Prevent security breaches by deploying CSA, the Cisco host intrusion prevention system - Learn the basics of endpoint security and why it is so important in today's security landscape - Protect endpoint systems from hackers, viruses, and worms with host intrusion prevention security - Prevent "Day-Zero" attacks with the first book on Cisco Security Agent (CSA) deployment Endpoint systems, being the point of execution for the malicious code, is where the most effective counter-intrusion mechanisms should be placed. Cisco Security Agent (CSA) is an important part of the network security puzzle that can help organizations secure their end systems. Its many capabilities include preventing "Day Zero" worm attacks, end system virus attacks, and Trojan horses; acting as a distributed firewall; performing an operating system lockdown; and performing application control. With the vast array of features, capabilities, and complexities associated with CSA, users need expert guidance to help them implement and maintain this important new security device and use it to maximum effect. This book presents a detailed explanation of CSA, illustrating the use of the product in a step-by-step fashion. The book presents a complete view of host intrusion prevention with CSA, including basic concepts, installations, tuning, and monitoring and maintenance. Part I discusses the need for end point security. Part II helps readers understand CSA building blocks. Part III delves into the primary concern of new customers, that being installation. Part IV covers monitoring and reporting issues. Part V covers CSA analysis features. Part VI discusses creating policies and CSA project implementation plans. Maintenance is covered in Part VII. Chad Sullivan is a triple-CCIE (Security, Routing/Switching, SNA/IP) and a systems engineer for Cisco Systems. Focusing predominantly on security in recent years, he is a member of the Security and VPN Virtual Teams at Cisco.

Table of Contents:
Foreword Introduction Part I   The Need for Endpoint Security Chapter 1   Introducing Endpoint Security Chapter 2   Introducing the Cisco Security Agent Part II   Understanding the CSA Building Blocks Chapter 3   Understanding CSA Groups and Hosts Chapter 4   Understanding CSA Policies, Modules, and Rules Chapter 5   Understanding Application Classes and Variables Part III   CSA Agent Installation and Local Agent Use Chapter 6   Understanding CSA Components and Installation Chapter 7   Using the CSA User Interface Part IV   Monitoring and Reporting Chapter 8   Monitoring CSA Events Chapter 9   Using CSA MC Reports Part V   Analyzing CSA Chapter 10    Application Deployment Investigation Chapter 11    Application Behavior Analysis Part VI   Creating Policy, Implementing CSA, and Maintaining the CSA MC Chapter 12    Creating and Tuning Policy Chapter 13    Developing a CSA Project Implementation Plan Chapter 14    CSA MC Administration and Maintenance Part VII   Appendixes Appendix A   VMS and CSA MC 4.5 Installation Appendix B   Security Monitor Integration Appendix C   CSA MIB Index