Extreme Exploits: Advanced Defenses Against Hardcore Hacks (Hacking Exposed)
by Victor Oppelman, Oliver Friedrichs, and Brett Watson
Paperback: 448 pages
Publisher: McGraw-Hill Osborne Media
Good coverage of darknets, honeynets, and triggered blackholes
First I must admit that I know and have worked with several of the authors of this book. I was given an autographed copy of the book late last year, however seeing as the book was published in 2005 I didn’t think there would be much along the lines of useable information seeing as many of the security threats and vulnerabilities have evolved quite a bit since then. However, as I started reading the book I quickly realized much of the information was still relevant today as it was several years ago. The chapters on ISP Security Practices and Securing the Domain Name System had very good coverage of many of the techniques used throughout Service Provider networks to secure their network and DNS infrastructure.
I particularly enjoyed reading the sections on using egress packet filters to restrict data leaks from within an organization – a particular problem today with the prevalance of Internet Worms and other Malware which often attempt to communicate back to their centralized Command & Control (C&C) hosts. The chapter on ‘Sinkholes and Backscatter’ has very good coverage on a wide variety of topics such as using Darknets and Honeynets to monitor malicious traffic and other nasties emanating throughout your network, as well as using techniques such as Triggered Blackhole Routing to propagate filters quickly and dynamically to drop DDoS and other malevolent traffic.
I would have to disagree with Dr. Anton Chuvakin that the chapters on Digital Forensics were disappointing. Personally, I learned quite a bit from these chapters and came away from reading them with a whole arsenal of new tools to use with which I can perform my own digital forensics on compromised systems. The coverage of Foremost, memdump, and some of the advanced digital forensic tools was top notch.
All in all, I would say this is still a good book for anyone involved in Network Security. Much of the information covered is still relevant in today’s networks. If the authors attempt to release a second edition I would suggest coverage of adapting Triggered Blackhole techniques to be used in more modern DDoS Mitigation scenarios. Additionally, discussion of new techniques used for Malware C&C and coverage of Fast-flux and Double-flux techniques used by the attackers to create more robust and reliable networks would be welcomed.
OSPF and IS-IS: Choosing an IGP for Large-Scale Networks
by Jeff Doyle
Paperback: 480 pages
Publisher: Addison-Wesley Professional
A welcome addition to any networking library
If you consider yourself a student of routing protocols and enjoy coverage of graph theory from the perspective of its application to link-state routing protocols, this text will certainly be a welcome addition to your library. This book not only provides information regarding ‘how’ link-state routing protocols work, it also provides information regarding ‘why’ the link-state routing protocols behave as they do, and why the protocol designers made certain choices in the development of these protocols. While it might seem a daunting task especially to the novice reader to learn about two routing protocols side-by-side, it is this treatment which makes this text so worthwhile. Being able to compare these two protocols and identify their similarities and differences simultaneously will ultimately help the network designer pick the right protocol for the job in a given network environment.
This book goes beyond IGP fundamentals by giving practical advice to the network designer which can assist in the planning and implementation of a scalable IGP deployment. For example, in the chapter on Area Design, the author states that “a useful guideline when designing a network is that network control traffic should never exceed 5 percent of the available bandwidth of any link in the network, and in normal circumstances should not exceed 1 percent”. The author then presents various formulas which can be used to determine the amount of bandwidth used by the protocol control traffic based on the number and type of LSAs which are expected to be present in a given network. Arguably one of the best chapters in the book is the chapter on Scaling. This chapter has some of the best coverage of the various modifications which router vendors make to their link-state protocol implementations in order to make routers perform calculations more rapidly, enhance flooding of Link-State updates, and other changes designed to make the protocols scale to support very large networks.
I am a stickler for accuracy, especially when it comes to technical textbooks. I pride myself on my ability to spot technical and grammatical errors in texts such as these, however I must say as I read this book I was very impressed that I found very little errors beyond just the simple grammatical and typographical. Jeff Doyle is an experienced writer, and it should come as no surprise that the technical content in this book is extremely well-vetted, accurate, and error-free. Ultimately, if you are a network operator, designer or architect and are interested in broadening your understand of link-state protocols coupled with the ability to more fully understand the technical distinctions between OSPF and IS-IS, this book is without a doubt one of the best options on the market today.