Network Security Assessment: Know Your Network et plus d'un million d'autres livres sont disponibles pour le Kindle d'Amazon. En savoir plus

Identifiez-vous pour activer la commande 1-Click.
Plus de choix
Vous l'avez déjà ? Vendez votre exemplaire ici
Désolé, cet article n'est pas disponible en
Image non disponible pour la
couleur :
Image non disponible

Commencez à lire Network Security Assessment: Know Your Network sur votre Kindle en moins d'une minute.

Vous n'avez pas encore de Kindle ? Achetez-le ici ou téléchargez une application de lecture gratuite.

Network Security Assessment 2e [Anglais] [Broché]

Chris Mcnab

Prix : EUR 51,08 Livraison à EUR 0,01 En savoir plus.
  Tous les prix incluent la TVA
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o
Il ne reste plus que 3 exemplaire(s) en stock (d'autres exemplaires sont en cours d'acheminement).
Expédié et vendu par Amazon. Emballage cadeau disponible.


Prix Amazon Neuf à partir de Occasion à partir de
Format Kindle EUR 15,13  
Broché EUR 51,08  

Offres spéciales et liens associés

Détails sur le produit

En savoir plus sur l'auteur

Découvrez des livres, informez-vous sur les écrivains, lisez des blogs d'auteurs et bien plus encore.

Dans ce livre (En savoir plus)
Parcourir les pages échantillon
Couverture | Copyright | Table des matières | Extrait | Quatrième de couverture
Rechercher dans ce livre:

Commentaires en ligne 

Il n'y a pas encore de commentaires clients sur
5 étoiles
4 étoiles
3 étoiles
2 étoiles
1 étoiles
Commentaires client les plus utiles sur (beta) 4.3 étoiles sur 5  23 commentaires
20 internautes sur 22 ont trouvé ce commentaire utile 
4.0 étoiles sur 5 A good companion to "Security Warrior" 4 mai 2004
Par Richard Bejtlich - Publié sur
"Network Security Assessment" (NSA) is the latest in a long line of vulnerability assessment / penetration testing books, stretching back to "Maximum Security" in 1997 and "Hacking Exposed" shortly thereafter. NSA is also the second major security title from O'Reilly this year, soon to be followed by "Network Security Hacks." NSA is a good book with some new material to offer, but don't expect to find deep security insight in this or similar assessment books.
NSA begins with the almost obligatory reference to the king of assessment books, "Hacking Exposed" (HE), saying "I leave listings of obscure techniques to behemoth 800-page 'hacking' books." I don't think some of the techniques covered in HE but not NSA are "obscure." Noticably lacking in NSA is coverage of dial-up techniques, wireless insecurities, Novell vulnerabilities, and attacking clients rather than servers. Should NSA receive a second edition, I expect to see the book expand closer to the "behemoth" it seems to deride.
The best chapter by far was ch. 11, where the author with assistance from Michael Thumann takes the reader on a tour of exploiting vulnerable code. The stack diagrams and code snippets were especially helpful and the explanations were clear enough. This sort of material is a solid introduction to some of the techniques found in "Security Warrior." I also liked ch. 14, where the author explains a sample assessment using the tools already introduced. Kudos as well for maintaining an errata page and tool archive on the publisher's Web site.
The advantage NSA has over HE is the variety of tools on hand. I learned of at least a dozen tools not mentioned elsewhere. The author seems to be thorough while listing various exploitable flaws from the last several years. While the prose is well-written, I believe the HE series does a better job communicating fundamentals of the underlying technology. In other words, HE gives better explanations of 'what' we are compromising, while "NSA" prefers to concentrate more on the compromising itself. This technology education aspect of the HE series has always been its strong point. For example, there's no need to read a 500 page book on Microsoft FrontPage to understand the problems with it when a quick look in a HE book explains the technology's basics as well as its security flaws.
It's been over a year since the 4th edition of HE was published, so I recommend buying NSA to freshen your assessment skills. For the scenarios it does cover, which include most UNIX and Windows Internet-based attacks, it is thorough and accurate. Combined with O'Reilly's "Security Warrior," NSA presents an updated picture of the assessment scene.
11 internautes sur 12 ont trouvé ce commentaire utile 
4.0 étoiles sur 5 Systematically understanding network access 3 avril 2004
Par W Boudville - Publié sur
[A review of the 2nd EDITION. This review was written on 3 December 2007.]

Over 3 years has elapsed since McNab wrote his first edition. Much of that edition is still valid. Sadly, in a way, because it means that despite the best efforts of that book and others of its ilk, we remain plagued with network attackers and insecure systems.

One of the constants between the editions is the focus on IPv4. Still! IPv6 only gets a glancing mention in the second edition. While everyone recognises that IPv4 will get exhausted of addresses, the transition to v6 still gets postponed. McNab ruminates that this very transition will of its own accord generate compromises. I wish he'd expand on this remark. But maybe there is yet little market reason to do so.

Another thing that does not get mentioned is phishing. In early 2004, it was still a minor threat. It has since blossomed into a chronic problem. But McNab is correct to ignore it, up to a point. He believes, as apparently does most of the IT security field, that phishing is largely a social engineering problem. That it is not a technical problem of patching bugs, per se. Yet viewed properly, phishing is a network attack that uses social engineering, and it is amenable to technical countermeasures that involve, in part, network actions.

I especially favour this edition, for the reasons in the preceding paragraph. In 2004, I and a co-inventor, Marvin Shannon, devised a US Patent Pending against phishing. The second edition of McNab's book came out in November 2007, and by not discussing phishing, it buttresses our claims of non-obviousness, 3 years after our filing.

[A review of the 1st Edition. This review was written on 3 April 2004.]

A logically very systematic delineation of ways that your system could be attacked over the Internet. There are standard ways to access your computer like rlogin, telnet, ssh and ftp. But each implementation of these faces the risk that an error was made in its coding, which might then be found and exploited by a cracker. Plus, since the advent of the Web, there are Web services that have not checked for the stereotypical but very real case of buffer overflow in submitted input over the network.

McNab describes all these, and more. But perhaps more usefully, his book is not a simple recital of implementation versions and associated known bugs and available patches. He tries instead to guide the reader into understanding the broad ideas in network access, and using a viewpoint of logically analysing for any weaknesses. Because any static listing of versions and bugs runs the risk of being obsoleted in a few years.

He presents web sites that are good resources for patches or latest versions of key programs. If you are concerned about a specific program, try going straight to it in the book and seeing what advice he offers.

For all the programs he mentions, some prior knowledge of their use would be handy. He gives a succinct description of each, but really he assumes you have already used it.
14 internautes sur 17 ont trouvé ce commentaire utile 
5.0 étoiles sur 5 Better than Hacking Exposed 10 avril 2004
Par James Drake - Publié sur
This book is a great resource for any administrator with IP networks to protect. As Wes Boudville says, it certainly is systematic with some great guidelines and useful checklists. The high level concepts laid out by the author make it much easier to understand the underlying issues with security nowadays. Instead of listing bugs and patches, McNab explains the different bug types, and I learnt a lot about stack and heap overflows in the application security chapter.
I'd recommend this book over Hacking Exposed and other books with the word 'hacking' in the title. The assessment material is comprehensive from both Unix and Windows standpoints, and I certainly picked up a bunch of new tricks that I wasn't aware of before. The book has great coverage of all the latest tools and techniques, but written in a timeless way. At just under 400 pages you'll find that it's not too long either!
8 internautes sur 9 ont trouvé ce commentaire utile 
5.0 étoiles sur 5 Comprehensive is an understatement 2 mai 2004
Par Thomas Schneider - Publié sur
The author has managed to pack a serious amount of low-level technical information into this book. In the other penetration testing and hacking books I've read, I haven't yet found one to be as comprehensive as Network Security Assessment--to give you an example this book covers IPsec, Citrix and Oracle issues that I have not seen covered elsewhere in print, let alone in the same book. A downside is that the book is hard to read from cover-to-cover, and should be used more as a reference, and the author does assume a level of reader knowledge. I've just finished reading Shellcoder's Handbook too, and found chapter 13 of this book to be a great technical primer for application level issues (such as heap, stack, integer overflows and format string bugs)--the diagrams are excellent and easy for anyone to understand.
All in all this is a very useful book for both the professional security analyst and systems admin with large networks to protect. The Oreilly site has some good info that you should check out, such as the TOC, index and sample chapter on network scanning ([...]
7 internautes sur 8 ont trouvé ce commentaire utile 
4.0 étoiles sur 5 Covers tools and techniques 2 juillet 2004
Par Dr Anton Chuvakin - Publié sur
"Network Security Assessment" is a fun little book that covers vanilla network security assessment approach from planning to scanning to exploitation (but for whatever reason no reporting and remediation in the end). I liked that the author outlined the methodology first before diving into techniques. Such methodology presents (as it is common in the security arena) a double-edged sword, since it is used by security consultants as well as amateur blackhats.
The book is mostly fun to read (especially when the author is picking on the CIA in his remote information gathering activities). Sometimes though it boils down to listings of known vulnerabilities, some dated, going back to the times of RedHat 5.x and public exploit references. The coverage is pretty comprehensive, includes UNIX and Windows platforms and applications as well as VPN (but not network devices and wireless). I also liked his description of information gathering activities. The book covers most of the commonly used tools such as "nmap" (covering some of the relatively lesser known details of this scanner) as well as touches upon some of the less common such as "scanrand"). Every chapter ends with a brief summary of possible countermeasures to the activities in the chapter.
The book is definitely recommended to people new to the whole security assessment area. I suspect that those involved in the field will pick up some new things as well. For example, I liked that the author emphasizes various brute-forcing tools that can be as handy as the actual exploits when attacking a networked service. Also, I learned a new approach for picking up an internal IP address from behind the NAT by watching for certain ICMP packets.
Anton Chuvakin, Ph.D., GCIA, GCIH is a Senior Security Analyst with a major security information management company. He is the author of the book "Security Warrior" (O'Reilly, 2004) and a contributor to "Know Your Enemy II' (AWL, 2004). His areas of infosec expertise include intrusion detection, UNIX security, forensics, honeypots, etc. In his spare time, he maintains his security portal
Ces commentaires ont-ils été utiles ?   Dites-le-nous

Discussions entre clients

Le forum concernant ce produit
Discussion Réponses Message le plus récent
Pas de discussions pour l'instant

Posez des questions, partagez votre opinion, gagnez en compréhension
Démarrer une nouvelle discussion
Première publication:
Aller s'identifier

Rechercher parmi les discussions des clients
Rechercher dans toutes les discussions Amazon

Rechercher des articles similaires par rubrique


Souhaitez-vous compléter ou améliorer les informations sur ce produit ? Ou faire modifier les images?