Enhanced descriptions from Syndetics:

Security threats are on the rise, and companies must be prepared to face them. One way companies are assessing security risk and the vulnerability of their networks is by hiring security firms to attempt to penetrate their networks or by developing in-house penetration testing skills to continually monitor network vulnerabilities. Penetration testing is a growing field, yet there is no definite resource on how to perform a penetration test and the ethics of testing. Penetration Testing and Cisco Network Defense offers detailed steps on how to emulate an outside attacker to assess the security of a network. Unlike other books on hacking, this book is specifically geared toward penetration testing. Divided into two parts, this book provides a set of guidelines and methodologies for understanding and performing internal penetration tests. It also shows how an attack can be detected on a network. Part one covers understanding penetration testing, assessing risks, and creating a testing plan. Part two focuses on the particulars of testing, and each chapter includes three essential components: the steps to perform a simulated attack using popular commercial and open-source applications; how to detect the attack with Cisco Intrusion Detection Sensor and Security Agent; suggestions on how to harden a system against attacks.

Table of contents provided by Syndetics

• A Foreword Introduction
• Part I A A A A A A A A A A A A A A A A A Overview of Penetration Testing
• Chapter 1 A A A A A A A A A A A Understanding Penetration Testing Defining Penetration Testing Assessing the Need for Penetration Testing Proliferation of Viruses and Worms Wireless LANs Complexity of Networks Today Frequency of Software Updates Availability of Hacking Tools The Nature of Open Source A Reliance on the Internet Unmonitored Mobile Users and Telecommuters Marketing Demands Industry Regulations Administrator Trust Business Partnerships Hacktivism Attack Stages Choosing a Penetration Testing Vendor Preparing for the Test
• Summary
• ChapterA 2 A A A A A A A A A A Legal and Ethical Considerations Ethics of Penetration Testing Laws U.S
• Laws Pertaining to Hacking 1973 U.S
• Code of Fair Information Practices 1986 Computer Fraud and Abuse Act (CFAA) State Laws Regulatory Laws 1996 U.S
• Kennedy-Kasselbaum Health Insurance Portability and AccountabilityAct (HIPAA) Graham-Leach-Bliley (GLB) USA PATRIOT ACT 2002 Federal Information Security Management Act (FISMA) 2003 Sarbanes-Oxley Act (SOX) A Non-U.S
• Laws Pertaining to Hacking Logging To Fix or Not to Fix
• Summary
• ChapterA 3 A A A A A A A A A A A Creating a Test Plan Step-by-Step Plan Defining the Scope Social Engineering Session Hijacking Trojan/Backdoor Open-Source Security Testing Methodology Manual Documentation Executive Summary Project Scope Results Analysis
• Summary
• Appendixes
• Summary
• Part II A A A A A A A A A A A A A A A A Performing the Test
• ChapterA 4 A A A A A A A A A A Performing Social Engineering Human Psychology Conformity Persuasion Logic Persuasion Need-Based Persuasion Authority-Based Persuasion Reciprocation-Based Social Engineering Similarity-Based Social Engineering Information-Based Social Engineering What It Takes to Be a Social Engineer Using Patience for Social Engineering Using Confidence for Social Engineering Using Trust for Social Engineering Using Inside Knowledge for Social Engineering First Impressions and the Social Engineer Tech Support Impersonation Third-Party Impersonation E-Mail Impersonation End User Impersonation Customer Impersonation Reverse Social Engineering Protecting Against Social Engineering
• Case Study
• Summary
• ChapterA 5 A A A A A A A A A A A Performing Host Reconnaissance Passive Host Reconnaissance A Company Website EDGAR Filings NNTP USENET Newsgroups User Group Meetings Business Partners Active Host Reconnaissance NSLookup/Whois Lookups SamSpade Visual Route Port Scanning TCP Connect() Scan SYN Scan NULL Scan FIN Scan ACK Scan Xmas-Tree Scan Dumb Scan NMap NMap Switches and Techniques Compiling and Testing NMap Fingerprinting Footprinting Detecting a Scan Intrusion Detection Anomaly Detection Systems Misuse Detection System Host-Based IDSs Network-Based IDSs Network Switches Examples of Scan Detection Detecting a TCP Connect() Scan Detecting a SYN Scan Detecting FIN, NULL, and Xmas-Tree Scans Detecting OS Guessing
• Case Study
• Summary
• ChapterA 6 A A A A A A A A A A Understanding and Attempting Session Hijacking Defining Session Hijacking Nonblind Spoofing Blind Spoofing TCP Sequence Prediction (Blind Hijacking) Tools Juggernaut Hunt TTY-Watcher T-Sight Other Tools Beware of ACK Storms Kevin Mitnick's Session Hijack Attack Detecting Session Hijacking Detectin

Author notes provided by Syndetics

Andrew Whitaker , CCSP(tm), is the Director of Enterprise InfoSec and Networking for TechTrain, where he performs penetration tests and teaches ethical hacking and Cisco® courses. He has been working in the IT industry for more than ten years, specializing in Cisco and security technologies, and has performed penetration tests for numerous financial institutions and Fortune 500 companies.

Daniel P. Newman , CISSP, CCSP, has been in the computer industry for over 12 years specializing in application programming, database design and network security for projects all over the world. He is the managing director and chief security officer for Tribal Knowledge Security and specializes in penetration testing and advanced technical training in Cisco, Microsoft, and Ethical Hacking topics.