Slashdot Mirror
Special Ops
In order to get the most out of Special Ops, I suggest that you brush up on your system administration skills, particularly Microsoft technologies. The book is aimed primarily at security and systems administrators, but several of the chapters are either aimed specifically at management (Chaps 17 & 18), or could easily be understood by them (chaps 1-3).
The authors write in a conversational, matter-of-fact style, including personal anecdotes and experiences where appropriate. The editors did a great job of "smoothing out" the styles of the different authors to give Special Ops a consistent feel.
One of the best features of Special Ops is the end-of-chapter content. These summaries include a "Security Checklist" which creates a nice list for admins to take into the field, a one-page summary of the chapter, links to relevant web pages, relevant mailing lists, other books to read for more in-depth information, a "Solutions Fast Track," and a FAQ. Some chapters list all of the freeware and commercial tools used/mentioned in that chapter. The Solutions Fast Track is a great section to hand to your slightly more technical manager explaining why you should secure a specific service. These chapter extras make Special Ops a great reference book, even if you never bother to read the rest of it.
Another great feature is the "Notes from the Underground ..." sections scattered throughout the book. All of the authors have worked in security for several years, and they share specific examples of attacks or other interesting tidbits they've seen over the years.
I had trouble giving Special Ops a rating of 9 or 10 for a few reasons. Even though the book is an easy read, it's a lot of information to digest. The subtitle makes it sound as if Microsoft, UNIX, and Oracle would receive equal treatment: not so. While there are 7 chapters on Microsoft specific technologies, UNIX and Oracle rate one chapter each. I would have preferred to see Special Ops split into 2 or 3 books, giving equal attention to all of the technologies.
The authors' bias towards certain commercial tools shows through as well. Granted, the majority of the authors are also Foundstone employees, but they should have given equal treatment to all tools. Explain the strengths and weaknesses of each tool and allow the reader to decide on the "best" tool.
All in all, Special Ops is a great book. It will definitely reside on my reference shelf for years to come.
Table of Contents- Assessing Internal Network Security
- Inventory and Exposure of Corporate Assets
- Hunting for High Severity Vulnerabilities (HSV)
- Attacking and Defending Windows XP Professional
- Attacking and Defending Windows 2000
- Securing Active Directory
- Securing Exchange and Outlook Web Access
- Attacking and Defending DNS
- Attacking and Defending Microsoft Terminal Services
- Securing IIS
- Hacking Custom Web Applications
- Attacking and Defending Microsoft SQL Server
- Attacking and Defending Oracle
- Attacking and Defending Unix
- Wireless LANs: Discovery and Defense
- Network Architecture
- Architecting the Human Factor
- Creating Effective Corporate Security Policies
You can purchase the Special Ops from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
He means, Uninstalling Windows 2000, doesn't he?
Is this truly the only Earth I can live on?
While there are 7 chapters on Microsoft specific technologies, UNIX and Oracle rate one chapter each.
:)
Well, this is a security guide, isn't it?
The coolest voice ever.
3) Put bricks around cinderblocks
Congratulations. Your Windows installation is now secure.
...If maintaining the security of networked machines running Microsoft Windows is part of your job...
I had a nightmare about that last week. wierd.
In response to the large numbers of complaints that the book focuses too narrowly on Micro$oft Products, I propose the following changes to make it more universal.
Please remove pages 1 - 1040 and replace with the following sheet of paper:
- - - - - - - -
1.) Educate your users.
Failing that:
2.) Execute your users.
I assert that my comment is only my opinion, not that of any employer, past, present or future.
Just create a text file called "Important Microsoft Security Update", put instructions in it to buy you the book, then copy it to \\bossspc\c$\windows\desktop
try { do() || do_not(); } catch (JediException err) { yoda(err); }
Making windows more secure? Part of it starts out like this...
Build a 'nix firewall...
Put the windows machine behind the 'nix firewall...
Adjust iptables rules accordingly...
I urge your to read the hole thing, one verse pr. line.
There's a hole in the bucket, dear Liza, dear Liza, There's a hole in the bucket, dear Liza, a hole.
So fix it dear Henry, dear Henry, dear Henry, So fix it dear Henry, dear Henry, fix it.
With what should I fix it, dear Liza, dear Liza, With what should I fix it, dear Liza, with what?
With straw, dear Henry, dear Henry, dear Henry, With straw, dear Henry, dear Henry, with straw.
But the straw is too long, dear Liza, dear Liza, The straw is too long, dear Liza, too long.
So cut it dear Henry, dear Henry, dear Henry, So cut it dear Henry, dear Henry, cut it!
With what should I cut it, dear Liza, dear Liza, With what should I cut it, dear Liza, with what?
Use the hatchet, dear Henry, dear Henry, dear Henry, Use the hatchet, dear Henry, the hatchet.
But the hatchet's too dull, dear Liza, dear Liza, The hatchet's too dull, dear Liza, too dull.
So, sharpen it, dear Henry, dear Henry, dear Henry, So sharpen it dear Henry, dear Henry, sharpen it!
With what should I sharpen it, dear Liza, dear Liza, With what should I sharpen, dear Liza, with what?
Use the stone, dear Henry, dear Henry, dear Henry, Use the stone, dear Henry, dear Henry, the stone.
But the stone is too dry, dear Liza, dear Liza, The stone is too dry, dear Liza, too dry.
So wet it, dear Henry, dear Henry, dear Henry, So wet it dear Henry, dear Henry, wet it.
With what should I wet it, dear Liza, dear Liza, With what should I wet it, dear Liza, with what?
With water, dear Henry, dear Henry, dear Henry, With water, dear Henry, dear Henry, water.
With what should I carry it, dear Liza, dear Liza, With what should I carry it dear Liza, with what?
Use the bucket dear Henry, dear Henry, dear Henry, Use the bucket, dear Henry, dear Henry, the bucket!
There's a hole in the bucket, dear Liza, dear Liza, There's a hole in the bucket, dear Liza, a hole.
Step 1: Place Windows system in a lead safe
Step 2: Take wire cutters and cut ethernet cable to said computer
Step 3: Close door
Step 4: Dump the safe into closest body of water
Now you have a windows system no one can touch.
Slashdot.. Land of nerds, trolls, and FlameBait..
...but someone who can make a windows box truely secure... now they've done something!!
:)
Unplugged the machine?
In case it's password-protected, the password is "12345".
It won't get a chance to turn me away. One glance at the website, and I was hammering the Back button.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.