- Shopping Bag ( 0 items )
Ten baseline areas for evaluation are covered in detail. The tools and examples detailed within this book include both Freeware and Commercial tools that provide a detailed analysis of security vulnerabilities on the target network. The book ends with guidance on the creation of customer roadmaps to better security and recommendations on the format and delivery of the final report.
* There is no other book currently on the market that covers the National Security Agency's recommended methodology for conducting technical security evaluations
* The authors are well known in the industry for their work in developing and deploying network security evaluations using the NSA IEM
* The authors also developed the NSA's training class on this methodology
Posted November 12, 2005
Companies that admit that they have an information security problem, is the first step toward a solution. If you are one of those companies, this book is for you! Authors Russ Rogers, Ed Fuller, Greg Miles, Matthew Hoagberg, Travis Schack, Ted Dykstra, Bryan Cunningham and Chuck Little, have done an outstanding job of writing a book that will help the majority of experienced INFOSEC professionals in the industry find the optimum security solution for their respective organization. Rogers, Fuller, Miles, Hoagberg, Schack, Dykstra, Cunningham and Little, begin by helping you understand what the IEM is intended to address, why this type of work is requested, where it could potentially be applied, and the phases into which IEM is organized. Next, the authors focus on those activities that occur prior to the start of the evaluation. Then, they delve into one of the most critical preparation aspects of doing any evaluation: assessing customer expectations, the tangible and intangible factors, that will affect the outcome of the evaluation. The authors continue by discussing the components and activities of the scoping process that will give you the majority of the information needed to do an effective and efficient job during the evaluation process. In addition, the authors next provide an overview of a number of legal issues faced by information security evaluation professionals and their customers. They also discuss the various aspects of the TEP and some of the things you want it to accomplish. Next, the authors discuss the framework of the on-site evaluation phase, where the meat of the technical evaluation occurs. Then, they discuss the network discovery portion of the onsite evaluation phase. The authors continue by covering the vulnerability scanning and host evaluation portions of the IEM. In addition, the authors then cover the remainder of the scanning, or hands-on, portion of the IEM. They also discuss the out-brief meeting that you'll hold with the customer. Next, the authors walk you through the process of categorizing , consolidating, correlating, and consulting, to develop practical and effective solutions for the customer. Then, they cover the sources of finding information and how this information can be put into a single chart that the customer an use as a road map to improving their security posture. The authors continue by identifying some type of metrics that will be needed to readily identify the current security posture. They also cover the presentation of the final report. Finally, they sum up the entire book. With the preceding in mind, the authors have also done an excellent job of writing a book that addresses the process-level security issues along with the technical findings, so that you can improve your chances to mitigate problems before they occur. So, in the end, all of these pieces can come together to create a custom and valuable security solution for your customer!Was this review helpful? Yes NoThank you for your feedback. Report this reviewThank you, this review has been flagged.