Security Monitoring: Proven Methods for Incident Detection on Enterprise Networks [Paperback]

Chris Fry (Author), Martin Nystrom (Author)

Book Description

ISBN-10: 0596518161 | ISBN-13: 978-0596518165 | Publication Date: February 23, 2009 | Edition: 1

How well does your enterprise stand up against today's sophisticated security threats? In this book, security experts from Cisco Systems demonstrate how to detect damaging security incidents on your global network--first by teaching you which assets you need to monitor closely, and then by helping you develop targeted strategies and pragmatic techniques to protect them.

Security Monitoring is based on the authors' years of experience conducting incident response to keep Cisco's global network secure. It offers six steps to improve network monitoring. These steps will help you:

• Develop Policies: define rules, regulations, and monitoring criteria
• Know Your Network: build knowledge of your infrastructure with network telemetry
• Select Your Targets: define the subset of infrastructure to be monitored
• Choose Event Sources: identify event types needed to discover policy violations
• Feed and Tune: collect data, generate alerts, and tune systems using contextual information
• Maintain Dependable Event Sources: prevent critical gaps in collecting and monitoring events

Security Monitoring illustrates these steps with detailed examples that will help you learn to select and deploy the best techniques for monitoring your own enterprise network.

Editorial Reviews

About the Author

Chris Fry has been a member of the Computer Security Incident Response Team (CSIRT) at Cisco Systems, Inc for 5 years, focusing on deployment of intrusion detection, network monitoring tools, and incident investigation. He began his career at Cisco in 1997 as an IT analyst, supporting Cisco's production services. His four years as a Network Engineer in Cisco IT's internal network support organization give him valuable knowledge about and unique insight into monitoring production enterprise networks. Chris holds a BA in Corporate Financial Analysis and an MS in Information and Communication Sciences from Ball State University.

Martin Nystrom is an InfoSec Investigations Manager for the Computer Security Incident Response Team (CSIRT) at Cisco Systems. He leads the global security monitoring team and provides guidance for incident response and security initiatives. Prior to joining Cisco's CSIRT, he was responsible for designing and consulting on secure architectures for IT projects. Martin worked as an IT architect and a Java programmer for 12 years prior, where he built his experience in the pharmaceutical and computer industries. He received a bachelor's degree from Iowa State University in 1990, a master's degree from NC State University in 2003, and his CISSP certification in 2004.

Product Details

• Paperback: 256 pages
• Publisher: O'Reilly Media; 1 edition (February 23, 2009)
• Language: English
• ISBN-10: 0596518161
• ISBN-13: 978-0596518165
• Product Dimensions: 9.1 x 7.2 x 0.6 inches
• Shipping Weight: 12 ounces (View shipping rates and policies)
• Average Customer Review: 4.8 out of 5 stars  See all reviews (10 customer reviews)
• Amazon Best Sellers Rank: #117,865 in Books (See Top 100 in Books)
  • #94 in Books > Computers & Technology > Certification > CompTIA
  • #96 in Books > Computers & Technology > Business & Culture > Privacy

Customer Reviews

Most Helpful Customer Reviews

12 of 14 people found the following review helpful:

5.0 out of 5 stars Useful for the more advanced reader, March 1, 2009

By 

calvinnme - See all my reviews
(HALL OF FAME REVIEWER)    (VINE VOICE)    (TOP 50 REVIEWER)   

This review is from: Security Monitoring: Proven Methods for Incident Detection on Enterprise Networks (Paperback)

This book is not an introduction to network, server, or database administration. Neither is it an introduction to security tools or techniques. You need to have a foundational understanding of these areas and seek to build on them through specialization of your base skills. If you need a more introductory book I highly recommend The Tao of Network Security Monitoring: Beyond Intrusion Detection. This book attempts to take you deeper into your network, guiding you to identify the more sensitive, important parts of the network for focused monitoring. The first chapter is just an overview chapter and introduces the fictitious company used throughout the book, Blanco Wireless. Like most tech books, the good stuff starts in chapter two.

The second chapter discusses the wide variety of approaches for selecting the policies to monitor. It then discusses the the environment in which these policies are to be applied. Chapter three explores two primary methods of learning about a network: network taxonomy and network telemetry. Chapter four provides a third and final foundation, guiding you to select broad targets on which to focus your monitoring. Deep, proactive security monitoring is overwhelming and unproductive if it isn't targeted to specific systems. By selecting monitoring targets, you can narrow your focus to the most critical systems, making the most of your security monitoring equipment and staff.

Once you've worked through the steps of defining security policies, you know your network, and you've selected your targets, you can build on that foundation by choosing your event sources. Chapter 5 provides an overview of the various device types and their event sources, how you can collect them, and how you can inspect them for security policy violations. The various choices available are collected into a subset of the best event sources to help you choose the appropriate sources quickly, without becoming overwhelmed in the sea of possibilities. Chapter 6 provides guidance on how you can carefully configure systems that fit your infrastructure, and then tune them so you can detect the real security events.Chapter 7 aims to professionalize your monitoring, preventing gaps that could allow an intrusion to succeed without notice. With these finishing touches in place, you should be able to monitor your systems with confidence.

Chapter 8 is a concluding chapter. It gives examples where monitoring ideals haven't always aligned with practical experience, including the consequences of those deviations from standard rules. It gives the results of two case studies, including how the organizations deployed targeted monitoring. It concludes by stripping down the advice of the book to bare-minimum tasks for each step, leaving you with a checklist to start your own targeted monitoring.

Appendix A gives detailed information on setting up and running a NetFlow collector based on OSU flow-tools, followed by some simple commands to enable NetFlow generation from a Cisco IOS router. OSU flow-tools is a set of open source NetFlow collection utilities.

This book is a good combination of tools, calculations, and advice on organizing your thoughts and strategy for the more advanced user who is familiar with networks and network security. I highly recommend it for that type of reader.

6 of 6 people found the following review helpful:

5.0 out of 5 stars Solid Practical Advice, March 18, 2009

By 

Parentsof4 (South East Michigan, United States) - See all my reviews

This review is from: Security Monitoring: Proven Methods for Incident Detection on Enterprise Networks (Paperback)

There is a lot of very practical information packed into this little book, no fluff or filler anywhere to be found. It will defiantly add value to any Network Security Monitoring implementation. This is a perfect book for a Network or System Engineer crossing over into Security. The only complaint is that it is way to pricey for such a small book printed on what feels like cheap newsprint.

3 of 3 people found the following review helpful:

5.0 out of 5 stars Real world view..., April 19, 2009

By 

Rob Renew (MD, USA) - See all my reviews

This review is from: Security Monitoring: Proven Methods for Incident Detection on Enterprise Networks (Paperback)

This book is a quick read "how-to" book to take your company to the next level. This is a real reality check written with an assumption that the reader is already familiar with networks and security. This book attempts to drive the value home with case studies, maintenance recommendations (yes, you do have to maintain the beast) and scripts to get started, and collected best practices. This is one of the books that get dog-eared and notes in the margin quickly.