Intrusion Detection and Prevention
Implement enterprise-wide security solutions based on detailed traffic and attack analysisIn today’s converged networking environment, cyber crime is on the rise and getting more sophisticated every day.  Malicious hackers lurk in dark corners, scanning for vulnerable systems and launching debilitating attacks.Intrusion Detection & Preventionshows you, step-by-step, how to mount a comprehensive defense, perform real-time security monitoring, and implement a proactive incident response plan.  Major examples of IDS software are covered, including TCPDump, RealSecure, Cisco Secure IDS, Network Flight Recorder, and Snort 2.0.  You’ll learn how to properly place and configure network sensors, analyze packets and TCP streams, correlate data, and counter attempted break-ins.  Plus, you’ll get vital coverage of legal standards, business guidelines, and the future of intrusion prevention.Inside, learn to:Identify and eliminate abnormal network traffic patterns and application-level abusesCapture, store, and analyze network transactions with TCPDumpDeploy sensors, agents, and manager components in single-tiered, multi-tiered, and peer-to-peer architecturesGrab, filter, decode, and process data packets and TCP streamsManage RealSecure Network Sensors, alerts, encryption keys, and reportsImplement ISS’s new central management system, SiteProtector 2.0Administer Cisco Secure IDS, Cisco Threat Response, and the Cisco Security AgentDistribute CSIDS 4200 Series Sensors and Catalyst 6000 IDS modulesUse Snort 2.0 rules, outputs, and plug-ins to detect unauthorized activityMonitor transactions with the Snort 2.0 Protocol Flow AnalyzerPerform packet inspection and protocol anomaly detection with Network Flight RecorderAssess threat levels using data correlation, fusion, and vulnerability scanningABOUT THE AUTHORS: Carl F. Endorf, CISSP, CISM, SSCP, CCNA, ITIL, CIWA, GSEC, IAM, is a technical security analyst working in the financial and insurance industries. Eugene Schultz, Ph.D., CISSP, CISM, is a Principal Engineer with Lawrence Berkeley National Laboratory and the Editor-in-Chief ofComputers and SecurityJim Mellander, a Principal Engineer with Lawrence Berkeley National Laboratory, developed the Kazaa Obliterator software, which prevents unauthorized peer-to-peer use. He teaches courses on intrusion detection and incident response.