Applied Network Security Monitoring is the essential guide to becoming an NSM analyst from the ground up. This book takes a fundamental approach to NSM, complete with dozens of real-world examples that teach you the key concepts of NSM.
Network security monitoring is based on the principle that prevention eventually fails. In the current threat landscape, no matter how much you try, motivated attackers will eventually find their way into your network. At that point, it is your ability to detect and respond to that intrusion that can be the difference between a small incident and a major disaster.
The book follows the three stages of the NSM cycle: collection, detection, and analysis. As you progress through each section, you will have access to insights from seasoned NSM professionals while being introduced to relevant, practical scenarios complete with sample data.
If you've never performed NSM analysis, Applied Network Security Monitoring will give you an adequate grasp on the core concepts needed to become an effective analyst. If you are already a practicing analyst, this book will allow you to grow your analytic technique to make you more effective at your job.
1. Applied Network Security Monitoring - p. I 2. Cover Image - p. I 3. Title Page - p. ii 4. Copyright - p. iv 5. Table of Contents - p. iv 6. Dedication - p. v 7. Acknowledgements - p. xi 8. About the Authors - p. xiii 9. Foreword - p. xv 10. Preface - p. xvii 11. Chapter 1 The Practice of Applied Network Security Monitoring - p. 1 12. Chapter 2 Planning Data Collection - p. 27 13. Chapter 3 The Sensor Platform - p. 43 14. Chapter 4 Session Data - p. 75 15. Chapter 5 Full Packet Capture Data - p. 99 16. Chapter 6 Packet String Data - p. 121 17. Chapter 7 Detection Mechanisms, Indicators of Compromise, and Signatures - p. 149 18. Chapter 8 Reputation-Based Detection - p. 175 19. Chapter 9 Signature-Based Detection with Snort and Suricata - p. 203 20. Chapter 10 The Bro Platform - p. 255 21. Chapter 11 Anomaly-Based Detection with Statistical Data - p. 289 22. Chapter 12 Using Canary Honeypots for Detection - p. 317 23. Chapter 13 Packet Analysis - p. 341 24. Chapter 14 Friendly and Threat Intelligence - p. 385 25. Chapter 15 The Analysis Process - p. 421 26. Appendix 1 Security Onion Control Scripts - p. 451 27. Appendix 2 Important Security Onion Files and Directories - p. 457 28. Appendix 3 Packet Headers - p. 459 29. Appendix 4 Decimal / Hex / ASCII Conversion Chart - p. 465 30. Index - p. 467
Applied Network Security Monitoring is the essential guide to becoming an NSM analyst from the ground up. This book takes a fundamental approach to NSM, complete with dozens of real-world examples that teach you the key concepts of NSM.
Network security monitoring is based on the principle that prevention eventually fails. In the current threat landscape, no matter how much you try, motivated attackers will eventually find their way into your network. At that point, it is your ability to detect and respond to that intrusion that can be the difference between a small incident and a major disaster.
The book follows the three stages of the NSM cycle: collection, detection, and analysis. As you progress through each section, you will have access to insights from seasoned NSM professionals while being introduced to relevant, practical scenarios complete with sample data.
If you've never performed NSM analysis, Applied Network Security Monitoring will give you an adequate grasp on the core concepts needed to become an effective analyst. If you are already a practicing analyst, this book will allow you to grow your analytic technique to make you more effective at your job.
1. Applied Network Security Monitoring - p. I 2. Cover Image - p. I 3. Title Page - p. ii 4. Copyright - p. iv 5. Table of Contents - p. iv 6. Dedication - p. v 7. Acknowledgements - p. xi 8. About the Authors - p. xiii 9. Foreword - p. xv 10. Preface - p. xvii 11. Chapter 1 The Practice of Applied Network Security Monitoring - p. 1 12. Chapter 2 Planning Data Collection - p. 27 13. Chapter 3 The Sensor Platform - p. 43 14. Chapter 4 Session Data - p. 75 15. Chapter 5 Full Packet Capture Data - p. 99 16. Chapter 6 Packet String Data - p. 121 17. Chapter 7 Detection Mechanisms, Indicators of Compromise, and Signatures - p. 149 18. Chapter 8 Reputation-Based Detection - p. 175 19. Chapter 9 Signature-Based Detection with Snort and Suricata - p. 203 20. Chapter 10 The Bro Platform - p. 255 21. Chapter 11 Anomaly-Based Detection with Statistical Data - p. 289 22. Chapter 12 Using Canary Honeypots for Detection - p. 317 23. Chapter 13 Packet Analysis - p. 341 24. Chapter 14 Friendly and Threat Intelligence - p. 385 25. Chapter 15 The Analysis Process - p. 421 26. Appendix 1 Security Onion Control Scripts - p. 451 27. Appendix 2 Important Security Onion Files and Directories - p. 457 28. Appendix 3 Packet Headers - p. 459 29. Appendix 4 Decimal / Hex / ASCII Conversion Chart - p. 465 30. Index - p. 467
