Name: Managing Security with Snort and IDS Tools
Price: 191.96 RON
Availability: InStock
Author: Kerry J Cox
ISBN: 9780596006617

Managing Security with Snort and IDS Tools

Kerry J Cox

Christopher Gerg

This practical guide to managing network security covers reliable methods for detecting network intruders, from using simple packet sniffers to more sophisticated IDS (Intrusion Detection Systems) applications and the GUI interfaces for managing them.

Citește tot Restrânge

Cuprins

Preface; Audience; About This Book; Assumptions This Book Makes; Chapter Synopsis; Conventions Used in This Book; Comments and Questions; Acknowledgments; Chapter 1: Introduction; 1.1 Disappearing Perimeters; 1.2 Defense-in-Depth; 1.3 Detecting Intrusions (a Hierarchy of Approaches); 1.4 What Is NIDS (and What Is an Intrusion)?; 1.5 The Challenges of Network Intrusion Detection; 1.6 Why Snort as an NIDS?; 1.7 Sites of Interest; Chapter 2: Network Traffic Analysis; 2.1 The TCP/IP Suite of Protocols; 2.2 Dissecting a Network Packet; 2.3 Packet Sniffing; 2.4 Installing tcpdump; 2.5 tcpdump Basics; 2.6 Examining tcpdump Output; 2.7 Running tcpdump; 2.8 ethereal; 2.9 Sites of Interest; Chapter 3: Installing Snort; 3.1 About Snort; 3.2 Installing Snort; 3.3 Command-Line Options; 3.4 Modes of Operation; Chapter 4: Know Your Enemy; 4.1 The Bad Guys; 4.2 Anatomy of an Attack: The Five Ps; 4.3 Denial-of-Service; 4.4 IDS Evasion; 4.5 Sites of Interest; Chapter 5: The snort.conf File; 5.1 Network and Configuration Variables; 5.2 Snort Decoder and Detection Engine Configuration; 5.3 Preprocessor Configurations; 5.4 Output Configurations; 5.5 File Inclusions; Chapter 6: Deploying Snort; 6.1 Deploy NIDS with Your Eyes Open; 6.2 Initial Configuration; 6.3 Sensor Placement; 6.4 Securing the Sensor Itself; 6.5 Using Snort More Effectively; 6.6 Sites of Interest; Chapter 7: Creating and Managing Snort Rules; 7.1 Downloading the Rules; 7.2 The Rule Sets; 7.3 Creating Your Own Rules; 7.4 Rule Execution; 7.5 Keeping Things Up-to-Date; 7.6 Sites of Interest; Chapter 8: Intrusion Prevention; 8.1 Intrusion Prevention Strategies; 8.2 IPS Deployment Risks; 8.3 Flexible Response with Snort; 8.4 The Snort Inline Patch; 8.5 Controlling Your Border; 8.6 Sites of Interest; Chapter 9: Tuning and Thresholding; 9.1 False Positives (False Alarms); 9.2 False Negatives (Missed Alerts); 9.3 Initial Configuration and Tuning; 9.4 Pass Rules; 9.5 Thresholding and Suppression; Chapter 10: Using ACID as a Snort IDS Management Console; 10.1 Software Installation and Configuration; 10.2 ACID Console Installation; 10.3 Accessing the ACID Console; 10.4 Analyzing the Captured Data; 10.5 Sites of Interest; Chapter 11: Using SnortCenter as a Snort IDS Management Console; 11.1 SnortCenter Console Installation; 11.2 SnortCenter Agent Installation; 11.3 SnortCenter Management Console; 11.4 Logging In and Surveying the Layout; 11.5 Adding Sensors to the Console; 11.6 Managing Tasks; Chapter 12: Additional Tools for Snort IDS Management; 12.1 Open Source Solutions; 12.2 Commercial Solutions; Chapter 13: Strategies for High-Bandwidth Implementations of Snort; 13.1 Barnyard (and Sguil); 13.2 Commericial IDS Load Balancers; 13.3 The IDS Distribution System (I(DS)2); Appendix A: Snort and ACID Database Schema; A.1 acid_ag; Appendix B: The Default snort.conf File; Appendix C: Resources; C.1 From Chapter 1: Introduction; C.2 From Chapter 2: Network Traffic Analysis; C.3 From Chapter 4: Know Your Enemy; C.4 From Chapter 6: Deploying Snort; C.5 From Chapter 7: Creating and Managing Snort Rules; C.6 From Chapter 8: Intrusion Prevention; C.7 From Chapter 10: Using ACID as a Snort IDS Management Console; C.8 From Chapter 12: Additional Tools for Snort IDS Management; C.9 From Chapter 13: Strategies for High-Bandwidth Implementations of Snort; Colophon;