Our goal in writing Network Intrusion Detection, Third Edition has been toempower you as an analyst. We believe that if you read this book cover to cover,and put the material into practice as you go, you will be ready to enter theworld of intrusion analysis. Many people have read our books, or attended ourlive class offered by SANS, and the lights have gone on; then, they are off tothe races. We will cover the technical material, the workings of TCP/IP, andalso make every effort to help you understand how an analyst thinks throughdozens of examples.
Network Intrusion Detection, Third Edition is offered in five parts. Part I,"TCP/IP," begins with Chapter 1, ranging from an introduction to thefundamental concepts of the Internet protocol to a discussion of RemoteProcedure Calls (RPCs). We realize that it has become stylish to begin a booksaying a few words about TCP/IP, but the system Judy and I have developed hasnot only taught more people IP but a lot more about IP as well—more thanany other system ever developed. We call it "real TCP" because thematerial is based on how packets actually perform on the network, not theory.Even if you are familiar with IP, give the first part of the book a look. We areconfident you will be pleasantly surprised. Perhaps the most important chapterin Part I is Chapter 5, "Stimulus and Response." Whenever you look ata network trace, the first thing you need to determine is if it is a stimulus ora response. This helps you to properly analyze the traffic. Please take the timeto make sure you master this material; it will prevent analysis errors as youmove forward.
Written to be both a training aid and a technical reference for intrusion detection analysts, Northcutt's book contains unparalleled, practical experience that can't be found anywhere else. With detailed explanations and illustrative examples from his own career, Northcutt covers the topic completely, from detect evaluation, analysis, and situation handling, through the theories involved in understanding hackers, intelligence gathering, and coordinated attacks, to an arsenal of preventive and aggressive security measures. Ideal for the serious security analyst, Network Intrusion Detection: An Analyst's Handbook is the tool that puts you in full control of your network's security.
--This text refers to an out of print or unavailable edition of this title. About the Author
Stephen Northcutt is a graduate of Mary Washington College. Beforeentering the field of computer security, he worked as a Navy helicopter searchand rescue crewman, white water raft guide, chef, martial arts instructor,cartographer, and network designer. Stephen is author/co-author of IncidentHandling Step by Step, Intrusion Signatures and Analysis, Inside NetworkPerimeter Security, and the previous two editions of this book. He was theoriginal author of the Shadow intrusion detection system and leader of theDepartment of Defense's Shadow Intrusion Detection team before acceptingthe position of Chief for Information Warfare at the Ballistic Missile DefenseOrganization. Stephen currently serves as Director of Training and Certificationfor the SANS Institute.
Judy Novak is currently a senior security analyst working for theBaltimore-based consulting firm of Jacob and Sundstrom, Inc. She primarily worksat the Johns Hopkins University Applied Physics Laboratory where she is involvedin intrusion detection and traffic monitoring and Information Operationsresearch. Judy was one of the founding members of the Army Research LabsComputer Incident Response Team where she worked for three years. She hascontributed to the development of a SANS course in TCP/IP and written a SANShands-on course, "Network Traffic Analysis Using tcpdump," both ofwhich are used in SANS certifications tracks. Judy is a graduate of theUniversity of Maryland—home of the 2002 NCAA basketball champions. She isan aging, yet still passionate, bicyclist, and Lance Armstrong is her modern-dayhero!