Security Monitoring

This book serves to alert you to a problem but fails to provide a general solution or one that is easy to implement.

Security Monitoring
Author: Chris Fry & Martin Nystrom
Publisher: O'Reilly
Price: £34.50
Pages: 246
ISBN: 978-0596518165

Security monitoring - it should be a no brainer, but it isn't. If you run a small to medium network and do nothing about it then you basically haven't a clue what is going on. If you run a big network and do nothing about it you simply have a bigger ignorance and hence risk. If you think about it for a few minutes it's amazing how opaque a network is without monitoring facilities.

Because of these simple facts this book is obviously has something to say but in the main only to users of Cisco routers and switches. Despite promises to cover open source and other software, it concentrates on using Netflow and other Cisco software.

It also reads like a book that is thin on content with the authors trying their best to sound academic and erudite. Of course there is the possibility that you are a sucker for initial chapter quotes and florid metaphor but at the end of the day it doesn't really set out the problem or the solution in any clear and unambiguous manner.

Yes, it is true that there are explanations of how to set up routers and other equipment for monitoring and it does describe some of the bigger picture in terms of what makes a given network architecture vulnerable and what to look out for.

It even explains some low level ideas such as how to gather information from logs, but if you follow the instructions you will have to do a lot of initial work and a lot of on-going work.

There are more general off-the-shelf solutions to the monitoring problem that bring together data from a range of sources using a range of protocols and present integrated dashboards that show you exactly what is going on under the hood. You really don't have to work as hard as this book seems to suggest to find out what is going on.

On the other hand, if you are a Cisco-only shop and you haven't tackled the problem of security monitoring it does provide some practical help and suggest what you might be lacking - but even here it doesn't offer an easy-to-use, pre-packaged solution.

For more warts and all book reviews visit i-programmer