- Paperback: 672 pages
- Publisher: Cisco Press; 1 edition (January 8, 2008)
- Language: English
- ISBN-10: 1587053365
- ISBN-13: 978-1587053368
- Product Dimensions: 7.3 x 1.5 x 8.8 inches
- Shipping Weight: 2.4 pounds (View shipping rates and policies)
- Average Customer Review: 4.8 out of 5 stars See all reviews (6 customer reviews)
- Amazon Best Sellers Rank: #1,056,541 in Books (See Top 100 in Books)
Enter your mobile number or email address below and we'll send you a link to download the free Kindle App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.
To get the free app, enter your mobile phone number.
Router Security Strategies: Securing IP Network Traffic Planes 1st Edition
Use the Amazon App to scan ISBNs and compare prices.
Frequently Bought Together
Customers Who Bought This Item Also Bought
From the Back Cover
"Router Security Strategies: Securing IP Network Traffic Planes" provides a compre-hensive approach to understand and implement IP traffic plane separation and protection on IP routers. This book details the distinct traffic planes of IP networks and the advanced techniques necessary to operationally secure them. This includes the data, control, management, and services planes that provide the infrastructure for IP networking. The first section provides a brief overview of the essential components of the Internet Protocol and IP networking. At the end of this section, you will understand the fundamental principles of defense in depth and breadth security as applied to IP traffic planes. Techniques to secure the IP data plane, IP control plane, IP management plane, and IP services plane are covered in detail in the second section. The final section provides case studies from both the enterprise network and the service provider network perspectives. In this way, the individual IP traffic plane security techniques reviewed in the second section of the book are brought together to help you create an integrated, comprehensive defense in depth and breadth security architecture. "Understanding and securing IP traffic planes are critical to the overall security posture of the IP infrastructure. The techniques detailed in this book provide protection and instrumentation enabling operators to understand and defend against attacks. As the vulnerability economy continues to mature, it is critical for both vendors and network providers to collaboratively deliver these protections to the IP infrastructure." -Russell Smoak, Director, Technical Services, Security Intelligence Engineering, Cisco Gregg Schudel, CCIE(R) No. 9591, joined Cisco in 2000 as a consulting system engineer supporting the U.S. service provider organization. Gregg focuses on IP core network security architectures and technology for interexchange carriers and web services providers. David J. Smith, CCIE No. 1986, joined Cisco in 1995 and is a consulting system engineer supporting the service provider organization. David focuses on IP core and edge architectures including IP routing, MPLS technologies, QoS, infrastructure security, and network telemetry.
- Understand the operation of IP networks and routers
- Learn about the many threat models facing IP networks, Layer 2 Ethernet switching environments, and IPsec and MPLS VPN services
- Learn how to segment and protect each IP traffic plane by applying defense in depth and breadth principles
- Use security techniques such as ACLs, rate limiting, IP Options filtering, uRPF, QoS, RTBH, QPPB, and many others to protect the data plane of IP and switched Ethernet networks
- Secure the IP control plane with rACL, CoPP, GTSM, MD5, BGP and ICMP techniques and Layer 2 switched Ethernet-specific techniques
- Protect the IP management plane with password management, SNMP, SSH, NTP, AAA, as well as other VPN management, out-of-band management, and remote access management techniques
- Secure the IP services plane using recoloring, IP fragmentation control, MPLS label control, and other traffic classification and process control techniques
About the Author
Gregg Schudel,CCIE No. 9591 (Security), joined Cisco in 2000 as a consulting system engineer supporting the U.S. Service Provider Organization. Gregg focuses on IP core network and services security architectures and technology for inter-exchange carriers, web services providers, and mobile providers. Gregg is also part of a team of Corporate and Field resources focused on driving Cisco Service Provider Security Strategy. Prior to joining Cisco, Gregg worked for many years with BBN Technologies, where he supported network security research and development, most notably in conjunction with DARPA and other federal agencies involved in security research. Gregg holds an MS in engineering from George Washington University, and a BS in engineering from Florida Institute of Technology. Gregg can be contacted through e-mail at firstname.lastname@example.org.
David J. Smith, CCIE No. 1986 (Routing and Switching), joined Cisco in 1995 and is a consulting system engineer supporting the Service Provider Organization. Since 1999 David has focused on service provider IP core and edge architectures, including IP routing, MPLS technologies, QoS, infrastructure security, and network telemetry. Between 1995 and 1999, David supported enterprise customers designing campus and global WANs. Prior to joining Cisco, David worked at Bellcore developing systems software and experimental ATM switches. David holds an MS in information networking from Carnegie Mellon University, and a BS in computer engineering from Lehigh University. David can be contacted through e-mail at email@example.com.
Top Customer Reviews
RSS focuses on ways to protect transit, receive, and exception IP traffic in the data, control, management, and service planes of Enterprise and Service Provider (SP) networks. That one sentence almost summarizes the entire table of contents, where Chs 4-7 cover the four planes, Chs 8 and 9 provide case studies for Enterprise and SP networks, respectively, and Chs 1-3 provide introductory and conceptual material. This is how to write a technical book! Tangential material appears in four appendices, and the authors keep the reader on track through the entire text.
RSS makes a compelling case for network security in a world where applications and Web 2.0 are all the rage. I believe many people who scoff at network security have no real idea of the complexities inherent in modern network infrastructure. Too many application-centric people take it for granted that they can reach whatever Web victim they're attacking; perhaps that is a credit to network engineers who've made their creations just work and not be the center of attention. Should attackers decide to focus on network infrastructure, RSS provides plenty of techniques for defending routers and even some switches. I enjoyed learning more about several uRPF techniques, Flexible Pattern Matching (FPM), Selective Packet Discard, Receive ACLS, Control Plane Policing, Dynamic APR Inspection (DAI), and CLI Views. Many of these methods exist to protect the network itself, not necessarily the endpoints. While the authors do mention a desire to protect hosts, I liked seeing such a focus on defending infrastructure. Perhaps "network security" should be a term transitioned to solely mean protecting network platforms?
I thought Appendix B would be the standard catalog of TCP/IP header diagrams, but I was pleasantly described to see a different approach. App B did depict IP, TCP, UDP, ICMP, IEEE 802.3, and 802.1Q headers, but the authors provide a security implication for each field in these headers. I found that to be original and informative.
I subtracted one star for two aspects of the book which bothered me. First, the authors tend to use the term "threat" in a manner which is not consistent with real threat terminology. For example, p 87 speaks of "the potential threat and impact of a given vulnerability". Threat, impact, and vulnerability are all separate concepts. Ch 2, where such terminology appears, is titled "Threat Models for IP Networks." If you read the chapter it is a catalog of attacks, which sections titled "Resource Exhaustion Attacks", "Spoofing Attacks", and so on. Clearly Ch 2 is "Attack Models for IP Networks".
Second, although the material in RSS is excellent, the authors' tendency to repeat concepts wore me down. It's usually acceptable to begin a section by referencing and/or rephrasing material from an earlier chapter, or at worst farther back in the same chapter. It's simply annoying to be told the same material that appeared in the last paragraph. Any time the reader encounters "as stated in the last section" or similar, the authors should reconsider discussing the concept again. Edits like these wouldn't necessarily shrink the book that much, but the text would not treat the reader as if he or she has too short an attention span to remember what he or she just read.
Despite those two concerns, I still very much enjoyed reading RSS. You will probably get more out of the book if you have MPLS experience, but the authors provide plenty of background anyway. One of the best aspects of RSS is the presentation of extensive IOS syntax for all of the major concepts in the book. The authors do not talk about a technique and then leave it as an exercise for the reader to determine how that idea should be implemented in IOS. Those trying to protect data, control, management, and service IP traffic will be well-served by reading RSS.
Book is structured into four Parts;
Part I focuses on laying the foundation for the rest of the book. It achieves this purpose by talking about the Enterprise and SP network fundamentals. This also includes day-in-the-life-of-a-packet through various router switching mechanisms. Chapter 2 re-hashes the network security/threat models but does a nice job of dividing it into various aspects of architectures including various IP VPNs scenarios.
For an advanced reader, this should serve as a nice refresher!
Part II introduces you to real meat of router security, i.e., securing the router planes in both IP and MPLS networks. Authors do a good job of describing the details of each component. Chapters in this section contain working details and IOS configuration snippets to enhance the understanding of various concepts discussed. An advanced user will find all the details given here very useful, and prefer read them cover to cover.
Part III walks you through various case studies to further the concepts explained in the prior chapters. I particularly like the idea of covering both Enterprise and SP case studies. It provides use cases, application examples, and best practices guidelines for the key concepts discussed in the whole book
In Part IV, I very much like the idea of not just copying pasting the headers as-is, rather adding the security implications of each and putting them into its context. Cisco IOS to IOS-XR Security transition is also useful although to mostly SP audience.
This book discusses security as in Router planes for both IP and MPLS VPNs Security. A few times you can notice that authors are repeating themselves.
Overall, I strongly recommend this book to all network security engineers as MPLS (due to its inherent advantages and applications) is gaining momentum not only in the service provider space but also in the enterprise market segment.