page are indexed from the Internet. All actions are under your responsability. Email us to report illegal contents or external links and we'll remove them immediately.

Download links for "The Tao of Network Security Monitoring: Beyond Intrusion Detecti":


How to Download
You may need eMule or Bittorrent to download ebook torrents or emule links.

Report Dead Link
Please leave a comment to report dead links, so that someone else may update new links.

1. Ebooks list page : 1526
2. The Tao of Network Security Monitoring: Beyond Intrusion Det
3. The Tao of Network Security Monitoring: Beyond Intrusion Detection
4. The Tao of Network Security Monitoring : Beyond Intrusion Detection (Repost)
5. The Tao of Network Security Monitoring Beyond Intrusion Detection Jul 2004
6. The Tao of Network Security Monitoring: Beyond Intrusion Detection (Repost)
7. The Tao of Network Security Monitoring : Beyond Intrusion Detection
8. Intrusion Detection: Network Security Beyond the Firewall
9. The Tao of Network Security Monitoring
10. Statistical Techniques for Network Security: Modern Statistically-Based Intrusion Detection and Protection
11. Security Monitoring with Cisco Security MARS (Networking Technology: Security)
12. The Case for Security Information and Event Management (SIEM) in Proactive Network Defense, Free TriGeo Network Security, Inc. White Paper
13. The Case for Security Information and Event Management (SIEM) in Proactive Network Defense, Free TriGeo Network Security, Inc. White Paper
14. The Case for Security Information and Event Management (SIEM) in Proactive Network Defense, Free TriGeo Network Security, Inc. White Paper
15. [share_ebook] Security Monitoring with Cisco Security MARS (Paperback)
16. Network Intrusion Detection,3 Ed