Implementing Intrusion Detection Systems, Tim Crothers, 2003

BKIMPIDS.RVW 20030909

"Implementing Intrusion Detection Systems", Tim Crothers, 2003, 0-7645-4949-9, U$40.00/C$62.95/UK#29.95
%A Tim Crothers
%C 5353 Dundas Street West, 4th Floor, Etobicoke, ON M9B 6H8
%D 2003
%G 0-7645-4949-9
%I John Wiley & Sons, Inc.
%O U$40.00/C$62.95/UK#29.95 416-236-4433 fax: 416-236-4448
%O http://www.amazon.com/exec/obidos/ASIN/0764549499/robsladesinterne
http://www.amazon.co.uk/exec/obidos/ASIN/0764549499/robsladesinte-21
%O http://www.amazon.ca/exec/obidos/ASIN/0764549499/robsladesin03-20
%P 316 p.
%T "Implementing Intrusion Detection Systems"

The preface implies that this book is a professional reference for building and maintaining intrusion detection systems (IDSs). I'd say it has a fair way to go before it could make that claim.

Chapter one is an overview of intrusion detection. The basic concepts are all included, but it is often difficult to understand the point that the author is making. Net-based IDS gets a somewhat limited review in chapter two, alongside a very brief introduction to TCP/IP. There are lots of printouts of event and audit logs in chapter three but very little explanation of the basic ideas behind host-based IDS. Chapter four is supposed to tell us how to handle alerts, but the long listings of packet traffic related to specific attacks (and not interpreted particularly well) do not really provide any useful advice on incident response. Chapters five and six raise a number of issues to consider when planning and maintaining an IDS, but the collection of information is neither organized nor exhaustive in terms of the factors which need to be dealt with. Supposedly about tuning, chapter seven is mostly about analysis of logs for an example attack. The scripts involved in installing Snort on Linux are listed in chapter eight.

This work is vague, unstructured, and incomplete. Yes, it would help you get an intrusion detection system running, but it has neither the conceptual depth of either of the two "Intrusion Detection"s, by Amoroso (cf. BKINTDET.RVW) or Bace (cf. BKNTRDET.RVW), the detail of" Intrusion Signatures and Analysis" (cf. BKINSIAN.RVW), nor even the practicality of Koziol's "Intrusion Detection with Snort" (cf. BKINDTSN.RVW).