| Books Co-Authored by Jay Beale: |
|
Want to see more?
View favorite books from other authors.
|
|
|
We asked some of our (and your!) favorite authors to share with us their
favorite 10 computer books from the past 10 years. Here's what we got back.
|
Jay Beale
is a security specialist, the lead developer of the Bastille project, a member of the Honeynet Project and the Linux technical lead in the Center for Internet Security. Jay is a senior research scientist with the George Washington University Cyber Security Policy and Research Institute and a security consultant for Intelguardians, LLC. Jay is Series Editor for Jay Beale's Open Source Security Series from Syngress Publishing. He is co-author of several books including the forthcoming Stealing the Network: How to Own an Identity and Penetration Tester's Open Source Toolkit.
|
Jay's favorite books: |
 Programming Perl by Larry Wall, Tom Christiansen, Jon Orwant -- This book is the second book that any system administrator should read, but it should also be in the first five or ten that any security engineer reads. Perl is invaluable in your work in either of these professions because it allows you to rapidly develop tools to make your work both easier and more effective. This goes double for system administrators, who should always work to use automation not only to get tasks accomplished efficiently and consistently, but also to reduce their workload, giving them more time to figure out how to proactively improve the systems.
 Essential System Administration by AEleen Frisch -- This is the very first book that any system administrator should read. Honestly, every Unix programmer or security engineer should read it too. It'll cement your understanding of how computers work, teach you Unix very deeply, and teach you how to administer systems. Among other things, this book teaches you how to chain programs together on the command line to realize the amazing power of the command shell. The strongest system administration practices use scripting, whether shell, Perl or Python, to make their work easier, more effective and more consistent. The Armadillo book is amazing in that full comprehension of it gives you a pretty complete background in the tech side of system administration. Everything else ends up being application and practice.
 Counter Hack Reloaded: A Step-by-Step Guide to Computer Attacks and Effective Defenses, 2nd Edition by Ed Skoudis -- Ed Skoudis's book covers the same topic as Hacking Exposed, another favorite of mine, but handles the topic much more strongly to me. He covers everything more deeply, giving you a solid understanding of not only how the attacks work, but also how the underlying technology fails in the first place. Instead of assuming your background is weak and keeping things too simple, his book starts out with three chapters that each overview a critical piece of background: TCP/IP, Unix and Windows. This depth of coverage is invaluable in a book on attack.
(The author's original choice was an older edition that is now out of print. This link is to the new edition now available)
 Stealing the Network: How to Own the Box by Ryan Russell, Tim Mullen -- This book is the first really accurate work of fiction on hacking that I've seen. It's a fiction book, shelved in the tech books section, because it teaches you about real attacks, sometimes with command line. The characters are skilled attackers, rather than their less subtle counterparts, the script kiddies. This attacker class is the one we don't tend to observe too often. The stories in this book are fascinating and written by people you're used to seeing presenting topics on the bleeding-edge at security conferences. Look especially for FX's Hex character, a witch of an attacker! I liked this book so much that I worked on its sequel, Stealing the Network: How to Own a Continent.
 Linux Server Security by Michael D. Bauer -- Mick Bauer's O'Reilly book covers secure administration of mail, web, DNS and FTP servers. No one should run one of these servers on Linux or Unix without reading this book. It also covers a number of supporting topics, from power SSH usage, iptables firewalls, logging, intrusion detection and even automatic system hardening with Bastille Linux. System hardening, the real topic of this book, massively reduces a machine's chances of being compromised. No book I've seen covers this topic anywhere near this well. Mick has done an amazing job, being even more thorough than he already is in his excellent "Paranoid Penguin" Linux Journal columns. He gives you what you need to set these servers up in the most secure way possible.
 Hardening Apache by Tony Mobily -- This short, inexpensive book is dedicated entirely to Apache security. It works as a great complement to Linux Server Security, specifically in its fifth chapter that gives a comprehensive coverage of Apache security modules as well as its sixth chapter that shows you how to put Apache in a chroot jail while still keeping PHP and Perl content working.
 Sendmail Cookbook by Craig Hunt -- Books on Sendmail are normally amazingly hard-going, so that few people seem to understand how to configure Sendmail all that well. This book teaches you how to do a lot of often complex, one-off tricks to tune and configure Sendmail. A lot of these are directly or indirectly applicable to security, actually. You'll learn a lot from this book about how Sendmail works, allowing you to run it better and more securely.
 Intrusion Signatures and Analysis by Stephen Northcutt, et al -- This book, written by Stephen Northcutt and a number of members of the SANS community, was excellent for learning to understand network attacks from the target's perspective. It gives an excellent coverage of the concepts used by the attacks and then takes you through packet traces from those attacks. You learn not only to diagnose specific attacks, but how to draw secondary conclusions about the attack.
Linux Programming by Example (Out of Print) by Kurt Wall -- This is the lite version of Advanced Programming in the Unix Environment, which means that you can read the entire book through pretty quickly, using APUE as a reference. It covers system programming in Linux, looking at common libraries, system calls, interprocess communication, TCP/IP socket programming and the like. It's a great introduction to deep programming and should probably be the Linux C programmer's second book after her first book on C. It's also very useful to the intermediate to advanced system or security administrator, who's gaining a deeper understanding of the system fundamentals. Kernels may be cool, but you must understand how the system's supporting components work before you're ready for the kernel.
 Linux Security Cookbook by Daniel J. Barrett, et al -- Though no substitute for Mick's Linux Server Security, this cookbook is chock full of one-off security tricks you can use on Linux. It doesn't matter how much you know -- you're guaranteed to find a trick or technique in here that you haven't yet thought of or at least one you don't have experience with. Because it's in a cookbook format, it makes it easy to just implement something without having to screw around trying to figure it out. This lets you get to a more secure practice much more quickly.
|
|
