I was (probably still am) naive when I read the book; it seems to me the essence of NSM is tying together the most useful streams of data. Who doesn't want correlation? Well, turns out most IDS/IPS vendors. But any points I unfairly deducted for obviousness were swamped by the points awarded for the picking the right types of information for that correlation. I did a lot of this stuff manually without seeing that there was a pattern to what I was doing - I always wanted to know who was involved in an event, to see the packet, and often wanted to see the packet in context. This was really hard before sguil.
I'm not aware of anything like the compelling, comprehensive, disciplined approach Tao covers. Awesome freakin' book.
6 comments:
"The network security monitoring philosophy is both obvious and completely revolutionary." yup!
"The network security monitoring philosophy is both obvious and completely revolutionary." yeah but how can we market it? :)
Wow thats pretty friggin awesome.
I was (probably still am) naive when I read the book; it seems to me the essence of NSM is tying together the most useful streams of data. Who doesn't want correlation? Well, turns out most IDS/IPS vendors. But any points I unfairly deducted for obviousness were swamped by the points awarded for the picking the right types of information for that correlation. I did a lot of this stuff manually without seeing that there was a pattern to what I was doing - I always wanted to know who was involved in an event, to see the packet, and often wanted to see the packet in context. This was really hard before sguil.
I'm not aware of anything like the compelling, comprehensive, disciplined approach Tao covers. Awesome freakin' book.
That is weird! :-) The book is truly awesome, but some few folks actually follow its advice that I am actually shocked that it got to top10.
It's cheating.. Half the article is written by David Bianco!
(congrats ;)
Post a Comment