Cisco® Security Monitoring, Analysis, and Response System (MARS) is a next-generation Security Threat Mitigation system (STM). Cisco Security MARS receives raw network and security data and performs correlation and investigation of host and network information to provide you with actionable intelligence. This easy-to-use family of threat mitigation appliances enables you to centralize, detect, mitigate, and report on priority threats by leveraging the network and security devices already deployed in a network, even if the devices are from multiple vendors. Security Monitoring with Cisco Security MARS helps you plan a MARS deployment and learn the installation and administration tasks you can expect to face. Additionally, this book teaches you how to use the advanced features of the product, such as the custom parser, Network Admission Control (NAC), and global controller operations. Through the use of real-world deployment examples, this book leads you through all the steps necessary for proper design and sizing, installation and troubleshooting, forensic analysis of security events, report creation and archiving, and integration of the appliance with Cisco and third-party vulnerability assessment tools. Learn the differences between various log aggregation and correlation systems Examine regulatory and industry requirements Evaluate various deployment scenarios Properly size your deployment Protect the Cisco Security MARS appliance from attack Generate reports, archive data, and implement disaster recovery plans Investigate incidents when Cisco Security MARS detects an attack Troubleshoot Cisco Security MARS operation Integrate Cisco Security MARS with Cisco Security Manager, NAC, and third-party devices Manage groups of MARS controllers with global controller operations This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks.

Master the CS-MARS system from Cisco with the only book available on this comprehensive security system Master the benefits of using the CS-MARS system from Cisco from real-world case studies Learn to sort out false positive alarms and validate true security incidents that need immediate action Mitigate attacks by automating investigation of incidents Manage and maintain information security compliance in line with the most recent governmental regulations Security Monitoring with CS-MARS will help you plan a MARS (Security Monitoring, Analysis, and Response System) deployment an.

Identify, manage, and counter security threats with the Cisco Security Monitoring, Analysis, and Response System Dale Tesch Greg Abelar While it is commonly understood that deploying network security devices is critical to the well-being of an organization's systems and data, all too often companies assume that simply having these devices is enough to maintain the integrity of network resources. To really provide effective protection for their networks, organizations need to take the next step by closely examining network infrastructure, host, application, and security events to determine if an attack has exploited devices on their networks. Cisco® Security Monitoring, Analysis, and Response System (Cisco Security MARS) complements network and security infrastructure investment by delivering a security command and control solution that is easy to deploy, easy to use, and cost-effective. Cisco Security MARS fortifies deployed network devices and security countermeasures, empowering you to readily identify, manage, and eliminate network attacks and maintain compliance. Security Threat Mitigation and Response helps you understand this powerful new security paradigm that reduces your security risks and helps you comply with new data privacy standards. This book clearly presents the advantages of moving from a security reporting system to an all-inclusive security and network threat recognition and mitigation system. You will learn how Cisco Security MARS works, what the potential return on investment is for deploying Cisco Security MARS, and how to set up and configure Cisco Security MARS in your network. "Dealing with gigantic amounts of disparate data is the next big challenge in computer security; if you're a Cisco Security MARS user, this book is what you've been looking for." -Marcus J. Ranum, Chief of Security, Tenable Security, Inc. Dale Tesch is a product sales specialist for the Cisco Security MARS product line for the Cisco Systems® United States AT Security team. Dale came to Cisco Systems through the acquisition of Protego Networks in February 2005. Since then, he has had the primary responsibilities of training the Cisco sales and engineering team on SIM systems and Cisco Security MARS and for providing advanced sales support to Cisco customers. Greg Abelar has been an employee of Cisco Systems since December 1996. He was an original member of the Cisco Technical Assistance Security team, helping to hire and train many of the team's engineers. He has held various positions in both the Security Architecture and Security Technical Marketing Engineering teams at Cisco. Understand how to protect your network with a defense-in-depth strategy Examine real-world examples of cost savings realized by Cisco Security MARS deployments Evaluate the technology that underpins the Cisco Security MARS appliance Set up and configure Cisco Security MARS devices and customize them for your environment Configure Cisco Security MARS to communicate with your existing hosts, servers, network devices, security appliances, and other devices in your network Investigate reported threats and use predefined reports and queries to get additional information about events and devices in your network Use custom reports and custom queries to generate device and event information about your network and security events Learn firsthand from real-world customer stories how Cisco Security MARS has thwarted network attacks This security book is part of the Cisco Press® Networking Technology Series. Security titles from Cisco Press help networking professionals secure critical data and resources, prevent and mitigate network attacks, and build end-to-end self-defending networks. Category: Cisco Press-Security Covers: Security Threat Mitigation

How well does your enterprise stand up against today's sophisticated security threats? In this book, security experts from Cisco Systems demonstrate how to detect damaging security incidents on your global network--first by teaching you which assets you need to monitor closely, and then by helping you develop targeted strategies and pragmatic techniques to protect them. Security Monitoring is based on the authors' years of experience conducting incident response to keep Cisco's global network secure. It offers six steps to improve network monitoring. These steps will help you: Develop Policies: define rules, regulations, and monitoring criteria Know Your Network: build knowledge of your infrastructure with network telemetry Select Your Targets: define the subset of infrastructure to be monitored Choose Event Sources: identify event types needed to discover policy violations Feed and Tune: collect data, generate alerts, and tune systems using contextual information Maintain Dependable Event Sources: prevent critical gaps in collecting and monitoring events Security Monitoring illustrates these steps with detailed examples that will help you learn to select and deploy the best techniques for monitoring your own enterprise network.

CCIE Professional Development Network Security Technologies and Solutions A comprehensive, all-in-one reference for Cisco network security Yusuf Bhaiji, CCIE No. 9305 Network Security Technologies and Solutions is a comprehensive reference to the most cutting-edge security products and methodologies available to networking professionals today. This book helps you understand and implement current, state-of-the-art network security technologies to ensure secure communications throughout the network infrastructure. With an easy-to-follow approach, this book serves as a central repository of security knowledge to help you implement end-to-end security solutions and provides a single source of knowledge covering the entire range of the Cisco network security portfolio. The book is divided into five parts mapping to Cisco security technologies and solutions: perimeter security, identity security and access management, data privacy, security monitoring, and security management. Together, all these elements enable dynamic links between customer security policy, user or host identity, and network infrastructures. With this definitive reference, you can gain a greater understanding of the solutions available and learn how to build integrated, secure networks in today’s modern, heterogeneous networking environment. This book is an excellent resource for those seeking a comprehensive reference on mature and emerging security tactics and is also a great study guide for the CCIE Security exam. “Yusuf’s extensive experience as a mentor and advisor in the security technology field has honed his ability to translate highly technical information into a straight-forward, easy-to-understand format. If you’re looking for a truly comprehensive guide to network security, this is the one! ” –Steve Gordon, Vice President, Technical Services, Cisco Yusuf Bhaiji, CCIE No. 9305 (R&S and Security), has been with Cisco for seven years and is currently the program manager for Cisco CCIE Security certification. He is also the CCIE Proctor in the Cisco Dubai Lab. Prior to this, he was technical lead for the Sydney TAC Security and VPN team at Cisco. Filter traffic with access lists and implement security features on switches Configure Cisco IOS router firewall features and deploy ASA and PIX Firewall appliances Understand attack vectors and apply Layer 2 and Layer 3 mitigation techniques Secure management access with AAA Secure access control using multifactor authentication technology Implement identity-based network access control Apply the latest wireless LAN security solutions Enforce security policy compliance with Cisco NAC Learn the basics of cryptography and implement IPsec VPNs, DMVPN, GET VPN, SSL VPN, and MPLS VPN technologies Monitor network activity and security incident response with network and host intrusion prevention, anomaly detection, and security monitoring and correlation Deploy security management solutions such as Cisco Security Manager, SDM, ADSM, PDM, and IDM Learn about regulatory compliance issues such as GLBA, HIPPA, and SOX This book is part of the Cisco CCIE Professional Development Series from Cisco Press, which offers expert-level instr

Cisco Systems, Inc. is the worldwide leader in networking for the Internet, and its Intrusion Detection Systems line of products is making in roads in the IDS market segment, with major upgrades having happened in February of 2003. Cisco Security Professional's Guide to Secure Intrusion Detection Systems is a comprehensive, up-to-date guide to the hardware and software that comprise the Cisco IDS. Cisco Security Professional's Guide to Secure Intrusion Detection Systems does more than show network engineers how to set up and manage this line of best selling products ... it walks them step by step through all the objectives of the Cisco Secure Intrusion Detection System course (and corresponding exam) that network engineers must pass on their way to achieving sought-after CCSP certification. Offers complete coverage of the Cisco Secure Intrusion Detection Systems Exam (CSIDS 9E0-100) for CCSPs

Any good attacker will tell you that expensive security monitoring and prevention tools aren’t enough to keep you secure. This practical book demonstrates a data-centric approach to distilling complex security monitoring, incident response, and threat analysis ideas into their most basic elements. You’ll learn how to develop your own threat intelligence and incident detection strategy, rather than depend on security tools alone. Written by members of Cisco’s Computer Security Incident Response Team, this book shows IT and information security professionals how to create an InfoSec playbook by developing strategy, technique, and architecture. Learn incident response fundamentals—and the importance of getting back to basics Understand threats you face and what you should be protecting Collect, mine, organize, and analyze as many relevant data sources as possible Build your own playbook of repeatable methods for security monitoring and response Learn how to put your plan into action and keep it running smoothly Select the right monitoring and detection tools for your environment Develop queries to help you sort through data and create valuable reports Know what actions to take during the incident response phase