The Practical Intrusion Detection Handbook
by Paul E. Proctor
Prentice Hall, 2001.
359 pages, index, 2 appendices, bibliography
Hardcover. ISBN 0-13-025960-8. $49.99
Reviewed by Robert Bruen April 13, 2001
This is one of those times where the title of the book actually reflects
the content. The Practical Intrusion Detection Handbook is exactly what
it says it is and it is done well. TCP/IP is mentioned only twice
throughout the book because protocols and what goes on underneath the
hood is not the topic. Instead, the book covers ID from a user perspective
where the user needs to learn about it, possibly to set one up.
In the introduction, the first item we encounter is "Security versus
Business", the main audience. Although it is hard to believe that any
business is still without some level of ID, the fact is that many are
not. Therefore, justification is the starting point with an entire
chapter (Chapter 11) devoted to justifying the cost of an Intrusion
Detection System based on the proper risk analysis and asset valuation
that any astute corporate CFO should understand (e.g. ROI). Usually it is a
hard sell to set up a system of prevention when the risk of failure is
small. Fortunately, the media is full of stories of virus attack and
defaced web sites. This chapter alone may be worth the price of the book
if you are trying to get your management to fund an IDS.
Since the audience is mainly the
business world, there are several other
chapters of great value for those who
are new to IDS and security. One
area that business just can not get
away from is the legal jungle. Unless
your business is directly concerned
with money as a product, not just
profits, such as banks or credit card
companies, most have not taken
security seriously. This has begun to
change forcing the legal world to
be satisfied when problems occur. A
long time ago when you suffered a
break in, the law was not very
interested. Now, when a credit card heist
from a web business involves 35,000 or
cards at a shot, evidence and
liability become important. Knowing how
to fold legal requirements into
incident response policy is no longer
something that you figure out after
the fact. Read Chapters 8 & 15.
Continuing down the practical path, the are several chapters that big
systems folks will like: the Project Lifecycle, the Requirements
Definition and the Tool Selection and Acquisition Process. Having once
upon a time taught project management, I appreciate the problems that
one can run up against in larger organizations that formalize everything.
These chapters will assist those people. These days I prefer the smaller,
flexible approach, but it is nice to a resource if the choice is not yours.
No IDS book would be complete with a chapter on things you can purchase,
along with pros and cons. For now, at least, most systems will be
software, but not all. Another distinction will be host based tools and
network based tools. In the end you will be analyzing data in the same
place, but naturally, the sources will be different. The important tools
are covered with pictures and screen shots.
This is definitely a recommended book, just keep in mind that it aims
at the business world, with all the caveats that brings. There are plenty
of real world examples of intrusions and detections, but there are also
examples of cost estimates, policy management and operational issues.