Essential Computer Security

Rating:

Description

• Well-written and researched history of surveillance techniques over the past century
• Food for thought- conveniences like credit cards and cell phones also monitor your actions
• May seem paranoid or conspiracy theorist at times, but this book is a compelling read

From slave passes used to track and monitor the whereabouts of slaves in the mid 1800’s through to post 9/11 advances in technology this book explores the constant struggle to balance security with privacy.

It often happens in computer security that the features and functionality provided to make tasks easier to do and help users be more productive can also be turned against them and open up avenues for attackers to exploit their systems.

Similarly, the very gadgets we use on a daily basis to help us be more efficient and provide us convenience can be used to monitor us. Every time you use a credit card there is a time / date stamp certifying your location at that point in time. Many cell phones are equipped with GPS functionality that can pinpoint your location at any given time.

It is tough not to be paranoid when reading this book. Most of the things used to “track” you also make life easier and possibly safer. But, this book gives you a lot to think about. Read this book.

Christian Parenti takes a potentially dry subject and makes it compelling. He provides a detailed history of surveillance in America- from the slave era through post 9/11. What you learn about how gadgets and conveniences you use everyday can also be used to monitor you may frighten you. A great read.

Buy it here: The Soft Cage: Surveillance in America From Slavery to the War on Terror

Rating:

The Bottom Line

• Excellent resource to prepare for this exam
• Great resource for information security concepts
• Practice questions and exams help you prepare

• None

Description

• The information in the book prepares you for the exam material and then some
• Study Strategies, Key Terms, Notes, Warnings and Fast Facts are used to reinforce the information
• The topics covered in the book are done so in a manner that will benefit anyone- testing or not
• Valuable resource for preparing for other security exams as well- CISSP, Security+, etc.

Review: TICSA Training Guide

Rating:

The Bottom Line

• Introduction to Platform for Privacy Preferences
• Syntax and examples to code P3P
• Style is easy to read and follow

• Good overview, but just scratches the surface

Description

• The first book to actually show developers HOW to write code to create a P3P compliant web site
• The style of following fictional characters helps the reader put the issues in perspective
• Illustrates that what some consider a “feature” others consider a violation of privacy
• Good information on spam, cookies, log files and web bugs to help readers understand these terms

Review: Web Site Privacy With P3P

• Real-world scenarios help define the issue
• Bridges the gap from theory to practice
• Good resource for administrators

• Some advice and techniques are a little dated
• Focuses a little too heavy on cryptography

Description

• Case studies are an excellent way to get readers to relate the theory to real-world implementation
• Good detailed description of some well-known viruses and worms, but nothing recent
• Well-written book with many useful references to other writings if you want more detail
• Covers most areas that a security administrator needs to be aware of- but predates IDS
• Good “how-to” reference that explains how to implement various security tools and devices

Review: White-Hat Security Arsenal

The Book

The book is laid out nicely, moving from basics to more advanced topics in a way that allows the reader to keep up.The first few chapters define the scope of the book and establish a framework for the rest of the information. Chapters four and five provide a more detailed view of incident response and spell out a variety of techniques and methods to use built-in features of the Windows operating system to prevent attacks.

Carvey walks the reader through an array of tools and utilities that can be used to collect forensic evidence. He describes what he feels are the pros and cons of each and provides a number of URL’s so the reader can find the tools and do their own testing to find out which ones work for them.

In chapter 7, Carvey tells you how to look under the hood and see what makes Windows tick. He explains where to look in Windows for forensic evidence, explaining the files and folders that typically give away an attack, and the tools and methods to detect it.

The final chapters discuss Carvey’s Forensic Server Project (FSP), different scanners and sniffers, and how to use PERL, Carvey’s script language of choice, in a Windows environment.

My Review

About a year ago I was investigating a system to try and determine if it was attacked, as well as when and how if it had been. I wrote for help to a list that I am on and Harlan Carvey responded with detailed and useful information that helped me out.I asked Carvey at the time if there were a book I could get that would help me learn that stuff and he told me that he didn’t want to be cocky per se, but that there really wasn’t and that I would have to wait until his book came out. Now that I have it I think I would have to agree.

There are plenty of great books on computer forensics available, but none that go into the depth that Carvey does on the Windows operating system itself. The information he provides regarding how and where Windows hides information is invaluable for finding and recovering from an attack.

Carvey makes extensive use of PERL, rather than using the native Windows Scripting Host (WSH), and he explains that PERL is vastly more flexible and powerful than what Windows has to offer. He provides details for how to install it and the scripts from the book are on the accompanying CD.

I highly recommend this book for ALL Windows system administrators and anyone who investigates incidents on Windows systems.