Cisco Security Agent (Paperback)

~ (Author)

Editorial Reviews

Product Description

Prevent security breaches by protecting endpoint systems with Cisco Security Agent, the Cisco host Intrusion Prevention System

• Secure your endpoint systems with host IPS
• Build and manipulate policies for the systems you wish to protect
• Learn how to use groups and hosts in the Cisco Security Agent architecture and how the components are related
• Install local agent components on various operating systems
• Explore the event database on the management system to view and filter information
• Examine Cisco Security Agent reporting mechanisms for monitoring system activity
• Apply Application Deployment Investigation to report on installed applications, hotfixes, and service packs
• Collect detailed information on processes and see how they use and are used by system resources
• Create and tune policies to control your environment without impacting usability
• Learn how to maintain the Cisco Security Agent architecture, including administrative access roles and backups

Cisco Security Agent presents a detailed explanation of Cisco Security Agent, illustrating the use of host Intrusion Prevention Systems (IPS) in modern self-defending network protection schemes. At the endpoint, the deployment of a host IPS provides protection against both worms and viruses. Rather than focusing exclusively on reconnaissance phases of network attacks a host IPS approaches the problem from the other direction, preventing malicious activity on the host by focusing on behavior. By changing the focus to behavior, damaging activity can be detected and blocked–regardless of the attack.

 

Cisco Security Agent is an innovative product in that it secures the portion of corporate networks that are in the greatest need of protection–the end systems. It also has the ability to prevent a day-zero attack, which is a worm that spreads from system to system, taking advantage of vulnerabilities in networks where either the latest patches have not been installed or for which patches are not yet available. Cisco Security Agent utilizes a unique architecture that correlates behavior occurring on the end systems by monitoring clues such as file and memory access, process behavior, COM object access, and access to shared libraries as well as other important indicators.

 

Cisco Security Agent is the first book to explore the features and benefits of this powerful host IPS product. Divided into seven parts, the book provides a detailed overview of Cisco Security Agent features and deployment scenarios. Part I covers the importance of endpoint security. Part II examines the basic components of the Cisco Security Agent architecture. Part III addresses agent installation and local use. Part IV discusses the Cisco Security Agent management console’s reporting and monitoring capabilities. Part V covers advanced Cisco Security Agent analysis features. Part VI covers Cisco Security Agent policy, implementation, and management. Part VII presents additional installation and management information.

 

Whether you are evaluating host IPS in general or looking for a detailed deployment guide for Cisco Security Agent, this book will help you lock down your endpoint systems and prevent future attacks.

 

“While there are still a lot of ways that security can go wrong, Cisco Security Agent provides a defense even when something is wrong. I remember the email that came around from our system administrator that said, ‘There’s something attacking our web server. We’re not sure what it is, but Stormwatch is blocking it.’ That was the Nimda worm–the first of a long line of attacks stopped by Cisco Security Agent.”

–Ted Doty, Product Manager, Security Technology Group, Cisco Systems®

 

This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

 

About the Author

Chad Sullivan, CCIE No. 6493, is a consulting systems engineer for Cisco Systems® based out of Atlanta who specializes in security on the Advanced Technologies team. Chad has focused predominantly on security as a specialty for a number of years and has been a member of the Cisco® Security and VPN Virtual team for the last 5 years.

Product Details

• Paperback: 456 pages
• Publisher: Cisco Press; illustrated edition edition (June 11, 2005)
• Language: English
• ISBN-10: 1587052059
• ISBN-13: 978-1587052057
• Product Dimensions: 8.9 x 7.3 x 1.1 inches
• Shipping Weight: 1.7 pounds (View shipping rates and policies)
• Average Customer Review: 3.5 out of 5 stars  See all reviews (4 customer reviews)
• Amazon.com Sales Rank: #460,029 in Books (See Bestsellers in Books)

Customer Reviews

Most Helpful Customer Reviews

1 of 1 people found the following review helpful:

3.0 out of 5 stars A decent volume, August 26, 2007

By	Wole Akpose "wolexca" (dundalk, md United States) - See all my reviews (REAL NAME)

As an endpoint protection solution, Cisco Security agent was a timely product, when it was released 2003, for being one of the industry's first behavior based host protection solution and thus offering some hope of protection against the widely feared zero-day attack scenario. While the product is considered a great tool, its proper deployment in an enterprise is non-trivial. Hence the value of a book like Cisco Security Agent : Prevent security breaches by protecting endpoint systems with Cisco Security Agent(CSA) , the Cisco host Intrusion Prevention System.

While the books organization is not quit elegant (it leaves the planning and implementation process to the last part while address advanced concepts earlier on), its comprehensive content on the subject makes it a useful book all the same. The seven part book makes the case for Cisco Security Agent (or any endpoint security solution for that matter) in the first part, addresses the CSA architecture in the second and describes the agent installation as well as issues with the local agent in the third. Monitoring and reporting was handled in fourth part while the fifth part addresses CSA analysis in deployment. The author developed policies, implementation and CSA maintenance in part six while the last part (appendixes) addresses integration with other Cisco technologies.

Chad's narrative while pedestrian provides ample guidance and example to appeal to an enterprise security administrator in a concise manner thereby compressing what could potentially have been a 1000 page manual into a less than 450 pages. Also the overall style of the presentation bellies Chad's breadth of experience as a network security subject matter expert.

Given the state of enterprise information systems security today, a typical enterprise will need a combination of tools to achieve a secure pasture and this book by Chad Sullivan as well as the Cisco NAC appliance book he helped co-write are very useful guides for organizations planning to develop or deploy a robust and holistic end-point control solutions. While the book is dated (2005), I'll still recommend it as a buy (even though I expect an update in the near future).

3.0 out of 5 stars Out of date, but still useful, January 8, 2010

By	Mike - See all my reviews

If you have been tasked with learning CSA configuration, management and deployment, this is a great still a great resource. I do have to say that it is very out of date. This book uses CSA 4.5 and there have been two other versions since that time. CSA 6 is the latest version and is where the most changes took place. The theory behind the book and architecture is still sound. The book is a valuable resource, but the reader needs to know that they cannot take all statements in the book at face value. Some parts reference retired or discontinued Cisco products, so when reading this book please double-check everything! If you are a new administrator this book alone will not be sufficient, you will need to work with a trainer or someone who has already configured and managed this product. As an example, Whitelists, Blacklists, Learn Mode, etc. are new in CSA 6 and not present in the book at all. Rule actions were added to and even changed drastically for some rules. Many changes were made to configuration options and navigation options on the MC. It's a great book and still 80 or 90% accurate, but that's a lot of product information missing or changed especially when you're talking about a Cisco product!

0 of 1 people found the following review helpful:

4.0 out of 5 stars Bit outdated but Good, August 10, 2007

By	N. Nizami "Techie" (U.S) - See all my reviews (REAL NAME)

I used this book to prepare for Cisco HIPS exam (which I passed). Even though it is bit outdated, it covers the product pretty well. The book starts with end point security bascis, then move into CSA building blocks, installation, configuration, monitoring, analyzingas and ends with CSA administration and maintainence. The book is well written, specially chapters 3, 4 and 5 really help in understanding the basic concepts.I would recommend it to anyone who wants to understand CSA or is preparing for the Cisco HIPS exam. I would also recommend "Advanced Hospt Intrusion Prevention with CSA" and "User Management Guide for CSA" from Cisco's website (a free download).