Bonus Chapter 3: Ten Essential Reference Books

In This Chapter

• Ten highly recommended information security books

• And why!

Overview

Information security is a hot topic, and new books on this important subject are being published every day. Some are better than others. The following list contains ten excellent books on a variety of subjects in information security. Many outstanding information security books have been written, and many more are likely to be published. However, the following short list contains ten books that we highly recommend.

Building Internet Firewalls, 2nd Edition, by Elizabeth D. Zwicky, Simon Cooper, D. Brent Chapman, and Deborah Russell (O’Reilly). This book contains the principles of deploying firewalls to implement an effective security strategy - and how to build one.

Designing Network Security, by Merike Kaeo (Cisco Press). Information security, Cisco-style! In addition to very technology-specific information, this book also describes basic fundamentals (authentication, authorization, accounting, cryptography, PKI, and security policy) in a very clear and concise manner.

Incident Response: Investigating Computer Crime, by Kevin Mandia and Chris Prosise (Osborne/McGraw-Hill). We like this book for its thorough coverage of investigations and evidence gathering.

Information Security: Protecting the Global Enterprise, by Donald L. Pipkin (Prentice Hall). We recommend this book for step-by-step guidance regarding important security management practices.

Network Intrusion Detection: An Analyst’s Handbook, by Stephen Northcutt and Judy Novak (New Riders); and Intrusion Signatures and Analysis, by Stephen Northcutt, Mark Cooper, Matt Fearnow, and Karen Frederick (New Riders). Okay, that’s really two books, but (ISC)² lists only the first one on its Web site, under “Suggested Study Materials.” The second book is an excellent (and logical) companion to the first - not listing both is like having Ying, but no Yang, or Mo, but no Jo. Both books are from the SANS Institute and provide practical, in-depth information.

RSA Security’s Official Guide to Cryptography, by Steve Burnett and Stephen Paine (RSA Press). This book contains thorough coverage of a complex subject in an easily understood format.

Security Engineering: A Guide to Building Dependable Distributed Systems, by Ross Anderson (Wiley Publishing, Inc.). Read this book for excellent, in-depth coverage of some very complex subjects.

Security Warrior, by Cyrus Peikari and Anton Chuvakin (O’Reilly). The nuts and bolts of cracking software, network attacks, operating system exploits, oh - and how to defend yourself!

The CERT Guide to System and Network Security Practices, by Julia H. Allen (Addison-Wesley). Read here to discover how to secure your systems and network, step by step.

The Tao of Network Security Monitoring and Extrusion Detection, by Richard Bejtlich (Addison-Wesley). Okay, we did it again, but these two companion books are definitely worth your time and belong together. Two great tastes that taste great together - like peanut butter and chocolate, or peanut butter and jelly, or peanut butter and pickles!