Internet Site Security

The authors--all engineers from the same security consultancy, one of whom has his Certified Information Security Systems Professional (CISSP) rating--do a good job of explaining some of the ways in which nefarious types come after your servers. Readers learn what a denial-of-service attack is, and how a man-in-the-middle scheme works. It's all accurate and fairly comprehensive, though there's nothing really revolutionary about it. This is just solid coverage of the security issues surrounding servers that provide Internet services to a wide and generally unsecured audience. If you've not read about that before, this book is a decent choice. --David Wall

Topics covered: The sorts of attacks to which Internet-connected servers are subject, explained in a TCP/IP-centric and generally operating-system-neutral way.

While a house needs an architect, contractors, plumbers, electricians and much more; networks require similar sets of skills if it is to be deployed in a secure manner. The problem with designing secure Internet sites is that the dynamics of information systems means that the foundation is constantly changing. Just as companies are finishing their migrations, there are new updates to deal with. The threats and vulnerabilities are for the most part increasing quicker than most organizations are able to deal with

For those looking to design their Internet information security infrastructure, Internet Site Security is an excellent title to use as their guide. It is like an architects guide to building secure networks.

The book is quite comprehensive in its coverage of all critical areas of security. It details how to build a secure infrastructure and how to deploy policies to protect it. It covers various technologies such as intrusion detections systems and firewalls, and shows how they are to be effectively deployed.

Then advantage of the book is that it has just the right combination of breath and depth. Topics are covered effectively, and the authors do not waste the reader's time by going into obscure security minutiae or academic threats.

Readers looking for an effective guide to fundamental issues involved with information security and Internet security are well advised to read Internet Site Security. Don't design you Internet site without it.


Superb practical book   July 26, 2002
Roy Madden (Dublin, Ireland)
2 out of 2 found this review helpful

This really is a superb book. The evidence that the authors are hands on types who have implemented what they describe is very apparent, and take it from someone who has been doing security for years, the problems they describe are what you experience in real life. It's a refreshing change from other books which describe the products/technologies as if they were reading a feature list - it's hard to find a book packed with real life experience.

I'd describe it as a 'mid level' book, i.e. if you need detailed knowledge of x509 etc you need a seperate tome - but if you want a fairly detailed overview of the majority of risks affecting your web site, this is the book to choose.


Come inside my firewalls   May 3, 2002
RJ (Alphabet City)
1 out of 3 found this review helpful

I only recently became a [website user]. Just a month ago, someone said to me, "Aww heck, they won't let me FTP from behind this firewall at work."

And I felt really stupid.

Fortunately for me, this very technical book was not at all confusing, as I ran off and bought it immediately after my humiliation. It is written in an informative and relatively jargon-free language. I have been tranformed from a virus-laden security ignoramus to a web geek security know-it-all!!!


practical and intuitive   April 25, 2002
Jake Luck (New York, NY USA)
6 out of 6 found this review helpful

This book covers the subject of Internet Security in a comprehensive manner. It contains excellent coverage on modern penetration/exploitation techniques as well as proper forensic procedures. The book shows you how to build a secure infrastructure and how to proactively deploy security policies, something that should be emphasized in every organization. It offers valuable insight on integration of a security infrastructure into an existing enterprise environment, covering both technical and political ramifications. The book discusses in-depth the strengths and weaknesses of various Intrusion Detection Systems and FireWall architectures. It also provides excellent coverage on IPSec and PAM; better than any documents that I have read on the Internet. The book provides both breadth and depth. It is neither a book all about theories and policies nor just another compilation of internet articles and mailing list discussions. Many insight gleaned from the authors' industry experience have shined through this book. It is a worth read even for a senior security engineer.