Book details of 'Intrusion Detection'

Title	Intrusion Detection
Author(s)	Rebecca Gurley Bace
ISBN	1578701856
Language	English
Published	December 1999
Publisher	Que

---

Back to shelf Computer security
Amazon.com info for Intrusion Detection

Score:

Vote for this book

The Virtual Bookcase Reviews of 'Intrusion Detection':

Reviewer Rob Slade wrote:
Bace's take on this topic (and title) provides a solid and comprehensive background for anyone pursuing the subject. Concentrating on a conceptual model the book is occasionally weak in regard to practical implementation, but more than makes up for this textual deficiency with a strong sense of historical background, developmental approaches, and references to specific implementations that the practitioner may research separately. (Look, guys, can we give the reviewers a break here and work on *some* variation in the title?) Chapter one presents a history of intrusion detection starting with system accounting, through audit systems, to the most recent research and experimental systems. The definitions and concepts focus from broad security theory to specific intrusion detection principles and variants in chapter two. Intrusion detection requires analysis of system and other information, and chapter three describes the sources for this data. Chapter four may be somewhat disappointing to security managers in that the discussion of analysis is academic and possibly weak in tone, even though real systems are used as illustrations. The review of possible responses, in chapter five, includes warnings against inappropriate overreactions. Vulnerability analysis, including a close look at controversial tools like COPS, SATAN, and ISS, is dealt with in chapter six. Chapter seven talks about technical issues that are still to be addressed. (The organization of this chapter is a bit loose, with some sections, such as those on reliability and analysis, seeming to overlap material.) Real world challenges are the topic of chapter eight, along with examples of attacks and intrusion detection system (IDS) design considerations. This section seems to reprise much of the content of the vulnerabilities chapter. Dealing with legal issues, evidence, and privacy in chapter nine it is nice to see some newer examples than the old "berferd" and "wiley hacker" standards. Chapter ten's review of intrusion detection systems, and actions to take if penetrated, addresses the informed user. Security administrators and strategists, at the executive level, are presented with everything from the need for security goals to globalization in chapter eleven. Designers get a few general guidelines in chapter twelve, along with comments from those who have been implementing exemplary systems. Chapter thirteen is a realistic look at future developments in attacks and defence. Of the other "Intrusion Detection" books, Terry Escamilla's (see reviews) is simply not in the same league, being basically a promotional brochure. "Network Intrusion Detection," by Stephen Northcutt (see reviews), is likewise not as clever as it thinks it is. Edward G. Amoroso (see reviews) is very close in both quality and usefulness, and possibly has the edge in practical terms, although his book is a bit narrower in focus. Bace provides a comprehensive overview and conceptual background that will ensure this text becomes a basic security reference. copyright Robert M. Slade, 2000
Add my review for Intrusion Detection

Book description:

With the number of intrusion and hacking incidents around the world on the rise, the importance of having dependable intrusion detection systems in place is greater than ever. Offering both a developmental and technical perspective on this crucial element of network security, Intrusion Detection covers: practical considerations for selecting and implementing intrusion detection systems; methods of handling the results of analysis, and the options for responses to detected problems, data sources commonly used in intrusion detection and how they influence the capabilities of all intrusion detection systems; legal issues surrounding detection and monitoring that affect the design, development, and operation of intrusion detection systems. More than just an overview of the technology, Intrusion Detection presents real analysis schemes and responses, as well as a detailed discussion of the vulnerabilities inherent in many systems, and approaches to testing systems for these problems.