Firewalls and Internet Security, Second Edition 96
| Firewalls and Internet Security, Second Edition. | |
| author | Cheswick-Bellovin-Rubin, 2003 |
| pages | 433 |
| publisher | Addison-Wesley |
| rating | AA++ |
| reviewer | D Bruce Curtis, Ceo, American Interconnect |
| ISBN | 020163466X |
| summary | Incorporating an Internet firewall from start to finish. |
The authors start with hacking and security needs analysis, progress thru strategies and techniques, and end with useful security formulas, hypotheses and real life examples. They draw upon their own experiences and observations about network security and host protection to give the reader a well-rounded view of the concepts of security as they apply today. The book is well written with simple examples and antecedents. They have taken great care to explain how hackers work and their methodology. The best thing about the book is that it does not go into great detail about unnecessary finite security specifics and shows what works best while adding value by allowing the reader the opportunity to think for themselves and address their own needs. They maintain the premise that: " Simple security is better than complex security: it is easier to understand, verify, and maintain."(Page 81) while covering the types of attacks not only by method, but also by class, ranging from the kiddie script up to the sophisticated tunneling and VPN methods.
FWAIS 2.0 is a comprehensive guide to the most common security problems while not wasting time on the insignificant. It includes a good set of general rules and the tool sets necessary to secure a network at any level. FAWAIS 2.0 covers current protocols and allows simple guidelines for flexibility in determining your own network needs. It describes the weaknesses in both hardware and software while addressing their relational aspects in easy to understand terms. Written with Freebsd in mind many of the techniques in this edition adapt well to other sources such as Linux, Os/X, Unix, NetBsd, and Solaris.
The entire premise of the book revolves around the concept that old style layered security is not as good as it may appear. And that internet security and firewalls are a holistic endeavor of system integration and design. The authors have taken care to show just how difficult it can be to keep up with large network topology and lend truth to the fact that there is no such thing as absolute security.
The concepts found in this book cover subjects such as :
- What firewalls can and cannot do, capabilities and weaknesses.
- What filtering services work best.
- What services and practices are overkill.
- Why firewalls are necessary, the risks to servers and the servers relationship to proper firewall installation.
- What the steps to hacking are and the methodology used to break into a host.
- The why, what and where of limiting services and the tools to secure the appropriate functions.
- Types of firewalls and best practices for implementing security while building and designing firewalls.
- Why building your own firewalls may be your best solution.
- Applying past experiences to your firewall design.
- Intrusion detection systems and their role as a network tool in firewall construction.
- Honey pot examples showing how the techniques have been used to thwart and frustrate potential adversaries.
The second edition is well documented and includes plenty of good link references, appendices and bibliography resources to help any professional keep current with the ever-changing environment of network defense.
Any organization evaluating current security needs should find the second edition helpful for determining their security goals and a comprehensive guide to help design, implement and deploy firewalls. The second edition is a definite must for any security library, certification-training program or public/private classroom situation.
I recommend Firewalls and Internet Security as the best starting point for anyone who might be considering any changes in company security structure or earning their security certifications.
You can purchase the Firewalls and Internet Security, Second Edition from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Step away from the computer! (Score:1)
Yours humbly,
Ta bù shì dà yú
AA++ (Score:3, Insightful)
Maybe I'm just a little more stingy with my praise.
Re:AA++ (Score:3, Informative)
yes! (Score:1)
All I'm saying is that someone who uses a rating like "AA++" is likely given to exaggeration.
Re:AA++ (Score:1)
BTW, it was infinitly more well written [that is, readable] than Knuths "Art of..."
Still today, if I need something fast, I rather look at Cormens "Introduction to Algorithms" and only if I dont find what I seek, I will open Knuths book. And where the hell is the fourth book ?
Re:AA++ (Score:1)
-- Standard & Poors
VPNs / tunneling (Score:5, Informative)
For those who want a more thorough background in the crypto-related topics found in Fwais2 (VPNs, tunneling, TLS, etc.), check out: http://www.youdzone.com/cryptobooks.html [youdzone.com]
There are now 147 cryptography and cryptography-related books (90 reviewed). 29 of the books have on-line errata links, and 7 of the books are free to download in their entirety.
Great review - will be purchasing soon... (Score:2, Interesting)
Sounds like a really fun and informative read (i.e. not "secure your enterprise in 21 days"), will probably be on my reading list soon.
Thank!
Oh my goodness! I finally get it for once. (Score:5, Funny)
That's rich! : p
Exceptional authors, but not an exceptional book (Score:5, Informative)
On the negative side, the book is a mix of simplistic and advanced material. In some areas the authors start with basics, while in others they use terms like "black-hole" (p. 249) with little regard for newbies. The book seems disorganized; readers will find it hard to separate key points from normal text. The "forensics" advice, admittedly labeled as "crude" in ch 17, gives incomplete recommendations which do not reflect best forensic live response practices. (The "best thing to do" is "run ps and netstat" and then "turn the computer off"?) The authors are also very negative about the Windows OS, saying on p. 255 "We do not know how to secure them, or even if it is possible." While Windows is admittedly difficult to configure and operate securely, this statement is a cop-out. Better to direct readers to "Securing Windows NT/2000 Servers for the Internet" by Stefan Norberg. Examples with IPChains in ch 11 should have been updated with IPTables, or at least IPTables should not have been dismissed as being the same except for syntax.
FAWAIS 2.0 does contain useful information. I just think books like O'Reilly's "Building Internet Firewalls, 2nd Edition" and New Riders' "Linux Firewalls, 2nd Edition" are more helpful. Addison-Wesley's "White Hat Security Arsenal" is more enlightening, as well. Review FAWAIS 2.0 in a store before you commit to buying it -- you might find it helpful.
Re:Exceptional authors, but not an exceptional boo (Score:5, Interesting)
One of the commonly repeated security shiboleths is 'end to end' security. This is a good thing in the same way that it is a good idea to have a burglar alarm in your house. The problem is when people start claiming that you should ONLY have a burglar alarm and that locking your front door is a BAD IDEA.
Over ten years ago I was involved in a series of arguments over the need for shadow passwords in UNIX. Not only did most people not get that they were needed there was actual opposition to the idea, people would claim repeatedly that protecting the password file made a system less secure. This despite the fact that crack was already circulating and usually managed to break a sizable proportion of passwords.
I get rather worried by the way some network administrators seem to consider getting a firewall to be the end of their security issues. It is as if they think a firewall is a +5 amulet of invincibility. But I get equally woried when folk make the claim that firewalls are unnecessary, and there are some very expensive consultants who make that claim when their clients are not arround.
Great review (Score:5, Interesting)
The real question is whether is goes into enough technical depth, I would say. I know reading overviews and general ideas is usually very useful and helpful in the short term (perhaps to sound knowledgable in a meeting?) but would this book really give you enough "technical prowess" to write your own firewall?
That's my only real concern, but a great review nonetheless.
Re:Great review (Score:4, Insightful)
if only the books would include samples, if nothing else, of an iptables based firewall, or even ipchains....some go indepth to talk about what the rules mean, but leave the rest for the reader to decipher -- and by this, i mean why the types of rules are being implemented, and why...
hopefully this rejuvenated title will help in this regard.
Damn ... (Score:5, Funny)
I don't buy any books that don't get at least a AAAAAAAAAAAAAAA+++++++++++++ rating.
Re:Damn ... (Score:1)
Firewalls (Score:1, Insightful)
Maybe you should actually read the book (Score:5, Interesting)
You should try actually reading the book before you speak in platitudes. I started Exodus's Managed Security Services group, which had thousands of firewalls under management when I left. Despite this book being published in 1994, it remained my #1 recommended reading on the topic of network security, right up until the end my time there in 2001. The principles are timeless, and for the discerning reader, they transcend firewall brands, configuration recommendations, or changes in protocols. It is a book about security principles, how layers of security interoperate, how human error and fallacy can wreck the best-designed security measures, and so on.
You'd be well advised to read it.
Trying to say that this book is not insightful because "security changes every day" is like trying to say that Knuth's Art of Computer Programming is not insightful because programming languages change all the time.
Re:Maybe you should actually read the book (Score:1)
The OP didn't really say that the book is no use, only that there's no substitute for experience.
You're dead right in that an understanding of the principles behind firewalling is essential for working with them, but he's dead right that only experience will allow you to deal with the requirements of the various users you'll come across (unless you go with a standard policy and refuse to change without exhaustive procedures, which happens to piss off most clients).
BTW, IAAFWG.
Re:Maybe you should actually read the book (Score:1)
Try ten years, Mr AC - back to the days of 9600 baud dial-up with packet filters.
Asshat.
Re:Firewalls (Score:5, Insightful)
From a technical perspective it's trivial to deny these requests, but from a political perspective it can get more challenging, particularly when the application has some kind of business application but needs either particular security scrutiny that hinders "ease of use" or is just a plain bad idea (ie, anonymous writable ftp site inside of a firewall).
Explaining the security implications in terms that non-technical users can understand is often impossible, particularly when the users are pre-convinced you just want to be a BOFH; they seem to only hear "blahblah you're stupid, blahblah I'm the boss and you can't have it".
Some, of course, are better than others and we're able to implement what they want to do in a way that satisfies security and functionality, but too often it just turns into political football.
You mean (Score:5, Informative)
(not often do we see dupe book reviews .. then again, I suppose it's fine to have multiple opinions on the subject.)
Also, note that this is identical to a review [amazon.com] (third one down, by the same guy it seems) on amazon. So it's a double-dupe!
Completely different, actually! (Score:1)
This one is the "Second Edition", with a rating of "AA++", whereas the one you refer to is the "2nd Ed.", with a rating of "9".
Re:You mean (Score:1)
*rimshot*
Re:You mean (Score:2)
Of course, I've learned over time to not trust people who go by "first-initial middle
Incorrect (Score:2)
"not a how to book" (Score:5, Funny)
What about a point-by-point, layer-on-layer, inch-by-inch, over-the-meadow-and-through-the woods, up-the-flagpole-and-see-if-anyone-salutes, nose-to-the-grindstone, pedal-to-the-metal, gun-crazed-kill-spree sort of a guideline? Would that apply?
Re:"not a how to book" (Score:2)
More reviews for this book (Score:2, Informative)
Security Forums Review [security-forums.com]
All in all not a bad book, perhaps a little disorganised, trying to fit too much in at once.
HOWTOs languishing (Score:5, Insightful)
You know, I've noticed that as linux grows more popular, the HOWTOs and mini-HOWTOs are in a pitiful state...yet books on Linux and networking are exploding on the market. When I first started with Linux, the HOWTOs were great sources of information- current, relevant...often funny, too.
Nowadays, they're languishing. Outdated to the point of near uselessness. Just today someone asked me if the Software RAID HOWTO was up to date or not- it was dated 5/8/2002 and referred only to kernel 2.2!
The networking howtos are worse- documentation for iptables/ipchains, and especially the QoS stuff, is SEVERELY out of date, incomplete, or just plain wrong. Dozens of kernel options or features have ZERO documentation, not even a help message.
Folks, if you find a howto that's really out of date, try to contact the author. If they're not interested in continuing to develop it, work with the Linux Documentation Project to see if you can take it over or if they have someone that can. At the very least, give the current author some 'patches'(if anything, if they don't make corrections, that's a good argument for finding a new maintainer.)
Re:HOWTOs languishing (Score:2, Funny)
What do you mean, only 2.2? I run Debian, you insensitive clod!
Sean
Re:HOWTOs languishing (Score:1, Informative)
Starting Point (Score:1)
Re:Starting Point (Score:1)
Then read the FAQ for your particular firewall implementation and by all means join a relevant mailing list for that implementation.
We're the Internet; we're here to help.
OpenBSD? (Score:3, Interesting)
No love for OpenBSD [openbsd.org]? It's arguably the best OS for security and firewalls.
AA++ ? ? (Score:2)
"Great seller, would use again, AAAAAAAAAAAAAAAAAAAAAAAA+++++++++++++++++++++++"
Not that using all the extra A's and plusses cheapens the use of A's and plusses. Just makes the user look like Mr. Dumas.
Re:AA++ ? ? (Score:1)