Implement an around-the-clock network surveillance system with an authorized self-study guide Organizations continue to deploy firewalls as their central gatekeepers to prevent unauthorized users from entering their networks. However, network security is in many ways similar to physical security in that no one technology serves all needs-rather, a layered defense provides the best results. Organizations are increasingly looking to additional security technologies to counter risk and vulnerability that firewalls alone cannot address. Network-based intrusion detection systems (IDSs) provide around-the-clock network surveillance. The Cisco Secure Intrusion Detection System (CSIDS) is a real-time, network-based IDS designed to detect, report, and terminate unauthorized activity throughout a network. Based on the official instructor-led training course of the same name, Cisco Secure Intrusion Detection System provides a clear explanation of why network security is crucial in today's converged networking environment, how CSIDS improves the security on a network, and how to install and configure CSIDS. Following the course outline and enhanced with real-world case studies, this book is divided into seven parts: In Part I, you are exposed to how networks are attacked, along with ways to secure networks. This leads into Part II, which provides an explanation of the components of CSIDS and how they fit into a secure network design. The installation of CSIDS is examined in Part III. Part IV discusses the management of alarms. Normal traffic generates many alarms, both from actual attacks as well as false positives. Without proper management, this flood of alarms can render the IDS ineffective. Part IV also explains how the various types of alarm signatures are classified, along with the severity levels that can be associated with an alarm signature. Part V analyzes the configuration of the major features of CSIDS. This information allows you to configure your CSIDS in an efficient manner, thus providing the best security for the network. Part VI looks at the configuration of the Cisco Secure Intrusion Detection Director (CSIDD) platform, as well as the Cisco IOS(r) Firewall IDS. This book concludes with Part VII on upcoming features and enhancements planned for the CSIDS. Whether you are preparing for the Cisco Security Specialist 1 certification or simply want to understand and make the most efficient use of intrusion detection systems, Cisco Secure Intrusion Detection System provides you with a complete solution for designing, implementing, and managing CSIDS networks. Official study materials for the Cisco Security Specialist 1 IDSPM exam Provides a comprehensive reference for the design, deployment, and management of the Cisco Secure Intrusion Detection System Understand the basic concepts of network security and the Cisco Security Wheel Learn about the concept of intrusion detection, the philosophy behind various IDSs, and the major components of the CSIDS Evaluate CSIDS Sensor deployment by using both 4200 Series Sensors and Catalyst 6000 IDS modules to determine where to place sensors in your network Install and configure CSPM as a Director platform to manage your CSIDS Sensors and analyze alarm information Examine the multitude of signatures supported by CSIDS and understand how to effectively manage CSIDS alarms Configure the major features of CSIDS, including IP blocking, sensor configuration, and signature filtering Install and configure the Cisco Secure ID Director platform, the configuration management utility, and the Cisco IOS Firewall IDS Examine feature updates and performance enhancements planned for the Cisco Secure IDS product line Earl Carter is a Security Research Engineer and member of the Security Technologies Assessment Team (STAT) for Cisco Systems, Inc.(r), where he performs security evaluations on numerous Cisco products, including everything from the PIX(r) Firewall and VPN solutions to Cisco CallManager and other VoIP products. Earl started with Cisco doing research for Cisco Secure Intrusion Detection System (formerly NetRanger) and Cisco Secure Scanner (formerly NetSonar).

Table of Contents:
I. INTRODUCTION TO NETWORK SECURITY. 1. Need for Network Security. Security Threats. Security Concepts. The Phases of an Attack. Attack Methodologies. Network Attack Points. Hacking Tools and Techniques. 2. Cisco Security Wheel. Securing the Network. Monitoring Network Security. Testing Network Security. Improving Network Security. II. INTRUSION DETECTION AND THE CSIDS ENVIRONMENT. 3. Intrusion Detection Systems. IDS Triggers. IDS Monitoring Locations. Hybrid Characteristics. 4. Cisco Secure IDS Overview. System Function and Features. Sensor Platforms and Modules. Director Platforms. Cisco Secure IDS and the PostOffice Protocol. III. CSIDS INSTALLATION. 5. Cisco Secure IDS Sensor Deployment. Preparing for Deployment: Analyzing Your Network Topology. Executing the Deployment: Sensor Installation Considerations. 6. Cisco Secure Policy Manager Installation. CSPM Overview. CSPM Installation Requirements. CSPM Installation Settings and Options. Starting CSPM. 7. 4200 Series Sensor Installation Within CSPM. Understanding the Sensor Appliance. Configuring the Sensor Bootstrap. Adding a Sensor to a CSPM Director. IV. ALARM MANAGEMENT AND INTRUSION DETECTION SIGNATURES. 8. Working with Cisco Secure IDS Alarms in CSPM. Managing Alarms. Customizing the Event Viewer. Preference Settings. Connection Status Pane. 9. Understanding Cisco Secure IDS Signatures. Signature Definition. Signature Classes. Signature Types. Signature Severity. 10. Signature Series. IP Signatures (1000 Series). ICMP Signatures (2000 Series). TCP Signatures (3000 Series). UDP Signatures (4000 Series). Web/HTTP Signatures (5000 Series). Cross-Protocol Signatures (6000 Series). String-Matching Signatures (8000 Series). Policy-Violation Signatures (10000 Series). V. CSIDS CONFIGURATION. 11. Sensor Configuration Within CSPM. CSPM Sensor Configuration Screens. Basic Configuration Changes. Log File Configuration. Advanced Configuration Changes. Pushing a New Configuration to Your Sensor. 12. Signature and Intrusion Detection Configuration. Basic Signature Configuration. Signature Templates. Signature Filtering. Advanced Signature Configuration. Creating ACL Signatures. 13. IP Blocking Configurations. Understanding ACLs. ACL Placement Considerations. Configuring the Sensor for IP Blocking. 14. Catalyst 6000 IDS Module Configuration. Understanding the Catalyst 6000 IDS Module. IDSM Ports and Traffic Flow. Capturing Traffic. Configuration Tasks. Updating IDSM Components. Troubleshooting. VI. CISCO SECURE INTRUSION DETECTION DIRECTOR (CSIDD). 15. Cisco Secure ID Director Installation. Director Software Installation. Starting the Director. Sensor Configuration. 16. The Configuration File Management Utility (nrConfigure). Working with nrConfigure. Host Types for Add Host Wizard. Connecting to a Previously Configured Sensor. Verifying That the Sensor Is Added to nrConfigure. Verifying That the Sensor Is Added to the Cisco Secure IDS Submap. Deleting a Sensor. Removing the Sensor Icon. Working with the Configuration Library. 17. Cisco IOS Firewall Intrusion Detection System. Cisco IOS Firewall IDS and Intrusion Detection. Supported Router Platforms. Deployment Issues. Signatures. Configuration Tasks. VII. CISCO SECURE IDS UPCOMING RELEASES. 18. Planned Cisco Secure IDS Enhancements. Version 3.0. Version 4.0. Sensor Enhancements. Cisco Secure IDS-User-Defined Signatures. VIII. APPENDIXES. Appendix A: Deploying Intrusion Detection: Case Studies. Using Cisco IOS Firewall IDS. Sending SYSLOG Data to a Cisco Secure IDS Sensor. Managing a Router with a Cisco Secure IDS Sensor. Cisco Secure IDS Tiered Director Hierarchy. Setting Up Multiple IDSM Blades in the Same Chassis. Appendix B: Cisco Secure IDS Architecture. Cisco Secure IDS Software Architecture. Cisco Secure IDS Communications. Cisco Secure IDS Commands. Cisco Secure IDS Directory Structure. Cisco Secure IDS Configuration Files. Communications. Appendix C: Cisco Secure ID Director Basic Troubleshooting. Director Problems. Sensor Problems. Oracle Problems. Data Management Package Problems. nrConfigure Problems. Online Help and NSDB. Appendix D: Cisco Secure IDS Log Files. Levels of Logging. Log File Naming Conventions. Log File Locations. Closing Active Files. Archived Log Files. Event Record Fields. Appendix E: Advanced Tips 749. Correcting a Sensor That Does Not Sniff. Using the Sensor COM Port for Console Access. Excluding False-Positive Alarms. Appendix F: Cisco Secure IDS Signature Structures and Implementations. Appendix G: Cisco Secure IDS Signatures and Recommended Alarm Levels. General Signatures. Connection Signatures. String Signatures. ACL Signatures. Appendix H: Cisco IOS Firewall IDS Signature List. Information Signatures. Attack Signatures. Appendix I: Cisco Secure Communications Deployment Worksheet. Appendix J: Glossary. Appendix K: Answers to Review Questions.