 |
Ksiazki - Informatyczne .pl » informatyka » informatyka Security Monitoring with Cisco Security MARS
Opis Security Monitoring with Cisco Security MARS: Security Monitoring with CS-MARS helps readers plan a MARS (Security Monitoring, Analysis, and Response System) deployment and learn the installation tasks and day-to-day tasks a network security professional can expect to face. Additionally, the book will teach the reader how to use the advanced features of the product, such as the custom parser and hierarchical deployment models. Security Monitoring with CS-MARS uses a series of real-world case studies to lead the reader through all steps of these very important tasks, including:
While security products have gained capabilities and sophistication, security monitoring has not kept pace. Usually, a company finds they need to deploy a different monitoring tool for each specific product. This results in increased staffing costs, but doesn't address the overall need to make sense from the data accumulated from various logging sources. CS-MARS addresses this need, and this book helps those network professionals using it get the most from the system. Security Monitoring with Cisco Security MARS Threat mitigation system deployment Gary Halleen Greg Kellogg Networks and hosts are probed hundreds or thousands of times a day in an attempt to discover vulnerabilities. An even greater number of automated attacks from worms and viruses stress the same devices. The sheer volume of log messages or events generated by these attacks and probes, combined with the complexity of an analyst needing to use multiple monitoring tools, often makes it impossible to adequately investigate what is happening. Cisco® Security Monitoring, Analysis, and Response System (MARS) is a next-generation Security Threat Mitigation system (STM). Cisco Security MARS receives raw network and security data and performs correlation and investigation of host and network information to provide you with actionable intelligence. This easy-to-use family of threat mitigation appliances enables you to centralize, detect, mitigate, and report on priority threats by leveraging the network and security devices already deployed in a network, even if the devices are from multiple vendors. Security Monitoring with Cisco Security MARS helps you plan a MARS deployment and learn the installation and administration tasks you can expect to face. Additionally, this book teaches you how to use the advanced features of the product, such as the custom parser, Network Admission Control (NAC), and global controller operations. Through the use of real-world deployment examples, this book leads you through all the steps necessary for proper design and sizing, installation and troubleshooting, forensic analysis of security events, report creation and archiving, and integration of the appliance with Cisco and third-party vulnerability assessment tools. "In many modern enterprise networks, Security Information Management tools are crucial in helping to manage, analyze, and correlate a mountain of event data. Greg Kellogg and Gary Halleen have distilled an immense amount of extremely valuable knowledge in these pages. By relying on the wisdom of Kellogg and Halleen embedded in this book, you will vastly improve your MARS deployment." -Ed Skoudis, Vice President of Security Strategy, Predictive Systems Gary Halleen is a security consulting systems engineer with Cisco. He has in-depth knowledge of security systems as well as remote-access and routing/switching technology. Gary is a CISSP and ISSAP. His diligence was responsible for the first successful computer crimes conviction in the state of Oregon. Gary is a regular speaker at security events and presents at Cisco Networkers conferences. Greg Kellogg is the vice president of security solutions for Calence, LLC. He is responsible for managing the company's overall security strategy. Greg has more than 15 years of networking industry experience, including serving as a senior security business consultant for the Cisco Enterprise Channel organization. Additionally, Greg worked for Protego Networks, Inc. (where MARS was originally developed). There he was responsible for developing channel partner programs and helped solution providers increase their security revenue. Learn the differences between various log aggregation and correlation systems
This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks. Category: Cisco Press-Security Covers: Security Threat Mitigation Spis treści Security Monitoring with Cisco Security MARS: Foreword Introduction Part I Introduction to CS-MARS and Security Threat Mitigation Chapter 1 Introducing CS-MARS Introduction to Security Information Management The Role of a SIM in Today's Network Common Features for SIM Products Desirable Features for SIM Products Challenges in Security Monitoring Types of Events Messages Understanding CS-MARS Security Threat Mitigation System Topology and Visualization Robust Reporting and Rules Engine Alerts and Mitigation Description of Terminology CS-MARS User Interface Dashboard Network Status My Reports Summary Chapter 2 Regulatory Challenges in Depth Health Insurance Portability and Accountability Act of 1996 (HIPAA) Who Is Affected by HIPAA? What Are the Penalties for Noncompliance? HIPAA Security Rule HIPAA Security Rule and Security Monitoring Gramm-Leach-Bliley Act of 1999 (GLB Act) Who Is Affected by the GLB Act? What Are the Penalties for Noncompliance with GLB? The GLB Act Safeguards Rule The GLB Safeguards Rule and Security Monitoring The Sarbanes-Oxley Act of 2002 (SOX) Who Is Affected by Sarbanes-Oxley? What Are the Penalties for Noncompliance with Sarbanes-Oxley? Sarbanes-Oxley Internal Controls Payment Card Industry Data Security Standard (PCI-DSS) Who Is Affected by the PCI Data Security Standard? What Are the Penalties for Noncompliance with PCI-DSS? The PCI Data Security Standard Compliance Validation Requirements Summary Chapter 3 CS-MARS Deployment Scenarios Deployment Types Local and Standalone Controllers Global Controllers Sizing a CS-MARS Deployment Special Considerations for Cisco IPSs Determining Your Events per Second Determining Your Storage Requirements Considerations for Reporting Performance Considerations for Future Growth and Flood Conditions Planning for Topology Awareness CS-MARS Sizing Case Studies Retail Chain Example State Government Example Healthcare Example Summary Part II CS-MARS Operations and Forensics Chapter 4 Securing CS-MARS Physical Security Inherent Security of MARS Appliances Security Management Network MARS Communications Requirements Network Security Recommendations Ingress Firewall Rules Egress Firewall Rules Network-Based IDS and IPS Issues Summary Chapter 5 Rules, Reports, and Queries Built-In Reports Understanding the Reporting Interface Reporting Methods The Query Interface Creating an On-Demand Report Batch Reports and the Report Wizard Creating a Rule About Rules Creating the Rule Creating Drop Rules About Drop Rules Creating the Drop Rule Summary Chapter 6 Incident Investigation and Forensics Incident Handling and Forensic Techniques Initial Incident Investigation Viewing Incident Details Finishing Your Investigation False-Positive Tuning Deciding Where to Tune Tuning False Positives in MARS Summary Chapter 7 Archiving and Disaster Recovery Understanding CS-MARS Archiving Planning and Selecting the Archive Server Configuring the Archiving Server Configuring CS-MARS for Archiving Using the Archives Restoring from Archive Restoring to a Reporting Appliance Direct Access of Archived Events Retrieving Raw Events from Archive Summary Part III CS-MARS Advanced Topics Chapter 8 Integration with Cisco Security Manager Configuring CS-Manager to Support CS-MARS Configuring CS-MARS to Integrate with CS-Manager Using CS-Manager Within CS-MARS Summary Chapter 9 Troubleshooting CS-MARS Be Prepared Troubleshooting MARS Hardware Beeping Noises Degraded RAID Array Troubleshooting Software and Devices Unknown Reporting Device IP Check Point or Other Logs Are Incorrectly Parsed New Monitored Device Logs Still Not Parsed How Much Storage Is Being Used, and How Long Will It Last? E-Mail Notifications Sent to Admin Group Never Arrive MARS Is Not Receiving Events from Devices Summary Chapter 10 Network Admission Control Types of Cisco NAC NAC Framework Host Conditions Understanding NAC Framework Communications Configuration of CS-MARS for NAC Framework Reporting Information Available on CS-MARS Summary Chapter 11 CS-MARS Custom Parser Getting Messages to CS-MARS Determining What to Parse Adding the Device or Application Type Adding Log Templates First Log Template Second and Third Log Templates Fourth and Fifth Log Templates Additional Messages Adding Monitored Device or Software Queries, Reports, and Rules Queries Reports Rules Custom Parser for Cisco CSC Module Summary Chapter 12 CS-MARS Global Controller Understanding the Global Controller Zones Installing the Global Controller Enabling Communications Between Controllers Troubleshooting Using the Global Controller Interface Logging In to the Controller Dashboard Drilling Down into an Incident Query/Reports Local Versus Global Rules Security and Monitor Devices Custom Parser Software Upgrades Global Controller Recovery Summary Part IV Appendixes Appendix A Querying the Archive Appendix B CS-MARS Command Reference Appendix C Useful Websites Index 1587052709 TOC 6/11/2007 |
|
Księgarnia informatyczna © ksiazki-informatyczne.pl
- cisco press , książka informatyczna - Security Monitoring with Cisco Security MARS
|