| Foreword |
|
xxv | |
| Acknowledgments |
|
xxvii | |
| Introduction |
|
xxix | |
| Part I Intrusion Detection: Primer |
|
|
1 Understanding Intrusion Detection |
|
|
3 | (20) |
|
Intrusion-Detection and Intrusion-Prevention Basics |
|
|
4 | (6) |
|
What Is an Intrusion-Detection System (IDS)? |
|
|
4 | (3) |
|
|
|
7 | (1) |
|
What Is an Intrusion-Prevention System (IPS)? |
|
|
7 | (2) |
|
|
|
9 | (1) |
|
The History of Intrusion Detection and Prevention |
|
|
10 | (2) |
|
WHY IDSs AND IPSs ARE IMPORTANT |
|
|
12 | (1) |
|
IDS and IPS Analysis Schemes |
|
|
13 | (6) |
|
|
|
13 | (1) |
|
The Anatomy of Intrusion Analysis |
|
|
14 | (2) |
|
Rule-Based Detection (Misuse Detection) |
|
|
16 | (1) |
|
Profile-Based Detection (Anomaly Detection) |
|
|
17 | (1) |
|
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
19 | (1) |
|
|
|
19 | (1) |
|
|
|
20 | (1) |
|
Intrusion-Detection and Intrusion-Prevention Myths |
|
|
20 | (2) |
|
|
|
22 | (1) |
|
2 Crash Course in the Internet Protocol Suite |
|
|
23 | (26) |
|
An Introduction to the Seven-Layer OSI Reference Model |
|
|
24 | (3) |
|
|
|
25 | (1) |
|
|
|
25 | (1) |
|
|
|
25 | (1) |
|
|
|
26 | (1) |
|
|
|
26 | (1) |
|
|
|
26 | (1) |
|
|
|
26 | (1) |
|
TCP/IP vs. the OSI Reference Model |
|
|
27 | (1) |
|
|
|
28 | (6) |
|
|
|
28 | (1) |
|
|
|
28 | (1) |
|
|
|
29 | (3) |
|
|
|
32 | (1) |
|
|
|
33 | (1) |
|
Transmission Control Protocol (TCP) |
|
|
34 | (5) |
|
|
|
35 | (1) |
|
|
|
35 | (2) |
|
|
|
37 | (2) |
|
User Datagram Protocol (UDP) |
|
|
39 | (1) |
|
|
|
39 | (1) |
|
Internet Control Message Protocol (ICMP) |
|
|
40 | (1) |
|
|
|
40 | (1) |
|
Address Resolution Protocol (ARP) |
|
|
41 | (5) |
|
|
|
42 | (1) |
|
|
|
43 | (1) |
|
A Practical Example of Routing |
|
|
44 | (2) |
|
|
|
46 | (1) |
|
|
|
47 | (2) |
|
3 Unauthorized Activity I |
|
|
49 | (20) |
|
|
|
50 | (1) |
|
|
|
51 | (17) |
|
|
|
51 | (2) |
|
|
|
53 | (9) |
|
|
|
62 | (1) |
|
|
|
62 | (4) |
|
|
|
66 | (2) |
|
|
|
68 | (1) |
|
4 Unauthorized Activity II |
|
|
69 | (24) |
|
Pros and Cons of Open Source |
|
|
70 | (1) |
|
|
|
71 | (7) |
|
|
|
71 | (5) |
|
|
|
76 | (1) |
|
|
|
76 | (1) |
|
Defense Against Buffer Overflow Attacks |
|
|
77 | (1) |
|
Commonly Exploited Programs and Protocols |
|
|
78 | (10) |
|
|
|
78 | (1) |
|
|
|
79 | (2) |
|
|
|
81 | (7) |
|
|
|
88 | (3) |
|
|
|
89 | (2) |
|
|
|
91 | (2) |
|
|
|
93 | (22) |
|
Tcpdump Command Line Options |
|
|
94 | (3) |
|
|
|
97 | (2) |
|
|
|
99 | (3) |
|
|
|
101 | (1) |
|
|
|
102 | (2) |
|
How Many Bytes Were Transferred in That Connection? |
|
|
104 | (1) |
|
Tcpdump as Intrusion Detection? |
|
|
105 | (3) |
|
Tcpslice, Tcpflow, and Tcpjoin |
|
|
108 | (3) |
|
|
|
108 | (1) |
|
|
|
109 | (1) |
|
|
|
110 | (1) |
|
|
|
111 | (4) |
| Part II Architecture |
|
|
6 IDS and IPS Architecture |
|
|
115 | (22) |
|
|
|
116 | (3) |
|
Single-Tiered Architecture |
|
|
116 | (1) |
|
Multi-Tiered Architecture |
|
|
117 | (1) |
|
Peer-to-Peer Architecture |
|
|
118 | (1) |
|
|
|
119 | (8) |
|
|
|
119 | (2) |
|
Sensor Deployment Considerations |
|
|
121 | (4) |
|
Sensor Security Considerations |
|
|
125 | (2) |
|
|
|
127 | (4) |
|
|
|
127 | (2) |
|
Agent Deployment Considerations |
|
|
129 | (1) |
|
Agent Security Considerations |
|
|
130 | (1) |
|
|
|
131 | (5) |
|
|
|
131 | (3) |
|
Manager Deployment Considerations |
|
|
134 | (1) |
|
Manager Security Considerations |
|
|
135 | (1) |
|
|
|
136 | (1) |
|
|
|
137 | (24) |
|
Information Flow in IDS and TPS |
|
|
138 | (8) |
|
|
|
138 | (1) |
|
|
|
139 | (1) |
|
|
|
140 | (1) |
|
|
|
141 | (1) |
|
|
|
141 | (2) |
|
|
|
143 | (2) |
|
Stateful Inspection of TCP Sessions |
|
|
145 | (1) |
|
|
|
145 | (1) |
|
|
|
145 | (1) |
|
|
|
146 | (8) |
|
|
|
147 | (2) |
|
|
|
149 | (2) |
|
|
|
151 | (2) |
|
|
|
153 | (1) |
|
|
|
154 | (1) |
|
|
|
154 | (2) |
|
|
|
154 | (1) |
|
How Malicious Code Can Be Detected |
|
|
155 | (1) |
|
|
|
155 | (1) |
|
|
|
156 | (1) |
|
|
|
157 | (1) |
|
|
|
158 | (3) |
| Part III Implementation and Deployment |
|
|
8 Internet Security System's RealSecure |
|
|
161 | (36) |
|
Installation and Architecture |
|
|
162 | (9) |
|
Architecture Considerations |
|
|
162 | (2) |
|
|
|
164 | (2) |
|
|
|
166 | (4) |
|
|
|
170 | (1) |
|
|
|
171 | (9) |
|
|
|
171 | (1) |
|
|
|
172 | (5) |
|
Creating and Implementing Packet Filters |
|
|
177 | (3) |
|
Creating and Implementing Event Filters |
|
|
180 | (3) |
|
|
|
181 | (1) |
|
Getting Acquainted with Your Network |
|
|
181 | (1) |
|
Using SiteProtector for Central Management |
|
|
182 | (1) |
|
Complementing Your Deployment with Proventia |
|
|
182 | (1) |
|
|
|
183 | (3) |
|
|
|
183 | (1) |
|
|
|
184 | (1) |
|
|
|
184 | (2) |
|
|
|
186 | (3) |
|
Creating RealSecure Signatures |
|
|
188 | (1) |
|
|
|
189 | (5) |
|
Upgrading from the RealSecure 6 Series to 7.0 |
|
|
190 | (1) |
|
Preface for Remote Upgrades |
|
|
190 | (1) |
|
Upgrading Windows Sensors |
|
|
191 | (1) |
|
Upgrading Unix and Linux Sensors |
|
|
192 | (1) |
|
Migrating from Sentry to RealSecure |
|
|
193 | (1) |
|
|
|
194 | (3) |
|
|
|
197 | (34) |
|
Designing Your Cisco-Based Solution |
|
|
199 | (31) |
|
|
|
200 | (1) |
|
|
|
200 | (5) |
|
Management and Operations |
|
|
205 | (1) |
|
|
|
205 | (1) |
|
|
|
206 | (1) |
|
|
|
207 | (1) |
|
Assigning Packet Capture to Signatures |
|
|
207 | (1) |
|
Session Sniping and Shunning |
|
|
207 | (1) |
|
|
|
208 | (3) |
|
Catalyst Switch Module The IDSM-2 |
|
|
211 | (5) |
|
|
|
216 | (11) |
|
|
|
227 | (1) |
|
|
|
227 | (2) |
|
|
|
229 | (1) |
|
|
|
230 | (1) |
|
|
|
231 | (18) |
|
|
|
232 | (1) |
|
|
|
233 | (1) |
|
|
|
233 | (1) |
|
|
|
233 | (1) |
|
Network Intrusion Detection Mode |
|
|
234 | (1) |
|
|
|
234 | (2) |
|
|
|
234 | (1) |
|
|
|
235 | (1) |
|
|
|
235 | (1) |
|
|
|
236 | (1) |
|
|
|
236 | (3) |
|
The Nature of Snort Rules |
|
|
236 | (1) |
|
|
|
237 | (1) |
|
|
|
238 | (1) |
|
|
|
239 | (1) |
|
|
|
239 | (1) |
|
|
|
239 | (1) |
|
|
|
240 | (1) |
|
|
|
240 | (2) |
|
|
|
241 | (1) |
|
|
|
241 | (1) |
|
|
|
242 | (3) |
|
New and Optimized Features |
|
|
242 | (1) |
|
|
|
243 | (1) |
|
Improved Protocol Decoding |
|
|
244 | (1) |
|
|
|
245 | (1) |
|
|
|
245 | (2) |
|
|
|
247 | (2) |
|
|
|
249 | (26) |
|
NFR Detection Methodology |
|
|
250 | (1) |
|
|
|
250 | (2) |
|
|
|
250 | (1) |
|
Sentivist Central Management System CMS |
|
|
251 | (1) |
|
Administrative Interface (AI) |
|
|
252 | (1) |
|
|
|
252 | (2) |
|
Organization of Signatures |
|
|
253 | (1) |
|
|
|
254 | (1) |
|
|
|
254 | (3) |
|
|
|
254 | (2) |
|
Record Statements (Forensics) |
|
|
256 | (1) |
|
Cool Things You Can Do with N-Code |
|
|
257 | (1) |
|
Central Management Server |
|
|
257 | (4) |
|
|
|
258 | (1) |
|
|
|
258 | (3) |
|
sentivist Deployment Strategy |
|
|
261 | (10) |
|
|
|
271 | (1) |
|
|
|
271 | (1) |
|
|
|
271 | (4) |
| Part IV Security and IDS Management |
|
|
|
|
275 | (18) |
|
The Basics of Data Correlation |
|
|
276 | (5) |
|
Data Correlation Definitions |
|
|
277 | (2) |
|
The Value of Data Correlation |
|
|
279 | (2) |
|
Advanced Approaches to Data Correlation and Fusion |
|
|
281 | (2) |
|
|
|
281 | (1) |
|
|
|
282 | (1) |
|
Understanding and Using Statistical Correlation |
|
|
283 | (4) |
|
The Basics of Statistical Correlation |
|
|
283 | (1) |
|
|
|
284 | (2) |
|
|
|
286 | (1) |
|
Pearson Product-Moment Correlation |
|
|
286 | (1) |
|
|
|
287 | (2) |
|
Real-Time Versus After-the-Fact Correlation |
|
|
289 | (3) |
|
|
|
292 | (1) |
|
|
|
293 | (18) |
|
|
|
295 | (1) |
|
|
|
295 | (1) |
|
|
|
296 | (1) |
|
|
|
296 | (1) |
|
The Incident-Response Process |
|
|
296 | (6) |
|
Performing a Risk Analysis |
|
|
296 | (1) |
|
Designing an Incident-Response Methodology |
|
|
297 | (2) |
|
Creating an Incident-Response Team |
|
|
299 | (2) |
|
Responding to an IDS or IPS Incident |
|
|
301 | (1) |
|
IDS and IPS Incident-Response Phases |
|
|
302 | (4) |
|
|
|
303 | (1) |
|
|
|
303 | (1) |
|
|
|
304 | (1) |
|
|
|
304 | (1) |
|
|
|
304 | (2) |
|
|
|
306 | (1) |
|
Forensic Analysis on IDS Logs |
|
|
306 | (1) |
|
|
|
307 | (3) |
|
|
|
307 | (1) |
|
|
|
308 | (1) |
|
|
|
308 | (1) |
|
|
|
309 | (1) |
|
|
|
310 | (1) |
|
|
|
311 | (8) |
|
Policies, Standards, Guidelines, Procedures, and Baselines |
|
|
312 | (5) |
|
|
|
312 | (1) |
|
Creating an IDS/IPS Policy |
|
|
313 | (3) |
|
|
|
316 | (1) |
|
Procedure for Implementation of Your Policy |
|
|
317 | (1) |
|
Keeping Your Policy Current |
|
|
317 | (1) |
|
|
|
317 | (2) |
|
15 Laws, Standards, and Organizations |
|
|
319 | (14) |
|
Understanding Legal Systems |
|
|
320 | (1) |
|
|
|
320 | (1) |
|
|
|
320 | (1) |
|
|
|
321 | (1) |
|
U.S. Computer-Related Laws |
|
|
321 | (2) |
|
Computer Fraud and Abuse Act, 18 U.S.C. § 1030 |
|
|
321 | (1) |
|
Electronic Communications Protection Act, 18 U.S.C. § 2510-22 and 2701 |
|
|
321 | (1) |
|
Health Insurance Portability and Accountability Act (HIPAA) |
|
|
322 | (1) |
|
|
|
323 | (1) |
|
|
|
323 | (3) |
|
California Statute SB1386 |
|
|
325 | (1) |
|
International Cyber Security-Related Laws |
|
|
326 | (1) |
|
The § 28 EC European Union Privacy Directive |
|
|
326 | (1) |
|
United Kingdom Computer Misuse Act, 1990 |
|
|
326 | (1) |
|
Germany's Datenschutz Law |
|
|
327 | (1) |
|
|
|
327 | (1) |
|
The Problems with International Law |
|
|
327 | (1) |
|
|
|
327 | (3) |
|
The Common Intrusion Detection Framework (CIDF) |
|
|
328 | (1) |
|
Intrusion Detection Working Group (IDWG) |
|
|
328 | (1) |
|
Common Vulnerabilities and Exposures (CVE) |
|
|
328 | (1) |
|
|
|
329 | (1) |
|
International Symposium on Recent Advances in Intrusion Detection (RAID) |
|
|
329 | (1) |
|
|
|
330 | (1) |
|
National White Collar Crime Center (NW3C) |
|
|
330 | (1) |
|
National Cybercrime Training Partnership (NCTP) |
|
|
331 | (1) |
|
High Technology Crime Investigation Association (HTCIA) |
|
|
331 | (1) |
|
Legal Resources on the Web |
|
|
331 | (1) |
|
|
|
331 | (2) |
|
16 Security Business Issues |
|
|
333 | (12) |
|
The Business Case for Intrusion Detection and Prevention |
|
|
334 | (2) |
|
Overall Security Strategy |
|
|
334 | (1) |
|
|
|
335 | (1) |
|
Proactive vs. Reactive Technology |
|
|
336 | (1) |
|
|
|
336 | (2) |
|
|
|
336 | (2) |
|
|
|
338 | (4) |
|
|
|
338 | (1) |
|
|
|
339 | (1) |
|
|
|
340 | (1) |
|
|
|
341 | (1) |
|
|
|
342 | (1) |
|
Managing Intrusion Detection |
|
|
342 | (1) |
|
|
|
342 | (1) |
|
Managing in a Distributed Environment |
|
|
343 | (1) |
|
|
|
343 | (2) |
|
17 The Future of Intrusion Detection and Prevention |
|
|
345 | (16) |
|
Lower Reliance on Signature-Based Intrusion Detection |
|
|
346 | (6) |
|
|
|
348 | (1) |
|
|
|
349 | (1) |
|
Rule-Based Intrusion Detection |
|
|
350 | (1) |
|
|
|
351 | (1) |
|
|
|
352 | (3) |
|
Data and Alert Correlation |
|
|
355 | (1) |
|
|
|
356 | (1) |
|
Integrated Forensics Capabilities |
|
|
357 | (1) |
|
Use of Honeypots in Intrusion Detection and Prevention |
|
|
357 | (1) |
|
|
|
358 | (1) |
|
|
|
359 | (2) |
| A Intrusion Detection and Prevention Systems |
|
361 | (4) |
| Index |
|
365 | |