| This book is structured to allow the reader to proceed from cover to cover in a natural learning and discovery process. The book is organized into 7 major sections composed of 14 chapters and 3 appendixes. Part I "The Need for Endpoint Security," covers the basics of why endpoint security is so important to today s rapidly changing security landscape. Chapter 1, "Introducing Endpoint Security," discusses endpoint security and the need for this technology. Chapter 2, "Introducing the Cisco Security Agent," discusses CSA and the security mechanisms that can be deployed as protection for a computing environment.
Part II, "Understanding the CSA Building Blocks," covers the basic components you must thoroughly understand when attempting to deploy the CSA architecture. Chapter 3, "Understanding CSA Groups and Hosts," discusses using groups and hosts in the CSA architecture and how the two components are related. Chapter 4, "Understanding CSA Policies, Modules, and Rules," describes the components necessary to build and manipulate policy for the systems you want to protect. These building blocks are broken down into individual rules so that you can better understand what control mechanisms are available and how to use them. Chapter 5, "Understanding Application Classes and Variables," discusses some of the CSA objects that simplify ongoing maintenance and usability of the software through the use of reusable elements.
Part III, "CSA Agent Installation and Local Agent Use," covers the agents themselves, how you can implement them, and how the user can interact with the agent locally. Chapter 6, "Understanding CSA Components and Installation," discusses the local agent components and installation process on various operating system platforms. Chapter 7, "Using the CSA User Interface," discusses how users should use the local agent interface that may be available to them as defined by the central security policy.
Part IV, "Monitoring and Reporting," covers the CSA Management Console s reporting and monitoring capabilites. Chapter 8, "Monitoring CSA Events," explores the event database on the management server and how you can view and filter the information. Chapter 9, "Using CSA MC Reports," discusses the report mechanisms available to the CSA administrator. These reports provide detailed information for the CSA architecture components.
Part V, "Analyzing CSA," covers the advanced CSA analysis features added in the 4.5 version of the product. Chapter 10, "Application Deployment Investigation," explores the new Application Deployment Investigation feature capable of providing reports regarding all installed applications, hotfixes, service packs, and applications connecting to the network as a client or server. Chapter 11, "Application Behavior Analysis," discusses the new capability of the CSA agent to collect detailed information regarding a specific process and how it uses and is used by system resources.
Part VI, "Creating Policy, Implementing CSA, and Maintaining the CSA MC," covers policy as a whole comprised of the various building blocks and a methodology that the company should follow when attempting to implement CSA. You also learn about information required to keep a CSA deployment running efficiently and how to provide the necessary level of backup required in case of a system failure Chapter 12, "Creating and Tuning Policy," examines the methods used to tune policy such that it controls your environment without impacting usability. Chapter 13, "Developing a CSA Project Implementation Plan," lays out a detailed implementation plan that takes you through the various stages and steps of a CSA deployment. Chapter 14, "CSA MC Administration and Maintenance," discusses administering and maintaining the CSA architecture, including administrative access roles and backups.
Part VII, "Appendixes," covers additional installation and management information. Appendix A, "VMS and CSA MC 4.5 Installation,"discusses basic single-server installation of the CiscoWorks VMS product along with the CSA MC. Appendix B, "Security Monitor Integration,"discusses integrating the CSA MC with the Security Monitor component of CiscoWorks VMS. Appendix C, "CSA MIB,"introduces the CSA MIB that can be used with various SNMP management systems.
|
