Author : Nitesh Dhanjani
Publisher : "O'Reilly Media, Inc."
Page : 350 pages
File Size : 33,44 MB
Release : 2005
Category : Computers
ISBN : 9780596007942
This concise, high-end guide shows experienced administrators how to customize and extend popular open source security tools such as Nikto, Ettercap, and Nessus. It also addresses port scanners, packet injectors, network sniffers, and web assessment tools.
Author : Mike Schiffman
Publisher : John Wiley & Sons
Page : 450 pages
File Size : 12,58 MB
Release : 2002-12-03
Category : Computers
ISBN : 0471445452
Learn how to protect your network with this guide to building complete and fully functional network security tools Although open source network security tools come in all shapes and sizes, a company will eventually discover that these tools are lacking in some area—whether it's additional functionality, a specific feature, or a narrower scope. Written by security expert Mike Schiffman, this comprehensive book will show you how to build your own network security tools that meet the needs of your company. To accomplish this, you'll first learn about the Network Security Tool Paradigm in addition to currently available components including libpcap, libnet, libnids, libsf, libdnet, and OpenSSL. Schiffman offers a detailed discussion of these components, helping you gain a better understanding of the native datatypes and exported functions. Next, you'll find several key techniques that are built from the components as well as easy-to-parse programming examples. The book then ties the model, code, and concepts together, explaining how you can use this information to craft intricate and robust security programs. Schiffman provides you with cost-effective, time-saving guidance on how to build customized network security tools using existing components. He explores: A multilayered model for describing network security tools The ins and outs of several specific security-related components How to combine these components into several useful network security techniques Four different classifications for network security tools: passive reconnaissance, active reconnaissance, attack and penetration, and defensive How to combine techniques to build customized network security tools The companion Web site contains all of the code from the book.
Author : Michael S Collins
Publisher : "O'Reilly Media, Inc."
Page : 416 pages
File Size : 21,45 MB
Release : 2014-02-10
Category : Computers
ISBN : 1449357865
Traditional intrusion detection and logfile analysis are no longer enough to protect today’s complex networks. In this practical guide, security researcher Michael Collins shows you several techniques and tools for collecting and analyzing network traffic datasets. You’ll understand how your network is used, and what actions are necessary to protect and improve it. Divided into three sections, this book examines the process of collecting and organizing data, various tools for analysis, and several different analytic scenarios and techniques. It’s ideal for network administrators and operational security analysts familiar with scripting. Explore network, host, and service sensors for capturing security data Store data traffic with relational databases, graph databases, Redis, and Hadoop Use SiLK, the R language, and other tools for analysis and visualization Detect unusual phenomena through Exploratory Data Analysis (EDA) Identify significant structures in networks with graph analysis Determine the traffic that’s crossing service ports in a network Examine traffic volume and behavior to spot DDoS and database raids Get a step-by-step process for network mapping and inventory
Author : Richard Bejtlich
Publisher : No Starch Press
Page : 436 pages
File Size : 35,74 MB
Release : 2013-07-15
Category : Computers
ISBN : 159327534X
Network security is not simply about building impenetrable walls—determined attackers will eventually overcome traditional defenses. The most effective computer security strategies integrate network security monitoring (NSM): the collection and analysis of data to help you detect and respond to intrusions. In The Practice of Network Security Monitoring, Mandiant CSO Richard Bejtlich shows you how to use NSM to add a robust layer of protection around your networks—no prior experience required. To help you avoid costly and inflexible solutions, he teaches you how to deploy, build, and run an NSM operation using open source software and vendor-neutral tools. You'll learn how to: –Determine where to deploy NSM platforms, and size them for the monitored networks –Deploy stand-alone or distributed NSM installations –Use command line and graphical packet analysis tools, and NSM consoles –Interpret network evidence from server-side and client-side intrusions –Integrate threat intelligence into NSM software to identify sophisticated adversaries There’s no foolproof way to keep attackers out of your network. But when they get in, you’ll be prepared. The Practice of Network Security Monitoring will show you how to build a security net to detect, contain, and control them. Attacks are inevitable, but losing sensitive data shouldn't be.
Author : Chris Sanders
Publisher : Elsevier
Page : 497 pages
File Size : 27,26 MB
Release : 2013-11-26
Category : Computers
ISBN : 0124172164
Applied Network Security Monitoring is the essential guide to becoming an NSM analyst from the ground up. This book takes a fundamental approach to NSM, complete with dozens of real-world examples that teach you the key concepts of NSM. Network security monitoring is based on the principle that prevention eventually fails. In the current threat landscape, no matter how much you try, motivated attackers will eventually find their way into your network. At that point, it is your ability to detect and respond to that intrusion that can be the difference between a small incident and a major disaster. The book follows the three stages of the NSM cycle: collection, detection, and analysis. As you progress through each section, you will have access to insights from seasoned NSM professionals while being introduced to relevant, practical scenarios complete with sample data. If you've never performed NSM analysis, Applied Network Security Monitoring will give you an adequate grasp on the core concepts needed to become an effective analyst. If you are already a practicing analyst, this book will allow you to grow your analytic technique to make you more effective at your job. - Discusses the proper methods for data collection, and teaches you how to become a skilled NSM analyst - Provides thorough hands-on coverage of Snort, Suricata, Bro-IDS, SiLK, and Argus - Loaded with practical examples containing real PCAP files you can replay, and uses Security Onion for all its lab examples - Companion website includes up-to-date blogs from the authors about the latest developments in NSM
Author : Kerry J. Cox
Publisher : "O'Reilly Media, Inc."
Page : 291 pages
File Size : 16,2 MB
Release : 2004-08-02
Category : Computers
ISBN : 0596552432
Intrusion detection is not for the faint at heart. But, if you are a network administrator chances are you're under increasing pressure to ensure that mission-critical systems are safe--in fact impenetrable--from malicious code, buffer overflows, stealth port scans, SMB probes, OS fingerprinting attempts, CGI attacks, and other network intruders.Designing a reliable way to detect intruders before they get in is a vital but daunting challenge. Because of this, a plethora of complex, sophisticated, and pricy software solutions are now available. In terms of raw power and features, SNORT, the most commonly used Open Source Intrusion Detection System, (IDS) has begun to eclipse many expensive proprietary IDSes. In terms of documentation or ease of use, however, SNORT can seem overwhelming. Which output plugin to use? How do you to email alerts to yourself? Most importantly, how do you sort through the immense amount of information Snort makes available to you?Many intrusion detection books are long on theory but short on specifics and practical examples. Not Managing Security with Snort and IDS Tools. This new book is a thorough, exceptionally practical guide to managing network security using Snort 2.1 (the latest release) and dozens of other high-quality open source other open source intrusion detection programs.Managing Security with Snort and IDS Tools covers reliable methods for detecting network intruders, from using simple packet sniffers to more sophisticated IDS (Intrusion Detection Systems) applications and the GUI interfaces for managing them. A comprehensive but concise guide for monitoring illegal entry attempts, this invaluable new book explains how to shut down and secure workstations, servers, firewalls, routers, sensors and other network devices.Step-by-step instructions are provided to quickly get up and running with Snort. Each chapter includes links for the programs discussed, and additional links at the end of the book give administrators access to numerous web sites for additional information and instructional material that will satisfy even the most serious security enthusiasts.Managing Security with Snort and IDS Tools maps out a proactive--and effective--approach to keeping your systems safe from attack.
Author : Brien Posey
Publisher : Elsevier
Page : 485 pages
File Size : 35,63 MB
Release : 2011-04-18
Category : Computers
ISBN : 0080949150
Today all companies, U.S. federal agencies, and non-profit organizations have valuable data on their servers that needs to be secured. One of the challenges for IT experts is learning how to use new products in a time-efficient manner, so that new implementations can go quickly and smoothly. Learning how to set up sophisticated products is time-consuming, and can be confusing. GFI's LANguard Network Security Scanner reports vulnerabilities so that they can be mitigated before unauthorized intruders can wreck havoc on your network. To take advantage of the best things that GFI's LANguard Network Security Scanner has to offer, you'll want to configure it on your network so that it captures key events and alerts you to potential vulnerabilities before they are exploited.In this book Brien Posey has pinpointed the most important concepts with examples and screenshots so that systems administrators and security engineers can understand how to get the GFI security tools working quickly and effectively. His straightforward, no nonsense writing style is devoid of difficult to understand technical jargon. His descriptive examples explain how GFI's security tools enhance the security controls that are already built into your server's operating system.* Secure Your Network Master the various components that make up the management console and prepare to use it for most tasks.* Analyze Scan Results View detected vulnerabilities, save and print results, query open ports, and filter your results.* Install and Use the ReportPack Learn how to build custom reports and schedule reports. See how filters allow you to control the information that is processed when a reports is run.* Perform a Hardware Inventory and Compile a Software Inventory Use GFI to do your inventories and perform audits. See how to blacklist and whitelist applications to make your reports more meaningful.* Manage Patches Effectively See how to deploy a specific patch, perform a scan comparison, uninstall a patch, and deploy custom software.* Use GFI EndPointSecurity to Lock Down Hardware Be prepared for users trying to install unauthorized software, copy sensitive data onto removable media, or perform other actions to try and circumvent your network's security.* Create Protection Policies Control the level of device access allowed on a system and create separate protection policies; one for servers, one for workstations, and one for laptops. Learn how to deploy agents.* Regulate Specific Devices Master some of the advanced features of GFI: locking device categories, blacklisting and whitelisting devices, and using file type restrictions.* Monitor Device Usage Keep tabs on your network by setting logging options, setting alerting options, and generating end point security reports. - Use GFI EndPointSecurity to Lock Down Hardware - Create Protection Policies to Control the Level of Device Access - Master Advanced Features of GFI: Locking Device Categories, Blacklisting and Whitelisting Devices, Using File Type Restrictions and More
Author : Chris Jackson
Publisher : Cisco Press
Page : 700 pages
File Size : 24,50 MB
Release : 2010-06-02
Category : Computers
ISBN : 1587059428
This complete new guide to auditing network security is an indispensable resource for security, network, and IT professionals, and for the consultants and technology partners who serve them. Cisco network security expert Chris Jackson begins with a thorough overview of the auditing process, including coverage of the latest regulations, compliance issues, and industry best practices. The author then demonstrates how to segment security architectures into domains and measure security effectiveness through a comprehensive systems approach. Network Security Auditing thoroughly covers the use of both commercial and open source tools to assist in auditing and validating security policy assumptions. The book also introduces leading IT governance frameworks such as COBIT, ITIL, and ISO 17799/27001, explaining their values, usages, and effective integrations with Cisco security products.
Author : Chris R. McNab
Publisher : "O'Reilly Media, Inc."
Page : 396 pages
File Size : 26,49 MB
Release : 2004
Category : Computers
ISBN : 059600611X
Covers offensive technologies by grouping and analyzing them at a higher level--from both an offensive and defensive standpoint--helping you design and deploy networks that are immune to offensive exploits, tools, and scripts. Chapters focus on the components of your network, the different services yourun, and how they can be attacked. Each chapter concludes with advice to network defenders on how to beat the attacks.
Author : Michael Gregg
Publisher : Elsevier
Page : 529 pages
File Size : 47,53 MB
Release : 2011-04-18
Category : Computers
ISBN : 0080553567
The Perfect Reference for the Multitasked SysAdminThis is the perfect guide if network security tools is not your specialty. It is the perfect introduction to managing an infrastructure with freely available, and powerful, Open Source tools. Learn how to test and audit your systems using products like Snort and Wireshark and some of the add-ons available for both. In addition, learn handy techniques for network troubleshooting and protecting the perimeter.* Take InventorySee how taking an inventory of the devices on your network must be repeated regularly to ensure that the inventory remains accurate.* Use NmapLearn how Nmap has more features and options than any other free scanner.* Implement FirewallsUse netfilter to perform firewall logic and see how SmoothWall can turn a PC into a dedicated firewall appliance that is completely configurable.* Perform Basic HardeningPut an IT security policy in place so that you have a concrete set of standards against which to measure. * Install and Configure Snort and WiresharkExplore the feature set of these powerful tools, as well as their pitfalls and other security considerations.* Explore Snort Add-OnsUse tools like Oinkmaster to automatically keep Snort signature files current.* Troubleshoot Network ProblemsSee how to reporting on bandwidth usage and other metrics and to use data collection methods like sniffing, NetFlow, and SNMP.* Learn Defensive Monitoring ConsiderationsSee how to define your wireless network boundaries, and monitor to know if they're being exceeded and watch for unauthorized traffic on your network. - Covers the top 10 most popular open source security tools including Snort, Nessus, Wireshark, Nmap, and Kismet - Follows Syngress' proven "How to Cheat" pedagogy providing readers with everything they need and nothing they don't
