Monday, March 13, 2006

Review of Sarbanes-Oxley IT Compliance Using COBIT and Open Source Tools Posted

Amazon.com just posted my four star review of Sarbanes-Oxley IT Compliance Using COBIT and Open Source Tools. From cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 review:

I read Sarbanes-Oxley IT Compliance Using COBIT and Open Source Tools (SOICUCAOST) to learn more about compliance issues. I am a security engineer who thankfully has not had to suffer through a SOX audit. I am glad I read SOICUCAOST, however. The book is clear, well-written, and makes innovative use of a live CD. While cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 book is not cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 answer to SOX compliance (no book is), small-to-medium-sized businesses will find SOICUCAOST a valuable guide.

Bejtlich Teaching NSM at USENIX 2006 in Boston

If you'd like to see me teach material related to my first book, please register for USENIX 2006 (cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Annual Technical Conference). I'll be presenting Network Security Monitoring with Open Source Tools all day on Friday, 2 June 2006 in Boston, MA.

I'll probably fly in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 previous day, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n attend Gerald Carter's half-day presentation Ecá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365real and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Art of Debugging Networks. I may stay for Dan Geer's class on Saturday -- Measuring Security.

Seats are filling for my only public Network Security Operations class in Fairfax, VA, 13-16 June 2006. Contact me via email (richard at taosecurity dot com) before 1 April to get cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 best rate!

Review of Security Log Management Posted

Amazon.com just posted my three star review of Security Log Management. From cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 review:

When I received a review copy of Security Log Management (SLM) last month, I was eager to read it. I saw two very powerful but seldom discussed tools -- Argus and Bro -- mentioned in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 table of contents. This indicated some original thinking, which I appreciate. Unfortunately, SLM did not live up to my expectations. When you strip out cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 pages of scripts and code and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 three reprinted chapters, you're left with a series of examples of output from cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 author's deployment of several tools. Aside from a few examples mentioned in this review, I don't think readers will learn much from SLM.

Sunday, March 12, 2006

Two Pre-Reviews

Two new books arrived at TaoSecurity last week. The first is Software Security: Building Security In by Gary McGraw. This book is available alone or in a boxed set with Exploiting Software and Building Secure Software. I've read cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 second book, so I may try to read Software Security right away. The new book is cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 third in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Addison-Wesley Software Security Series.

At RSA in February Gary told me he wanted Building Secure Software to begin that series, but instead it ended up in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Addison-Wesley Professional Computing Series. The ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r book in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Software Security Series is Rootkits, a book I'm waiting to read. I'd like a little more programming knowledge before trying that one. The second book added to my reading queue is Anti-Hacker Toolkit, 3rd Ed. I reviewed cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 2nd Ed in June 2004 and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 1st Ed in August 2002. I sat down with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 2nd and 3rd editions and did a cursory examination of changes. The major difference is a new chapter, 26, on reverse engineering binaries. Aside from that, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 3rd Ed is structurally identical to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 2nd Ed. A few tools have been added and some have been deleted. Co-authors Chris Davis, Aaron Philipp, and David Cowen have stepped in to help lead author Mike Shema, although material from original authors Keith Jones and Brad Johnson is still present. (Mike Shema is cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 third original author, meaning he, Keith, and Brad wrote cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 1st Ed.)

I have a feeling that my recommendation for cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 3rd Ed will be cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same as for cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 2nd Ed -- if you don't have a copy, get one. Security pros should know how to use most if not all of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 tools in Anti-Hacker Toolkit. Employers -- asking about tools in this book is a great way to start a dialogue with candidate employees. If you have cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 2nd or even cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 1st Ed, however, you probably won't be able to financially justify cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 upgrade.

Review of Skype Me! Posted

Amazon.com just posted my five star review of Skype Me!. From cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 review:

Skype Me! is cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 perfect introduction to Skype for users of all skill levels. It could serve as an example of how to write a product-centric book that delivers real value. The text is well written, clear, and focused. The material becomes progressively complex as cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 reader moves from learning about Skype, to installing it, to using it, to extending it into areas I hadn't previously considered. Anyone who wants to get cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 most out of Skype should read Skype Me!

Sound Familiar?

I found cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 following quote in this story about problems at cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 CIA:

"[Y]ou're getting into cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 problem of very junior, inexperienced people, which a lot of veteran CIA people feel now is part of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 problem. Porter Goss has to double cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 number of operational people in an environment where cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re are no mentors. Who's going to train cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365se people?"

This reminded me of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 problems in information technology. There is far too much infrastructure being operated by far too many inexperienced people who have no mentors.

Review of InfoSec Career Hacking Posted

Amazon.com just posted my two star review of InfoSec Career Hacking. This write-up is for those of you who say I don't write enough negative reviews. I was particularly upset to see 3 of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 book's 12 chapters are reprints. This is a disturbing trend. Syngress is using chapters from older books as filler for new titles that can't stand on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir own. From cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 review:

InfoSec Career Hacking (ICH) is a confused, directionless book. It's a collection of contributions by various authors, three of which were previously published. The main text never states cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 goal of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 text, so I turned to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 description on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 back cover: "A technical guide to landing (and keeping) a job in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 information security field... If you want to refine those skills to land a top InfoSec job and employer-funded trip to Vegas next year, you've come to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 right place." It sounds like ICH wants to be a sort of employment guide for "hackers," but it ends up as a muddle of some useful original material and recycled chapters from older Syngress titles.