- Paperback: 336 pages
- Publisher: Cisco Press; 1 edition (July 16, 2007)
- Language: English
- ISBN-10: 1587052709
- ISBN-13: 978-1587052705
- Product Dimensions: 7.3 x 0.7 x 9 inches
- Shipping Weight: 1.2 pounds
- Average Customer Review: 5 customer reviews
- Amazon Best Sellers Rank: #4,261,719 in Books (See Top 100 in Books)
Enter your mobile number or email address below and we'll send you a link to download the free Kindle App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.
To get the free app, enter your mobile phone number.
Security Monitoring with Cisco Security MARS 1st Edition
Use the Amazon App to scan ISBNs and compare prices.
Fulfillment by Amazon (FBA) is a service we offer sellers that lets them store their products in Amazon's fulfillment centers, and we directly pack, ship, and provide customer service for these products. Something we hope you'll especially enjoy: FBA items qualify for FREE Shipping and Amazon Prime.
If you're a seller, Fulfillment by Amazon can help you increase your sales. We invite you to learn more about Fulfillment by Amazon .
From the Back Cover
Security Monitoring with Cisco Security MARS
Threat mitigation system deployment
Networks and hosts are probed hundreds or thousands of times a day in an attempt to discover vulnerabilities. An even greater number of automated attacks from worms and viruses stress the same devices. The sheer volume of log messages or events generated by these attacks and probes, combined with the complexity of an analyst needing to use multiple monitoring tools, often makes it impossible to adequately investigate what is happening.
Cisco® Security Monitoring, Analysis, and Response System (MARS) is a next-generation Security Threat Mitigation system (STM). Cisco Security MARS receives raw network and security data and performs correlation and investigation of host and network information to provide you with actionable intelligence. This easy-to-use family of threat mitigation appliances enables you to centralize, detect, mitigate, and report on priority threats by leveraging the network and security devices already deployed in a network, even if the devices are from multiple vendors.
Security Monitoring with Cisco Security MARShelps you plan a MARS deployment and learn the installation and administration tasks you can expect to face. Additionally, this book teaches you how to use the advanced features of the product, such as the custom parser, Network Admission Control (NAC), and global controller operations. Through the use of real-world deployment examples, this book leads you through all the steps necessary for proper design and sizing, installation and troubleshooting, forensic analysis of security events, report creation and archiving, and integration of the appliance with Cisco and third-party vulnerability assessment tools.
“In many modern enterprise networks, Security Information Management tools are crucial in helping to manage, analyze, and correlate a mountain of event data. Greg Kellogg and Gary Halleen have distilled an immense amount of extremely valuable knowledge in these pages. By relying on the wisdom of Kellogg and Halleen embedded in this book, you will vastly improve your MARS deployment.
—Ed Skoudis, Vice President of Security Strategy, Predictive Systems
Gary Halleen is a security consulting systems engineer with Cisco. He has in-depth knowledge of security systems as well as remote-access and routing/switching technology. Gary is a CISSP and ISSAP. His diligence was responsible for the first successful computer crimes conviction in the state of Oregon. Gary is a regular speaker at security events and presents at Cisco Networkers conferences.
Greg Kellogg is the vice president of security solutions for Calence, LLC. He is responsible for managing the company's overall security strategy. Greg has more than 15 years of networking industry experience, including serving as a senior security business consultant for the Cisco Enterprise Channel organization. Additionally, Greg worked for Protego Networks, Inc. (where MARS was originally developed). There he was responsible for developing channel partner programs and helped solution providers increase their security revenue.
Learn the differences between various log aggregation and correlation systems
- Examine regulatory and industry requirements
- Evaluate various deployment scenarios
- Properly size your deployment
- Protect the Cisco Security MARS appliance from attack
- Generate reports, archive data, and implement disaster recovery plans
- Investigate incidents when Cisco Security MARS detects an attack
- Troubleshoot Cisco Security MARS operation
- Integrate Cisco Security MARS with Cisco Security Manager, NAC, and third-party devices
- Manage groups of MARS controllers with global controller operations
This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.
Category: Cisco Press—Security
Covers: Security Threat Mitigation
About the Author
Gary Halleen is a security consulting systems engineer with Cisco. He has in-depth knowledge of security systems, remote access, and routing/switching technology. Gary is a CISSP and ISSAP and has been a technical editor for Cisco Press. Before working at Cisco, he wrote web-based software, owned an Internet service provider, worked in Information Technology at a college, and taught computer science courses. His diligence was responsible for the first successful computer crimes conviction in the state of Oregon. Gary is a regular speaker at security events, and he presents at Cisco Networkers conferences. He lives in Salem, Oregon, with his wife and children.
Greg Kellogg is the vice president of security solutions for Calence, LLC, which is based out of Tempe, Arizona. He is responsible for managing the company’s overall security strategy, as well as developing new security solutions and service offerings, establishing strategic partnerships, managing strategic client engagements, and supporting business development efforts. Greg has more than 15 years of networking industry experience, including serving as a senior security business consultant for the Cisco Systems Enterprise Channel organization. While at Cisco, Greg helped organizations understand regulatory compliance, policy creation, and risk analysis to guide their security implementations. He was recognized for his commitment to service with the Cisco Technology Leader of the Year award. Additionally, Greg worked for Protego Networks, Inc. (where MARS was originally developed). While there, he was responsible for developing channel partner programs and helping solution providers increase their security revenue. Greg currently resides in Spring Branch, Texas, with his wife and four children.
Author interviews, book reviews, editors picks, and more. Read it now
Top customer reviews
There was a problem filtering reviews right now. Please try again later.
I found that the authors did a great job detailing the importance and configuration of Archiving for CS-MARS. Many organizations forget to do this and suffer because of it.
Some of the other highlights that caught my eye and I thought everyone would like were:
- Chapter on Regulatory Compliance - Most books offer too many details on information that does not mean a lot to their audience, but this gives the perfect amount of information in order for you to understand the compliancy rules and how CS-MARS specifically handles them.
- How to size the MARS box for your organization
- Another chapter that caught the eye, was how to secure your MARS appliance, and why you should, with suggested IPS placement and firewall rules
- Details into how to use CS-MARS in your incident response procedure
- Integration of CSM with CS-MARS, this is where Cisco really stands out with security, being able to bring intelligence from one product into another
- The book would not of been complete without a section on the Custom Parser. There are a few examples, plus a parser for the Cisco CSC Module that you won't find anywhere else.
Overall a must for anyone working with CS-MARS product.
Another aspect that I thought was lacking was in the arena of topology awareness and device discovery. The book mentions that this solution is Topology Aware and how that is beneficial. However, it does not get very deep into how that is calculated and it pulls this information. Discovery is glossed over as well. For example, MARs has a global setting that is called "Valid Addresses". Does anyone know what that means? I would assume any addresses on MY network.
The book also mentions that MARs can do Vulnerability Assessments to determine the OS/Patch level of a host, but doesn't give detail as to how and when this happens.
I also felt like the book was extremely terse in explanation of connecting it to devices for collection. Granted this is a MARS book, but the fact that it is from Cisco Press, I would have expected general recommendations for connecting to an ASA, Pix, Router and Switch. None of that is there. Additionally, Netflow is barely mentioned.
This book is a good read, but only for new Mars admins. This book is well written, but its coverage is like swiss cheese. It is more like a document that was produced from an idea of what MARs was going to be during the development cycle than a guide that will lead you through implementation, and operation. As I said, I enjoyed, the book and it was a quick read. Probably not worth the list price though.
I certainly recommend this book to anyone who is looking at security event management products, or has purchased MARS for their organization!