Network Security Assessment

Rating:
Summary: A great collection of assessment tools and techniques
Review:
Awareness is a key component in a person's quest for mitigating the inherent risk of operating an IP network attached to the Internet. The book "Network Security Assessment" by Chris McNab, is recommended for anyone who is new to the profession of network perimeter assessment or anyone interested in learning more about how to defend their infrastructure.

The book focuses upon the enumeration and exploitation process of assessing a network perimeter. The author has a great section on manipulating whois, dns and nmap for network enumeration. These sections provide the reader an understanding of the techniques used to determine their networks external façade in a way that is clear and easy to follow yet reiterating the importance of understanding protocols such as ICMP and the advanced usage of information gathering tools like tcpdump.

A large portion of the book show tools, techniques and methodologies used to evaluate and exploit networks and host services. This information is useful and interesting to read; some of the exploits are quite old and could be useful for finding systems that were in dire need of patches. However, the book is about assessing the network not vulnerability re-mediation. The author does have a neat article "Top Ten Tips to Make Attackers' Lives Hell" on O'Reilly's web site. The assessment techniques cover Unix and Windows systems as well as many protocols such as LDAP, SNMP and applications such as IIS and Oracle.

The book ends with a great section on Application-Level risks. This includes useful information on buffer overflows, integer overflows, format string bugs and the like. This is well written and an explanation that is clear.

I feel like this book is a culmination of years of old notebooks, it is a handy resource. Overall, I would definitely recommend this book to anyone new to network security assessment. Even those who have experience in the field will find useful information and techniques in this book. It was a fun book to read and an excellent starting point when looking into the means by which one should assess their network.


Rating:
Summary: A good companion to "Security Warrior"
Review: "Network Security Assessment" (NSA) is the latest in a long line of vulnerability assessment / penetration testing books, stretching back to "Maximum Security" in 1997 and "Hacking Exposed" shortly thereafter. NSA is also the second major security title from O'Reilly this year, soon to be followed by "Network Security Hacks." NSA is a good book with some new material to offer, but don't expect to find deep security insight in this or similar assessment books.

NSA begins with the almost obligatory reference to the king of assessment books, "Hacking Exposed" (HE), saying "I leave listings of obscure techniques to behemoth 800-page 'hacking' books." I don't think some of the techniques covered in HE but not NSA are "obscure." Noticably lacking in NSA is coverage of dial-up techniques, wireless insecurities, Novell vulnerabilities, and attacking clients rather than servers. Should NSA receive a second edition, I expect to see the book expand closer to the "behemoth" it seems to deride.

The best chapter by far was ch. 11, where the author with assistance from Michael Thumann takes the reader on a tour of exploiting vulnerable code. The stack diagrams and code snippets were especially helpful and the explanations were clear enough. This sort of material is a solid introduction to some of the techniques found in "Security Warrior." I also liked ch. 14, where the author explains a sample assessment using the tools already introduced. Kudos as well for maintaining an errata page and tool archive on the publisher's Web site.

The advantage NSA has over HE is the variety of tools on hand. I learned of at least a dozen tools not mentioned elsewhere. The author seems to be thorough while listing various exploitable flaws from the last several years. While the prose is well-written, I believe the HE series does a better job communicating fundamentals of the underlying technology. In other words, HE gives better explanations of 'what' we are compromising, while "NSA" prefers to concentrate more on the compromising itself. This technology education aspect of the HE series has always been its strong point. For example, there's no need to read a 500 page book on Microsoft FrontPage to understand the problems with it when a quick look in a HE book explains the technology's basics as well as its security flaws.

It's been over a year since the 4th edition of HE was published, so I recommend buying NSA to freshen your assessment skills. For the scenarios it does cover, which include most UNIX and Windows Internet-based attacks, it is thorough and accurate. Combined with O'Reilly's "Security Warrior," NSA presents an updated picture of the assessment scene.

Rating:
Summary: Covers tools and techniques
Review: "Network Security Assessment" is a fun little book that covers vanilla network security assessment approach from planning to scanning to exploitation (but for whatever reason no reporting and remediation in the end). I liked that the author outlined the methodology first before diving into techniques. Such methodology presents (as it is common in the security arena) a double-edged sword, since it is used by security consultants as well as amateur blackhats.

The book is mostly fun to read (especially when the author is picking on the CIA in his remote information gathering activities). Sometimes though it boils down to listings of known vulnerabilities, some dated, going back to the times of RedHat 5.x and public exploit references. The coverage is pretty comprehensive, includes UNIX and Windows platforms and applications as well as VPN (but not network devices and wireless). I also liked his description of information gathering activities. The book covers most of the commonly used tools such as "nmap" (covering some of the relatively lesser known details of this scanner) as well as touches upon some of the less common such as "scanrand"). Every chapter ends with a brief summary of possible countermeasures to the activities in the chapter.

The book is definitely recommended to people new to the whole security assessment area. I suspect that those involved in the field will pick up some new things as well. For example, I liked that the author emphasizes various brute-forcing tools that can be as handy as the actual exploits when attacking a networked service. Also, I learned a new approach for picking up an internal IP address from behind the NAT by watching for certain ICMP packets.

Anton Chuvakin, Ph.D., GCIA, GCIH is a Senior Security Analyst with a major security information management company. He is the author of the book "Security Warrior" (O'Reilly, 2004) and a contributor to "Know Your Enemy II' (AWL, 2004). His areas of infosec expertise include intrusion detection, UNIX security, forensics, honeypots, etc. In his spare time, he maintains his security portal info-secure.org

Rating:
Summary: A good companion to "Security Warrior"
Review: "Network Security Assessment" (NSA) is the latest in a long line of vulnerability assessment / penetration testing books, stretching back to "Maximum Security" in 1997 and "Hacking Exposed" shortly thereafter. NSA is also the second major security title from O'Reilly this year, soon to be followed by "Network Security Hacks." NSA is a good book with some new material to offer, but don't expect to find deep security insight in this or similar assessment books.

NSA begins with the almost obligatory reference to the king of assessment books, "Hacking Exposed" (HE), saying "I leave listings of obscure techniques to behemoth 800-page 'hacking' books." I don't think some of the techniques covered in HE but not NSA are "obscure." Noticably lacking in NSA is coverage of dial-up techniques, wireless insecurities, Novell vulnerabilities, and attacking clients rather than servers. Should NSA receive a second edition, I expect to see the book expand closer to the "behemoth" it seems to deride.

The best chapter by far was ch. 11, where the author with assistance from Michael Thumann takes the reader on a tour of exploiting vulnerable code. The stack diagrams and code snippets were especially helpful and the explanations were clear enough. This sort of material is a solid introduction to some of the techniques found in "Security Warrior." I also liked ch. 14, where the author explains a sample assessment using the tools already introduced. Kudos as well for maintaining an errata page and tool archive on the publisher's Web site.

The advantage NSA has over HE is the variety of tools on hand. I learned of at least a dozen tools not mentioned elsewhere. The author seems to be thorough while listing various exploitable flaws from the last several years. While the prose is well-written, I believe the HE series does a better job communicating fundamentals of the underlying technology. In other words, HE gives better explanations of 'what' we are compromising, while "NSA" prefers to concentrate more on the compromising itself. This technology education aspect of the HE series has always been its strong point. For example, there's no need to read a 500 page book on Microsoft FrontPage to understand the problems with it when a quick look in a HE book explains the technology's basics as well as its security flaws.

It's been over a year since the 4th edition of HE was published, so I recommend buying NSA to freshen your assessment skills. For the scenarios it does cover, which include most UNIX and Windows Internet-based attacks, it is thorough and accurate. Combined with O'Reilly's "Security Warrior," NSA presents an updated picture of the assessment scene.

Rating:
Summary: a worthy addition to a network security bookshelf
Review: Hello,

I've bought a lot of network security books, as keeping up to date is important in my industry (security analyst). My bookshelf is literally filled with books on this topic which I use both as reference material and/or as a total read from start to finish.

When I saw Network Security Assessment on Amazon, I was immediately attracted to the title, but felt it might be just another unwieldy book with a lot of techniques but little explanation. But I bought it anyway, and since it arrived before Security Warrior did, I started to read it first.

It just goes to show that even when you think you know alot, there's someone out there that has some worthy experience to share. This book shares a wealth of tools, and supplements it with not only examples of how to use those tools, but surrounds the whole use of those tools with a methodology without directly ramming a methodology down your throat.

From the introduction of what tools are required, through to network enumeration, scanning, remote information services (dns, ldap), and right through to specifics of assessing ftp, email, vpn and others...I felt this book was a worthy addition to anyones network security library. It even makes multiple references to materials outside the scope of this book, so if you want to read up more on something else - you've got a great start.

I like books to be simple in their approach, because as we all know network security can be very complex. I think this book achieves this goal, and I recommend it to beginners, intermediates and even some experts who are open to refreshers.

Rating:
Summary: Excellent book to assess your own network security...
Review: Target Audience
Network administrators or security administrators who want to assess the security of their systems.

Contents
This book is a series of assessments that you can do to your systems to determine the level of your system security

The book is divided into the following chapters: Network Security Assessment; The Tools Required; Internet Host And Network Enumeration; IP Network Scanning; Assessing Remote Information Systems; Assessing Web Services; Assessing Remote Maintenance Services; Assessing FTP And Database Services; Assessing Windows Networking Services; Assessing Email Services; Assessing IP VPN Services; Assessing Unix RPC Services; Application-Level Risks; Example Assessment Methodology; TCP, UDP Ports, And ICMP Message Types; Sources Of Vulnerability Information

Review
Every day brings word of new exploits and new security bugs in various operating systems. Some are new and unique, and many are rehashed exploits made possible by the failure to patch and secure your systems. In order to see your system as a cracker would, you need to understand the mindset and toolsets that are used against you. This book, Network Security Assessment, will help you do just that.

Each chapter starts with a brief explanation of the area being discussed, as well as some of the overall security concerns related to that service. The rest of the chapter is then devoted to various exploits and tools that can be launched against the different operating systems. Chris McNab uses extensive illustrations and output listings to show the reader how the tools work and what type of information can be exposed to an attacker. Since many of the tools are Unix-based or are expected to be used against Unix-type systems, the author does assume familiarity with administration of Unix variants.

There are a lot of things to like about this book. The assessment methodology is organized and well thought out. It's not just a random scattering of exploits. The author also takes great pains to provide the sites where you can download the tools. In addition to that, the tools are also mirrored at the O'Reilly site so that you are protected against websites that may move around. The argument could be made that this provides a fledging cracker with all the information they need to break into your system. True, but the information already exists, and they will find it with or without this book. This book levels the playing field by making security information available to corporate administrators so that they have a chance against attackers.

Conclusion
A worthy addition to the bookshelf of network and security administrators. By following the exploits and processes outlined, you'll be able to sleep well knowing that you've covered as many bases as you can.

Rating:
Summary: Comprehensive is an understatement
Review: The author has managed to pack a serious amount of low-level technical information into this book. In the other penetration testing and hacking books I've read, I haven't yet found one to be as comprehensive as Network Security Assessment--to give you an example this book covers IPsec, Citrix and Oracle issues that I have not seen covered elsewhere in print, let alone in the same book. A downside is that the book is hard to read from cover-to-cover, and should be used more as a reference, and the author does assume a level of reader knowledge. I've just finished reading Shellcoder's Handbook too, and found chapter 13 of this book to be a great technical primer for application level issues (such as heap, stack, integer overflows and format string bugs)--the diagrams are excellent and easy for anyone to understand.

All in all this is a very useful book for both the professional security analyst and systems admin with large networks to protect. The Oreilly site has some good info that you should check out, such as the TOC, index and sample chapter on network scanning (http://www.oreilly.com/catalog/networksa/).

Rating:
Summary: nice book but unix based
Review: the book is good, but its almost totally unix based, I downloaded the tools and they all require unix systems
we just use Microsoft, and 99% of our clients use MS only
Really should be called unix security hacks

Rating:
Summary: Excellent book and has a lot of valuable information
Review: The book's preface starts out with a simple fact, one that is not always obvious to many: It is never impossible for a hacker to break into a computer system, only improbable. When designing and security a network, it is the job of the security architect to maximize that level of improbability as much as possible. Anyone who makes their network even a little bit more security resilient will quickly find a drop in the number of security breaches.


The publication of Hacking Exposed a few years ago started a new era in books about network scanning. Hacking Exposed was the first popular book that detailed how to go about performing a penetration test. In a similar vein, NSA is comparable to Hacking Exposed in that it provides a framework for doing security assessments. The big difference is that NSA provides a much more structured approach to performing the assessment, whereas Hacking Exposed lacked that formal approach. Hacking Exposed also goes into more details in many areas, and its initial title has morphed into many other different titles.


This more formal approach is manifest in the books 14 chapters. The first two chapters of NSA start out with the fundamental need and requirements for performing a network security assessment, and then details the tools and methodologies required to bring that assessment to fruition.


Chapter 3 details the ins and outs of network enumeration and also shows how to use standard utilities such as whois and nmap for network enumeration. Perhaps one of the most beneficial features of the book is the selection of countermeasures that are found at the end of each chapter. These countermeasures are very useful in ensuring that any vulnerabilities are appropriately fixed.


Besides listing methods which an intruder might use to elude common security applications, the book also goes into numerous hacking tools. While some may see this as providing fuel to the fire, it is clear that the tools are readily available (and have been for years). Listing of such tools won't make hacking easier for miscreants and script kiddies; rather it provides a level playing field for systems administrators who need to defend against such hackers.


After network and host enumeration, NSA steps forward into topics such as dealing with web servers and CGI, remote access issues, and ftp and database security issues. Chapter 9 does a good job of focusing on Microsoft Windows security issues. While entire books have been written about weak Windows security protocols such as NetBIOS, SMB and CIFS, NSA does a good job encapsulating ways to keep vulnerabilities here in check. Readers are highly advised to put the Windows networks services countermeasures listed at the end of the chapter into use.


Chapters 10-12 deal with the myriad security issues with email, VPN and RPC issues. While most of the information in these chapters (and the book as a whole) has been elucidated elsewhere, there is nonetheless a lot of valuable information contained in the chapters.


Chapter 13, "Application-Level Risks," is important in that many organizations put far too much emphasis on security the perimeter and forgetting about the application. The need for more emphasis on application-level security is eloquently put by Marcus Ranum when he notes that "these days, with the kind of plug-ins that come in your typical browser, combined with all the bizarre undocumented protocols used by new Internet applications, make it highly unlikely that a firewall is doing anything more complex than a thin layer of policy atop routing. As such, the applications behind the firewall are now more critical to security than the firewall itself. Which should scare the holey moley out of you."


Chapter 14 closes the book with a methodology for running a network security assessment. The author notes that running an assessment requires more thought than simply running security tools in a haphazard manner.


Overall, Network Security Assessment provides a good framework for anyone who is serious about running network security scans to security his perimeter and interior networks. The book is written in a style that is readable and understandable style; while more of an introductory text, it does not treat the reader as a dummy.


When it comes to running a network security assessment, the methodology is often more important than the running of the tools. While there is nothing radically new detailed in NSA, it does provide an effective and comprehensive overview of the issues involved in only 355 pages. If you are looking for a to-the-point book that does not get bogged down with screen prints and meaningless hacker stories and myths, Network Security Assessment is a good place to start.


Rating:
Summary: Excellent book
Review: This is an excellent written book that I would definitely recommend to anyone interested in Network Security. The author has a very professional approach to security assessment and every chapter covers in detail ways to find out information about systems and their vulnerabilities. The final chapter walks through the process of creating a detailed report about an attack. One of the best security related books I have ever read.