The Tao of network security monitoring : beyond intrusion detection /
Richard Bejtlich ; foreword by Ron Gula.
- Boston : Addison-Wesley, c2005.
- xxxiv, 798 pages : illustrations ; 24 cm
Includes index
Contents Ch. 1 The security process 3 Ch. 2 What is network security monitoring? 25 Ch. 3 Deployment considerations 45 Ch. 4 The reference intrusion model 105 Ch. 5 Full content data 119 Ch. 6 Additional data analysis 173 Ch. 7 Session data 211 Ch. 8 Statistical data 247 Ch. 9 Alert data : Bro and Prelude 285 Ch. 10 Alert data : NSM using Sguil 317 Ch. 11 Best practices 347 Ch. 12 Case studies for managers 385 Ch. 13 Analyst training program 405 Ch. 14 Discovering DNS 433 Ch. 15 Harnessing the power of session data 473 Ch. 16 Packet monkey heaven 491 Ch. 17 Tools for attacking network security monitoring 521 Ch. 18 Tactics for attacking network security monitoring 583 Epilogue : the future of network security monitoring 651 App. A Protocol header reference 663 App. B Intellectual history of network security monitoring 685 App. C Protocol anomaly detection
Using real-life case studies of compromised networks, this title shows readers how to quickly develop and apply the skills necessary to detect, prevent, and respond to new and emerging threats to computer security
In English text.
0321246772 (pbk.)
Computer networks--Security measures. Electrical and Computer Engineering. Engineering and Applied Sciences. Telecommunications.