or
Sign in to turn on 1-Click ordering.
Express Checkout with PayPhrase
What's this? | Create PayPhrase
More Buying Choices
33 used & new from $10.75
Have one to sell? Sell yours here
or
Get a $7.09 Amazon.com Gift Card
Network Security Assessment: Know Your Network
 
 
Share your own customer images
Search inside another edition of this book
Tell the Publisher!
I’d like to read this book on Kindle

Don’t have a Kindle? Get your Kindle here, or download a FREE Kindle Reading App.

Network Security Assessment: Know Your Network [Paperback]

Chris McNab (Author)
4.3 out of 5 stars  See all reviews (21 customer reviews)
List Price: $49.99
Price: $36.49 & this item ships for FREE with Super Saver Shipping. Details
You Save: $13.50 (27%)
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o
In Stock.
Ships from and sold by Amazon.com. Gift-wrap available.
Want it delivered Friday, September 10? Choose One-Day Shipping at checkout. Details
11 new from $32.48 22 used from $10.75
Textbook StudentJoin Amazon Student and get FREE Two-Day Shipping for one year with Amazon Prime shipping benefits.

Formats

 Amazon Price New from Used from
Paperback $36.49   $32.48 $10.75
Sell This Book Back for $7.09
Whether you buy it used on Amazon for $10.75 or somewhere else, you can sell it back to our Textbook Buyback Store at the current price of $7.09 through December 31, 2010. Restrictions Apply
Used Price$10.75
Buyback Price$7.09
Price after
Buyback$3.66

Frequently Bought Together

Network Security Assessment: Know Your Network + Security Warrior + Network Warrior: Everything you need to know that wasn't on the CCNA exam
Price For All Three: $95.85

Show availability and shipping details

Buy the selected items together

  • In Stock.
    Ships from and sold by Amazon.com.
    This item ships for FREE with Super Saver Shipping. Details

  • Security Warrior by Cyrus Peikari Paperback$29.67

    In Stock.
    Ships from and sold by Amazon.com.
    This item ships for FREE with Super Saver Shipping. Details

  • Network Warrior: Everything you need to know that wasn't on the CCNA exam by Gary A. Donahue Paperback$29.69

    In Stock.
    Ships from and sold by Amazon.com.
    This item ships for FREE with Super Saver Shipping. Details

Customers Who Bought This Item Also Bought

Security Warrior

Security Warrior

by Cyrus Peikari
4.3 out of 5 stars (29)  $29.67
Network Warrior: Everything you need to know that wasn't on the CCNA exam

Network Warrior: Everything you need to know that wasn't on the CCNA exam

by Gary A. Donahue
4.7 out of 5 stars (45)  $29.69
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning

Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning

by Gordon Fyodor Lyon
4.9 out of 5 stars (23)  $32.97
Security Monitoring: Proven Methods for Incident Detection on Enterprise Networks

Security Monitoring: Proven Methods for Incident Detection on Enterprise Networks

by Chris Fry
4.8 out of 5 stars (10)  $38.42
Hacking: The Next Generation (Animal Guide)

Hacking: The Next Generation (Animal Guide)

by Nitesh Dhanjani
4.9 out of 5 stars (9)  $26.39
› Explore similar items

Editorial Reviews

Product Description

How secure is your network? The best way to find out is to attack it. Network Security Assessment provides you with the tricks and tools professional security consultants use to identify and assess risks in Internet-based networks-the same penetration testing model they use to secure government, military, and commercial networks. With this book, you can adopt, refine, and reuse this testing model to design and deploy networks that are hardened and immune from attack.

Network Security Assessment demonstrates how a determined attacker scours Internet-based networks in search of vulnerable components, from the network to the application level. This new edition is up-to-date on the latest hacking techniques, but rather than focus on individual issues, it looks at the bigger picture by grouping and analyzing threats at a high-level. By grouping threats in this way, you learn to create defensive strategies against entire attack categories, providing protection now and into the future.

Network Security Assessment helps you assess:

  • Web services, including Microsoft IIS, Apache, Tomcat, and subsystems such as OpenSSL, Microsoft FrontPage, and Outlook Web Access (OWA)


  • Web application technologies, including ASP, JSP, PHP, middleware, and backend databases such as MySQL, Oracle, and Microsoft SQL Server


  • Microsoft Windows networking components, including RPC, NetBIOS, and CIFS services


  • SMTP, POP3, and IMAP email services


  • IP services that provide secure inbound network access, including IPsec, Microsoft PPTP, and SSL VPNs


  • Unix RPC services on Linux, Solaris, IRIX, and other platforms


  • Various types of application-level vulnerabilities that hacker tools and scripts exploit


Assessment is the first step any organization should take to start managing information risks correctly. With techniques to identify and assess risks in line with CESG CHECK and NSA IAM government standards, Network Security Assessment gives you a precise method to do just that.

About the Author

Chris McNab is the technical director of Matta, a vendor-independent security consulting outfit based in the United Kingdom. Since 2000, Chris has presented and run applied hacking courses across Europe, training a large number of financial, retail, and government clients in practical attack and penetration techniques, so that they can assess and protect their own networks effectively.

Chris speaks at a number of security conferences and seminars, and is routinely called to comment on security events and other breaking news. He has appeared on television and radio stations in the UK (including BBC 1 and Radio 4), and in a number of publications and computing magazines.

Responsible for the provision of security assessment services at Matta, Chris and his team undertake Internet-based, internal, application, and wireless security assessment work, providing clients with practical and sound technical advice relating to secure network design and hardening strategies. Chris boasts a 100% success rate when compromising the networks of multinational corporations and financial services companies over the last five years.

Product Details

  • Paperback: 512 pages
  • Publisher: O'Reilly Media; 2 edition (November 1, 2007)
  • Language: English
  • ISBN-10: 0596510306
  • ISBN-13: 978-0596510305
  • Product Dimensions: 9.1 x 7 x 0.9 inches
  • Shipping Weight: 1.6 pounds (View shipping rates and policies)
  • Average Customer Review: 4.3 out of 5 stars  See all reviews (21 customer reviews)
  • Amazon Bestsellers Rank: #229,480 in Books (See Top 100 in Books)
    #73 in  Books > Computers & Internet > Networking > Intranets & Extranets
    #46 in  Books > Computers & Internet > Networking > Networks, Protocols & APIs > LAN
    #19 in  Books > Computers & Internet > Certification Central > Office

    •  Would you like to update product info or give feedback on images?

More About the Author

Chris McNab
Discover books, learn about writers, read author blogs, and more.

› Visit Amazon's Chris McNab Page
Front Cover | Table of Contents | First Pages | Index | Back Cover | Surprise Me!
Search Inside This Book:
Inside This Book (learn more)
Browse and search another edition of this book.
Key Phrases - Statistically Improbable Phrases (SIPs): (learn more)
network scanning, heap overflows, last logon, configuration analysis, format string bugs, web service vulnerabilities, remotely exploitable issues, annot int, internal network space, header scanning, target network space, using retaddr, enterprise web environments, inverse host lookup, password grinding, accessible network services, remote maintenance services, saved instruction pointer, logical program flow, saved frame pointer, security hot fixes, command overflow, static overflows, destination port unreachable, extra pings
Key Phrases - Capitalized Phrases (CAPs): (learn more)
Check Point, Packet Storm, Date Notes, Microsoft Windows, Task Scheduler, Investigating Web Service Vulnerabilities, Assessing Web Services, Red Hat, Attacker Target, Microsoft Exchange, Messenger Service, Port State Service, Method Not Allowed, Assessing Windows Networking Services Example, Application-Level Risks, Database Services, Sequence Prediction, Assessing Unix, Internet Figure, Active Directory, Sun Solaris, Washington University, Assessing Remote Information Services Example, Microsoft Corp, Administrator Access
Browse Sample Pages:
Front Cover | Table of Contents | First Pages | Index | Back Cover | Surprise Me!
Search Inside This Book:
Citations (learn more)
2 books cite this book:

What Do Customers Ultimately Buy After Viewing This Item?

Network Security Assessment: Know Your Network
66% buy the item featured on this page:
Network Security Assessment: Know Your Network by Chris McNab Paperback 4.3 out of 5 stars (21)
$36.49
Security Warrior
12% buy
Security Warrior by Cyrus Peikari Paperback 4.3 out of 5 stars (29)
$29.67
Security Monitoring: Proven Methods for Incident Detection on Enterprise Networks
8% buy
Security Monitoring: Proven Methods for Incident Detection on Enterprise Networks by Chris Fry Paperback 4.8 out of 5 stars (10)
$38.42
Network Security Bible
7% buy
Network Security Bible by Eric Cole Paperback 4.5 out of 5 stars (8)
$37.79
› Explore similar items

Tags Customers Associate with This Product

 (What's this?)
Click on a tag to find related items, discussions, and people.
 
(4)
(3)
(2)
(1)
(1)
(1)
(1)
(1)
(1)
(1)
Agree with these tags?

Your tags: Add your first tag
 
See most popular tags

Sell a Digital Version of This Book in the Kindle Store

If you are a publisher or author and hold the digital rights to a book, you can sell a digital version of it in our Kindle Store. Learn more
 

Customer Reviews

21 Reviews
5 star:
 (11)
4 star:
 (7)
3 star:
 (2)
2 star:
 (1)
1 star:    (0)
 
 
 
 
 
Average Customer Review
4.3 out of 5 stars (21 customer reviews)
 
 
 
 
Share your thoughts with other customers:
Most Helpful Customer Reviews

 
19 of 21 people found the following review helpful:
4.0 out of 5 stars A good companion to "Security Warrior", May 3, 2004
This review is from: Network Security Assessment: Know Your Network (Paperback)
"Network Security Assessment" (NSA) is the latest in a long line of vulnerability assessment / penetration testing books, stretching back to "Maximum Security" in 1997 and "Hacking Exposed" shortly thereafter. NSA is also the second major security title from O'Reilly this year, soon to be followed by "Network Security Hacks." NSA is a good book with some new material to offer, but don't expect to find deep security insight in this or similar assessment books.

NSA begins with the almost obligatory reference to the king of assessment books, "Hacking Exposed" (HE), saying "I leave listings of obscure techniques to behemoth 800-page 'hacking' books." I don't think some of the techniques covered in HE but not NSA are "obscure." Noticably lacking in NSA is coverage of dial-up techniques, wireless insecurities, Novell vulnerabilities, and attacking clients rather than servers. Should NSA receive a second edition, I expect to see the book expand closer to the "behemoth" it seems to deride.

The best chapter by far was ch. 11, where the author with assistance from Michael Thumann takes the reader on a tour of exploiting vulnerable code. The stack diagrams and code snippets were especially helpful and the explanations were clear enough. This sort of material is a solid introduction to some of the techniques found in "Security Warrior." I also liked ch. 14, where the author explains a sample assessment using the tools already introduced. Kudos as well for maintaining an errata page and tool archive on the publisher's Web site.

The advantage NSA has over HE is the variety of tools on hand. I learned of at least a dozen tools not mentioned elsewhere. The author seems to be thorough while listing various exploitable flaws from the last several years. While the prose is well-written, I believe the HE series does a better job communicating fundamentals of the underlying technology. In other words, HE gives better explanations of 'what' we are compromising, while "NSA" prefers to concentrate more on the compromising itself. This technology education aspect of the HE series has always been its strong point. For example, there's no need to read a 500 page book on Microsoft FrontPage to understand the problems with it when a quick look in a HE book explains the technology's basics as well as its security flaws.

It's been over a year since the 4th edition of HE was published, so I recommend buying NSA to freshen your assessment skills. For the scenarios it does cover, which include most UNIX and Windows Internet-based attacks, it is thorough and accurate. Combined with O'Reilly's "Security Warrior," NSA presents an updated picture of the assessment scene.

Help other customers find the most helpful reviews  
Was this review helpful to you? Yes No


 
11 of 12 people found the following review helpful:
4.0 out of 5 stars Systematically understanding network access, April 3, 2004
This review is from: Network Security Assessment: Know Your Network (Paperback)
[A review of the 2nd EDITION. This review was written on 3 December 2007.]

Over 3 years has elapsed since McNab wrote his first edition. Much of that edition is still valid. Sadly, in a way, because it means that despite the best efforts of that book and others of its ilk, we remain plagued with network attackers and insecure systems.

One of the constants between the editions is the focus on IPv4. Still! IPv6 only gets a glancing mention in the second edition. While everyone recognises that IPv4 will get exhausted of addresses, the transition to v6 still gets postponed. McNab ruminates that this very transition will of its own accord generate compromises. I wish he'd expand on this remark. But maybe there is yet little market reason to do so.

Another thing that does not get mentioned is phishing. In early 2004, it was still a minor threat. It has since blossomed into a chronic problem. But McNab is correct to ignore it, up to a point. He believes, as apparently does most of the IT security field, that phishing is largely a social engineering problem. That it is not a technical problem of patching bugs, per se. Yet viewed properly, phishing is a network attack that uses social engineering, and it is amenable to technical countermeasures that involve, in part, network actions.

I especially favour this edition, for the reasons in the preceding paragraph. In 2004, I and a co-inventor, Marvin Shannon, devised a US Patent Pending against phishing. The second edition of McNab's book came out in November 2007, and by not discussing phishing, it buttresses our claims of non-obviousness, 3 years after our filing.

==============================================================================
[A review of the 1st Edition. This review was written on 3 April 2004.]

A logically very systematic delineation of ways that your system could be attacked over the Internet. There are standard ways to access your computer like rlogin, telnet, ssh and ftp. But each implementation of these faces the risk that an error was made in its coding, which might then be found and exploited by a cracker. Plus, since the advent of the Web, there are Web services that have not checked for the stereotypical but very real case of buffer overflow in submitted input over the network.

McNab describes all these, and more. But perhaps more usefully, his book is not a simple recital of implementation versions and associated known bugs and available patches. He tries instead to guide the reader into understanding the broad ideas in network access, and using a viewpoint of logically analysing for any weaknesses. Because any static listing of versions and bugs runs the risk of being obsoleted in a few years.

He presents web sites that are good resources for patches or latest versions of key programs. If you are concerned about a specific program, try going straight to it in the book and seeing what advice he offers.

For all the programs he mentions, some prior knowledge of their use would be handy. He gives a succinct description of each, but really he assumes you have already used it.
Help other customers find the most helpful reviews  
Was this review helpful to you? Yes No


 
14 of 17 people found the following review helpful:
5.0 out of 5 stars Better than Hacking Exposed, April 9, 2004
By James Drake (Arlington, VA USA) - See all my reviews
This review is from: Network Security Assessment: Know Your Network (Paperback)
This book is a great resource for any administrator with IP networks to protect. As Wes Boudville says, it certainly is systematic with some great guidelines and useful checklists. The high level concepts laid out by the author make it much easier to understand the underlying issues with security nowadays. Instead of listing bugs and patches, McNab explains the different bug types, and I learnt a lot about stack and heap overflows in the application security chapter.

I'd recommend this book over Hacking Exposed and other books with the word 'hacking' in the title. The assessment material is comprehensive from both Unix and Windows standpoints, and I certainly picked up a bunch of new tricks that I wasn't aware of before. The book has great coverage of all the latest tools and techniques, but written in a timeless way. At just under 400 pages you'll find that it's not too long either!

Help other customers find the most helpful reviews  
Was this review helpful to you? Yes No

Share your thoughts with other customers: Create your own review
 
 
Ad
 
Most Recent Customer Reviews

4.0 out of 5 stars Still good companion for the security prosessional
This review is a comparison between the first and second edition. Other readers have properly described the book and you won't find anything different. Read more
Published on July 2, 2008 by JEO

5.0 out of 5 stars Essential For Security Concerned IT Admins
'Network Security Assessment: Know Your Network' is an absolute must buy for anyone that runs/admins a network and needs to know the tricks to keeping things safer in today's... Read more
Published on April 2, 2008 by Daniel McKinnon

5.0 out of 5 stars Any collection catering to programmers or network managers needs
Chris McNab's NETWORK SECURITY ASSESSMENT appears in its second updated edition to cover the protocols for testing network security - by trying to attack it internally. Read more
Published on January 6, 2008 by Midwest Book Review

5.0 out of 5 stars Network Security Assessment
explainsa variety of exploits and tells you how to harden your network. This book is very well researched and extremely well written and is reader friendly, as some security books... Read more
Published on July 20, 2005 by Graham S. Roberts

5.0 out of 5 stars Very good book for security policy enablers and admins
This is one of the few books that I have come across that focuses mainly on the innards of security assessments. Read more
Published on May 29, 2005 by William McAfee

5.0 out of 5 stars Good Methodology and Specifics
I've read a heck of a lot of books on security assessments. Some turn into hacking manuals, others turn into windy documents on documenting the process and why each piece of the... Read more
Published on May 7, 2005 by A. E Heald

4.0 out of 5 stars Getting into the technical nitty-gritty of assessments
Recently I published a review of "Security Assessment - Case Studies for Implementing The NSA IAM". In other reviews of this book, one person was upset that it did not focus on... Read more
Published on May 4, 2005 by Christopher Byrne

3.0 out of 5 stars Good book for assessments overview
Network Security Assessment is a quite good book. It lists many scanning tools and techniques appliable on different network aspects, reordering ideas to a confused security... Read more
Published on February 25, 2005 by Alessandro Perilli

4.0 out of 5 stars Excellent book and has a lot of valuable information
The book's preface starts out with a simple fact, one that is not always obvious to many: It is never impossible for a hacker to break into a computer system, only improbable... Read more
Published on October 9, 2004 by Ben Rothke

5.0 out of 5 stars A great collection of assessment tools and techniques

Awareness is a key component in a person's quest for mitigating the inherent risk of operating an IP network attached to the Internet. Read more
Published on August 30, 2004 by F. Loehmann

Only search this product's reviews


Customer Discussions

This product's forum
Discussion Replies Latest Post
No discussions yet

Ask questions, Share opinions, Gain insight
Start a new discussion
Topic:
First post:
Prompts for sign-in
 


Active discussions in related forums
Search Customer Discussions
Search all Amazon discussions
   


Look for Similar Items by Category

Look for Similar Items by Subject

Search Books by subject:
























i.e., each book must be in subject 1 AND subject 2 AND ...
 

Feedback

If you need help or have a question for Customer Service, contact us.
 Would you like to update product info or give feedback on images?
Is there any other feedback you would like to provide?

Your comments can help make our site better for everyone.


Your Recent History

 (What's this?)

After viewing product detail pages or search results, look here to find an easy way to navigate back to pages you are interested in.