LAN Switch Security: What Hackers Know About Your Switches Review

Average Reviews:

(More customer reviews)I really looked forward to reading LAN Switch Security (LSS), simply because it covered layer 2 issues. These days application security, rootkits, and similar topics get all the press, but the foundation of the network is still critical. Unfortunately, LSS disappointed me enough to warrant this three star review. I'm afraid those before me who wrote five star reviews 1) don't read enough other books or 2) don't set their expectations high enough.
Let me first say I am not anti-Cisco, nor anti-Cisco-book. For an earlier Cisco Press book I wrote "I really enjoyed reading Cisco Router Firewall Security (CRFS) by Richard Deal. This book delivers just what a technical Cisco book should: discussion of concepts, explanation of command syntax, and practical examples." LSS, however, is not what I like to see in a Cisco book. It suffers the major flaw found in almost all technical books featuring large numbers of writers (LSS has 2 authors, 4 contributors, 2 tech editors): incoherence and overlapping discussions. Furthermore, many of these contributors do not write clearly. I found large sections to be disjointed and inconsistent. It is clear that no one stepped up to the plate to see if the finished product made any sense from the reader's perspective.
The second major problem with this book is that older books easily overpower LSS. For example, in March 2006 I gave Hacking Exposed: Cisco Networks (HECN) four stars. HECN covers many of the same topics as LSS, more clearly, with more syntax, and better explanations. Anyone who wants to buy a book about layer 2 security should start with HECN. If you don't want to buy a book, just download the free 86-page Cisco IOS Switch Security Configuration Guide published by NSA.
If you read HECN or the NSA guide, you'll be struck by the amount of configuration syntax in those resources. If you glance through LSS you'll see syntax, but (and this bothered me greatly) not for all the features discussed. For example, LSS ch 16 (Wire Speed Access Control Lists) features sections titled "Working with RACL", "Working with VACL", and "Working with PACL". That's great -- six pages (pp 263-268), with no command syntax! Sure, you can read about using VACLs for traffic capture, but where are the examples? If you tell me they are the same as other examples, I want to see the proof. This is the sort of glaring omission that really frustrated me.
I did like some of LSS. I thought attacks against link aggregation protocols, discussions of control plane policy, and spanning tree protocol were interesting. Adding discussions of ARP spoofing a remote gateway using Yersinia would have been helpful. There's a decent number of typos (POP != "point of presence", replace "Ethernet" with "IP" on p 235), but technically the book seemed sound. (One of the authors was kind enough to confirm the p 235 typo; I wanted to be sure I hadn't missed something important.)
I notice Cisco is publishing a book titled Router Security Strategies: Securing IP Network Traffic Planes in December. Presumably that will be a counterpart to this title, except at layer 3. I hope that new book avoids the mistakes made by LSS.

Click Here to see more reviews about: LAN Switch Security: What Hackers Know About Your Switches

LAN Switch Security: What Hackers Know About Your SwitchesA practical guide to hardening Layer 2 devices and stopping campus network attacksEric VynckeChristopher Paggen, CCIE® No. 2659Contrary to popular belief, Ethernet switches are not inherently secure. Security vulnerabilities in Ethernet switches are multiple: from the switch implementation, to control plane protocols (Spanning Tree Protocol [STP], Cisco® Discovery Protocol [CDP], and so on) and data plane protocols, such as Address Routing Protocol (ARP) or Dynamic Host Configuration Protocol (DHCP). LAN Switch Security explains all the vulnerabilities in a network infrastructure related to Ethernet switches. Further, this book shows you how to configure a switch to prevent or to mitigate attacks based on those vulnerabilities. This book also includes a section on how to use an Ethernet switch to increase the security of a network and prevent future attacks.Divided into four parts, LAN Switch Security provides you with steps you can take to ensure the integrity of both voice and data traffic traveling over Layer 2 devices. Part I covers vulnerabilities in Layer 2 protocols and how to configure switches to prevent attacks against those vulnerabilities. Part II addresses denial-of-service (DoS) attacks on an Ethernet switch and shows how those attacks can be mitigated. Part III shows how a switch can actually augment the security of a network through the utilization of wirespeed access control list (ACL) processing and IEEE 802.1x for user authentication and authorization. Part IV examines future developments from the LinkSec working group at the IEEE. For all parts, most of the content is vendor independent and is useful for all network architects deploying Ethernet switches.After reading this book, you will have an in-depth understanding of LAN security and be prepared to plug the security holes that exist in a great number of campus networks. Eric Vyncke has a master's degree in computer science engineering from the University of Liège in Belgium. Since 1997, Eric has worked as a Distinguished Consulting Engineer for Cisco, where he is a technical consultant for security covering Europe. His area of expertise for 20 years has been mainly security from Layer 2 to applications. He is also guest professor at Belgian universities for security seminars. Christopher Paggen, CCIE® No. 2659, obtained a degree in computer science from IESSL in Liège (Belgium) and a master's degree in economics from University of Mons-Hainaut (UMH) in Belgium. He has been with Cisco since 1996 where he has held various positions in the fields of LAN switching and security, either as pre-sales support, post-sales support, network design engineer, or technical advisor to various engineering teams. Christopher is a frequent speaker at events, such as Networkers, and has filed several U.S. patents in the security area.Contributing Authors:Jason Frazier is a technical leader in the Technology Systems Engineering group for Cisco.Steinthor Bjarnason is a consulting engineer for Cisco.Ken Hook is a switch security solution manager for Cisco.Rajesh Bhandari is a technical leader and a network security solutions architect for Cisco.Use port security to protect against CAM attacksPrevent spanning-tree attacks Isolate VLANs with proper configuration techniquesProtect against rogue DHCP serversBlock ARP snoopingPrevent IPv6 neighbor discovery and router solicitation exploitationIdentify Power over Ethernet vulnerabilitiesMitigate risks from HSRP and VRPPStop information leaks with CDP, PaGP, VTP, CGMP and other Cisco ancillary protocolsUnderstand and prevent DoS attacks against switchesEnforce simple wirespeed security policies with ACLsImplement user authentication on a port base with IEEE 802.1xUse new IEEE protocols to encrypt all Ethernet frames at wirespeed.This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.Category: Cisco Press—SecurityCovers: Ethernet Switch Security$60.00 USA / $69.00 CANLAN Switch Security: What Hackers Know About Your SwitchesA practical guide to hardening Layer 2 devices and stopping campus network attacksEric VynckeChristopher Paggen, CCIE® No. 2659Contrary to popular belief, Ethernet switches are not inherently secure. Security vulnerabilities in Ethernet switches are multiple: from the switch implementation, to control plane protocols (Spanning Tree Protocol [STP], Cisco® Discovery Protocol [CDP], and so on) and data plane protocols, such as Address Routing Protocol (ARP) or Dynamic Host Configuration Protocol (DHCP). LAN Switch Security explains all the vulnerabilities in a network infrastructure related to Ethernet switches. Further, this book shows you how to configure a switch to prevent or to mitigate attacks based on those vulnerabilities. This book also includes a section on how to use an Ethernet switch to increase the security of a network and prevent future attacks.Divided into four parts, LAN Switch Security provides you with steps you can take to ensure the integrity of both voice and data traffic traveling over Layer 2 devices. Part I covers vulnerabilities in Layer 2 protocols and how to configure switches to prevent attacks against those vulnerabilities. Part II addresses denial-of-service (DoS) attacks on an Ethernet switch and shows how those attacks can be mitigated. Part III shows how a switch can actually augment the security of a network through the utilization of wirespeed access control list (ACL) processing and IEEE 802.1x for user authentication and authorization. Part IV examines future developments from the LinkSec working group at the IEEE. For all parts, most of the content is vendor independent and is useful for all network architects deploying Ethernet switches.After reading this book, you will have an in-depth understanding of LAN security and be prepared to plug the security holes that exist in a great number of campus networks. Eric Vyncke has a master's degree in computer science engineering from the University of Liège in Belgium. Since 1997, Eric has worked as a Distinguished Consulting Engineer for Cisco, where he is a technical consultant for security covering Europe. His area of expertise for 20 years has been mainly security from Layer 2 to applications. He is also guest professor at Belgian universities for security seminars. Christopher Paggen, CCIE® No. 2659, obtained a degree in computer science from IESSL in Liège (Belgium) and a master's degree in economics from University of Mons-Hainaut (UMH) in Belgium. He has been with Cisco since 1996 where he has held various positions in the fields of LAN switching and security, either as pre-sales support, post-sales support, network design engineer, or technical advisor to various engineering teams. Christopher is a frequent speaker at events, such as Networkers, and has filed several U.S. patents in the security area.Contributing Authors:Jason Frazier is a technical leader in the Technology Systems Engineering group for Cisco.Steinthor Bjarnason is a consulting engineer for Cisco.Ken Hook is a switch security solution manager for Cisco.Rajesh Bhandari is a technical leader and a network security solutions architect for Cisco.Use port security to protect against CAM attacksPrevent spanning-tree attacks Isolate VLANs with proper configuration techniquesProtect against rogue DHCP serversBlock ARP snoopingPrevent IPv6 neighbor discovery and router solicitation exploitationIdentify Power over Ethernet vulnerabilitiesMitigate risks from HSRP and VRPP...

Get 29% OFF

Click here for more information about LAN Switch Security: What Hackers Know About Your Switches

Read More...

Snort IDS and IPS Toolkit (Jay Beale's Open Source Security) Review

Average Reviews:

(More customer reviews)Syngress published "Snort 2.0" in Mar 03, and I gave it a four star review in Jul 03. Syngress followed with "Snort 2.1" in May 04, and I gave it a four star review in Jul 04. I recommend reading those reviews, since the latest edition -- "Snort IDS and IPS Toolkit" (SIAIT) -- makes many of the same mistakes as its predecessors. Worse, it includes material that was already outdated in BOTH previous editions. If you absolutely must buy a book on Snort, this edition is your only real choice. Otherwise, I would stick with the manual and online articles.
SIAIT looks impressive page-wise, but it suffers from the multiple-author, no-editing, rush-to-production problems unfortunately inherent in many Syngress titles. One would think that including many contributing authors (11, apparently) would make for a strong book. In reality, the book contributes very little beyond what appears in "Snort 2.1," despite the fact that "only" chapters 8, 10, 11, and 13 appear to be repeats or largely rehashes of older material. Comparing to "Snort 2.1," these compare to old chapters 7, 10, 12, and 11, respectively.
The absolute worst part of this book is the re-introduction of all the outdated information in chapters 8 and 10. It is 2007 and we are STILL reading on p 353 that XML output is "our favorite and relatively new logging format" and on p 367 that "Unified logs are the future of Snort reporting." (I cited both of these as being old news in Jul 04!) I should note that these chapters are not entirely duplicates; if you compare output such as that on page 335 of "Snort 2.1" with page 365 in SIAIT you'll see the author replaced the original 2003 timestamps with 2006! This is the height of lazy publishing. Chapter 10 features similar tricks, where traffic is the same except for global replacements of IP addresses and timestamps; notice the ACK numbers are still the same and the test uses Snort 1.8.
There's plenty more in this book to make you cringe. Mentions of Netbus, SubSeven, BO2k, ExploreZip, QAZ, and the like in ch 1 will make you think it's 1999 all over again. In ch 2 you can be mislead into thinking that "there will be rule upgrades released with each major version of Snort for those who do not care to register." In reality the last rule set for unregistered users arrived with Snort 2.4 in Jul 05. Ch 3 wastes time rambling about SMP, threads, operating systems, and other topics I can better learn in a non-Snort book. I also liked reading how to install Snort 2.4.3 on OpenBSD in a book about Snort 2.6.x. Ch 3 also featured such pearls of wisdom as recommendations to not run Metasploit but instead use worthless stateless tools like Snot and Sneeze (p 123).
A few more choice words could be said about these disasters. Check out the "three way handshake" diagram on p 238 that shows FIN ACK / FIN ACK / FIN, and the "graceful close" diagram on p 239 that shows FIN / FIN ACK / ACK / ACK. These sorts of train wrecks are evidence that someone is asleep at the publishing house. Returning to the old material theme for ch 9, be prepared for screenshots or output from BASE 1.0.2 from Jul 04, Sguil 0.3.1 from Apr 04, and SnortSnarf from Jan 03. Finally, ch 12: why bother?
I have a few positive comments. The best chapter in SIAIT is ch 5 (Inner Workings). I liked seeing Afterglow, Tenshi, and SEC in ch 9. I enjoyed hearing something about performance profiling in ch 6. I thought the rules chapter was ok, but (to repeat a plea from my earlier reviews) would someone please consider writing a real rule writing reference that exceeds the introductory material found in this book and elsewhere? We also need coverage of shared object rules and other advanced Snort features.
It should be clear by now that the Syngress Snort book procession needs to end. Another publisher should consider writing a real Snort book for version 3.0 once it is available.

Click Here to see more reviews about: Snort IDS and IPS Toolkit (Jay Beale's Open Source Security)

This all new book covering the brand new Snort version 2.6 from members of the Snort developers team.This fully integrated book, CD, and Web toolkit covers everything from packet inspection to optimizing Snort for speed to using the most advanced features of Snort to defend even the largest and most congested enterprise networks. Leading Snort experts Brian Caswell, Andrew Baker, and Jay Beale analyze traffic from real attacks to demonstrate the best practices for implementing the most powerful Snort features. The accompanying CD contains examples from real attacks allowing readers test their new skills. The book will begin with a discussion of packet inspection and the progression from intrusion detection to intrusion prevention. The authors provide examples of packet inspection methods including: protocol standards compliance, protocol anomaly detection, application control, and signature matching. In addition, application-level vulnerabilities including Binary Code in HTTP headers, HTTP/HTTPS Tunneling, URL Directory Traversal, Cross-Site Scripting, and SQL Injection will also be analyzed. Next, a brief chapter on installing and configuring Snort will highlight various methods for fine tuning your installation to optimize Snort performance including hardware/OS selection, finding and eliminating bottlenecks, and benchmarking and testing your deployment. A special chapter also details how to use Barnyard to improve the overall performance of Snort. Next, best practices will be presented allowing readers to enhance the performance of Snort for even the largest and most complex networks. The next chapter reveals the inner workings of Snort by analyzing the source code. The next several chapters will detail how to write, modify, and fine-tune basic to advanced rules and pre-processors. Detailed analysis of real packet captures will be provided both in the book and the accompanying CD. Several examples for optimizing output plugins will then be discussed including a comparison of MySQL and PostrgreSQL. Best practices for monitoring Snort sensors and analyzing intrusion data follow with examples of real world attacks using: ACID, BASE, SGUIL, SnortSnarf, Snort_stat.pl, Swatch, and more.The last part of the book contains several chapters on active response, intrusion prevention, and using Snort's most advanced capabilities for everything from forensics and incident handling to building and analyzing honey pots. Data from real world attacks will be presented throughout this part as well as on the accompanying CD. * This fully integrated book, CD, and Web toolkit covers everything all in one convenient package * It is authored by members of the Snort team and it is packed full of their experience and expertise* Includes full coverage of the brand new Snort version 2.6, packed full of all the latest information

Get 34% OFF

Click here for more information about Snort IDS and IPS Toolkit (Jay Beale's Open Source Security)

Read More...

Voice over IP Security Review

Average Reviews:

(More customer reviews)I have been carrying this book around with me for a couple weeks now and had a couple long plane flights as well. This is a difficult book to review. The author clearly knows his stuff and the threat treatment is great. However, the material is all over the map. The subtitle talks about good security practices and the book is short on that to be candid. Bottom line, if you are considering a VoIP deployment or wondering how secure/robust your existing deployment is, this is a must read.
My favorite "I never thought of that" scenario in the book was a simple power outage. What if you have twenty thousand IP phones and the power drops . . . then when it is restored all 20k phones start banging the server causing an outage.

Click Here to see more reviews about: Voice over IP Security

Voice over IP SecuritySecurity best practices derived from deep analysis of the latest VoIP network threatsPatrick ParkVoIP security issues are becoming increasingly serious because voice networks and services cannot be protected from recent intelligent attacks and fraud by traditional systems such as firewalls and NAT alone. After analyzing threats and recent patterns of attacks and fraud, consideration needs to be given to the redesign of secure VoIP architectures with advanced protocols and intelligent products, such as Session Border Controller (SBC). Another type of security issue is how to implement lawful interception within complicated service architectures according to government requirements.Voice over IP Security focuses on the analysis of current and future threats, the evaluation of security products, the methodologies of protection, and best practices for architecture design and service deployment. This book not only covers technology concepts and issues, but also provides detailed design solutions featuring current products and protocols so that you can deploy a secure VoIP service in the real world with confidence.Voice over IP Security gives you everything you need to understand the latest security threats and design solutions to protect your VoIP network from fraud and security incidents.Patrick Park has been working on product design, network architecture design, testing, and consulting for more than 10 years. Currently Patrick works for Cisco® as a VoIP test engineer focusing on security and interoperability testing of rich media collaboration gateways. Before Patrick joined Cisco, he worked for Covad Communications as a VoIP security engineer focusing on the design and deployment of secure network architectures and lawful interception (CALEA). Patrick graduated from the Pusan National University in South Korea, where he majored in computer engineering.Understand the current and emerging threats to VoIP networksLearn about the security profiles of VoIP protocols, including SIP, H.323, and MGCPEvaluate well-known cryptographic algorithms such as DES, 3DES, AES, RAS, digital signature (DSA), and hash function (MD5, SHA, HMAC)Analyze and simulate threats with negative testing toolsSecure VoIP services with SIP and other supplementary protocolsEliminate security issues on the VoIP network border by deploying an SBCConfigure enterprise devices, including firewalls, Cisco Unified Communications Manager, Cisco Unified Communications Manager Express, IP phones, and multilayer switches to secure VoIP network trafficImplement lawful interception into VoIP service environmentsThis IP communications book is part of the Cisco Press® Networking Technology Series. IP communications titles from Cisco Press help networking professionals understand voice and IP telephony technologies, plan and design converged networks, and implement network solutions for increased productivity.Category: Networking—IP CommunicationCovers: VoIP Security

Get 19% OFF

Click here for more information about Voice over IP Security

Read More...

FISMA Principles and Best Practices: Beyond Compliance Review

Average Reviews:

(More customer reviews)this is one of the better titles on FISMA.
If you work in the govt. arena and have to deal with FISMA, check this book out.
Written by an insider who knows his stuff.

Click Here to see more reviews about: FISMA Principles and Best Practices: Beyond Compliance

While many agenciesstruggle to comply with Federal Information Security Management Act (FISMA) regulations, those that have embraced its requirements have found that their comprehensive and flexible nature provides a sound security risk management framework for the implementation of essential system security controls. Detailing a proven approach for establishing and implementing a comprehensive information security program, FISMA Principles and Best Practices: Beyond Compliance integrates compliance review, technical monitoring, and remediation efforts to explain how to achieve and maintain compliance with FISMA requirements.Based on the author's experience developing, implementing, and maintaining enterprise FISMA-based information technology security programs at three major federal agencies, including the U.S. Department of Housing and Urban Development, the book gives you workable solutions for establishing and operating an effective security compliance program. It delineates the processes, practices, and principles involved in managing the complexities of FISMA compliance. Describing how FISMA can be used to form the basis for an enterprise security risk management program, the book:Provides a comprehensive analysis of FISMA requirementsHighlights the primary considerations forestablishing an effective security compliance programIllustrates successful implementation of FISMA requirements with numerous case studiesClarifying exactly what it takes to gain and maintain FISMA compliance, Pat Howard, CISO of the Nuclear Regulatory Commission, provides detailed guidelines so you can design and staff a compliance capability, build organizational relationships, gain management support, and integrate compliance into the system development life cycle. While there is no such thing as absolute protection, this up-to-date resource reflects the important security concepts and ideas for addressing information security requirements mandated for government agencies and companies subject to these standards.

Get 17% OFF

Click here for more information about FISMA Principles and Best Practices: Beyond Compliance

Read More...