End-to-End Network Security: Defense-in-Depth

One of the mistakes many organizations make when it comes to information security is thinking that the firewall will do it all. Management often replies incredulously to a hacking incident with the thought "but don't we have a firewall".Organizations need to realize a single appliance alone won't protect their enterprise, irrespective of what the makers of such appliances suggest and promise. A true strategy of security defense in depth is required to ensure a comprehensive level of security is implemented. Defense in depth uses multiple computer security technologies to keep organizations risks in check. One example of defense in depth is having an anti-virus and anti-spyware solution both at the user's desktop, and also at the gateway.With that, End-to-End Network Security: Defense-in-Depth provides an in-depth look at the various issues around defense in depth. Rather than taking a very narrow approach to security, the book focuses on the comprehensive elements of designing a secure information security infrastructure that can really work to ensure an organization is protected against the many different types of threats it will face on a daily basis.The books 12 chapters provide a broad look at the various ways in which to secure a network. Aside from a minor mistake in chapter 1 where the author confuses encryptions standards and encryption algorithms (but then again, many people make the same mistake), the book provides a clear and to the point approach to the topic at hand. After reading the book, one will have a large amount of the information needed to secure their Cisco-based network.While it is not in the title, the book is completely centered on Cisco hardware, software, and Cisco IOS. It is a Cisco Press title written by a Cisco employee, as you would expect, it has a heavy Cisco slant. For those that do not work in a Cisco environment, the information in the book will likely be far too Cisco centric for their needs. A review of the index shows that the book provides a near A-Z overview of information security. One of the only missing letters is `J', but then again, that would require writing about Juniper.Chapter 1 starts off with a detailed overview of the fundamentals of network security technologies. Chapter 2 details the various security frameworks and methodologies around securing network devices. The six-step methodology that the author writes of is comprised of preparation, identification, classification, traceback, reaction and postmortem.The author mistakenly writes that manual analysis of complex firewall policies is almost impossible because it is very time-consuming. The truth is that the time-consuming aspect does not make it impossible. It can be done, but the author is correct that the use of automated tools makes such analysis much quicker and easier.Chapters 5 and 6 provide an excellent overview of reacting to information security incidents. The chapters cover all of the necessary details, from laws, log finals, postmortem and more.Chapter 9 provides and extensive overview of the various elements of IPT security. It includes various ways to protect the many parts of a Cisco IPT infrastructure. In this chapter and the others, the author does a very good job of detailing the various configurations steps necessary to secure a Cisco device, both at the graphical level and also at the ISO command line level.Chapter 12 concludes the book with 3 case studies of using defense in depth a small, medium and large enterprise networks. Different size networks have different requirements and constraints and are not secured in the same manner.Overall, End-to-End Network Security: Defense-in-Depth is an excellent and comprehensive book on how to secure a Cisco infrastructure. It details the many threats such an environment will face, and lists countermeasures to mitigate each of those threats. Anyone involved in securing Cisco-based networks will find this book to be quite helpful in their effort to secure their network.

The book furnishes a comprehensive understanding of how to secure a network. Firewalls are the first and most common defense. If your network is large enough, then you may or should have several of these, between your internal subnets. And the network routes that face the rest of the internet should have a DMZ.By now, most readers are already aware of the need for firewalls. What you get here are practical steps in installing and managing these. But another key extra is how to maintain virtual private nets. An acknowledgement that many companies have people who need to access securely from outside the corporate network. A VPN can be much trickier to set up, and there is a computational cost to using it.The text also goes into how to handle IPv6 networks, and when these interact with the usual IPv4 networks of the outside world. A bit unclear what is the market demand for these IPv6 nets, thus far. I've nothing against them. But v6 deployment has been much slower than expected. Still, it's good that the book includes them in its discussion.

This book's focus is securing Cisco-based networking infrastructure using IOS features and dedicated Cisco security appliances and tools. Understandably, some products referenced have reached End of Life status, like the CSA and CS-MARS.In the context of CISSP CBK, content applies primarily to "Telecommunications and Network Security", with a sprinkle across some of the other domains. Author skillfully blends together detailed configuration examples, deployment recommendations, several case studies, and articulation of security principles that can apply to any size network or business.If end-to-end network security and defense-in-depth means to you the inclusion of protection against malware, application layer threats, and social engineering, there is little in the book on these topics. However, if you are looking for a one-stop reference on deployment guidance to harden Cisco-based networks along with a comprehensive list of network security protocols, this is a great reference. With a few exceptions it is as much applicable today as when 1st published in 2007.One humorous typo is "Security lifecycle:" in "Contents at a glance", vs. "Security lifestyle:" in "Contents" and on page 41 introducing Part II. Your choice!