BKNTSCSE.RVW  940324

International Data Group
155 Bovet Road, Suite 310
San Mateo, CA   94402
USA
415-312-0650
fax: 415-286-2740
"Network Security Secrets", Stang, 1993, 1-56884-021-7, U$49.95/C$64.95
norman@digex.com

It's hard to have confidence in a book on data security that starts off with
two examples of "back doors" -- neither of which have the slightest connection
to back doors.  Then, there is the example of radiation risks which cites a
study probably more related to chemical exposure.  Do not lose heart, however. 
These are apparently aberrations in what is otherwise a very practical and
down-to-earth security manual.

That opening chapter on specific examples starts a section on risk analysis. 
Security mavens may find it lacking in rigour and overlong in verbiage, but
most micro/LAN/office managers have little formal training in the formal
aspects of data security and need the example after example approach.  The
questionnaires and quizzes probably drive the point home as well as, or better
than, Stang's love of charts.

Part two is a bit weaker.  It opens with a questionable chapter on the
"players" in the game:  data security versus the hackers.  There is a chapter
on the security aspects of network design.  Given Stang and Moon's background
in the NCSA the two virus chapters are no surprise, and generally good.

Part three gives more detail (*lots* of detail in the tabular reviews of
chapter 12) on security solutions, policies and products.  Not exhaustive:  the
password chapter, in looking at security *breaking* programs, makes no mention
of the HACK program for obtaining any passwords used over Ethernet or the KNOCK
program which exploits a bug in versions of NetWare which allows anyone to gain
SUPERVISOR access without passwords.  Still, there is much practical help for
the LAN manager here.

Part four looks at specific network operating systems and the security features
and functions thereof.  As well as comparisons of the different systems, there
are chapters collecting the security commands and concepts of each.  These are
handy, but not necessarily more so than the original documentation.  NetWare
"effective rights", for example, continue to bedevil LAN managers using
Novell's software.  All the parts are included here, but the calculation of
effective rights is not deal with.  (There is also one "oops".  The chapter on
UNIX security contains a description of the VMS "WANK" worm.)

Part five looks at ways to implement security.  An unusual, but very valuable,
section in the chapter on training is an extensive list of training available
in a variety of security related areas.  (Most of the virus courses seem to be
given by an outfit called Norman Data Defense Systems.  Oh well.)

Part six briefly describes the shareware files on the included disks.  A series
of appendices primarily give contact information.

It'll be difficult to get a busy LAN manager to sit still long enough to read
this.  But it'll be worth it.

copyright Robert M. Slade, 1994   BKNTSCSE.RVW  940324
 
======================
DECUS Canada Communications, Desktop, Education and Security group newsletters
Editor and/or reviewer ROBERTS@decus.ca, RSlade@sfu.ca, Rob Slade at 1:153/733
Author "Robert Slade's Guide to Computer Viruses" (Oct. '94) Springer-Verlag