Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Books Media The Internet Book Reviews

Designing Network Security 90

Posted by timothy from the money-for-nothin'-and-chicks-for-free dept.
cthulu13 writes "Network security can often be a difficult task because there are so many things to consider. This book can help you get a handle on it all by providing a single place to look for advice on policy, design, and implementation. I wish I had the benefit of this book when I was first starting out in my career in security." Read on below for cthulu13's review of the second edition of Merike Kaeo's Designing Network Security.
Designing Network Security, 2nd. Ed.
author Merike Kaeo
pages 745
publisher CiscoPress
rating 8
reviewer cthulu13
ISBN 1587051176
summary A good overall resource on network security policy, design, and implementation.

Weighing in at a hefty 745 pages, Designing Network Security is a concise and authoritative guide to the sometimes daunting task of designing secure networks - with a special emphasis placed on Cisco solutions, of course. The book is divided into three major sections:basic theory and essentials; policy design and best practices; and implementation with Cisco hardware. In my opinion this book is best suited as a reference book for those who already have a firm foundation in security and networking, but could also be of value to beginner level techs with a bit of patience. While the topics that are covered have all pertinent information discussed, some might wish that there were a bit more explanation of the Hows and Whys.

The first section, "Security Fundamentals," is an especially valuable part of the book in that it provides a great desk reference to the building blocks of secure networks. The first chapter deals with the basics of encryption technologies - symmetrical/asymmetrical cryptography, digital hashes, public key systems, etc. From there the book moves into what is probably its meatiest chapter, covering the application of encryption to security technologies which range from TACACS+ authorization to TLS encryption. Building on previous chapters, the third chapter deals with the application of these security technologies in protecting real world installations. I was especially impressed with the attention paid to wireless and VoIP technologies in this chapter - this is one of the first discussions of VoIP security I have seen in a general reference book. The first section winds up with a fairly exhaustive discussion on routing protocol security which I also thought was excellent.

The second section, "The Corporate Security Policy," is a good reference to infosec management. Many topics covered in this section are applicable to the CISSP exam - so if that is a career goal for you, this can act as one of your study guides. The section begins with a discussion of threats in the enterprise environment. Types of threats as well as common protocol vulnerabilites are discussed. I felt that some of the material in this chapter was a bit dated, in particular the sections on TCP sequence number attacks (most recent OSes have improved their sequence generation routines to make it nearly impossible to do this) and the ping of death (which I don't remember working on anything after Windows 95 or Linux 2.0.23). The next chapter is a bit more valuable in its discussion of the basics of risk assessment and management. This leads into a discussion of actual design and implementation of security policy. Sample topics include physical/logical controls, data confidentiality, and policies/procedures for staff. And finally this section concludes with a good chapter on incident handling and response.

The final section, "Practical Implementation," is the Cisco-centric third of the book. Many parts of this section are a good reference to points covered on the CCSP exams, especially the SECUR test. The first chapter deals with configuring access controls and audit on Cisco devices from the PIX to switches and routers. A brief discussion of intrusion detection implementations is also included. The next chapter consists of primarily information dealing with firewall/screening router construction - content filtering, packet screening, and the various types of IOS filters. Several implementation examples are included to walk you through the process of configuring CBAC (content-based access control) and the Cisco PIX. From there the section moves to remote access security, with good sections on all Cisco based AAA (authentication, authorization, and accounting) features including lock-and-key and accounting-based billing. Finally, the book wraps up with a chapter on securing VPN, Wireless, and VOIP networks which focuses more on design than implementation, although there are still some Cisco (PIX) based examples. The book's appedices cover DDOS attacks, well-known port numbers, and guidelines for reporting and preventing intrusions.

Overall, I felt this was an excellent book which clearly fufilled its purpose. For the intermediate to advanced network security engineer this could act as an excellent desktop reference, while still being accessible enough to teach to the beginner. The writing style is clear and precise, and I found no technical errors in the material presented. As I mentioned, the book could act as an additional study aid for several security certifications, including the CISSP or the CCSP. I look forward to the next volume by Ms. Kaeo.

You can purchase Designing Network Security, 2nd Ed. from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
This discussion has been archived. No new comments can be posted.

Designing Network Security More

Designing Network Security

Comments Filter:

  • Network Security (Score:3, Funny)

    by Anonymous Coward on Thursday January 08, 2004 @12:31PM (#7916233)
    Honestly, unless you are selling a book, I heave heard that the only real problem with Linux network security involves the fact the patches for it's many security flaws are often themselves compromised and infected with trojans, etc. On the other hand, the patches I get from Microsoft use a FIPS certified level 3 SSL connection so that the new code is certified by the source. Although I don't think I have needed any... been running Windows Server 2003 for about 2 years now and have never been without problems for a single day.

    Sincerely
    Bill Toms
    MCSD, MCSE
    SoftoTex Software [sofotex.com]

    • Re:Network Security (Score:5, Funny)

      by pantycrickets ( 694774 ) on Thursday January 08, 2004 @12:41PM (#7916405)
      Although I don't think I have needed any... been running Windows Server 2003 for about 2 years now and have never been without problems for a single day.

      Exactly.
    • "the patches I get from Microsoft use a FIPS certified level 3 SSL connection so that the new code is certified by the source."

      Exactly the point that many OSS people have been making for a while. I hit Windows Update every month or so to get patches for machines I maintain, and I'm amazed by the sheer number of security vulnerabilities they're fixing each month. And the flow never stops, even though Win2K has been out for three years, now! Sure, Linux and the OSS projects have security needs that have t

    • Linux Updates are signed (Score:3, Informative)

      by Anonymous Coward
      Most RPM systems use signed RPMs, so there is a similar system. Even better, updates are not given in the form of an .exe file that you have to click on to see what it is. With Unix/Linux package managers, there is a seperation of the package and the (trusted) installer package, so you can get information on a package, including the list of files and changes before even launching the update. Also, I have not seen Linux updates that say "You cannot remove this after it is installed."
    • so that the new code is certified by the source
      Does anybody else see a problem with this?

    • Re:Network Security (Score:5, Insightful)

      by Hiro Antagonist ( 310179 ) on Thursday January 08, 2004 @01:08PM (#7916767) Journal
      Honestly, unless you are selling a book, I heave heard that the only real problem with Linux network security involves the fact the patches for it's many security flaws are often themselves compromised and infected with trojans, etc.

      I realize that I'm just feeding the troll, but I've never run across a single 'security patch' that has introduced a single trojan into any of the Linux systems I administrate. In addition, Debian (my distribution of choice), as well as every other major vendor (to my knowledge) signs and checksums their packages to prevent tampering. Sure, the package archives don't use SSL, but that's because you don't need to -- it would be much easier to break in to the package repository than it would be to properly rewrite the packet stream in such a fashion so that it would even be functional, much less provide an appropriate checksum.

      A good case-in-point of how well this system works is the recent Debian break-in, in fact. Despite losing *four* crucial systems to a compromise, the integrity of the package archive was kept intact, because of GPG signatures, md5 checksums, and a massive pile of worldwide archive sites against which to verify. The compromise, recovery, and analysis of the break-in was kept open to the public, with factual updates made available at every step of the way. No cover-ups, no spin, no attempts to conceal the severity of the compromise. Just plain honesty.

      This prompts a very important question: Would you expect the same from Microsoft if they had faced a similar break-in?

  • additional resources: (Score:1, Informative)

    by Tirel ( 692085 )
    the o'reilly network security articles [onlamp.com] are another great resource for the advanced system administrator.

    plus, they're free..

  • Too ignorant, didn't read :) (Score:5, Informative)

    by __aavhli5779 ( 690619 ) on Thursday January 08, 2004 @12:31PM (#7916252) Journal
    Cisco was actually sending this book out for free a few months ago, and thanks to somebody's making me aware of this deal I managed to snag a copy.

    I'm no network security guy, more just a mundane perl hacker, so most of the chapters were over my head and I'm not really qualified to comment on the contents, but I can at least assert that the book is indeed very comprehensive and well-written, and I liked the diagrams, though I couldn't exactly recall what they were about. My only complaint was that the focus seemed exclusive at times on only securing Cisco equipment, which means that it has a rather narrow focus if one isn't deploying their technologies.

    Hopefully some day when some corporation views my over-inflated resume and decides to trust me with their datacenter, I'll remember everything I skipped over in this quality book :)
    • I am all about pretty diagrams. I don't know if this book can top the secuirty plus one we used at school where hackers were always depicted as thin white kids at terminals wearing a mad-hatter's hat from alice in wonderland or the wardrobe of carmen sandiego, cape, fidora and all. Not to mention the firewalls were always a clip-art of a brick wall between the cloud and the office building. Where does the cloud plug in?

  • A to Z about network security, (Score:5, Informative)

    by geek00 ( 260622 ) on Thursday January 08, 2004 @12:33PM (#7916278)
    Compared to the first version of this title, the second version offers information regarding leading edge technologies such as Voice over IP (VoIP) and wireless networks. Another topic covered in the second version is Virtual Private Networks (VPN). Making the second version of this title a very well rounded resource. Another new chapter in the second addition is on Routing Protocol Security. The Routing Protocol Security chapter has some good information on several of the widely deployed Interior Gateway Protocols such as RIP, EIGRP and OSPF. The chapter covers information mostly on the authentication pieces and fundamental rules of each routing protocol and not much more.

    I found the small section on BGP in the chapter to be a little sparse and expected BGP to be covered in a bit more detail. Nonetheless, is does mention briefly, some of the challenges with BGP and a few of the proposed successors of the BGP protocol such as S-BGP and SoBGP.

    This is an all-a-round good reference for network security.
    • If security is your only concern you should have as many layers of security as possible with firewalls between each layer locked down as tight as possible. That said, security is never your only concern. Cost, ease of maintenance, performance, and flexibility are all important in a network design. After all, the purpose of your company is probably to get something accomplished, not to avoid getting hacked. There are times when every different network configuration is appropriate from super secure to a cable

  • Languages can help as well (Score:3, Interesting)

    by Space cowboy ( 13680 ) on Thursday January 08, 2004 @12:35PM (#7916322) Journal
    Given that "VM" languages are being used more and more (and really, anything that handles it's own memory is the largest gain, IMHO), a lot of the attacks will be getting less and less to work with over time.

    I can't see mainstream OS's being written in Java just yet [grin - Windows JP (Java Protected), now with less memory holes!] but applications are getting more likely to be protected in this way.

    Running .NET or compiled-java is pretty much indistinguishable from running C++ programs, and they're so much easier to develop in than more-traditional languages, so perhaps the future is bright :-)

    Simon
    • Wait... Maybe someone can explain this to me: compiled-java is when you compile your bytecode into actual machine-language beforehand to allow it to execute faster, right? And in Java, the memory allocation and de-allocation (new() calls and garbage collection) is done by the JVM, right?

      So is the JVM involved at all when you're running compiled-java, or not? It would seem like it would have to be, to handle memory, unless the compilation process builds in some kind of memory manager.

      This poster has me
      • Maybe I wasn't clear. I was referring to the compile-to-machine-code not just-in-time-compiling. There is no VM in a precompiled java program, although there will be garbage collector and arrays will be checked etc.

        Tools like gcj, or newer JBuilder's will do this. There will always be some overhead for GC, but unless you're doing physics simulations running for weeks, I seriously doubt you'd notice the difference...

        Simon.
    • Although on the surface this may appear to be true, as applications grow more and more complex, which is inevitable as users demand more and more services from corporate America, the business logic behind them dramatically increases in complexity as well.

      The trend in actual successful attacks versus theoretical or practical vulnerabilities is moving from OS and network hacks to more application based hacks - these attacks tend to focus on the business processes behind the applications per se.

      A more se

  • Concise!?! (Score:4, Funny)

    by Orien ( 720204 ) on Thursday January 08, 2004 @12:41PM (#7916406)
    at a hefty 745 pages, Designing Network Security is a concise and...

    Am the only one who sees some irony in that statement?

  • Why a book ? (Score:3, Insightful)

    by Krapangor ( 533950 ) on Thursday January 08, 2004 @12:43PM (#7916425) Homepage
    It would be outdated 3 months after it was published.
    The only reason for buying is to get rid of the damned trees which lurk around everywhere.

    • Re:Why a book ? (Score:1, Informative)

      by Anonymous Coward
      While sometimes technologies become obsolete (e.g. computing power makes certain types of OLD encryption more vulnerable or some cryptographic scheme is cracked, or some software platform is now almost gone *cough*VAX/VMS*cough*) the fundamentals don't change that much.

      Hell, I picked up "Web Security, Privacy & Commerce" from O'Reilly the other day, and it has a bit on the old DOS program toneloc... you know, the wardialer from ages past. Why? It's still important to know if your computers have modem

  • consice (Score:2, Funny)

    by manifest37 ( 632701 )
    concise ( P ) Pronunciation Key (kn-ss)
    adj.
    Expressing much in few words; clear and succinct.

    Last time i checked 745 pages was not "concise".

  • It's easy (Score:5, Funny)

    by Chairboy ( 88841 ) on Thursday January 08, 2004 @12:58PM (#7916640) Homepage
    Designing network security is easy, I already learned about this in movies and books by Gibson. First, you need to cyberjack a killer ICE. If you use a BLACK ICE, you can actually kill the jackers that are cracking into your mainframe by overloading their neural interfaces.

    Something else you might do is write defensive viruses that sit on your router and can be deployed against attackers.

    Another thing that has good success is having circuit breakers hooked to your network interface that can channel all the power from your corporate reactor straight into the network. This will cause any attackers machine to burst into flame.

    Artificial intelligence bots can be a cheap way to get good security, but keep in mind that they can go rogue, so also keep a stable of CircuitRunners, basically AI Bounty Hunters that can track down your security AIs and terminate them if they go rogue. Symantec makes good CircuitRunners, I hear.

    Oh, be sure to hire a network administrator that 'knows linux'. It's probably best to hire someone young who has the dexterity to use the 3d flythrough administration interface.

    Good luck, and be secure in the knowledge that you can now jack into your iron in safety!
    • I agree totally! I tried admin'ing my box with the 3d fly through admin package, but the g-force was too much, i blacked out from lack of blood just doing a kernal rebuild.
    • Good luck, and be secure in the knowledge that you can now jack into your iron in safety!

      Now that would make a mess!

  • Scissors [dumbentia.com]

    really what more do you need?

  • Scary (Score:1, Insightful)

    by Anonymous Coward
    It scares me when I see comments like "I wish I knew of this book when I was starting my security career". It really irritates me that people are so incompetent to feel that they are competent in the security without even understanding the basics.

  • Books I'd like now. (Score:1, Funny)

    by Anonymous Coward
    Books that I also want now.
    The hand book of lottery ticket and sports winners for 2004-2010.
    The worst security holes of win98/winXP and their solutions for "Open MS Lic." fifth edition 2015.
    IP6 Now! how to painless update legacy IP4 appa. (2030)

    And my personal future favorite:
    The source to votedote used to mod your government up or down.

  • Crypto-gram newsletter (Score:5, Informative)

    by glinden ( 56181 ) * on Thursday January 08, 2004 @01:42PM (#7917481) Homepage Journal
    Sounds like an interesting book. If you're interested in security topics, I can't recommend Bruce Schneider's (author of Applied Cryptography [schneier.com], among other things) Crypto-gram [counterpane.com] newsletter. It's free and gives a great overview of the news on computer security. His focus is often on ineffective security measures that people manage to avoid and how they can be improved. Well worth reading.
    • In addition to Schnier's excellent monthly mailing, the Dartmouth College Institute for Security Technology Studies offers a fantastic daily blog of info-security news from around the world. Well worth subscribing to, and highly informative for those interested. Website: http://news.ists.dartmouth.edu/ Newsletter Signup: http://news.ists.dartmouth.edu/cgi-bin/signup.cgi
  • There are three simple steps to network security - follow them to the letter and you will never have any problems.

    The three steps are:

    1) Ban Windows from your network.

    2) Ban Doors.

    3) Ban Users.

    Follow those steps and you will never have any problems!

Slashdot Top Deals

"If there isn't a population problem, why is the government putting cancer in the cigarettes?" -- the elder Steptoe, c. 1970

Close