Overcome Your Fastest-Growing Security Problem: Internal, Client-Based Attacks

Today's most devastating security attacks are launched from within the company, by intruders who have compromised your users' Web browsers, e-mail and chat clients, and other Internet-connected software. Hardening your network perimeter won't solve this problem. You must systematically protect client software and monitor the traffic it generates.

Extrusion Detection is a comprehensive guide to preventing, detecting, and mitigating security breaches from the inside out. Top security consultant Richard Bejtlich offers clear, easy-to-understand explanations of today's client-based threats and effective, step-by-step solutions, demonstrated against real traffic and data. You will learn how to assess threats from internal clients, instrument networks to detect anomalies in outgoing traffic, architect networks to resist internal attacks, and respond effectively when attacks occur.

Bejtlich's The Tao of Network Security Monitoring earned acclaim as the definitive guide to overcoming external threats. Now, in Extrusion Detection, he brings the same level of insight to defending against today's rapidly emerging internal threats. Whether you're an architect, analyst, engineer, administrator, or IT manager, you face a new generation of security risks. Get this book and protect yourself.

Coverage includes



Architecting defensible networks with pervasive awareness: theory, techniques, and tools
Defending against malicious sites, Internet Explorer exploitations, bots, Trojans, worms, and more
Dissecting session and full-content data to reveal unauthorized activity
Implementing effective Layer 3 network access control
Responding to internal attacks, including step-by-step network forensics
Assessing your network's current ability to resist internal attacks
Setting reasonable corporate access policies
Detailed case studies, including the discovery of internal and IRC-based bot nets
Advanced extrusion detection: from data collection to host and vulnerability enumeration

About the Web Site Get book updates and network security news at Richard Bejtlich's popular blog, taosecurity.blogspot.com, and his Web site, www.bejtlich.net.