Interview with Earl Carter, Member of Cisco’s Security Technologies Assessment Team (STAT)

Who is Earl Carter?

I am a security research engineer who is a member of Cisco’s Security Technologies Assessment Team (STAT). Our team examines Cisco products for security problems to help the product teams improve the overall security posture of their products.

How did you gain interest in computer security?

I became interested in computer security when I got a job working at the Air Froce Information Warfare Center (AFIWC). Working at AFIWC, I helped secure Air Froce networks from attack and analyze attacks against Air Force networks.

Which are your favorite security tools and why?

I think that my favorite tools are the custom tools that I create to do my product testing, But I would have to say that my favorite open source tool is Nessus. It is an excellent vulnerability scanner that is continually being updated by a wide variety of people.

How long did it take you to write “Cisco Secure Intrusion Detection System“? Any major difficulties?

I wrote the book in three months. The only difficulty was catching up on all of the sleep that I missed while writing the book.

In your opinion, what are the most important things an administrator has to do in order to keep a network secure?

I think that the most important things that an administrator can do to keep their network secure is to keep up to date on security patches, enforce access restrictions at the network perimeter and deploy some type of IDS to monitor their network for intrusion attempts. All of these items should be incorporated into a solid security policy that clearly indicates the level of security that you wish to maintain on your network. Securing every device in the network is very important and you need to establish multiple security barriers that an attacker needs to break through to gain access to your network devices. Many network administrators focus on making a very strong perimeter defense, but fail to provide any other defensive measures throughout the network. In these environments, if the attacker is able to break through the outer boundary (because of one missed hole or new vulnerability), the rest of the network is ripe for attack.

What advice would you give to people starting to learn about intrusion detection?

If you are just learning about intrusion detection, I would recommend that you learn about the various security threats and common attacks that you will have to defend your network against. Next, I would recommend that you learn everything that you can about your network (topology, protocol used, functionality supported, etc.) so that you can determine the potential areas that an attacker can attack your network. Finally, you then need to determine a way that you can watch your network for the attacks in the areas that you feel are the most vulnerable. This is probably most easily accomplished by deploying some type of IDS.

What are your future plans? Any exciting new projects?

Currently I am working on a revision to the current IDS book to incorporate the new functionality that has been incorporated into Cisco IDS since the last IDS book was published. This new book (ISBN – 1587051443) should be available early in 2004.