How well does your enterprise stand up against today's sophisticated security threats? In this book, security experts from Cisco Systems demonstrate how to detect damaging security incidents on your global network--first by teaching you which assets you need to monitor closely, and then by helping you develop targeted strategies and pragmatic techniques to protect them.
Security Monitoring is based on the authors' years of experience conducting incident response to keep Cisco's global network secure. It offers six steps to improve network monitoring. These steps will help you:
- Develop Policies: define rules, regulations, and monitoring criteria
- Know Your Network: build knowledge of your infrastructure with network telemetry
- Select Your Targets: define the subset of infrastructure to be monitored
- Choose Event Sources: identify event types needed to discover policy violations
- Feed and Tune: collect data, generate alerts, and tune systems using contextual information
- Maintain Dependable Event Sources: prevent critical gaps in collecting and monitoring events
Security Monitoring illustrates these steps with detailed examples that will help you learn to select and deploy the best techniques for monitoring your own enterprise network.
About the Author
Chris Fry has been a member of the Computer Security Incident Response Team (CSIRT) at Cisco Systems, Inc for 5 years, focusing on deployment of intrusion detection, network monitoring tools, and incident investigation. He began his career at Cisco in 1997 as an IT analyst, supporting Cisco's production services. His four years as a Network Engineer in Cisco IT's internal network support organization give him valuable knowledge about and unique insight into monitoring production enterprise networks. Chris holds a BA in Corporate Financial Analysis and an MS in Information and Communication Sciences from Ball State University.
Martin Nystrom is a Member of Technical Staff (MTS) for the Computer Security Incident Response Team (CSIRT) at Cisco Systems. He leads the global security monitoring team and provides guidance for incident response and security initiatives. Prior to joining Cisco's CSIRT, he was responsible for designing and consulting on secure architectures for IT projects. Martin worked as an IT architect and a Java programmer for 12 years prior, where he built his experience in the pharmaceutical and computer industries. He received a bachelor's degree from Iowa State University in 1990, a master's degree from NC State University in 2003, and his CISSP certification in 2004. He is the author of O'Reilly's "SQL Injection Defenses", and the forthcoming, "Security Monitoring". He is a frequent conference speaker, and was honored on the Java One Rock Star Wall of Fame. He enjoys speaking at FIRST and Cisco Networkers conferences, and providing security guidance to customers via Cisco's Executive Briefing program. Most of Martin's papers and presos can be found at xianshield.org
Service Magic: The Art of Amazing Your Customers
Service Magic is not about creating illusions. It is a powerful book that applies the art and skill of stage magic to the creation of a service experience that seems magical. What does that look like? When the service you receive leaves you with a smile on your face and a story to tell, you have just...
The Mimetic Finite Difference Method for Elliptic Problems (MS&A)
This book describes the theoretical and computational aspects of the mimetic finite difference method for a wide class of multidimensional elliptic problems, which includes diffusion, advection-diffusion, Stokes, elasticity, magnetostatics and plate bending problems. The modern mimetic discretization technology developed in part by the...
iWork '09 Portable Genius
A portable guide to the most-used features of iWork '09, Apple's office productivity suite
Even in a down economy, Macs are enjoying increased popularity. iWork '09 provides an alternative to Microsoft Office. This guide covers the key skills, tools, and shortcuts to help you make the most of the iWork applications:...
Pragmatic Guide to Subversion (Pragmatic Guides)
Subversion sets the standard in version control systems. Championed by open-source developers, Subversion is behind some of today's biggest and most important software, including Apache, FreeBSD, Ruby, and MediaWiki. But more than just a tool for open-source collaboration, Subversion has made a significant impact in the corporate...
Wind Energy: Renewable Energy and the Environment
Due to the mounting demand for energy and increasing population of the world, switching from nonrenewable fossil fuels to other energy sources is not an option—it is a necessity. Focusing on a cost-effective option for the generation of electricity, Wind Energy: Renewable Energy and the Environment covers all...