Network Intrusion Detection: An Analyst's Handbook

About

Features

• Identify vulnerable targets on your system.

• Recognize common and unusual attack patterns.

• Know and disable your enemies.

• Recognize real detects versus false alarms, and know when to report them.

• Evaluate ID systems and third-party tools.

• Learn about automated response and manual response in relation to real-time analysis.

• Propose and justify ID expenditures.

Description

Written to be both a training aid and a technical reference for intrusion detection analysts, Northcutt's book contains unparalleled, practical experience that can't be found anywhere else. With detailed explanations and illustrative examples from his own career, Northcutt covers the topic completely, from detect evaluation, analysis, and situation handling, through the theories involved in understanding hackers, intelligence gathering, and coordinated attacks, to an arsenal of preventive and aggressive security measures. Ideal for the serious security analyst, Network Intrusion Detection: An Analyst's Handbook is the tool that puts you in full control of your network's security.

Sample Content

Table of Contents

1. Mitnick Attack.

Exploiting TCP. Detecting the Mitnick Attack. Preventing the Mitnick Attack. Summary.

Filtering Policy. Signatures. Filter Examples. Policy Issues Related to Targeting Filters. Summary.

Events of Interest. Limits to Observation. Low-Hanging Fruit Paradigm. Human Factors Limit Detects. Severity. Countermeasures. Sensor Placement. Outside Firewall. Push/Pull. Analyst Console. Host- or Network- Based Intrusion Detection. Summary.

Multiple Solutions Working Together. Commercial IDS Interoperability Solutions. Correlation. SQL Databases. Summary.

Commercial Tools. MS Windows-Capable Systems. UNIX-Based Systems. GOTS. Evaluating Intrusion Detection Systems. Lincoln Labs Approach. Summary.

False Positives. IMAP Exploits. Exploit Ports with SYN/FIN Set. Scans to Apply Exploits. Single Exploit, portmap. Summary.

Commonly Detected Denial-of-Service Traces. Rarely Seen Well- Known Programs. Summary.

Network and Host Mapping. NetBIOS Specific Traces. Stealth Attacks. Summary.

Christmas Eve 1998. Where Attackers Shop. Communications Network. Anonymity. Summary.

Coordinated Traceroutes. NetBIOS Deception. RESETs and More RESETs. SFRP Scans. Target-Based Analysis. Summary.

eNTrax. CMDS 4.0. tripwire. nmap. Summary.

Intrusion Detection in a Security Model. Defining Risk. Risk. Defining the Threat. Risk Management Is Dollar Driven. How Risky Is a Risk? Summary.

Automated Response. Honeypot. Manual Response. Summary.

Part One: Management Issues. Part Two: Threats and Vulnerabilities. Part Three: Tradeoffs and Recommended Solutions. Summary.

Increasing Threat. Cyber Terrorism and Y2K. Trusted Insider. Improved Response. The Virus Industry Revisited. Hardware-Based ID. Defense in Depth. Program-Based ID. PDD63. Smart Auditors.

Updates

Submit Errata