Firewalls and Internet Security, 2nd Ed. 84
| Firewalls and Internet Security: Repelling the Wily Hacker, 2nd Ed. | |
| author | William Cheswick, Steven Bellovin, Aviel Rubin |
| pages | 455 |
| publisher | Addison-Wesley |
| rating | 9 |
| reviewer | Eater |
| ISBN | 020163466X |
| summary | Long-awaited second edition of the security administrator's favorite classic. |
Those familiar with this classic have undoubtedly recommended it to other hackers seeking a definitive text. Firewalls and Internet Security has provided a roadmap for security conscious sysadmins since its publication in 1994. It mixed sound policy recommendations with examples of UNIX-based implementations, all rooted in experience from working in AT&T corporate security.
Although many of the ideas laid out in the original edition are just as relevant in today's Internet, much has changed technically since 1994. Alas, this month Addison-Wesley has released a new second edition ... nearly complete rewrite (and 135 page expansion) of the original classic.
A glance at the new edition indeed reveals significant changes. Avi Rubin has been added as an author. The preface details some of the predictions made from the first edition... some of which came true, and others that didn't. Most sections have been vastly expanded, if not completely restructured.
Denial-of-services (DoS) attacks, infamous in the previous decade, are explored in greater depth. Replacements of deprecated tools have been given new sections (ssh is detailed following the chapter on the "r" commands, for example.) The myriad of enumeration tools available today are discussed (i.e., Nessus, hping, nmap).
Intrusion-detection tools, almost completely absent from the first edition, are given space in the new book, although not nearly as much as I would have liked. Much has been added on the subject of cryptography and authentication. Forthcoming standards like IPV6 and DNSsec are discussed.
Those who've read the original will recall the "Evening with Berferd." the chapter detailing a break-in the authors were able to watch and analyze in real-time. This inspired more than a few honeypot oriented projects. The second edition introduces a second real-world scenario, the "Taking of Clark," which illustrates forensic measures to be taken after after a host is compromised. Fans of Foundstone's Hacker's Challenge will find it familiar.
The defining thread across all of these topics is what makes this book a classic: the emphasis of the "why," not just the "how." Although the examples are mostly geared towards UNIX users, the guidance and policy suggestions are directly applicable to any platform where the reader is responsible for making security decisions.
Perhaps the greatest aspect of this book is its availability: it's on the web here. Those who are working in the security field, or those interested in it, will benefit from owning the hard-copy available from Addison-Wesley.
You can also purchase Firewalls and Internet Security, 2nd Edition from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
How does it stack up against... (Score:4, Interesting)
Rob. (In the spirit of complete disclosure, I used to work with Simon Cooper's mum)
Re:How does it stack up against... (Score:5, Informative)
I know, this one could talk less about firewalls and windows and more about unix, but anyway, is good to see in what is better and in what not.
Re:How does it stack up against... (Score:2)
Oooh, a third edition of the Big Yellow Safe book? I'm there.
Re:How does it stack up against... (Score:5, Informative)
Re:How does it stack up against... (Score:2, Insightful)
This second edition super does a job of updating the original, and it's about time. For unix security people I'd suggest you also read Hacking Linux Exposed [hackinglinuxexposed.com] because it has very in depth coverage of everything from a Linux standpoint. (Unix really, but they focus on Linux for their answers about how you fix things. Pathnames may differ for other Unix systems, like BSD.)
O'Reilly's BIF is good, but I'd suggest a Linux-specific firewall book too, like Linux Firewalls, Second Edition [linux-firewall-tools.com].
For those people not familiar with Hacker's Challenge (1st and 2nd editions) it's a book chock full of real-world (presumably sanitized) cracking examples where they tell you what happened, copies of of log data, and you try to figure out what happened. Very good book.
I'd also like to note that Hacker's Challenge (and Hacking Linux Exposed, for that matter) are not Foundstone books. Hacker's Challenge's lead author is Mike Schiffman, director of security at @stake, which is definately not Foundstone. Foundstone is doing poorly, going so far as to patent port scanning [ntobjectives.com].
Correction (Score:5, Interesting)
Re:Correction (Score:4, Informative)
ches
Well duh! (Score:1)
If you respond to this troll and say it's a great book to buy, I'll buy it!
well i'm planning on it anyway...
Re:Correction (Score:2)
The new edition is rather nice, too
Kudos for at least some content owners having some brains in their heads.
well.. (Score:5, Informative)
One of the reference books for tcpip today... (Score:3, Interesting)
The content may be beyond a lot of beginners, but folks need to look at what is possible.
Re:One of the reference books for tcpip today... (Score:1)
Re:One of the reference books for tcpip today... (Score:5, Informative)
Cartoons? (Score:2)
Re:Cartoons? (Score:2, Interesting)
Sed quis custodiet ipsos custodes (but who will guard the guards themselves?)
have been recited by me to many colleagues over the past few years.....
Re:Cartoons? (Score:2, Informative)
http://www-fp.aw.com/bigcovers/020163466X.jpg
-sig
Re:Cartoons? (Score:1)
There are lots of new epigrams. Ever done a bibliographic entry for a Bugs Bunny cartoon? 8-)
ches
only 1st Ed available in full (Score:5, Informative)
Only the first edition of the book is available on the web in full at http://www.wilyhacker.com/1e/ [wilyhacker.com]
The second edition appears to be only available in hard copy, for the full purchase price, although there are some chapter excerpts available for download.
Re:only 1st Ed available in full (Score:2)
What about patched for human security holes? (Score:2, Insightful)
Re:What about patched for human security holes? (Score:3, Funny)
Re:What about patched for human security holes? (Score:5, Insightful)
I've had to deal with such systems before and my passwords rapidly degraded from secure, non-dictionary crackable "phrases" to stupid crap like "Abcdef1", "aBcdef1", or "FuckYou2".
Of course, I've also known people that did just write their passwords down on a piece of paper, even if you didn't have to change them. The best one was a Unix sysadmin at a place I used to work. He was incompetent, so we would just get stuff done ourselves by going over to his cube and reading the appropriate root password off the bottom of his wrist rest.
Re:What about patched for human security holes? (Score:2)
The irony is that this has caused me to use much less secure passwords on that host than I use elsewhere -- my usual passwords are based on made-up phrases and would be pretty tough to crack even if you knew other passwords of mine (an old one was wh2EaTB for "we hate to eat at Taco Bell") but on this server I use a more predictable scheme that lets me figure out what I most likely chose as the password last month.
The bigger irony is that I'm told the sysadmin of this particular server has his password set to never expire! Apparently he can pick a good one but nobody else can.
Re:What about patched for human security holes? (Score:2)
Re:What about patched for human security holes? (Score:5, Interesting)
I just did a web-based auth system at work. We have a new web site structure, and we wanted to protect an area for faculty and staff only (I work at a university, in the CS department). I had to come up with a scheme to "force" good passwords for use with the web site (since there will be stuff in that private area that students should never be able to see). It's harder to do than you might think. There's a very fine line between pissing people off with strong passwords and letting them slide by using things like "qwerty".
In the end, I came up with this:
- >=6 characters
- At least one non-alphanumeric character
- Cannot be based on username (forward or backward)
That's it. Pretty easy going, right? Not really. I've had a couple people complain already (it's been two days since we went live). I even removed the "Cannot be based on a dictionary word" requirement. We also removed the "Cannot be the same as your Unix system password" requirement (over my loud protestations).I actually had a professor (a computer science professor, mind you) ask that I make it more lenient. He lamented to me that because he had to choose a "strange" password (since his "normal" password didn't pass my tests), he had already forgotten what he had chosen. He then asked me to email him and let him know what his password is. After I got done laughing, I prepared a carefully-worded LARTish email explaining to him what a one-way hash is and why I wasn't able to tell him what his word was, even if I wanted to send it to him in email. I also threw in a little bit of "weak passwords are the #1 security hole" boilerplate and explained that I was glad that his normal system password wasn't able to be used on the web site.
I haven't sent the email yet; I thought it might be too harsh so I decided to sit on it overnight. I think on one hand that anyone clueless enough to use a password that can't pass even my lame scheme deserves to be cut down a notch or two. Then I think that he's a tenured prefessor, and I should be more respectful. Then I think that he's a tenured professor, and yet is a complete idiot, and I go back to #1. I've always wanted to give a prof what-for.
-B
Social eng beats firewall, you need log analysis (Score:3, Insightful)
Firewalls are great when you can trust all your insiders. That's rarely the case. Real-time intrusion detection systems also help out, but fail when:
To really address security of corporate data you need to:
This log analysis approach complements the others, and will catch more insidious, long term, and more damaging violations of critical data. Most corporations have the firewall angle covered well, but can't address social engineering or misbehaving insiders.
Of course, the big problem here is storing all that log data. Security analysis companies have been around but either can't perform analysis at the detail required, or charge too much (that log data is huge and Oracle isn't cheap).
Addamark Technologies [addamark.com] has a security event logging and analysis tool that seems to address this problem though. They sell a product that uses a cluster of cheap Linux PCs to store all that data, and a SQL/Perl query interface (for those that want to query data directly without web-UI tools), some good web-UI tools. Data loading performance and query performance is out of this world. They've got a great customer list, too.
Re:Social eng beats firewall, you need log analysi (Score:3, Informative)
Not exactly. Firewalls are great when you can't trust all your outsiders, which is always the case. It's just that you need more, besides the firewall, to deal with the internal problems.
Real-time intrusion detection systems also help out, but fail when:
* insiders do the job -- they're not "intruding"
The IDS belongs on the same network with the resources (servers) so that they see all activity, internal as well as external.
Intelligent IDS (Score:5, Informative)
Re:Intelligent IDS (Score:2)
Re:Intelligent IDS (Score:4, Interesting)
Overall, I believe that the Intelligent IDS can be a wonderful solution for almost any type of network. I'm setting up one for my office and my apt.
Alexander Harrison [mailto]
Nocturn Designs
Re:Intelligent IDS (Score:2, Insightful)
It appears to still have the fundamental problem with all IDS' (see this [aciri.org]). In summary, without the IDS being aware of minutae of the protocol stack of the target machine, it can't actually detect intrusions, not to mention IDS' can easily be overwhelmed. IMHO IDS' are dangerous, IT folks develop a sense of invulnerability. While they're useful for the run of the mill crap that most kids spew, someone who's committed can open a can and the IDS will just stand around and look dumb. If you're the IT guy who told everyone that they could sleep at night because the IDS was taking care of business, then you look dumb.
Re:Review? (Score:3, Informative)
Web security documents (Score:1, Interesting)
www.cgisecurity.com/lib [cgisecurity.com]
Alas? (Score:5, Funny)
Is the author really lamenting the release of the new book? (Perhaps Eater is actually a Wily Hacker?)
Re:Alas? (Score:2)
Eater
IPv6 has been around since 1996 (Score:1)
Re:IPv6 has been around since 1996 (Score:2)
Eater
A Zen story (Re:Security Gurus?) (Score:5, Funny)
"Yes," Tenno replied.
"Tell me," the master continued, "did you place your umbrella to the left of your shoes, or to the right?"
Tenno did not know the answer, and realized that he had not yet attained full awareness. So he became Nan-in's apprentice and studied under him for ten more years.
That is why gurus rejoice a good security book.
Re:A Zen story (Re:Security Gurus?) (Score:1)
One day, Tenno ordered a hamburger with the works, then stood back, and waited for Nan-in to place his order. Nan-in looked at the menu of choices available, then pointed at what he wanted, and said, "Make me one with everything".
After that, Tenno decided to extend his apprenticeship under the master for the next 25 years, as he realized he was just a dumb shit who still had a lot to learn
What my parents thought (Score:3, Funny)
At the time I was thinking of going into security consulting. I thought it would be best to really study up.
They live near Portland, Oregon, which is the home of the famous Powells [powells.com] bookstore, and Powells Technical Books, probably the best technical bookstore in the world. It's worth visiting Portland just to go to Powell's technical books.
So on a visit to the bookstore I bought a copy of 2600 [2600.com] just to see what the bad guys were up to. You know, so I'd be a better security expert.
Well, this got my parents really worried. They thought I was going to start cracking people's boxes. My mother, in a very frightened tone of voice, asked me to promise never to do that. I don't think they really believed that I was trying to learn about it so I could do a better job as a consultant.
Considering that the government can now force bookstores to reveal book purchases without either a search warrant or your knowledge, I would suggest purchasing the book (and any security books) from a brick & mortar bookstore, and paying cash.
If my mother thought I was studying it so I could become 31337, imagine what John Ashcroft might think.
Re:What my parents thought (Score:3, Insightful)
You have a good point. I'd like to add to that, that you're doing 2600 a bit of a disservice by characterizing it or its contributors so glibly as "bad guys". There's plenty of questionable stuff in 2600, but the point of it all is to encourage curiosity about, and understanding of, actual systems in the world - things you won't necessarily ever learn about in school etc. Since it's targeted mainly towards a young audience (afaict), this naturally gets bound up in a certain amount of rebelliousness and so on. But a thinking adult can see past this.
There's a really fundamental point here, which is that if you're surrounded by black boxes that you don't understand, you become a helpless consumer, unable to understand or effectively deal with the world around you except in a second-class citizen sort of way. That's what many corporations would like to be the case, of course, and it's the direction that consumer culture naturally gravitates towards - but not everybody buys into that, and wanting to find out more about the world around you, and the technology on which so much depends, is not a crime.
suspicious things... (Score:1)
I find this rather disturbing. The only reason I can see for this is so they can scan what you are printing. I even asked them about it, the person I asked literally flushed, then stammered then said "well, it's uhh easier this way" Uh huh If it was just to use a better printer, swell, but they have plenty of space out on the floor for it, in fact they have a few photocopiers etc aligned on the wall for public use, but NOT what you go find on the web and decide to print out, nope, that has to be done back out of view in the office.
Same library. Last summer I went in there, wires hanging from the ceiling, I traced them, saw (what I knew to be but are designed to not look like)obvious cams being installed that are aimed at the computers. I asked the same librarian then "what electronic stuff are you installing?". She said, "oh, that's just some electronic stuff". I asked again, "Exactly what kind of electronic stuff" "Just stuff".
uh huh
Re:What my parents thought (Score:2)
Of particular interest is the huge collection of used, and hard-to-find books interspersed with the new books. There are no 'used' and 'new' sections at Powell's tech books.
Wow, mine aren't the only ones..... (Score:2)
In the 80's I partnered with some friends to start a multi-media/DTP company, while still keeping my day job at a photo lab.
Since everyone at the lab knew about my company, someone gave me a xeroxed Forbes article on how laser printers were being used to make bogus checks. It laid out step by step on how to do it, obviously so companies could make changes to prevent this type of scam.
When my parents came across it in my home, they were convinced that this was what I was really doing with the computer equiptment, and warned me that they wouldn't give me bail money when I was arrested for it.
Everything old is new again (Score:3, Funny)
Say, have I ever told you about the time I hacked Steve Bellovin? I did? Oh, well, never mind.
"internet security" (Score:4, Funny)
Cheswick lates talk (Score:4, Informative)
Re:Cheswick lates talk (Score:1)
He wrote a dedication in my new book: "Do not lend this book!"
Re:Cheswick lates talk (Score:1)
Secure Programming for Linux and Unix HOWTO (Score:2)
1st edition was pretty good (Score:2)
I've just asked for a review copy of the new edition.
Danny.