Who is Earl Carter?

I am a security research engineer who is a member of Cisco's Security Technologies Assessment Team (STAT). Our team examines Cisco products for security problems to help the product teams improve the overall security posture of their products.

How did you gain interest in computer security?

I became interested in computer security when I got a job working at the Air Froce Information Warfare Center (AFIWC). Working at AFIWC, I helped secure Air Froce networks from attack and analyze attacks against Air Force networks.

Which are your favorite security tools and why?

I think that my favorite tools are the custom tools that I create to do my product testing, But I would have to say that my favorite open source tool is Nessus. It is an excellent vulnerability scanner that is continually being updated by a wide variety of people.


How long did it take you to write "Cisco Secure Intrusion Detection System"? Any major difficulties?

I wrote the book in three months. The only difficulty was catching up on all of the sleep that I missed while writing the book.

In your opinion, what are the most important things an administrator has to do in order to keep a network secure?

I think that the most important things that an administrator can do to keep their network secure is to keep up to date on security patches, enforce access restrictions at the network perimeter and deploy some type of IDS to monitor their network for intrusion attempts. All of these items should be incorporated into a solid security policy that clearly indicates the level of security that you wish to maintain on your network. Securing every device in the network is very important and you need to establish multiple security barriers that an attacker needs to break through to gain access to your network devices. Many network administrators focus on making a very strong perimeter defense, but fail to provide any other defensive measures throughout the network. In these environments, if the attacker is able to break through the outer boundary (because of one missed hole or new vulnerability), the rest of the network is ripe for attack.

What advice would you give to people starting to learn about intrusion detection?