Slashdot Mirror
Firewalls and Internet Security, 2nd Ed.
Those familiar with this classic have undoubtedly recommended it to other hackers seeking a definitive text. Firewalls and Internet Security has provided a roadmap for security conscious sysadmins since its publication in 1994. It mixed sound policy recommendations with examples of UNIX-based implementations, all rooted in experience from working in AT&T corporate security.
Although many of the ideas laid out in the original edition are just as relevant in today's Internet, much has changed technically since 1994. Alas, this month Addison-Wesley has released a new second edition ... nearly complete rewrite (and 135 page expansion) of the original classic.
A glance at the new edition indeed reveals significant changes. Avi Rubin has been added as an author. The preface details some of the predictions made from the first edition... some of which came true, and others that didn't. Most sections have been vastly expanded, if not completely restructured.
Denial-of-services (DoS) attacks, infamous in the previous decade, are explored in greater depth. Replacements of deprecated tools have been given new sections (ssh is detailed following the chapter on the "r" commands, for example.) The myriad of enumeration tools available today are discussed (i.e., Nessus, hping, nmap).
Intrusion-detection tools, almost completely absent from the first edition, are given space in the new book, although not nearly as much as I would have liked. Much has been added on the subject of cryptography and authentication. Forthcoming standards like IPV6 and DNSsec are discussed.
Those who've read the original will recall the "Evening with Berferd." the chapter detailing a break-in the authors were able to watch and analyze in real-time. This inspired more than a few honeypot oriented projects. The second edition introduces a second real-world scenario, the "Taking of Clark," which illustrates forensic measures to be taken after after a host is compromised. Fans of Foundstone's Hacker's Challenge will find it familiar.
The defining thread across all of these topics is what makes this book a classic: the emphasis of the "why," not just the "how." Although the examples are mostly geared towards UNIX users, the guidance and policy suggestions are directly applicable to any platform where the reader is responsible for making security decisions.
Perhaps the greatest aspect of this book is its availability: it's on the web here. Those who are working in the security field, or those interested in it, will benefit from owning the hard-copy available from Addison-Wesley.
You can also purchase Firewalls and Internet Security, 2nd Edition from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Does the reviewer ever state that this is a must read?
Sounds like I will have to read it to find out, hopefully its not too expensive.
Hey anyone want to go in together and buy a copy? After I read it I will pass it on to someone else (who of course helped pay for the book)
-out-
www.jamesmcmurry.com
O'Reilly's Building Internet Firewalls (Zwicky, Cooper & Chapman)?
Rob. (In the spirit of complete disclosure, I used to work with Simon Cooper's mum)
The first edition is available online. Of the second edition, a couple of chapters are available (in pdf, one in html). It does not say if the remaining chapters will become available. Anyone has information on this?
"Perhaps the greatest aspect of this book is its availability: it's on the web here." That should put that in the article.
Karma: Bad due to google bombing - Robert Watkins woz 'ere.
This is, without a doubt *the* bible for the subject. Got mine 2nd hand from a car boot years ago, and it lives on my desk permanently. I'd love to see how it's been updated, and whether there are any new additions similar to the Berferd tracing story. The short scripts for scanning subnets etc were great too. Well, well, worth reading.
Edition one of this book has a permanent place on the reference shelf of my tcpip classroom. Anytime you're talking about tcpip connectivity these days, you are also talking about securing that connectivity.
The content may be beyond a lot of beginners, but folks need to look at what is possible.
Have they put in any new cartoons since the first edition, some were very memorable and very appropriate. With the intervening years of IT tomfoolery there must be a few candidates.
Only the first edition of the book is available on the web in full at http://www.wilyhacker.com/1e/
The second edition appears to be only available in hard copy, for the full purchase price, although there are some chapter excerpts available for download.
Specifically, the one which makes lusers write their UserIDs and passwords on Post-It(c) notes on their monitors? You'd be amazed how many times I had to send people emails from themselves before they got the message. . .
You are not the customer.
A guy called "O'Reilly" and he's building walls??
It gets me laughing every time I think of the ending to that episode.. Basil walking out of the hotel with the garden gnome under his arm..
"Where are you going Basil??!?"
"I'm just going to see Mr O'Reilly dear. Then I think I might go to Canada.."
(sick, just sick.. maybe even worse mental imagery than the goatse trolls can think up..)
For anyone looking for more information on IDS's or Intelligent IDS's than is covered in the new book, take a look at the white paper on Intelligent IDS's at SecurityProfiling.
To be fait, i think the fact that you can go and read it for free means that very little has to be said, other than "go see". And it's well worth it too :)
www.cgisecurity.com/lib
Is the author really lamenting the release of the new book? (Perhaps Eater is actually a Wily Hacker?)
sulli
RTFJ.
It got a "9." Therefore, it is an average book.
Man what is with the rash of security books out lately? It's like as if there is a new sendmail bug out or something...what?....Oh.
Well then go here to get the book and secure up your networks! Entertainment News anyone?
Slashdot readers got Microsoft to GPL Windows, for example. Very effective sort we are!
Firewalls are great when you can trust all your insiders. That's rarely the case. Real-time intrusion detection systems also help out, but fail when:
To really address security of corporate data you need to:
This log analysis approach complements the others, and will catch more insidious, long term, and more damaging violations of critical data. Most corporations have the firewall angle covered well, but can't address social engineering or misbehaving insiders.
Of course, the big problem here is storing all that log data. Security analysis companies have been around but either can't perform analysis at the detail required, or charge too much (that log data is huge and Oracle isn't cheap).
Addamark Technologies has a security event logging and analysis tool that seems to address this problem though. They sell a product that uses a cluster of cheap Linux PCs to store all that data, and a SQL/Perl query interface (for those that want to query data directly without web-UI tools), some good web-UI tools. Data loading performance and query performance is out of this world. They've got a great customer list, too.
At the time I was thinking of going into security consulting. I thought it would be best to really study up.
They live near Portland, Oregon, which is the home of the famous Powells bookstore, and Powells Technical Books, probably the best technical bookstore in the world. It's worth visiting Portland just to go to Powell's technical books.
So on a visit to the bookstore I bought a copy of 2600 just to see what the bad guys were up to. You know, so I'd be a better security expert.
Well, this got my parents really worried. They thought I was going to start cracking people's boxes. My mother, in a very frightened tone of voice, asked me to promise never to do that. I don't think they really believed that I was trying to learn about it so I could do a better job as a consultant.
Considering that the government can now force bookstores to reveal book purchases without either a search warrant or your knowledge, I would suggest purchasing the book (and any security books) from a brick & mortar bookstore, and paying cash.
If my mother thought I was studying it so I could become 31337, imagine what John Ashcroft might think.
Request your free CD of my piano music.
Say, have I ever told you about the time I hacked Steve Bellovin? I did? Oh, well, never mind.
You did not just "try this yourself"... you're obviously either a home-town "beta" or a buddy (or even developer) for the product....
a simple whois tells me:
$>whois nocturndesign.com
Registrant:
*******
#### Soldiers Home Rd. ### ###
West Lafayette, IN 47906
US
$>whois securityprofiling.com
Registrant:
Security Profiling (SECURITYPROFILING-DOM)
#### Kenwood Dr.
Lafayette
IN,47905
US
Directions to work?
IPv6 isn't a forthcoming standard as the review would have you believe. I have the 1996 edition of a book by Christan Huitema, a former chairperson of the IAB, detailing the IPv6. Anyhow, the review seems useful...
After ten years of apprenticeship, Tenno achieved the rank of Zen teacher. One rainy day, he went to visit the famous master Nan-in. When he walked in, the master greeted him with a question, "Did you leave your wooden clogs and umbrella on the porch?"
"Yes," Tenno replied.
"Tell me," the master continued, "did you place your umbrella to the left of your shoes, or to the right?"
Tenno did not know the answer, and realized that he had not yet attained full awareness. So he became Nan-in's apprentice and studied under him for ten more years.
That is why gurus rejoice a good security book.
"I may be Love's bitch, but at least I'm man enough to admit it."
isn't that an oxymoron like "army intelligence"?
Only 'flamers' flame!
Security gurus rejoice... the 2nd edition is finally here!"
If the readers were "security gurus" they'd already know this stuff, silly!
Trolling is a art,
Firewalls are great when you can trust all your insiders. That's rarely the case.
Not exactly. Firewalls are great when you can't trust all your outsiders, which is always the case. It's just that you need more, besides the firewall, to deal with the internal problems.
Real-time intrusion detection systems also help out, but fail when:
* insiders do the job -- they're not "intruding"
The IDS belongs on the same network with the resources (servers) so that they see all activity, internal as well as external.
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
I had the pleasure of attending LinuxForum 2003 (in danish) this weekend, where Cheswick talked about internet security. His slides can be found here and his entire talk is here. I must say that he is a very funny and interesting person.
Get some revenue out of it!
If you respond to this troll and say it's a great book to buy, I'll buy it!
well i'm planning on it anyway...
Ursula Andress, Catherine Deneuve, and Charo, twice...
If you're interested in writing secure programs (instead of installing / configuring existing programs to be secure), take a look at my freely-available book: Secure Programming for Linux and Unix HOWTO.
- David A. Wheeler (see my Secure Programming HOWTO)
god
--I go to a public library occassionaly to use their computers. It's fun to be on high speed. Sometimes I use their printers when I am there, they have a modest fee on a per printed page deal. All the networked computers had their own printers until a couple of weeks ago,it was handy as you could set your own preferences and margins and copy count, etc, and not interfere with anyone else, check if you liked the results, etc. Swell. So now they switched to a print server thing, a big laser printer, but dig this! It's not out on the floor where you as a patron can just go grab your printouts, nope, it's kept inside the office, you have to go to the desk and ask the librarian to please bring your printouts.
I find this rather disturbing. The only reason I can see for this is so they can scan what you are printing. I even asked them about it, the person I asked literally flushed, then stammered then said "well, it's uhh easier this way" Uh huh If it was just to use a better printer, swell, but they have plenty of space out on the floor for it, in fact they have a few photocopiers etc aligned on the wall for public use, but NOT what you go find on the web and decide to print out, nope, that has to be done back out of view in the office.
Same library. Last summer I went in there, wires hanging from the ceiling, I traced them, saw (what I knew to be but are designed to not look like)obvious cams being installed that are aimed at the computers. I asked the same librarian then "what electronic stuff are you installing?". She said, "oh, that's just some electronic stuff". I asked again, "Exactly what kind of electronic stuff" "Just stuff".
uh huh
I've just asked for a review copy of the new edition.
Danny.
I have written over 900 book reviews
.....who think that way.
In the 80's I partnered with some friends to start a multi-media/DTP company, while still keeping my day job at a photo lab.
Since everyone at the lab knew about my company, someone gave me a xeroxed Forbes article on how laser printers were being used to make bogus checks. It laid out step by step on how to do it, obviously so companies could make changes to prevent this type of scam.
When my parents came across it in my home, they were convinced that this was what I was really doing with the computer equiptment, and warned me that they wouldn't give me bail money when I was arrested for it.