Network Security Auditing (Cisco Press Networking Technology Series)

I am almost done reading this book and its all worth it. As an Information Security Practitioner, my goal why I bought this book is to learn how to think like an Auditor to help me prepare systems for a PCI-DSS, ISO27001, HIPAA and SOC (the new SAS70 Type II Report) audits. Chris Jackson's style of writing makes the topic interesting, specifically the chapter that covers Information Security and the Law. The gem in this book is definitely the focus on how to review Cisco IOS and ASA configuration, rules and policies. As an ITIL fellow, I love how Chris focused on the benefits of implementing best practices and other service-oriented frameworks on your IT infrastructure. I consider the topics about penetration testing such as NMAP and BackTrack a bonus, specifically to IT Generalists or Junior IT Auditors who wants to be aware of the current threat landscape out there. I will definitely wait and purchase Chris Jackson's next Security Book.

The subtitle of Network Security Auditing is the complete guide to auditing security, measuring risk, and promoting compliance. The book does in fact live up to that and is a comprehensive reference to all things network security audit related.In 12 chapters at almost 450 pages, the book covers all of the key areas around network security that is of relevance to those working in information security.As a Cisco Press title, written by a Cisco technical solutions architect, the book naturally has a heavy Cisco slant to it. Nonetheless, it is still an excellence reference even for those not working in a Cisco environment.While the first 3 chapters of the book provide an overview that is great even for a security newbie, the overall style of the book is highly technical and comprehensive.Chapters 1-3 provide an introduction to the principles of auditing, information security and the law, and governance, frameworks and standards. Each chapter is backed with a significant amount of information and the reader is presented with a thorough overview of the concepts.Chapter 3 does a good job of providing the reader with the details of current frameworks and standards, including PCI DSS, ITIL, ISO 17799/27001 and others. Author Chris Jackson does a good job of explaining the differences between them and where they are best used. Given this is a Cisco-centric book, he also shows how the various Cisco security products can be integrated for such regulatory and standards support.Throughout the book, the author makes excellent use of many auditing checklists for each area that can be used to quickly ascertain the level of security audit compliance.Chapter 6 is perhaps the best chapter in the book on the topic of Policy, Compliance and Management, and the author provides an exceptionally good overview of the need for auditing security policies. This is a critical area as far too many organizations create an initial set of information security policies, but subsequently never take the time to go back and see if they are indeed effective and providing the necessary levels of data protection.Jackson notes that accessing the effectiveness of a policy requires the auditor to look at the policy from the viewpoint of those who will interpreting its meaning. A well intentioned policy might recommend a particular course of action, but unless specific actions are required, there is little an organization can expect the policy to actually accomplish to help the organization protect its data assets if it is misinterpreted.The chapter suggests that the auditor ask questions such as: is the policy implementable, enforceable, easy to understand, based on risk, in line with business objectives, cost effective, effectively communicated and more. If these criteria are not well-defined and delineated, then the policies will exist in text only, offering little information security protection to the organization.Jackson also writes of the need to measure how well policies are implemented as part of a security assessment. He suggested using a maturity model as a way to gauge if the organization is in its evolution towards fully integrating security into its business process or if it already has a formal integration process in place.In chapter 8 on Perimeter Intrusion Prevention, Jackson writes that protecting a network perimeter used to be a relatively easy task. All an organization would have to do is stick a firewall on its Internet connection, lock down the unused ports and monitor activity. But in most corporate networks today, the perimeter has been significantly collapsed. If you compound that with increased connectivity, third-party access, and more; and then bring in advanced persistent threats into the equation, it is no longer a simple endeavor to protect a network.Chapter 8 provides detailed framework on how to perform a perimeter design review and assessment. As part of the overall review, the chapter details other aspects of the assessment including the need for reviews of the logical and physical architectures, in addition to a review of the firewall. Jackson also lists a large number of security tools that can be used to during an audit.Chapter 11 covers endpoint protection with a focus on the end-user. Jackson notes that users never cease to amaze with their abilities to disappoint by opening suspicious file attachments, running untrusted Facebook applications, and much more. The book notes that organizations today face significantly higher levels of risk from endpoint security breaches than ever before due to our highly mobile and connected workforce.The chapter details an endpoint protection operational control review that can be used to assess the organizations processes for identifying threats and performing proactive management of endpoint devices. While the chapter is quite Cisco-centric, with references to the Cisco SIO (Security Intelligence Operations) and a number of other Cisco products, the chapter does provide a good overview of the fundamentals of endpoint protection and how to do it the right way.Overall, Network Security Auditing is highly technical and detailed reference that makes for an excellent primary reference on the fundamental of information security. With ample amounts of checklist, coding refences, detailed diagrams and just the right amount of screen shots, Network Security Auditing makes an excellent guide that any technical member of an IT or security group should find quite informative.

I obtained this book at the Sonoran Desert Security User Group (SDSUG) meeting. Network Security Auditing is another excellent book from Cisco Press. As with all Cisco Press publications, it is slanted to CISCO solutions and approaches. However this book is an excellent resource for network security auditors, security network architects, and new network engineers. This book would also be a great reference for someone who is assessing their own network against security deployment best practices.The book is 445 pages and broken into 12 chapters. Chapter 2 does a very good job explaining the various IT security laws and regulations that impact network security. This chapter is a great reference for anyone trying to explain to their management why one must perform security due diligence and what compliance laws effect their industry.IMHO the best parts of this book are the Audit Checklist at the end of Chapters 5 – 12. These checklists are a nice supplement to the NIST SP 800-53A security control assessment. Network Security Auditing checklists re-enforces what should be assess and how to go about doing so. These checklists would be useful for network security architects to ensure that design / implement a secure infrastructure and perimeters.Chapter 3 Information Security Governance, Frameworks, and Standards does a superb job providing an overview of the current frameworks and standards, including PCI DSS, ITIL, ISO 17799/27001. Differences between the processes are discussed and where they are best applied. The only weakness of this section is omitting Risk Management Framework (NIST SP 800-37 rev1) which is the primary framework used by the Govt and can be easily applied to commercial companies.Network Security Auditing stresses the need for security policies and how to go about auditing them. The book recommends that auditors ask questions such as: is the policy implementable, enforceable, easy to understand, based on risk, in line with business objectives, cost effective, effectively communicated and more. If these criteria are not well-defined and delineated, then the policies will exist in text only, offering little information security protection to the organization. Cisco Policy Management and Monitoring tools are discussed in detail with supporting screen captures.Chapter 7-12 are detailed references for auditing endpoints, remote access, access control, perimeter intrusion, and network infrastructure. Each chapter contains thorough overview concepts as well as how to do it the right way.In closing, I highly recommend this book, it will not disappoint.

This book explains in detail how you can constantly improve your security through auditing. It is written so that an non IT professional would understand and the tools and techniques greatly makes my job as an IT Auditor less complicated. The book is a complete guide to auditing security and includes detailed auditing checklists. An overview of the book covers the Principles of Auditing, Security and the Law, Security, Governance, Frameworks, and Standards, and Auditing Tools and Techniques.