We got a MARS box at my work, so I grabbed this book to get up to snuff. It was a very annoying and frustrating book. The first 1/3 of the book seemed to be semi-marketing fluff, and actually prompted me to note "hahaha" in one of the margins. In about a decade of working through technical books,
Security threat mitigation and response understanding Cisco security MARS
β Scribed by Tesch, Dale;Abelar, Greg
- Publisher
- Cisco Press
- Year
- 2006;2007
- Tongue
- English
- Leaves
- 405
- Series
- Networking Technology
- Category
- Library
No coin nor oath required. For personal study only.
β¦ Synopsis
Identify, manage, and counter security threats with the Cisco Security Monitoring, Analysis, and Response System. While it is commonly understood that deploying network security devices is critical to the well-being of an organization's systems and data, all too often companies assume that simply having these devices is enough to maintain the integrity of network resources. To really provide effective protection for their networks, organizations need to take the next step by closely examining network infrastructure, host, application, and security events to determine if an attack has exploited devices on their networks. Cisco[registered] Security Monitoring, Analysis, and Response System (Cisco Security MARS) complements network and security infrastructure investment by delivering a security command and control solution that is easy to deploy, easy to use, and cost-effective. Cisco Security MARS fortifies deployed network devices and security countermeasures, empowering you to readily identify, manage, and eliminate network attacks and maintain compliance. new security paradigm that reduces your security risks and helps you comply with new data privacy standards. This book clearly presents the advantages of moving from a security reporting system to an all-inclusive security and network threat recognition and mitigation system. You will learn how Cisco Security MARS works, what the potential return on investment is for deploying Cisco Security MARS, and how to set up and configure Cisco Security MARS in your network. Dealing with gigantic amounts of disparate data is the next big challenge in computer security; if you're a Cisco Security MARS user, this book is what you've been looking for. - Marcus J. Ranum, Chief of Security, Tenable Security, Inc. Dale Tesch is a product sales specialist for the Cisco Security MARS product line for the Cisco Systems[registered] United States AT Security team. Dale came to Cisco Systems through the acquisition of Protego Networks in February 2005. sales and engineering team on SIM systems and Cisco Security MARS and for providing advanced sales support to Cisco customers. Greg Abelar has been an employee of Cisco Systems since December 1996. He was an original member of the Cisco Technical Assistance Security team, helping to hire and train many of the team's engineers. He has held various positions in both the Security Architecture and Security Technical Marketing Engineering teams at Cisco. Understand how to protect your network with a defense-in-depth strategy. Examine real-world examples of cost savings realized by Cisco Security MARS deployments. Evaluate the technology that underpins the Cisco Security MARS appliance. Set up and configure Cisco Security MARS devices and customize them for your environment. Configure Cisco Security MARS to communicate with your existing hosts, servers, network devices, security appliances, and other devices in your network. Investigate reported threats and use predefined reports and queries to get additional information about events and devices in your network. information about your network and security events. Learn firsthand from real-world customer stories how Cisco Security MARS has thwarted network attacks. This security book is part of the Cisco Press[registered] Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.
β¦ Table of Contents
Cover......Page 1
Contents......Page 11
Foreword......Page 19
Introduction......Page 22
Part I: The Security Threat Identification and Response Challenge......Page 28
Understanding Security Information Management Legacy Threat Response......Page 30
Understanding the Unified Security Platform......Page 35
Summary......Page 47
The Self-Defending Network and the Expanding Role of CS-MARS......Page 50
CS-MARS as an STM Solution......Page 66
Summary......Page 70
Fact, FUD, and Fiction......Page 74
Real Threats to Enterprises......Page 76
Attack Impact......Page 79
Total Cost of Ownership......Page 88
Using CS-MARS to Ensure ROI and Protect Your Assets......Page 89
Summary......Page 91
Part II: CS-MARS Theory and Configuration......Page 94
Technical Introduction to the CS-MARS Appliance......Page 96
Database Storage and Utilization......Page 103
Network Topology Used for Forensic Analysis......Page 106
NetFlow in CS-MARS......Page 113
Positive Alert Verification and Dynamic Vulnerability Scanning......Page 115
Methodology of Communication......Page 118
Summary......Page 124
Deploying CS-MARS in Your Network......Page 126
CS-MARS Initial Setup and Quick Install......Page 133
CS-MARS Reporting Device Setup......Page 139
Creating Users and Groups......Page 146
Configuring NetFlow and Vulnerability Scanning......Page 147
Configuring CS-MARS System Maintenance......Page 151
Configuring System Parameters......Page 152
Summary......Page 153
Identifying CS-MARSβSupported Devices......Page 156
Configuring Devices to Communicate with CS-MARS......Page 170
Summary......Page 228
Part III: CS-MARS Operation......Page 230
Using the Summary Dashboard, Network Status Graphs, and My Reports Tab......Page 232
Using the Incidents Page......Page 248
Simple Queries......Page 257
Summary......Page 268
Creating Reports......Page 270
Creating Rules......Page 280
Summary......Page 303
Part IV: CS-MARS in Action......Page 306
State Government......Page 308
Large University......Page 309
Hospital......Page 311
Enterprise Financial Company......Page 313
Small Business......Page 314
Summary......Page 316
Part V: Appendixes......Page 318
Security Links and Descriptions......Page 320
Quick Hardware and Protocol Specifications for CS-MARS......Page 326
NetFlow Platform Guide......Page 330
V4.1 Product Support List......Page 332
Security Threat Mitigation......Page 340
Sample Seed File......Page 344
ISS Configuration Scripts......Page 345
IOS and CATOS NetFlow Quick Configuration Guide......Page 348
Complete Command Summary......Page 352
CS-MARS Maintenance Commands......Page 355
CS-MARS V4.1 Reports......Page 360
Using Serial Console Access......Page 374
Configuring Check Point NG FP3/AI and CS-MARS......Page 378
Configuring Check Point Provider-1 R60......Page 384
AβB......Page 386
C......Page 387
D......Page 388
G......Page 389
I......Page 390
N......Page 391
R......Page 392
S......Page 393
TβU......Page 394
XβZ......Page 395
π SIMILAR VOLUMES
Cyber-Security Threats, Actors, and Dynamic Mitigation provides both a technical and state-of-the-art perspective as well as a systematic overview of the recent advances in different facets of cyber-security. It covers the methodologies for modeling attack strategies used by threat actors targeting
This textbook examines non-traditional forms of security and expands the notion of security to include non-state actors and non-human actors.γ Proposing an expansive view of non-traditional forms of security that go beyond traditionally recognized issues of threats to state and national territory
Nigeria is one of the most dynamic countries on the African continent with severe security threats. Tackling the major issues, Security in Nigeria examines the underlying causes of insecurity, specific violent threats to the state, the crisis of governance on the legitimacy of the Nigerian state and