Security Threat Mitigation and Response: Understanding Cisco Security MARS

We got a MARS box at my work, so I grabbed this book to get up to snuff. It was a very annoying and frustrating book. The first 1/3 of the book seemed to be semi-marketing fluff, and actually prompted me to note "hahaha" in one of the margins. In about a decade of working through technical books, and a BA in political science (which led me to read some seriously pompous material), I've NEVER DONE THAT.*Overall I didn't find the book that helpful. If you are fairly new to infosec (I'm not condescending here, everyone was once new at everything) it might have enough new information hidden amongst the MBA-speak to keep your attention, but I found myself skimming a lot, and eventually just tossed the book aside.On the bright side you can occasionally find useful material in it as a reference book. Since it's light on technical information for it's weight, don't count on that too much, but it's not totally useless. For example I was able to find MARS' place in our infrastructure in regards to Netflow with this book, (MARS as a collector is security-focused, and not a proper primary collector for traffic engineering, which makes complete sense), but to set it up accordingly I had to google around and eventually found a really good MARS blog.So I'd say that if you have a MARS box, get your work to buy you this book because it will occasionally be handy, maybe shaving a few minutes off of a google session. If I was paying I would skip it.* The line that prompted me to actually burst into laughter actually claimed that a specific set of practices surrounding the MARS box made it impenetrable. If I had the book at home right now I would quote it, so readers could recall the Oracle "unbreakable" debacle and smile.