CCSP Self-Study Guide. Cisco Intrusion Detection System (CIDS): 2nd Edition

Author: (USA) Carter Ed./Zhou Xingwei/Zhang Yichun/Sun Zhaoxin
Publisher:
Publish Date: 2005-04-01
Features:
■ Understand how CiscoIDS protects, monitors, and enhances physical security policies;
■ Review network-based and host-based security technologies;
■ Review the concept of the security wheel diagram and apply the SAFE solution to AVVID;
■ Install and configure CiscoIDS to monitor the network and prevent malicious attacks;
■ Understand the advantages and working principles of Cisco threat response technology;
■ Apply alarm signatures and master the method of customizing signatures;
■ Use the sensor management platform to effectively implement CiscoIDS in the network;
■ Deeply understand the architecture of Cisco security agents.
In addition to using firewalls and other network security devices to restrict intruders, intrusion detection and corresponding preventive measures are also very important. This is also an important component of a comprehensive network security solution. Cisco intrusion detection sensors and various management functions work together to provide the network with multiple functions, including detecting, alerting, and automatically shutting down malicious network behavior. This book provides in-depth configuration and deployment information to build reliable and powerful intrusion detection solutions. This book is an authorized self-study textbook by Cisco, offering detailed information on various CiscoIDS currently in use, helping you master host-based and network-based IDS functions. Chapter summaries will guide you quickly into the learning process, configuration examples will show you how to fully leverage IDS capabilities, and review questions at the end of each chapter will test your knowledge retention. Whether you need a reference manual for CIDS sensor configuration or are preparing for the 642-531 exam, this book will provide effective assistance. This book is an authorized self-study textbook based on the CiscoIDS course, providing a detailed introduction to the main components of Cisco Intrusion Prevention System (IPS). The book first outlines the basic framework of network security, then introduces intrusion detection, CIDS systems, Cisco network IDS configuration, alarm management, methods for configuring and responding to virus signatures, host intrusion protection, CiscoIDS maintenance and troubleshooting, enterprise-level IDS management, enterprise-level IDS monitoring and reporting, Cisco threat response, and more. As the functions provided by CiscoIPS continue to evolve, the final chapter of this book introduces the upcoming features of Cisco Intrusion Prevention System (likely to become reality by the time this book is published). The appendix provides case studies on Cisco Intrusion Prevention Solution configuration and answers to review questions for each chapter. This book can be used as study and review material for the CCSP certification exam. For technicians who maintain and operate CiscoIDS systems, this book is also an excellent reference.