Slashdot Mirror
Special Ops
In order to get the most out of Special Ops, I suggest that you brush up on your system administration skills, particularly Microsoft technologies. The book is aimed primarily at security and systems administrators, but several of the chapters are either aimed specifically at management (Chaps 17 & 18), or could easily be understood by them (chaps 1-3).
The authors write in a conversational, matter-of-fact style, including personal anecdotes and experiences where appropriate. The editors did a great job of "smoothing out" the styles of the different authors to give Special Ops a consistent feel.
One of the best features of Special Ops is the end-of-chapter content. These summaries include a "Security Checklist" which creates a nice list for admins to take into the field, a one-page summary of the chapter, links to relevant web pages, relevant mailing lists, other books to read for more in-depth information, a "Solutions Fast Track," and a FAQ. Some chapters list all of the freeware and commercial tools used/mentioned in that chapter. The Solutions Fast Track is a great section to hand to your slightly more technical manager explaining why you should secure a specific service. These chapter extras make Special Ops a great reference book, even if you never bother to read the rest of it.
Another great feature is the "Notes from the Underground ..." sections scattered throughout the book. All of the authors have worked in security for several years, and they share specific examples of attacks or other interesting tidbits they've seen over the years.
I had trouble giving Special Ops a rating of 9 or 10 for a few reasons. Even though the book is an easy read, it's a lot of information to digest. The subtitle makes it sound as if Microsoft, UNIX, and Oracle would receive equal treatment: not so. While there are 7 chapters on Microsoft specific technologies, UNIX and Oracle rate one chapter each. I would have preferred to see Special Ops split into 2 or 3 books, giving equal attention to all of the technologies.
The authors' bias towards certain commercial tools shows through as well. Granted, the majority of the authors are also Foundstone employees, but they should have given equal treatment to all tools. Explain the strengths and weaknesses of each tool and allow the reader to decide on the "best" tool.
All in all, Special Ops is a great book. It will definitely reside on my reference shelf for years to come.
Table of Contents- Assessing Internal Network Security
- Inventory and Exposure of Corporate Assets
- Hunting for High Severity Vulnerabilities (HSV)
- Attacking and Defending Windows XP Professional
- Attacking and Defending Windows 2000
- Securing Active Directory
- Securing Exchange and Outlook Web Access
- Attacking and Defending DNS
- Attacking and Defending Microsoft Terminal Services
- Securing IIS
- Hacking Custom Web Applications
- Attacking and Defending Microsoft SQL Server
- Attacking and Defending Oracle
- Attacking and Defending Unix
- Wireless LANs: Discovery and Defense
- Network Architecture
- Architecting the Human Factor
- Creating Effective Corporate Security Policies
You can purchase the Special Ops from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
for the second time in a day I got a fist post!
"Special" Ops.
You could design a complete FPS game around this concept I think.
post
sO I c@|\| b3c0|\/|3 t3h 1337 h4>0r!
...Come and try to snatch my crops
These pigs want to blow my house down...
He means, Uninstalling Windows 2000, doesn't he?
Is this truly the only Earth I can live on?
... insert Linux CD into CD-R drive of PC running Windows...
A young Chinese tiger keeper has been mauled to death after apparently trying to defecate on one of his big cats.
The 19-year-old appears to have climbed the railings of the Bengal tiger cage and pulled his trousers down.
Evidence at the scene of the death at the Jinan animal park included toilet paper, excrement and a trouser belt.
Zoo officials think Xu Xiaodong either slipped into the cage or was pulled in by one of the four angry tigers.
According to the South China Morning Post, the man told a co-worker he needed to go to the toilet but police were called when he failed to return.
They found his body lying on the ground surrounded by tigers. The teenager had reportedly been bitten in the neck and was covered in blood. Police believe Xu climbed the wall of a partially constructed building used to raise the tigers to relieve himself. They said the smell probably caused the tigers to pounce.
You can see more stories about tigers and zoos on Ananova, or read our Animal attacks file.
I f I can get my emplotyer to buy this for me?
It is certainly the kind of problem I often end up facing at work, far too many people know just enough to majorly fuck things up nowadays.
Personally, I would prefer not to have to use M$ware at all, but all too often legacy systems in the workplace are a lock in, so I expect to see things like this continue to be published and be popular for a good while.
An infinite number of monkeys will eventually come up with the complete works of
...then it's time to join the army and be all you can be, instead of some lowly schmuck tasked with the impossible.
Who are you? The new #2 Who is #1? You are #617565. I am not a number, I am a free man! Muhahaha.
While there are 7 chapters on Microsoft specific technologies, UNIX and Oracle rate one chapter each.
:)
Well, this is a security guide, isn't it?
The coolest voice ever.
Nah, it'd be waaay too hard a difficulty curve, and the power ups would always be buggy :P
An infinite number of monkeys will eventually come up with the complete works of
...does this book discuss Jennifer Connolly's breasts at all? 'Cause if it don't, I'll save my money and go watch Hulk this weekend instead.
from beginning to end what would be the most usefull network administration guides for an intermediate linux user who wants to learn how to server web pages, databases, run an all linux network, etc... any recomendations
I'd rate it somewhere around 6 or 7 out of 10, certainly no where near 9. My major complaints are similar to those of the author of the article:
- Gives no mention of its focus on Microsoft OS's, but it concentrates on them nearly entirely.
- Simple, simple, simple. If you know your basics, most of this book is redundant and a review. There's a lengthy discussion on how a traceroute works. That's a little too simple for my tastes.
- Though not required, the author seems excessively biased towards Microsoft OS's. He even goes so far to suggest (in mild language) that it's easier to track invaders using Microsoft products than using freely available tools. C'mon, I think we all know the pile of open source tools available for these applications outnumber and outwork anything out of Redmond.
It's something I think newbie MS admins should read, but it doesn't hold much new content for anyone who's been admining for a year+.
+ Donald Gunth
+ Email: dgunth@quicktek.net
"Caffeine is the greatest lubricant ever created." -ESR
To go one step further, I'd like to suggest that it is a moral imperative for Linux users to keep this book away from Windows sysadmins. Right now, even they are pretty sure that Windows is insecure, though they run it anyway. But if they read this book, they might start believing the FUD that MS spews and think that Windows is actually usable!
[1]There are even the first glimmerings from the academic world that this could be mathematically proven using "chaOS" theory, the application of regular chaos theory to OS design.
Try manm eta=
or type this into your browser:
http://www.google.com/search?q=[insert program name here]&ie=UTF-8&oe=UTF-8&hl=en&btnG=Google+Search&
everything else is cheating!
So, this book advertises itself as a guide for administrators who want to secure their systems. Fair enough. But how much do you want to bet that a chapter like "Attacking and Defending Windows 2000" spends 40 pages on hacking techniques, then closes with a short paragraph reading, "install the latest security patches from Microsoft"?
Security is not exactly rocket science from an admin POV. You keep your system up-to-date and pay attention to the latest exploit warnings, and you will be fine 99.9% of the time. Almost without fail, hacking incidents at major companies are found to be due to security holes that have been known about and fixed for months, if not years. Competant admins simply do not get hacked.
Any admin who isn't completely shirking his duties has exactly no use for this book. Who, then, will find it valuable? That's right: hackers. Script kiddies have an easy enough time of it as it is. The computer book industry needs to take some responsibility and stop publishing this sort of hacker how-to.
Boromir, son of Faramir, King of Gondor and Minas Tirith
Why anyone would knowingly use Microsoft Windows in any environment where security is a concern is beyond me. It seems that Windows mostly attracts the suit/manager type of people who generally don't have a clue about technology to begin with (or lack the intelligence or desire to understand UNIX).
CRONYN DIED OF prostate cancer Sunday at his home in Fairfield, Conn., even if you didn't blah blah blah american actor icon blah blah blah....
I always asume that I have an evil hxxor inside. Really!! If You have an desktop running "click and launch trojans"-enables OS, You better assume there will be strange activity from that box sooner or later. That box will be able to reach switches and may or may not be able to log on to it, or may or may not be able to sniff the network(there are ways you know, robertgraham.com had an good intro on the subject me thinks) and may or may not be able to mail(using local adressbook) other internal machines("click and launch trojans"-enables OS). I wont even allow anything but serial-only configuration of firewalls!(yea, minicom:)).
To conclude: If you got crap on the desktops(most companies has) be careful!
Your major complaints about this book is true, yet, one point, however, is quite arguable to me, that is the microsoft point.
Microsoft products (i.e. windows 95/98/NT/2k/2k3) does have its place (and a large market share...) on corporate markets (on clients), therefore it should be considered as a large portion of corporate administration. I spend most of my time administrating windows even though i'm a linux admin. (Well, the good debian box does not require much administration, honestly.)
Boromir wasn't the son of Faramir, they were gay lovers.
As soon as I read that there are 7 chapters on M$, I knew the M$ flames would be abundant in this thread of comments. I'd like to take a different approach to this; rather than adamently bash microsoft, I'll be more subtle about it. I see securing MS products as a challenge. Yes, they're buggy (release early / often,) and I love my Unixees more, but this could be a fun game. Anyone can RTFM and secure *nix boxen, but someone who can make a windows box truely secure... now they've done something!!
"The best laid plans of mice and men gang oft agley..." - ROBERT BURNS
Maybe Windows needs 7 chapters to Linux's 1 on securing it. This would be fair coverage.
Feeling like stirring the kettle today with karma to burn.
I used to wonder what was so holy about a silent night, now I have a child.
3) Put bricks around cinderblocks
Congratulations. Your Windows installation is now secure.
Can someone mirror the site in a Lynx-compatible format? I have to access the web using Lynx at work and that site doesn't load for me.
Anybody know where I could get a Threads of Fate ISO? It's a bitch trying to find it on Kazaa. Links to FTP sites would be great.
You probably became a LOTR fanboy after seeing the movie, so it's understandable. I've been reading, and rereading JRR for the last 20+ years, and you're wrong about Boromir being the son of Faramir.
See, Boromir and Faramir are both brothers, their father is Arathorn.
Arathorn is the father of Aragorn
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
http://www.cgisecurity.com/lib/
...If maintaining the security of networked machines running Microsoft Windows is part of your job...
I had a nightmare about that last week. wierd.
American icon, indeed. Born in London, Ontario and educated at McGill.
In response to the large numbers of complaints that the book focuses too narrowly on Micro$oft Products, I propose the following changes to make it more universal.
Please remove pages 1 - 1040 and replace with the following sheet of paper:
- - - - - - - -
1.) Educate your users.
Failing that:
2.) Execute your users.
I assert that my comment is only my opinion, not that of any employer, past, present or future.
I urge your to read the hole thing, one verse pr. line.
There's a hole in the bucket, dear Liza, dear Liza, There's a hole in the bucket, dear Liza, a hole.
So fix it dear Henry, dear Henry, dear Henry, So fix it dear Henry, dear Henry, fix it.
With what should I fix it, dear Liza, dear Liza, With what should I fix it, dear Liza, with what?
With straw, dear Henry, dear Henry, dear Henry, With straw, dear Henry, dear Henry, with straw.
But the straw is too long, dear Liza, dear Liza, The straw is too long, dear Liza, too long.
So cut it dear Henry, dear Henry, dear Henry, So cut it dear Henry, dear Henry, cut it!
With what should I cut it, dear Liza, dear Liza, With what should I cut it, dear Liza, with what?
Use the hatchet, dear Henry, dear Henry, dear Henry, Use the hatchet, dear Henry, the hatchet.
But the hatchet's too dull, dear Liza, dear Liza, The hatchet's too dull, dear Liza, too dull.
So, sharpen it, dear Henry, dear Henry, dear Henry, So sharpen it dear Henry, dear Henry, sharpen it!
With what should I sharpen it, dear Liza, dear Liza, With what should I sharpen, dear Liza, with what?
Use the stone, dear Henry, dear Henry, dear Henry, Use the stone, dear Henry, dear Henry, the stone.
But the stone is too dry, dear Liza, dear Liza, The stone is too dry, dear Liza, too dry.
So wet it, dear Henry, dear Henry, dear Henry, So wet it dear Henry, dear Henry, wet it.
With what should I wet it, dear Liza, dear Liza, With what should I wet it, dear Liza, with what?
With water, dear Henry, dear Henry, dear Henry, With water, dear Henry, dear Henry, water.
With what should I carry it, dear Liza, dear Liza, With what should I carry it dear Liza, with what?
Use the bucket dear Henry, dear Henry, dear Henry, Use the bucket, dear Henry, dear Henry, the bucket!
There's a hole in the bucket, dear Liza, dear Liza, There's a hole in the bucket, dear Liza, a hole.
Step 1: Place Windows system in a lead safe
Step 2: Take wire cutters and cut ethernet cable to said computer
Step 3: Close door
Step 4: Dump the safe into closest body of water
Now you have a windows system no one can touch.
Slashdot.. Land of nerds, trolls, and FlameBait..
It won't get a chance to turn me away. One glance at the website, and I was hammering the Back button.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
Although I admit I'm partial to the book, it should be noted that the DNS chapter is unbiased; covering the dns infrastructure, BIND, DJBDNS, and MSDNS.
Then Hacking Linux Exposed came out, by totally different non-foundstone people. It covered Linux security through and through. Sure, kurtz' name was on the cover, but note how he was demoted from an author to a 'series consultant'. Bet the guy didn't write a damned word, considering the quality of Hacking Linux vs Hacking Exposed.
Maybe the Special ops editors will realize the error and get some good writers for a unix specific version.
Hey isn't this one of the software pirates from Foundstone as well??
l es /0,15114,457276,00.html
h tm l?tid=187
http://www.fortune.com/fortune/technology/artic
http://slashdot.org/articles/03/06/10/0012208.s