Active Books
Related Subjects:
More Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250


In depth and completeReview Date: 2007-12-29
Want to deploy an IPS? Start with this book.Review Date: 2005-06-15
The section on host IPS touches on a number of items with a rather detailed treatment of buffer overflows. Although I find reading source code in a book painfully boring, this detailed treatment of buffer overflows is welcomed. If you go through this section carefully, you will have a very good understanding of why buffer overflows are often exploited and more importantly how they can be defeated with tools like PaX and StackGuard. There is a brief treatment of hardened OS's and SELinux. Personally, I think the SELinux treatment was a bit light, especially as SELinux is now standard for Fedora Core 3 and Red Hat Enterprise Linux 4. Few books touch on SELinux, so a more expanded treatment of it here would have been welcomed. Nonetheless, the section on host based IPS is recommended to any server owner, especially those that lease or co-locate equipment that is in a network environment which they cannot control.
Chapter 7 focuses on application layer IPS controls. The best part of this chapter is a good review of common web application attacks such as cross-site scripting, form field manipulation, and SQL injection. These types of attacks are frequent entry points for hackers. The chapter also includes information on tools like ModSecurity, IIS Lockdown and others that can be used to protect your applications.
The remaining chapters provide background IPS information and details on how to protect the network layer. If you are a network manager, these chapters are a good starting point to IPS theory and practice. The last chapter provides brief accounts about deploying various open source tools, such as fwsnort, SnortSAM, LIDS, PSAD, and PortSentry. The inclusion of these tools is great but I think most will find that the treatment is too brief to provide a full-scale implementation. The authors point you in the right direction and get you started but you will need to rely on another resource if you plan to deploy many of these solutions.
Intrusion Prevention and Active Response is very good for anyone looking to secure their hosts and/or network. Some sections can become a bit tedious at times as they include packet captures, traces, and other highly detailed and technical information. I am not sure that showing a page full of a packet capture is too beneficial. I would rather see this replaced with CD-ROM that can simulate such events. Aside from this caveat, the treatment and background information on IPS is very strong.
I recommend this book to anyone considering deploying IPS systems or simply want to learn more about the differences between intrusion detection and intrusion prevention. As one of the few books focusing strictly on IPS, I think any security manager or system administrator can find some useful tidbits inside.
false positives and negatives are the problemReview Date: 2005-04-10
The strongest configuration is to put an IPS inline. So that it sits between the Internet and your computers. It parses the network traffic at any or all of the 5 layers, from data link to application. In its most intensive incarnation, it can analyse application layer data and modify these before passing them on. Plus, of course, it can block suspects attack messages, even in a zero-day mode.
The discussion is fairly technical. A good prior knowledge of UDP and TCP is needed to make sense of much of the text.
The book is also careful to warn of the pitfalls of using an IPS, especially inline. False positives and negatives. It is very hard to correctly find all the attacks. That is, to be able to implement a robust rule set to remove attacks from the traffic.
Intrusion Prevention HelpReview Date: 2005-04-05
Host and network protection solutionsReview Date: 2005-09-11
It would have been relatively easy to write a book that simply covered one facet of the IPS product space, such as network IPS systems. However, the authors have chosen to try and write a comprehensive overview of the tools currently available for both the network and the host, as well as ways in which they can be attacked and the scenarios they work in. While the book focuses on open source tools, including the Snort IPS extensions, the techniques apply to closed source, commercial tools as well.
In general I found Intrusion Prevention to be a decent first book on the subject, although a bit unfocused in its delivery. At times it seems to try and bite off more than it can chew, or go off on a tangent for too long (such as the many pages of nmap options), but in general the book does a fair job of delivering its promise. Through it you'll get a good overview of many of the technologies present in the IPS marketspace and what they offer. If you're up to it, you'll even learn a few ways to test the tools and weed out the snake oil vendors.
The book is heavy on actual system output and configuration examples. I like the explicit packet captures and snort rules, I think they go a long way towards illustrating the premise of an IPS system. As is somewhat common with Syngress press books, the formatting is a bit off at times (sometimes it's too wide or slips over the page boundary at the wrong time), but if you can work past that you're rewarded with a useful example.
For host-based IPS solutions, the book covers a number of approaches that aren't always evident as IPS techniques. Various stack protection mechanisms, including LD_PRELOAD techniques like Libsafe, GCC modifications such as StackGuard, and kernel modifications like LIDS, PaX, RBAC and GrSecurity are all described.
By now you can see that the book is pretty Linux and open source centric. This isn't too bad at all, since the basic functionality is present in most of the commercial tools, as well. These can include inline network data modification and reactions or application integrity checking tools. The open source versions, while they sometimes have fewer features, are excellent representatives of this technology.
The book really comes together in chapter 8, 'Deploying Open Source IPS Solutions.' Several vulnerable systems are set up, deployed in a fictitious network, and protected through a variety of IPS solutions which work together to create a layered security model. If the network can detect the attack, it's dropped or modified to remove the offending bits. If the malicious data gets through to the host, the host-level IPS tools remediate the problem. All in all a nice example chapter.
The discussion on how to evade IPS devices was a bit lacking, unfortunately. It seems squeezed in, and doesn't have the same level of detail as other chapters on similar topics. Detailed descriptions of the layer 3, 4 and application layer obfuscation techniques would have been useful to help explain this complex topic.
Before you begin thinking that the authors are entirely gung-ho on IPS technologies, they spend a long time discussing how they can be fooled and how they are fundamentally prone to false positives. This tempered stance is valuable, and they recommend that you take a limited set of functionality from your IDS system and make it reactive in your IPS.
There are only a couple of books that cover IPS technologies to any significant degree, and this appears to be the only one solely devoted to discussing IPS approaches for both the host and network. To that end, the authors have done a pretty good job of introducing the reader to what an IPS can give them, how to evaluate it, and what to expect in the real world. While the book itself has some production and layout problems, the material is worthwhile and will give the reader much-needed advice.

Used price: $11.98
Collectible price: $22.95

RV Electrical Systems: A Basic Guide to Troubleshooting, Repairing and ImprovementReview Date: 2007-04-10
Rv InfoReview Date: 2007-10-22
Easy to understand in plain english!Review Date: 2006-05-13
RV electrical guideReview Date: 2007-02-12
Easy-to-understand information for do-it-yourselfersReview Date: 2006-02-18

Used price: $42.72

GoodReview Date: 2008-08-08
However, I now think the techniques depend on reasonably stable fincial markets, and after the emerginging crises starting in the summer of 2007, I have decided not to prusue this farther.
Theoretical framework with no practical examples.Review Date: 2005-01-19
As it currently stands the book can only benefit the super-genius-theoretical types who do not need to see examples to understand OR someone who ALREADY really understands the concepts.
The book rather frequently presents variables or constants without explicitly defining them for the reader (it assumes we know what they mean from the accompanying discussion).
The book gives exercises, but without answers what good are these?
The one thing the book does is make you realize there is a lot you do not know. You can find ideas in portfolio management that exist by reading this book but if you are at all like me you are going to have to look elsewhere for the answers. I have had better luck with Google searches for stuff like Style Analysis.
The book shows how smart the authors are: they know stuff that must of us do not. Unfortunately this is the feeling I get as I read sections of their book. They intend to keep it this way. Bottom line: the book fails to bridge the gap between theory and practice.
This is the seminal text for Quantitative FinanceReview Date: 2004-11-11
One to add to your reading listReview Date: 2007-06-30
Sadly, though not enough money managers embrace what this book is trying to say with regards to risk and return.
Practical approach and mathematically rigorous at the same timeReview Date: 2006-02-01

Used price: $16.92

Excellent resourceReview Date: 2008-09-29
The typewriter or the computer? Your choiceReview Date: 2008-09-12
GreatReview Date: 2008-05-15
Equals Worst ResultsReview Date: 2006-12-09
Example: This 2005 edition of BEST PRACTICE continues to laud the 1989 reforms in math education (read: Connected Math) set forth by the National Council of Teachers of Mathematics, yet within the last two months the NCTM issued headline-making changes in its recommendations to math teachers, effectively retracting its pro-CMP policy in favor of a more traditional approach. Again, this happened because schools and parents recognized the harm wrought by ten years of CMP and its "student-centered" philosophy. Alas, they didn't see it in time to prevent a decade's worth of damage. Why? Because they were sold a bill of goods by the American education establishment, which abandoned substantive learning ages ago in favor of shallow pop-psychology, fad-chasing, and sophism.
I can attest to the failure of Whole Language, another gimmick foisted on America's children in the name of cutting-edge reform. Today's high-school juniors and seniors were first taught to read and write in the mid-1990s, during Whole Language's heyday, and it shows: their writing suffers from rampant spelling and syntax errors, and many students have trouble comprehending what were once standard high-school-level texts like The Scarlet Letter. Worse, they are easily frustrated and resentful for having any reading material outside their narrow self-interest assigned to them, no doubt because the student-centered movement has made them complacent and, ironically, disinterested in reading about cultures, time periods, and experiences unlike their own.
The authors present the standards proposed by numerous education think-tanks and associations as if they were above reproach. The NCTM example alone proves they're not; and as Diane Ravitch notes in her book The Language Police, the 1996 NCTE-IRA standards for teaching English were so bad the Clinton Administration temporarily withdrew funding for the project before it was published. The NCTE in particular is as much a political association as a professional one; it does not welcome or tolerate dissenting views, and it therefore does not speak for all, or even a majority of, the nation's English teachers.
There is nothing wrong with classical teaching. I'll take rote-memorization, seat work, and lecturing over the "experiential," "active," "hands-on learning" drivel so ardently promoted by today's education apostates. It gets results, and it doesn't have to be boring, either, not if it's taught by someone who cares about students and knows their subject-matter thoroughly. Zemelman et al know this, which is why they are so contemptuous of anything remotely traditional occurring in the nation's classrooms; where would their careers be if traditional teaching methods were widely validated over the new nonsense? It's also the reason why they obfuscate their assertions with pseudo-scientific studies--all of which are as vulnerable to selective interpretation and flakiness as is medical research--not to mention pseudo-scientific language. To my mind, manipulative jargon like "constructivist learning" and "triangulated assessment" does more to reveal the dishonest agenda and desperate aspirations of today's educrats than it does to legitimize their authority.
Teachers--i.e. working classroom teachers, not theorists and pedagogues--should do what works best for them and their students. The more we submit to crass opportunists and smug politicos, the more we give up our intellectual integrity in favor of "research-based" gimmickry, the more our entire profession suffers.
Best Practice,Third Edition: Today's Standards for Teaching and Learning in America's SchoolsReview Date: 2006-08-06

Used price: $12.24

Kevlar CanoeReview Date: 2008-01-23
Excellent resourceReview Date: 2007-08-28
The use of common materials to create a high quality canoe is insightful, inexpensive and the directions are easy to follow. Concepts are explained well, with plenty of pictures and should make the process easy to replicate.
Overall this book is very well done and a valuable guide for anyone wanting to build their own boat.
Interesting book but method is not for meReview Date: 2005-11-29
After reading the book, I realized this method of building would be too expensive for me (due to Kevlar costs).
Well put togetherReview Date: 2002-01-13
DIY Kevlar Canoe... and it is so easyReview Date: 2003-05-08

Used price: $8.50

Laser SailingReview Date: 2008-09-10
There are better choicesReview Date: 2008-08-11
Great book!Review Date: 2007-04-29
Laser LearnerReview Date: 2007-03-09
DisappointingReview Date: 2003-05-15
As well as being very dated (it seems all the photos were taken in the 70's) subjects as vital as tacking is explained in four bullet points, with no photos.

Used price: $50.00

Design of Analog Filters Review Date: 2008-05-30
Also, I recommend "Introduction of Modern Network Synthesis" by M. E. Van Valkenburg as a companion book.
Not as good as the original.Review Date: 2007-09-30
ExcellentReview Date: 2007-05-14
Strong in FundamentalsReview Date: 2002-07-16
one of the best books on the subjectReview Date: 2003-04-09

Used price: $1.81

Buy before your RVReview Date: 2007-06-12
Interested in RVing...Review Date: 2006-09-24
First timers to own an RVReview Date: 2006-08-03
Lots of basics. Some TOO Basic.Review Date: 2006-12-17
In its defense, it does give a general overview of black and grey water tanks and basics about hitches and the types of RVs that exist and I'm sure the authors meant well. But there are some really dumbed-down instructions about ordinary things you already know about. Its almost insulting. There are much better books out there that dont assume you are mentally challenged!
Enjoyable and fast readingReview Date: 2003-01-04

Used price: $2.99

Finding the Right WordsReview Date: 2007-04-20
Most of it seems rather routine, but it may be a life-saver to a new bride faced with umpteen thank you notes to write for all the gifts.
Beyond the standard, social thank yous, it shows sample thank you notes for members of your family. I like the idea of writing a note telling them why they are special in our life.
She made one suggestion that irked me, to start a thank you chain letter. There's a ton of those on the internet and most people find them pretty annoying. Otherwise, the book had good ideas, although none really exceptional. It's just handy to have it all together.
Good concept for a book, but suggestions are a little cheesyReview Date: 2007-03-13
it's okayReview Date: 2006-12-30
ThanksReview Date: 2006-02-05
disappointedReview Date: 2006-07-27

Used price: $64.00

Boo, Osterbrock.Review Date: 2008-10-12
Very good treatment of Plasma ionizationReview Date: 2008-05-25
The diagrams are updated from the older version as well.
More extensive indexes and other new material make it also a good long term reference book.
Mi platonico amor por las nebulosasReview Date: 2000-03-31
Mi platonico amor por las nebulosasReview Date: 2000-03-31
I could never get into this book.Review Date: 2004-04-23
It also has way too many numbers scattered in tables, and you must read the chapter to know what assumptions were made when he calculated those numbers. Our entire class had such a difficult time with homework using this book that I doubt any of us would give a good review of the book.
My own research is in AGN, and for the most part he does OK in explaining them but he can confuse you in comparing them.
Related Subjects:
More Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250
But you'll have a hard time if you're not technically savvy, if you don't master at least the basics of TCP/IP, network and application security, Linux, and even C and Assembler up to a certain extent. It is not written for managers trying to decide what commercial product to choose and purchase.
Be prepared for some in depth, geek stuff. The build-up and organization is logical and obvious. A good and detailed first four chapters explain why you should go for IPS', what they are, what they will do and what they will not. This `introduction' is followed by 3 chapters (about 170 pp.) detailing, with all technical details, examples, code samples and such, what attacks an inline IPS may thwart, how these attacks work. This part is really in depth, and in some points is a very good complement to the mandatory reading of Hacking Exposed. In particular, I really liked Chapter 6, were the inner workings of a buffer overflow are explained. Then again, be prepared to drill down to the stack pointers, processor registers and all that good stuff. After all, exploiting buffer overflows is not obvious, and so is the understanding of what they are. But the authors manage to explain the actual workings of a buffer overflow, starting from such concepts as process and memory management, the stack pointers - and use a practical example so you can try this at home.
One may want to read it twice, though...
The book concludes with two chapters about Open Source IPS, and Evasion Techniques.
Recommended reading? Yes, definitely for anyone with a good technical basis, wondering what IPS' really are about.
Pros:
- In depth, no blah blah, no big screenshots, no page filling
- Good layout, easily readable large font
- Full of practical examples, code sample, and how-to's. You'll want a Linux box around to try this stuff out
- All chapters end with a summary (normal), but also a checklist (a kind of bulleted complement of the summary), a `solutions fast track', not about solutions (see cons) but rather another topic by topic review. Then comes the commented list of URLs mentioned in the chapter - good to review things and dig further, and a FAQ, giving practical answers to those questions you're still wondering about.
- Not commercial - the whole discussion is based on Snort, Netfilter, and zillions of readily available hacking tools and Linux add-ons
Cons:
- Syngress probably hired some marketing guy who felt it was absolutely necessary to include all sorts of buzzwords and frills: chapters are `Solutions'. This book is about explaining and understanding, not about solutions. Little checked marks, the Syngress URL on every page, `Notes from the Underground' boxes. Underground? Yeah, that must sound cool... All rather pointless and distracting. Minus one star for this.
- Nothing about commercial products. Everything is based on Open Source. While that makes it easy to test things out, most readers would still appreciate an additional chapter covering some pros and cons of the major products out there. Even when it comes to compare them to Snort.
All in all, great job, great book, interesting but at times demanding reading. Next recommended reading? Snort 2.1 Intrusion Detection, from Syngress as well.