Customer Reviews

Intrusion Prevention Fundamentals

5 star:		(1)
4 star:		(1)
3 star:		(0)
2 star:		(0)
1 star:		(0)

 

 

The book is clearly written, does not assume previous knowledge. If you need a place to start, this is a fine place to start. However, the content is very dated. Charts end at 2003, examples include Nimda, the land attack, slammer. Please don't get me wrong, those are all oldies, but goodies and each teaches an important lesson, but it would be nice to see something from 2005/2006. More effort should have been invested in a discussion on "zero day" attacks, the authors mention attacks may occur that have not been seen in the wild, but do not offer stategies for this. Since "zero day" attacks are not uncommon these days, the issue must be considered and addressed.

The last one third of the book includes the Cisco specifics, e.g. Cisco Security Agent, Policy Feature Card, etc that you expect to see in a Ciscopress book. I enjoyed this part of the book immensely. If you are a manager of a Cisco shop and want to know that you have implemented defense in depth well, this is a great discussion. If you are considering the Cisco product line, this will be truly helpful for you, the authors don't sell, but they lay out how to implement a number of the Cisco security tools in a clear, concise, complete and accurate manner.

It's hard to imagine a system today that isn't connected to the outside world. And with this connection comes (at no extra charge) a way for the bad guys to get access to your data. And unlike our normal custure, there are few (if any) cops out there to do battle with the bad guys.

Unfortunately that leaves the security of your system up to you. And to help you, all kinds of products have emerged to protect your system from undesired penetration from the bad guys, be they from across the globe, or down the hall.

This book gives an overview of the whole problem from a very good description of the threats, to the general rules that any IPS system has to have. As it was written by a couple of Cisco folk, this book tends to follow Cisco concepts in software, hardware, and usage. This isn't all bad because Cisco has a good set of products in this area, arguably the most complete and best integrated together set of tools available. And if you're not using Cisco, this book will still be of use as you'll know what to look for in comparing your equipment with that from Cisco.