Slashdot Mirror
Intrusion Detection
Disgruntled Goat sent us a review of Intrusion Detection, a text sure to be of interest to all those working in organizations. The author is a former NSA employee and has written this book as a text to convince upper-level types of the need for security and actually paying attention to it. Click below to read more.
Intrusion Detection
author
Rebecca Gurley Bace
pages
339
publisher
Macmillan Technical Publishing, o01/2000
rating
9/10
reviewer
Disgruntled Goat, disgruntled_goat@hotmail.com
ISBN
1-57870-185-6
summary
Very good InfoSec handbook for suits and junior suits.
The Scenario
Security books, quite frankly, are pretty much a dime a dozen, most of which are
written by people in IT field security. What immediately separates this book from
the rest is the background of the author. Ms. Bace is an ex-government employee,
spending 12 years in everyone's favorite spook organization, the National Security Agency. She led the Computer Misuse
and Anonmaly Detection (CMAD) Research Program for six years at the NSA. She also collaborated
on Computer Crime : A Crimefighter's Handbook by Dr. David Icove of the FBI. She also won the Distinguished Leadership Award in 1995 from the NSA.
And, it's $50 also.
What made this good for me was the fact that I could have points to show to management for InfoSec issues. I work in a hospital and we tend to attract a large amount of famous people as patients. If something damaging was leaked to the media about a famous person's medical condition that was potentially embarassing, we're looking at a good multi-million dollar lawsuit. This book isn't a by-the-book "How to protect your systems", but more of a book on what to safeguard, and how to detect patterns that may indicate patterns of unauthorized usage.
One of the things that I liked was the chapter on Legal Issues. One of the sections in the chapter was "What Real Cases Have Taught Us". It did a few page review on Mitnick's case, cut and dry. It shows that Shimomura was no rocket scientist, and with cooperation from the courts, you can bust almost anyone. But it did bring up several good points, such as obtaining court orders, how laws work, and how it can be considered evidence.
For those with functioning brains who have vested interests in InfoSec and protecting their organization from people who wish to do harm, and getting real security info, rather than from those half-assed "Security Experts" like JohnP, then pick this up.
What's Bad? This book is sort of dry reading. It's akin to reading college CS textbooks for pleasure. Or law books. What I didn't like is the fact that she wasn't real clear on the distinction of "hackers", nor how she describes them. She worries that "hackers" wish to "corrupt the trust process". And the focus for the book is not primarily for techies. It's designed for CIO smacking. Generally, if you're in an organization like mine, your CIO has very little technical background. So, good for CIO bashing.
And, it's $50 also.
What's Good? This is good if you're in a position where you need to convince management of security threats. It's also good for the kiddies who want to get an idea of what to look for when they're gunning for targets to disrupt.
What made this good for me was the fact that I could have points to show to management for InfoSec issues. I work in a hospital and we tend to attract a large amount of famous people as patients. If something damaging was leaked to the media about a famous person's medical condition that was potentially embarassing, we're looking at a good multi-million dollar lawsuit. This book isn't a by-the-book "How to protect your systems", but more of a book on what to safeguard, and how to detect patterns that may indicate patterns of unauthorized usage.
One of the things that I liked was the chapter on Legal Issues. One of the sections in the chapter was "What Real Cases Have Taught Us". It did a few page review on Mitnick's case, cut and dry. It shows that Shimomura was no rocket scientist, and with cooperation from the courts, you can bust almost anyone. But it did bring up several good points, such as obtaining court orders, how laws work, and how it can be considered evidence.
So What's In It For Me? If you're a script kiddie, probably nothing. But for those who are achin' to topple some network, this may be for you.
For those with functioning brains who have vested interests in InfoSec and protecting their organization from people who wish to do harm, and getting real security info, rather than from those half-assed "Security Experts" like JohnP, then pick this up.
Pick this book up at ThinkGeek.
Table of Contents- The History of Intrusion Detection
- Concepts and Definitions
- Information Sources
- Analysis Schemes
- Responses
- Vulnerability Analysis: A Special Case
- Technical Issues
- Understanding the Real-World Challenge
- Legal Issues
- For Users
- For Strategists
- For Designers
- Future Needs
TCP connection to 'www.nsa.gov' failed, No Such Agency?
the post anonymous button would be nice right now...
anyway, VIIDS = visual imagery and intrusion detection systems: ie. my current job. (yes, also government)
this much i will tell you, the majority of the equipment used (and i don't know about NSA) but for priority A and B resources (being Nucelar Weapons and Armed Fighters/Weapons Storage areas, etc.) DO NOT have all that hi-tech junk you see on tv. up until recently our annunciator system was a hunk of metal developed by the navy back in the 60-70's. the rest is mainly motion detectors, sensors, etc.
These aren't used so much to prevent ppl from getting in, but also to deter admitance. (Don't worry though, should u get in, there are cops in there still who have full athority to shoot you). In fact almost daily i see a sign that states "Use of Deadly Force is Authorized".
As far as if you were to try and hack the computer annunciator systems, well, first you'd have to get access to them, they're not on an outside network, so good luck there.
basically, if someone once this stuff bad enough, they can get it. It will however take them alot of work, and also would result in probably a lot of damage to the equipment to get it out of the area.
to all the would be's who think they want to try, good luck, and i hope you can run fast cuz i'll shoot your ass too.
I know this isn't exactly what you're looking for, but I purchased a copy of O'Reilly's book Practical UNIX and Internet Security 2nd Edition and have found it to be very useful. This book covers almost everything (accounts, passwords, auditing, logging, backups, physical security, file system, etc etc etc) and is well written (I expect no less from ORA). I also purchased a copy of the book you are referring to, and even though it was not very well written, the "real world" examples of TCP/IP and UDP/IP attacks were a good way to put all I knew about TCP/IP in theory into real world situations. Oh yeah, and from the book, I also know how to disconnect people from IRC now (love them RSTs!).
One the more interesting Intrusion Detection concepts I've seen in recent times is the Deception ToolKit. What this program does is "fakes" a bunch of commonly exploited security holes on your system - even though those holes aren't actually there. This is could prove to be very good at catchin script kiddies who run sendmail break-in scripts, etc. A very interesting concept, indeed - I don't know how well it works, though. Anybody out there with any opinions on this piece of software?
Dear IRS,
I am writing to you to cancel my subscription.
Network Intrusion Detection: An Analyst's Handbook
by Stephen Northcutt
ISBN: 0735708681
Excellent book on intrusion detection.
Having read Clifford Stoll's book (The Cuckoo's Egg) I believe that government employees suffer a credibility problem when discussing computer security issues. In his book, Stoll describes the arrogance of government staff who would not take him seriously when he detailed the security breaches he had found. Although I haven't read the book being reviewed here, I would also highly recommend Stoll's book to those who are interested in this issue (IMHO).
"Ever get the feeling you've been cheated?" - John Lydon, San Francisco 1978
And, you can get the book from bookpool.com for $26.50 (I agree that it's a useful book, and this is a decent price, so I thought I would share).
I met her briefly at RSA2000 (...and got a signed copy, heh.) (should I ebay it?).
/that/ Peter Neumann, borrowed my copy to flip through and see the references to him and to check the TOC for topics covered. He seemed pleased... I haven't had time to read the book yet, though I've flipped through and seen various references to SATAN and similar...
Anyway, when I met her, Peter Neumann (yes,
Returned Peace Corps IT Volunteer
Can't do exactly what you want, but have you looked at Ross Anderson's homepage at
http://www.cl.cam.ac.uk/users/rja14/
He has lots and lots of interesting stuff on security on his site. The lottery paper was great.
If you really want to learn how to secure your network, learn how to break in to one. If you aren't interested enough to learn this highly versatile skill, you are in the wrong industry and your company is allowing the wrong people to make their security decisions for them.
Title: Maximum Linux Security
Publisher: SAMS Publishing
Author: Anonymous
ISBN: 0-672-31670-6
LOCCCN: 99-61434
First Printing: September 1999
Pages: 743
Micro-Review: Definitely worth buying, reading, and implementing.
Ack. Recently during a department meeting our security guy was explaining to our PHB the steps he has taken to protect our general purpose internet server (web, ftp, email primairly) He told her about how we use ipchains firewall rules to protect the system and started talking about the IDS we recently installed (portsentry by Psionic Software which is some pretty impressive softare, and it's GPL'd) and how it responds to a portscan, which is to drop the route to the attacker completely by appending the ipchains ruleset. She initially told him to remove portsentry and the firewall rules because she "didn't like the idea of denying anyone access to our resources" ;->
I think a book like this could be very useful in such situations when the person in charge simply doesn't grasp the basic principles of network security (or really networks in general.) And if reading it doesn't help it sounds big and heavey enough to be used as an effective LART.
"Listen: We are here on Earth to fart around. Don't let anybody tell you any different!" - Kurt Vonnegut
The main InfoSec problem out there today is that the people who control where the IT money is spent, don't always understand the risks associated with ignoring or cutting back on proactive security measures. This book gave me a different way to present. I'd strongly recommend it to both InfoSec folks as well at senior IT management.
Never knock on Death's door:
More race stuff in one place,
than any one place on the net.
Network Intrusion Detection: An Analyst's Handbook by Stephenn Northcutt is an excellent resource. Go back a couple of months in the book reviews here on /. and you'll find my review of it. It was published in Sept. 1999 so it is about as current as you can get. Also, it describes what functionality an IDS should have so you can decide what system works best for your network. Northcutt is one of the original SHADOW people and now works for SANS.
Do really dense people warp space more than others?
1. IDS systems are notorious for dropping packets. Attacks to your network can be missed when the bandwith utilization on your network exceeds a certain percentage. Many IDS systems are only reliable in this fashion up to 10Mb connections.
2. Intrusion detection programs generally will not reorder packets. Any attacks with fragmented packets, out of order packets, and so on will often slip by without being detection. This is also a good way to penetrate a firewall packet filtering rule that does not reorder/reassemble packets.
3. IDS systems tend uto use a string matching algorithm to detect network attacks ( such as a phf or php ) and variances in the attack string can also potentially bypass the IDS without generating an event.
An intrusion detection system is a good tool to top off your networks security policy.. It should not replace human intervention or other security measures including a firewall and proactive network scanning.
LW
It's not GPL'd... it's free for non-commercial use.
very informative post there.
Also, there's a fundamental problem with all of these honeypot systems. Say you're running a web server, no ssl or any weird stuff, and have locked it down to JUST port 80. You get portscanned, maybe a kiddie devotes a few seconds trying the best port-80 hacks.
OTOH, you have a honeypot or port listener running, and you pop up like a glowing beacon in the night as, well, a honeypot worthy of much, much attention.
Of course if your server's already a mound of tantalizing open ports, the loss in making it (look) more attractive are less in comparison with being able to capture kiddies, or at least scare them with lawyers.
Returned Peace Corps IT Volunteer
Didn't you see the top lvl-2+ post? No Such Agency ...exists on the net. Yeah, I think the NSA has been slashdotted.
Hey CmdrTaco, here's a new slashbox or side-menu item, list of famous websites we've slashdotted back to the stoneage.
Returned Peace Corps IT Volunteer
http://bejtlich.home.texas.net/intv2-1.txt
The author takes a different view on some of Stephen Northcutt's analysis, especially regarding reset scans. (He says they don't really exist.)