The Tao of Network Security Monitoring: Beyond Intrusion Detection

Once your security is breached, everyone will ask the same question: nowwhat? Answering this question has cost companies hundreds of thousands ofdollars in incident response and computer forensics fees. This book reducesthe investigative workload of computer security incident response teams(CSIRT) by posturing organizations for incident response success.Firewalls can fail. Intrusion-detection systems can be bypassed. Networkmonitors can be overloaded. These are the alarming but true facts aboutnetwork security. In fact, too often, security administrators' tools can…