Slashdot Mirror
Firewalls and Internet Security, 2nd Ed.
Those familiar with this classic have undoubtedly recommended it to other hackers seeking a definitive text. Firewalls and Internet Security has provided a roadmap for security conscious sysadmins since its publication in 1994. It mixed sound policy recommendations with examples of UNIX-based implementations, all rooted in experience from working in AT&T corporate security.
Although many of the ideas laid out in the original edition are just as relevant in today's Internet, much has changed technically since 1994. Alas, this month Addison-Wesley has released a new second edition ... nearly complete rewrite (and 135 page expansion) of the original classic.
A glance at the new edition indeed reveals significant changes. Avi Rubin has been added as an author. The preface details some of the predictions made from the first edition... some of which came true, and others that didn't. Most sections have been vastly expanded, if not completely restructured.
Denial-of-services (DoS) attacks, infamous in the previous decade, are explored in greater depth. Replacements of deprecated tools have been given new sections (ssh is detailed following the chapter on the "r" commands, for example.) The myriad of enumeration tools available today are discussed (i.e., Nessus, hping, nmap).
Intrusion-detection tools, almost completely absent from the first edition, are given space in the new book, although not nearly as much as I would have liked. Much has been added on the subject of cryptography and authentication. Forthcoming standards like IPV6 and DNSsec are discussed.
Those who've read the original will recall the "Evening with Berferd." the chapter detailing a break-in the authors were able to watch and analyze in real-time. This inspired more than a few honeypot oriented projects. The second edition introduces a second real-world scenario, the "Taking of Clark," which illustrates forensic measures to be taken after after a host is compromised. Fans of Foundstone's Hacker's Challenge will find it familiar.
The defining thread across all of these topics is what makes this book a classic: the emphasis of the "why," not just the "how." Although the examples are mostly geared towards UNIX users, the guidance and policy suggestions are directly applicable to any platform where the reader is responsible for making security decisions.
Perhaps the greatest aspect of this book is its availability: it's on the web here. Those who are working in the security field, or those interested in it, will benefit from owning the hard-copy available from Addison-Wesley.
You can also purchase Firewalls and Internet Security, 2nd Edition from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
O'Reilly's Building Internet Firewalls (Zwicky, Cooper & Chapman)?
Rob. (In the spirit of complete disclosure, I used to work with Simon Cooper's mum)
The first edition is available online. Of the second edition, a couple of chapters are available (in pdf, one in html). It does not say if the remaining chapters will become available. Anyone has information on this?
This is, without a doubt *the* bible for the subject. Got mine 2nd hand from a car boot years ago, and it lives on my desk permanently. I'd love to see how it's been updated, and whether there are any new additions similar to the Berferd tracing story. The short scripts for scanning subnets etc were great too. Well, well, worth reading.
Edition one of this book has a permanent place on the reference shelf of my tcpip classroom. Anytime you're talking about tcpip connectivity these days, you are also talking about securing that connectivity.
The content may be beyond a lot of beginners, but folks need to look at what is possible.
Only the first edition of the book is available on the web in full at http://www.wilyhacker.com/1e/
The second edition appears to be only available in hard copy, for the full purchase price, although there are some chapter excerpts available for download.
For anyone looking for more information on IDS's or Intelligent IDS's than is covered in the new book, take a look at the white paper on Intelligent IDS's at SecurityProfiling.
That patch will be issued immediately after the patch that causes asshole sysadmins to stop requiring a new password every 30 days that doesn't match any of the previous 11 passwords, is at least 8 characters long containing mixed case, a number, and a non-alphanumeric character.
I've had to deal with such systems before and my passwords rapidly degraded from secure, non-dictionary crackable "phrases" to stupid crap like "Abcdef1", "aBcdef1", or "FuckYou2".
Of course, I've also known people that did just write their passwords down on a piece of paper, even if you didn't have to change them. The best one was a Unix sysadmin at a place I used to work. He was incompetent, so we would just get stuff done ourselves by going over to his cube and reading the appropriate root password off the bottom of his wrist rest.
Is the author really lamenting the release of the new book? (Perhaps Eater is actually a Wily Hacker?)
sulli
RTFJ.
I just did a web-based auth system at work. We have a new web site structure, and we wanted to protect an area for faculty and staff only (I work at a university, in the CS department). I had to come up with a scheme to "force" good passwords for use with the web site (since there will be stuff in that private area that students should never be able to see). It's harder to do than you might think. There's a very fine line between pissing people off with strong passwords and letting them slide by using things like "qwerty".
In the end, I came up with this:
- >=6 characters
- At least one non-alphanumeric character
- Cannot be based on username (forward or backward)
That's it. Pretty easy going, right? Not really. I've had a couple people complain already (it's been two days since we went live). I even removed the "Cannot be based on a dictionary word" requirement. We also removed the "Cannot be the same as your Unix system password" requirement (over my loud protestations).I actually had a professor (a computer science professor, mind you) ask that I make it more lenient. He lamented to me that because he had to choose a "strange" password (since his "normal" password didn't pass my tests), he had already forgotten what he had chosen. He then asked me to email him and let him know what his password is. After I got done laughing, I prepared a carefully-worded LARTish email explaining to him what a one-way hash is and why I wasn't able to tell him what his word was, even if I wanted to send it to him in email. I also threw in a little bit of "weak passwords are the #1 security hole" boilerplate and explained that I was glad that his normal system password wasn't able to be used on the web site.
I haven't sent the email yet; I thought it might be too harsh so I decided to sit on it overnight. I think on one hand that anyone clueless enough to use a password that can't pass even my lame scheme deserves to be cut down a notch or two. Then I think that he's a tenured prefessor, and I should be more respectful. Then I think that he's a tenured professor, and yet is a complete idiot, and I go back to #1. I've always wanted to give a prof what-for.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
Firewalls are great when you can trust all your insiders. That's rarely the case. Real-time intrusion detection systems also help out, but fail when:
To really address security of corporate data you need to:
This log analysis approach complements the others, and will catch more insidious, long term, and more damaging violations of critical data. Most corporations have the firewall angle covered well, but can't address social engineering or misbehaving insiders.
Of course, the big problem here is storing all that log data. Security analysis companies have been around but either can't perform analysis at the detail required, or charge too much (that log data is huge and Oracle isn't cheap).
Addamark Technologies has a security event logging and analysis tool that seems to address this problem though. They sell a product that uses a cluster of cheap Linux PCs to store all that data, and a SQL/Perl query interface (for those that want to query data directly without web-UI tools), some good web-UI tools. Data loading performance and query performance is out of this world. They've got a great customer list, too.
After ten years of apprenticeship, Tenno achieved the rank of Zen teacher. One rainy day, he went to visit the famous master Nan-in. When he walked in, the master greeted him with a question, "Did you leave your wooden clogs and umbrella on the porch?"
"Yes," Tenno replied.
"Tell me," the master continued, "did you place your umbrella to the left of your shoes, or to the right?"
Tenno did not know the answer, and realized that he had not yet attained full awareness. So he became Nan-in's apprentice and studied under him for ten more years.
That is why gurus rejoice a good security book.
"I may be Love's bitch, but at least I'm man enough to admit it."
isn't that an oxymoron like "army intelligence"?
Only 'flamers' flame!
I had the pleasure of attending LinuxForum 2003 (in danish) this weekend, where Cheswick talked about internet security. His slides can be found here and his entire talk is here. I must say that he is a very funny and interesting person.