Chris Fry

Security Monitoring (eBook, ePUB)

Proven Methods for Incident Detection on Enterprise Networks

• Format: ePub

Produktbeschreibung

How well does your enterprise stand up against today's sophisticated security threats? In this book, security experts from Cisco Systems demonstrate how to detect damaging security incidents on your global network--first by teaching you which assets you need to monitor closely, and then by helping you develop targeted strategies and pragmatic techniques to protect them.Security Monitoring is based on the authors' years of experience conducting incident response to keep Cisco's global network secure. It offers six steps to improve network monitoring. These steps will help you:Develop Policies: define rules, regulations, and monitoring criteriaKnow Your Network: build knowledge of your infrastructure with network telemetrySelect Your Targets: define the subset of infrastructure to be monitoredChoose Event Sources: identify event types needed to discover policy violationsFeed and Tune: collect data, generate alerts, and tune systems using contextual informationMaintain Dependable Event Sources: prevent critical gaps in collecting and monitoring eventsSecurity Monitoring illustrates these steps with detailed examples that will help you learn to select and deploy the best techniques for monitoring your own enterprise network.

---

Dieser Download kann aus rechtlichen Gründen nur mit Rechnungsadresse in A, B, BG, CY, CZ, D, DK, EW, E, FIN, F, GR, HR, H, IRL, I, LT, L, LR, M, NL, PL, P, R, S, SLO, SK ausgeliefert werden.

Produktdetails

• Verlag: O'Reilly Media
• Seitenzahl: 256
• Erscheinungstermin: 9. Februar 2009
• Englisch
• ISBN-13: 9780596555450
• Artikelnr.: 53001195

Autorenporträt

Chris Fry has been a member of the Computer Security Incident Response Team (CSIRT) at Cisco Systems, Inc for 5 years, focusing on deployment of intrusion detection, network monitoring tools, and incident investigation. He began his career at Cisco in 1997 as an IT analyst, supporting Cisco's production services. His four years as a Network Engineer in Cisco IT's internal network support organization give him valuable knowledge about and unique insight into monitoring production enterprise networks. Chris holds a BA in Corporate Financial Analysis and an MS in Information and Communication Sciences from Ball State University.

Inhaltsangabe

Preface
What This Book Is Not
What This Book Is
Conventions Used in This Book
Using Code Examples
Safari® Books Online
Comments and Questions
Acknowledgments
Chapter 1: Getting Started
1.1 A Rapidly Changing Threat Landscape
1.2 Why Monitor?
1.3 Challenges to Monitoring
1.4 Outsourcing Your Security Monitoring
1.5 Monitoring to Minimize Risk
1.6 Policy-Based Monitoring
1.7 Why Should This Work for You?
1.8 Open Source Versus Commercial Products
1.9 Introducing Blanco Wireless
Chapter 2: Implement Policies for Monitoring
2.1 Blacklist Monitoring
2.2 Anomaly Monitoring
2.3 Policy Monitoring
2.4 Monitoring Against Defined Policies
2.5 Types of Policies
2.6 Policies for Blanco Wireless
2.7 Conclusion
Chapter 3: Know Your Network
3.1 Network Taxonomy
3.2 Network Telemetry
3.3 The Blanco Wireless Network
3.4 Conclusion
Chapter 4: Select Targets for Monitoring
4.1 Methods for Selecting Targets
4.2 Practical Considerations for Selecting Targets
4.3 Recommended Monitoring Targets
4.4 Choosing Components Within Monitoring Targets
4.5 Blanco Wireless: Selecting Targets for Monitoring
4.6 Conclusion
Chapter 5: Choose Event Sources
5.1 Event Source Purpose
5.2 Choosing Event Sources for Blanco Wireless
5.3 Conclusion
Chapter 6: Feed and Tune
6.1 Network Intrusion Detection Systems
6.2 NIDS Deployment Framework
6.3 System Logging
6.4 NetFlow
6.5 Blanco's Security Alert Sources
6.6 Conclusion
Chapter 7: Maintain Dependable Event Sources
7.1 Maintain Device Configurations
7.2 Monitor the Monitors
7.3 Monitor Databases
7.4 Automated System Monitoring
7.5 System Monitoring for Blanco Wireless
7.6 Conclusion
Chapter 8: Conclusion: Keeping It Real
8.1 What Can Go Wrong
8.2 Case Studies
8.3 Real Stories of the CSIRT
8.4 Bare Minimum Requirements
8.5 Conclusion
Detailed OSU flow-tools Collector Setup
Set Up the Server
Configuring NetFlow Export from the Router
SLA Template
Service Level Agreement: Information Security and Network Engineering
Calculating Availability
Colophon