There are many good books that discuss the basics of systems administration. This is not one of those books. This book is much deeper and more specific and fills a niche that I think needed to be filled.
If you are in charge of a group of servers, especially as your company’s setup becomes larger and more complex, knowing how to check for problems and intruders is vital. It is also something that can be difficult to learn because of the dearth of materials readily available.
Security Monitoring, by Chris Fry and Martin Nystrom, seeks to remedy that problem. The authors are experienced security analysts and speakers who refined their materials over many years of giving security related presentations at conferences. They know what they are talking about, and their manner of presenting the material is clear and logical. The book’s subtitle is “Proven Methods for Incident Detection on Enterprise Networks.” It fits.
When I first noticed the deep ties each of the authors have with Cisco, I was concerned that the book might focus solely on their products, but they discuss software and methods from many vendors, including free and open source options. I found their discussions honest, open, and balanced.
The book begins by answering what security monitoring is, why it would be useful and desirable, and discusses several of the challenges involved in doing it well. We then move to the implementation of policies for monitoring, including a good description of the many types of monitoring that can be done, their strengths and weaknesses.
Next, we are led to know our network. This is foundational, but something that many systems administrators and IT workers don’t do, either because of time constraints or they just don’t think about it. However, taking the time up front to explore and really know what is in your network and how it is set up gives you a great advantage later when you receive security notices from your monitoring software–it helps you sort important things out from noise far more quickly and easily. The time savings later make this step well worth the time it takes to perform it.
Later, the book helps us select targets for monitoring, choose good sources for event collection and keep them dependable, feed and tune our netword intrusion detection systems and logging, and far more.
Each chapter and topic are demonstrated through an example that persists throughout the book, a fictional company called Blanco Wireless. As the chapters progress, we analyze and create security monitoring for the company. That was a useful thing to include.
One of my favorite features of the book is the final chapter which gives multiple real life examples through case studies and anecdotes to help illustrate moments when implementing the advice in the book would have been incredibly helpful, but when it was not done prior to an incident. The authors are very honest and humble here and own up to their humanity. Like the rest of us, they don’t always do what they know should be done. Some of these are their stories of learning the hard way that you don’t save time by skipping steps.
I think this book belongs on the shelf of anyone who has any responsibility for the security of systems, whether that responsibility is ultimate or partial. There is a lot in here, and anyone working in the field is sure to benefit in some way from the information.