CSCI E-170 Reading

Lecture 10: Security Tools

required reading:

Other documents

• Understand the evolution of firewalls - Smith (2002)
• Firewall - Wikipedia
• Deep Packet Inspection - Wikipedia
• Antivirus - Wikipeda
• Sandbox - Wikipeda
• Know your Enemy: Honeynets - Honeynet Project (2006)
• Intrusion Detection FAQ - SANS - skim basics
• Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection - Ptacek (1998)
• Sniffing FAQ - Grahm (2000)
• The AIDE manual - Haber - sections 3 & 8
• Top 125 Network Security Tools - sectools.org (2011) - skim
• Nmap man page - nmap.org - Description & Port Scanning Techniques

optional reading:

RFCs that may be of interest

• Firewall Enhancement Protocol (FEP) - RFC 3093 - Gaynor & Bradner (2001)

Documents that may be of interest

• Guide to Intrusion Detection and Prevention Systems (IDPS) - NIST
• Active Mapping: Resisting NIDS Evasion Without Altering Traffic - Shankar & Paxson
• Smashing The Stack For Fun And Profit - Aleph One
• Chatter on the wire: A Look at DHCP Traffic - Kollmann (2007)
• Chatter on the wire: A look at excessive network traffic and what it can mean to network security - Kollmann (2005)

Books that may be of interest

• Firewalls and Internet Security: Repelling the Wily Hacker, Second Edition - Cheswick & Bellovin
• The Tao of Network Security Monitoring: Beyond Intrusion Detection - Bejtlich