Special Ops

If maintaining the security of networked machines running Microsoft Windows is part of your job (but you need a touch of Oracle and UNIX advice, too), take heart. elwing writes "Don't let the cover title and camo look turn you away -- Special Ops is a no-nonsense guide to securing your network from inside attackers. This is one of the first books I've seen which covers this topic in detail. It doesn't skimp on external threats, but the majority of the book deals with host based security." Read on for the rest of elwing's review. Special Ops: Host and Network Security for Microsoft, UNIX, and Oracle author Erik Pace Birkholz, et al. pages 1040 publisher Syngress rating 8 - Worth Reading reviewer elwing ISBN 1931836698 summary Taking a look at securing your network from the inside.

In order to get the most out of Special Ops, I suggest that you brush up on your system administration skills, particularly Microsoft technologies. The book is aimed primarily at security and systems administrators, but several of the chapters are either aimed specifically at management (Chaps 17 & 18), or could easily be understood by them (chaps 1-3).

The authors write in a conversational, matter-of-fact style, including personal anecdotes and experiences where appropriate. The editors did a great job of "smoothing out" the styles of the different authors to give Special Ops a consistent feel.

One of the best features of Special Ops is the end-of-chapter content. These summaries include a "Security Checklist" which creates a nice list for admins to take into the field, a one-page summary of the chapter, links to relevant web pages, relevant mailing lists, other books to read for more in-depth information, a "Solutions Fast Track," and a FAQ. Some chapters list all of the freeware and commercial tools used/mentioned in that chapter. The Solutions Fast Track is a great section to hand to your slightly more technical manager explaining why you should secure a specific service. These chapter extras make Special Ops a great reference book, even if you never bother to read the rest of it.

Another great feature is the "Notes from the Underground ..." sections scattered throughout the book. All of the authors have worked in security for several years, and they share specific examples of attacks or other interesting tidbits they've seen over the years.

I had trouble giving Special Ops a rating of 9 or 10 for a few reasons. Even though the book is an easy read, it's a lot of information to digest. The subtitle makes it sound as if Microsoft, UNIX, and Oracle would receive equal treatment: not so. While there are 7 chapters on Microsoft specific technologies, UNIX and Oracle rate one chapter each. I would have preferred to see Special Ops split into 2 or 3 books, giving equal attention to all of the technologies.

The authors' bias towards certain commercial tools shows through as well. Granted, the majority of the authors are also Foundstone employees, but they should have given equal treatment to all tools. Explain the strengths and weaknesses of each tool and allow the reader to decide on the "best" tool.

All in all, Special Ops is a great book. It will definitely reside on my reference shelf for years to come.

Table of Contents

1. Assessing Internal Network Security
2. Inventory and Exposure of Corporate Assets
3. Hunting for High Severity Vulnerabilities (HSV)
4. Attacking and Defending Windows XP Professional
5. Attacking and Defending Windows 2000
6. Securing Active Directory
7. Securing Exchange and Outlook Web Access
8. Attacking and Defending DNS
9. Attacking and Defending Microsoft Terminal Services
10. Securing IIS
11. Hacking Custom Web Applications
12. Attacking and Defending Microsoft SQL Server
13. Attacking and Defending Oracle
14. Attacking and Defending Unix
15. Wireless LANs: Discovery and Defense
16. Network Architecture
17. Architecting the Human Factor
18. Creating Effective Corporate Security Policies

You can purchase the Special Ops from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Comments

Hax0rs inside:/

[Manic Ken]

I always asume that I have an evil hxxor inside. Really!! If You have an desktop running "click and launch trojans"-enables OS, You better assume there will be strange activity from that box sooner or later. That box will be able to reach switches and may or may not be able to log on to it, or may or may not be able to sniff the network(there are ways you know, robertgraham.com had an good intro on the subject me thinks) and may or may not be able to mail(using local adressbook) other internal machines("click and launch trojans"-enables OS). I wont even allow anything but serial-only configuration of firewalls!(yea, minicom:)).
To conclude: If you got crap on the desktops(most companies has) be careful!