Most Helpful Customer Reviews
4 of 5 people found the following review helpful:
5.0 out of 5 stars
Paranoia with a Purpose, February 15, 2006
This review is from: Penetration Testing and Network Defense (Paperback)
Andrew Whitaker and Daniel Newman show how to protect a network by showing how to attack it. Penetration Testing and Network Defense, written for network security professionals, has strong disclosures that warn against the temptation to try some of the techniques taught in the book without written permission from those who own target systems. If you have been administering a network or consulting, you will already be familiar with much of the contents of the book. However, the book saves the reader the time of going many places to acquire all this information. There are a few non-technical parts to the book. Chapter 4, Performing Social Engineering, should be ready by practically everyone who works with computers or lives in the information age for that matter. The authors almost had me thinking like a criminal. But this is a necessary exercise to stay one step ahead of the bad guys. Appendix A walks the reader through preparing a security policy. Most of the book is written directly to those who already have a working knowledge of networking and the TCP/IP protocol. For over 10 chapters the authors cover many techniques for stealing data or taking down a network. The perspective of this guide flips flops from hacker to security administrator. Many new features in systems today are highlighted, such as Flood Defender for Cisco PIX firewall. All of the best tools are listed, both free and commercial, for evaluating the security of a network. I give this guide five stars because it is easy to read and has excellent real world examples. I learned several new things and got some old questions answered. The book reinforces one of life's most important lessons I try to teach my kids. Respect other people: respect other people's things.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
4 of 5 people found the following review helpful:
5.0 out of 5 stars
Excellent Book. Highly Recommended, January 14, 2006
This review is from: Penetration Testing and Network Defense (Paperback)
First of all, I want to say that the authors did a superb job writing Penetration Testing and Network Defense. Overall, I was very pleased with the book. It is definitely an asset to all areas of Information Technology and Information Security. The book appears to have been written for any experience level or even job level for that matter. There is a good balance between theory, best practices, demonstrations, and case studies. Personally, I found that the book was easy to read. The thing that is seen with most security books is that the material is often dry and boring. I didn't find this to be true with this book. Although technical terms are used in introducing particular tools, explanations are easy to understand as metaphors/analogies are used to simplify the concepts for inexperienced users. The authors were able to clearly demonstrate tools by using real world examples which the reader can relate to. Another thing I found helpful was the fact that all of the examples were short and to the point. The authors did not go on and on about useless information. They tell you about the tool/vulnerability, show you how it works, how the vulnerability can be exploited, and how to defend against it. Furthermore, although there are thousands of tools available, the authors did an exceptional job in making selections for discussion in this book. Although they couldn't possibly cover each and every tool, the authors did make references to external sources throughout the book. In addition, an appendix section was organized with hundreds of tools. Each tool contains a brief description and the link to the website where the reader can experiment on their own time. To conclude, I highly recommend this book. It is an essential resource for penetration testers, network administrators, and security professionals. I look forward to reading other books in the Security line of Cisco books.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
10 of 14 people found the following review helpful:
3.0 out of 5 stars
Four stars if published in fall 2003 instead of fall 2005, August 29, 2006
This review is from: Penetration Testing and Network Defense (Paperback)
Penetration testing is becoming a hot topic again, but the available books on the subject continue to underwhelm. Penetration Testing and Network Defense (PTAND), published in the fall of 2005, would be a four star book if it had been published two years earlier. Stephen Northcutt, unlike all other reviewers, noticed this fact as well. When you combine this problem with PTAND with several other deficiencies, the result is a book you can unfortunately skip. I usually try to avoid reading and reviewing books that I expect not to like. However, PTAND looked promising. I have several excellent Cisco Press books, like Cisco Router Firewall Security. A major problem with PTAND is that it is largely out of date. For example, Ch 12 discusses malware, but uses B02K, SubSeven, the Melissa virus, and Brown Orifice as examples. In Ch 6, session hijacking is done with Hunt and Juggernaut, but ignores Ettercap, Cain and Abel, and Yersinia. (I found it funny that p 131 of this Cisco Press book describes Juggernaut's author as "someone with the handle of 'route'", but doesn't say that 'route' is Mike Schiffman, Cisco employee since April 2003.) In addition to outdated or missing tools (THC's Amap and Hydra are also neglected), PTAND fails to mention problems with many of its techniques. In Ch 5, the authors never hint that servers susceptible to DNS zone transfers are not as plentiful as they were in 1998. A discussion of Visual Route doesn't explain that information reported by the tool may have nothing to do with the physical location of a system. Ch 10's description of ACK tunnels ignores that stateful firewalls have been denying such covert channels for years. PTAND also misses some technical and conceptual details. The definitions of "threat" in Ch 1 are really describing attacks or risks. On p 98, the authors should say that closed ports reply with RST ACK, not just RST. I don't think the authors understand idle scanning (pp 102-3), and their examples of fingerprinting on p 106 are taken directly from Fyodor's 1998 paper (without credit)! On p 351 PTAND propagates the myth that SSIDs "are like shared passwords," and poorly claims that broadcasting SSIDs is a "mistake". I liked many of the case studies in this book, but several had problems. In Ch 14, the authors should have just used Metasploit instead of using shell code from Metasploit to perpetrate their case study. Their case study in Ch 10 uses Macof to overflow a switch CAM table (pp 343-4), but on p 129 the authors previously stated they found such techniques unreliable. Ch 10 fails to mention that CDP is not a routable protocol, so it cannot be used remotely. Ch 10 also calls IDS' "intruder detection systems". On the typo side, replace 1996 on p 25 with 1986, and remember that FTP data does not use port 21 TCP. With active FTP, source port 20 is used. With passive FTP, nothing can be said a priori about the ports that might be used. If you are an absolute pen testing beginner, you may find this book valuable. I don't see any advantage to reading this book when texts like Hacking Exposed are available. (If you think my Foundstone history makes me biased about the HE books, check out my earlier reviews of that series.) I did like the use of case studies in each chapter, and the explanations of how to mostly use Cisco IDS to detect certain classes of attack. The defensive recommendations were also decent. Those looking for solid pen testing recommendations might find Pete Herzog's free Open Source Security Testing Methodology Manual to be valuable.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
|
