The Practice of Network Security Monitoring: Understanding Incident Detection and Response Author: Richard Bejtlich | Language: English | ISBN:
B00E5REN34 | Format: EPUB
The Practice of Network Security Monitoring: Understanding Incident Detection and Response Description
Network security is not simply about building impenetrable walls — determined attackers will eventually overcome traditional defenses. The most effective computer security strategies integrate network security monitoring (NSM): the collection and analysis of data to help you detect and respond to intrusions.
In The Practice of Network Security Monitoring, Mandiant CSO Richard Bejtlich shows you how to use NSM to add a robust layer of protection around your networks — no prior experience required. To help you avoid costly and inflexible solutions, he teaches you how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools.
You'll learn how to:
- Determine where to deploy NSM platforms, and size them for the monitored networks
- Deploy stand-alone or distributed NSM installations
- Use command line and graphical packet analysis tools, and NSM consoles
- Interpret network evidence from server-side and client-side intrusions
- Integrate threat intelligence into NSM software to identify sophisticated adversaries
There's no foolproof way to keep attackers out of your network. But when they get in, you'll be prepared. The Practice of Network Security Monitoring will show you how to build a security net to detect, contain, and control them. Attacks are inevitable, but losing sensitive data shouldn't be.
- File Size: 6731 KB
- Print Length: 376 pages
- Publisher: No Starch Press; 1 edition (July 26, 2013)
- Sold by: Amazon Digital Services, Inc.
- Language: English
- ASIN: B00E5REN34
- Text-to-Speech: Enabled
X-Ray:
- Lending: Not Enabled
- Amazon Best Sellers Rank: #28,738 Paid in Kindle Store (See Top 100 Paid in Kindle Store)
- #9
in Kindle Store > Kindle eBooks > Computers & Technology > Networking > Networks, Protocols & API's - #15
in Books > Computers & Technology > Networking > Networks, Protocols & APIs > Networks - #19
in Books > Computers & Technology > Networking > Network Administration
- #9
in Kindle Store > Kindle eBooks > Computers & Technology > Networking > Networks, Protocols & API's - #15
in Books > Computers & Technology > Networking > Networks, Protocols & APIs > Networks - #19
in Books > Computers & Technology > Networking > Network Administration
Most computer books are badly written. The information in the book is fine (usually, hopefully), but the actual craft of writing is poor. They read like computer programs. This isn't surprising, as most computer books are written by computer professionals. By the time you're good enough at a computing topic to write a book about it, your brain automatically arranged things in machine-friendly order. That's human nature. The downside of this, however, is that most computing books lack the things that make books interesting to human beings. We readers grit our teeth and plow through them because we need the information.
I'm pleased to say that Richard Bejtlich's The Practice of Network Security Monitoring is not one of those books. The damn thing is actually readable. By normal people.
That's a vague assertion. How about a metric? Season 6 of Burn Notice just hit Netflix streaming. I watched a few episodes Saturday. They ended on a tense cliffhanger, but I finally had to go to bed. Sunday, I finished reading this book before seeing how Westin and company got out of their fix. (Okay, that's not exactly a metric, but it's a good sign.)
Bejtlich graduated from Harvard and the Air Force Academy graduate. He led CIRT teams in the Air Force, built a security team at General Electric, and is now Chief Security Officer at Mandiant. He's on television as an electronic security guru. And for the last decade-plus, he's been beating the drum about intelligent attackers and the need for a holistic approach to security. When everybody else was going on about firewalls and antivirus and access controls and penetration testing, he wrote books like The Tao of Network Security Monitoring arguing that we need to think about network defense as an ongoing activity.
This certainly fell into my lap at an opportune time. With the various revelations being made about the NSA and its tactics, as well as the upsurge in attention being paid to network and application security in general, this book was a welcome arrival in and of itself. There's a lot of attention paid to the "aftermath" of security breaches. We see a lot of books that talk about what to do after you've been hacked, or tools that can help determine if your application can be penetrated, along with tools and recommendations for performing that kind of testing. Less often asked (or covered) is "what can we do to see if people are actually trying to get into our network or applications in the first place?" While it's important to know how we got hacked, I'd like to see where we might get hacked, and sound an early warning to stop those hackers in their tracks.
To that end, Network Security Monitoring (NSM) makes a lot of sense, and an important line of defense. If the networks can be better monitored/protected, our servers are less likely to be hacked. We cannot prevent all breaches, but if we understand them and can react to them, we can make it harder for hackers to get to anything interesting or valuable.
It's with this in mind that Richard Bejtlich has written "The Practice of Network Security Monitoring", and much of the advice in this book focuses on monitoring and protecting the network, rather than protecting end servers. The centerpiece of this book (at least from a user application standpoint) is the open source Security Onion (SO) NSM suite from Doug Burks (http://securityonion.blogspot.com/).
The Practice of Network Security Monitoring: Understanding Incident Detection and Response Preview
Link
Please Wait...