BKOPSOST.RVW 20041203
"Open Source Security Tools", Tony Howlett, 2005, 0-321-19443-8,
U$49.99/C$71.99
%A Tony Howlett tony@howlett.org
%C One Lake St., Upper Saddle River, NJ 07458
%D 2005
%G 0-321-19443-8
%I Prentice Hall
%O U$49.99/C$71.99 +1-201-236-7139 fax: +1-201-236-7131
%O http://www.amazon.com/exec/obidos/ASIN/0321194438/robsladesinterne
http://www.amazon.co.uk/exec/obidos/ASIN/0321194438/robsladesinte-21
%O http://www.amazon.ca/exec/obidos/ASIN/0321194438/robsladesin03-20
%O tl a rl 2 tc 3 ta 3 tv 2 wq 2
%P 578 p. + CD-ROM
%T "Open Source Security Tools"
The tools listed in this book are for network security, almost without
exception. The preface states that the book is intended primarily for
systems administrators, although security professionals may find
useful information as well. Howlett makes an effort to include items
that have Windows versions, although only about a third do. He has
also included tutorial materials on detailed aspects of the TCP/IP
protocols that have a bearing on the operation of security software.
Chapter one outlines the open source concept, starting with a fairly
idealized scenario, but continuing with some history, advantages (and
disadvantages), and a brief look at two of the major open source
licences. The nominal topic of chapter two is operating systems, and
so it is rather odd that most of the tools described are network
utilities. However, the descriptions are better than are given in
most reviews of software tools, and the details are clear for all who
may read them. While chapter three does provide a quick overview of
TCP/IP and filtering, it does not cover the full range of firewall
types. The programs listed are comprehensively described in terms of
installation and administration commands. Port scanning is covered in
chapter four, and, again, while the programs are explained well, other
details, such as the services that would need to be turned off to
reduce the danger of open ports, are not. Much the same can be said
about the discussion of vulnerability scanners, in chapter five.
Chapter six looks at the most widely used network sniffers. The
concepts behind, and examples of, both network- and host-based
intrusion detection systems are given in chapter seven. Logging and
audit data can accumulate quickly and overwhelm the administrator, so
chapter eight reviews some common tools to present, analyse, and
manage the information. Chapter nine lists a variety of encryption
tools. Wireless tools, primarily for finding networks, are given in
chapter ten. Forensic tools are examined in chapter eleven, but there
may not be a sufficient distinction made between the network and data
recovery tools. Chapter twelve finishes off with some more general
discussion about open source software, and where to find it.
There are some helpful appendices: well-known TCP/IP port numbers, and
a large list of plug-ins for Nessus.
The tutorial material could have had more depth and care, but there is
no denying the value of the compilation (particularly with all the
software included on the CD).
copyright Robert M. Slade, 2004 BKOPSOST.RVW 20041203
====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@sun.soci.niu.edu
If you have responsibility for security, but have no authority to
set rules or punish violators, your own role in the organization
is to take the blame when something big goes wrong.
- Spaf's First Principle of Security Administration
Practical UNIX and Internet Security, Garfinkel & Spafford
http://victoria.tc.ca/techrev or http://sun.soci.niu.edu/~rslade
Rob Slade (rslade@sprint.ca)