Computer and Information Security Handbook, 2nd Edition

Computer and Information Security Handbook, 2nd Edition

by John R. Vacca
Released November 2012
Publisher(s): Morgan Kaufmann
ISBN: 9780123946126

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

The second edition of this comprehensive handbook of computer and information security provides the most complete view of computer security and privacy available. It offers in-depth coverage of security theory, technology, and practice as they relate to established technologies as well as recent advances. It explores practical solutions to many security issues. Individual chapters are authored by leading experts in the field and address the immediate and long-term challenges in the authors’ respective areas of expertise.

The book is organized into 10 parts comprised of 70 contributed chapters by leading experts in the areas of networking and systems security, information management, cyber warfare and security, encryption technology, privacy, data storage, physical security, and a host of advanced security topics. New to this edition are chapters on intrusion detection, securing the cloud, securing web apps, ethical hacking, cyber forensics, physical security, disaster recovery, cyber attack deterrence, and more.

  • Chapters by leaders in the field on theory and practice of computer and information security technology, allowing the reader to develop a new level of technical expertise
  • Comprehensive and up-to-date coverage of security issues allows the reader to remain current and fully informed from multiple viewpoints
  • Presents methods of analysis and problem-solving techniques, enhancing the reader's grasp of the material and ability to implement practical solutions

Table of contents

  1. Cover image
  2. Title page
  3. Table of Contents
  4. Copyright
  5. Dedication
  6. Foreword
  7. Preface
    1. Organization of this Book
    2. Supplemental Materials
  8. Acknowledgments
  9. About the Editor
  10. Contributors
  11. Part I: Overview of System and Network Security: A Comprehensive Introduction
    1. Chapter 1. Building a Secure Organization
      1. 1 Obstacles to Security
      2. 2 Computers are Powerful and Complex
      3. 3 Current Trend is to Share, Not Protect
      4. 4 Security isn’t about Hardware and Software
      5. 5 Ten Steps to Building a Secure Organization
      6. 6 Preparing for the Building of Security Control Assessments
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
    2. Chapter 2. A Cryptography Primer
      1. 1 What is Cryptography? What is Encryption?
      2. 2 Famous Cryptographic Devices
      3. 3 Ciphers
      4. 4 Modern Cryptography
      5. 5 The Computer Age
      6. 6 How AES Works
      7. 7 Selecting Cryptography: the Process
      8. 8 Summary
      9. Chapter Review Questions/Exercises
      10. Multiple Choice
      11. Exercise
    3. Chapter 3. Detecting System Intrusions
      1. 1 Introduction
      2. 2 Monitoring Key Files in the System
      3. 3 Security Objectives
      4. 4 0day Attacks
      5. 5 Good Known State
      6. 6 Rootkits
      7. 7 Low Hanging Fruit
      8. 8 Antivirus Software
      9. 9 Homegrown Intrusion Detection
      10. 10 Full-Packet Capture Devices
      11. 11 Out-of-Band Attack Vectors
      12. 12 Security Awareness Training
      13. 13 Data Correlation
      14. 14 SIEM
      15. 15 Other Weird Stuff on the System
      16. 16 Detection
      17. 17 Network-Based Detection of System Intrusions (DSIs)
      18. 18 Summary
      19. Chapter Review Questions/Exercises
      20. Exercise
      21. References
    4. Chapter 4. Preventing System Intrusions
      1. 1 So, What is an Intrusion?
      2. 2 Sobering Numbers
      3. 3 Know Your Enemy: Hackers versus Crackers
      4. 4 Motives
      5. 5 The Crackers’ Tools of the Trade
      6. 6 Bots
      7. 7 Symptoms of Intrusions
      8. 8 What Can You Do?
      9. 9 Security Policies
      10. 10 Risk Analysis
      11. 11 Tools of Your Trade
      12. 12 Controlling User Access
      13. 13 Intrusion Prevention Capabilities
      14. 14 Summary
      15. Chapter Review Questions/Exercises
      16. Exercise
    5. Chapter 5. Guarding Against Network Intrusions
      1. 1 Traditional Reconnaissance and Attacks
      2. 2 Malicious Software
      3. 3 Defense in Depth
      4. 4 Preventive Measures
      5. 5 Intrusion Monitoring and Detection
      6. 6 Reactive Measures
      7. 7 Network-Based Intrusion Protection
      8. 8 Summary
      9. Chapter Review Questions/Exercises
      10. Exercise
    6. Chapter 6. Securing Cloud Computing Systems
      1. 1 Cloud Computing Essentials: Examining the Cloud Layers
      2. 2 Software as a Service (SaaS): Managing Risks in the Cloud
      3. 3 Platform as a Service (PaaS): Securing the Platform
      4. 4 Infrastructure as a Service (IaaS)
      5. 5 Leveraging Provider-Specific Security Options
      6. 6 Achieving Security in a Private Cloud
      7. 7 Meeting Compliance Requirements
      8. 8 Preparing for Disaster Recovery
      9. 9 Summary
      10. Chapter Review Questions/Exercises
      11. Exercise
      12. References
    7. Chapter 7. Fault Tolerance and Resilience in Cloud Computing Environments
      1. 1 Introduction
      2. 2 Cloud Computing Fault Model
      3. 3 Basic Concepts on Fault Tolerance
      4. 4 Different Levels of Fault Tolerance in Cloud Computing
      5. 5 Fault Tolerance against Crash Failures in Cloud Computing
      6. 6 Fault Tolerance against Byzantine Failures in Cloud Computing
      7. 7 Fault Tolerance as a Service in Cloud Computing
      8. 8 Summary
      9. Chapter Review Questions/Exercises
      10. Exercise
      11. Acknowledgments
      12. References
    8. Chapter 8. Securing Web Applications, Services, and Servers
      1. 1 Setting the Stage
      2. 2 Basic Security for HTTP Applications and Services
      3. 3 Basic Security for SOAP Services
      4. 4 Identity Management and Web Services
      5. 5 Authorization Patterns
      6. 6 Security Considerations
      7. 7 Challenges
      8. 8 Summary
      9. Chapter Review Questions/Exercises
      10. Exercise
    9. Chapter 9. Unix and Linux Security
      1. 1 Unix and Security
      2. 2 Basic Unix Security Overview
      3. 3 Achieving Unix Security
      4. 4 Protecting User Accounts and Strengthening Authentication
      5. 5 Limiting Superuser Privileges
      6. 6 Securing Local and Network File Systems
      7. 7 Network Configuration
      8. 8 Improving the Security of Linux and Unix Systems
      9. 9 Additional Resources
      10. 10 Summary
      11. Chapter Review Questions/Exercises
      12. Exercise
    10. Chapter 10. Eliminating the Security Weakness of Linux and Unix Operating Systems
      1. 1 Introduction to Linux and Unix
      2. 2 Hardening Linux and Unix
      3. 3 Proactive Defense for Linux and Unix
      4. 4 Summary
      5. Chapter Review Questions/Exercises
      6. Exercise
    11. Chapter 11. Internet Security
      1. 1 Internet Protocol Architecture
      2. 2 An Internet Threat Model
      3. 3 Defending against Attacks on the internet
      4. 4 Internet Security Checklist
      5. 5 Summary
      6. Chapter Review Questions/Exercises
      7. Exercise
    12. Chapter 12. The Botnet Problem
      1. 1 Introduction
      2. 2 Botnet Overview
      3. 3 Typical Bot Life Cycle
      4. 4 The Botnet Business Model
      5. 5 Botnet Defense
      6. 6 Botmaster Traceback
      7. 7 Preventing Botnets
      8. 8 Summary
      9. Chapter Review Questions/Exercises
      10. Exercise
    13. Chapter 13. Intranet Security
      1. 1 Smartphones and Tablets in the Intranet
      2. 2 Security Considerations
      3. 3 Plugging the Gaps: NAC and Access Control
      4. 4 Measuring Risk: Audits
      5. 5 Guardian at the Gate: Authentication and Encryption
      6. 6 Wireless Network Security
      7. 7 Shielding the Wire: Network Protection
      8. 8 Weakest Link in Security: User Training
      9. 9 Documenting the Network: Change Management
      10. 10 Rehearse the Inevitable: Disaster Recovery
      11. 11 Controlling Hazards: Physical and Environmental Protection
      12. 12 Know Your Users: Personnel Security
      13. 13 Protecting Data Flow: Information and System Integrity
      14. 14 Security Assessments
      15. 15 Risk Assessments
      16. 16 Intranet Security Implementation Process Checklist
      17. 17 Summary
      18. Chapter Review Questions/Exercises
      19. Exercise
    14. Chapter 14. Local Area Network Security
      1. 1 Identify Network Threats
      2. 2 Establish Network Access Controls
      3. 3 Risk Assessment
      4. 4 Listing Network Resources
      5. 5 Threats
      6. 6 Security Policies
      7. 7 The Incident-Handling Process
      8. 8 Secure Design Through Network Access Controls
      9. 9 IDS Defined
      10. 10 NIDS: Scope and Limitations
      11. 11 A Practical Illustration of NIDS
      12. 12 Firewalls
      13. 13 Dynamic NAT Configuration
      14. 14 The Perimeter
      15. 15 Access List Details
      16. 16 Types of Firewalls
      17. 17 Packet Filtering: IP Filtering Routers
      18. 18 Application-Layer Firewalls: Proxy Servers
      19. 19 Stateful Inspection Firewalls
      20. 20 NIDS Complements Firewalls
      21. 21 Monitor and Analyze System Activities
      22. 22 Signature Analysis
      23. 23 Statistical Analysis
      24. 24 Signature Algorithms
      25. 25 Local Area Network Security Countermeasures Implementation Checklist
      26. 26 Summary
      27. Chapter Review Questions/Exercises
      28. Exercise
    15. Chapter 15. Wireless Network Security
      1. 1 Cellular Networks
      2. 2 Wireless Ad hoc Networks
      3. 3 Security Protocols
      4. 4 WEP
      5. 5 Secure Routing
      6. 6 ARAN
      7. 7 SLSP
      8. 8 Key Establishment
      9. 9 ING
      10. 10 Management Countermeasures
      11. 11 Summary
      12. Chapter Review Questions/Exercises
      13. Exercise
      14. References
    16. Chapter 16. Wireless Sensor Network Security
      1. 1 Introduction to the Wireless Sensor Network (WSN)
      2. 2 Threats to Privacy
      3. 3 Security Measures for WSN
      4. 4 Secure Routing in WSN
      5. 5 Routing Classifications in WSN
      6. 6 WSN Security Framework and Standards
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
      10. References
    17. Chapter 17. Cellular Network Security
      1. 1 Introduction
      2. 2 Overview of Cellular Networks
      3. 3 The State of the Art of Cellular Network Security
      4. 4 Cellular Network Attack Taxonomy
      5. 5 Cellular Network Vulnerability Analysis
      6. 6 Summary
      7. Chapter Review Questions/Exercises
      8. Exercise
      9. References
    18. Chapter 18. RFID Security
      1. 1 RFID Introduction
      2. 2 RFID Challenges
      3. 3 RFID Protections
      4. 4 Summary
      5. Chapter Review Questions/Exercises
      6. Exercise
      7. References
    19. Chapter 19. Optical Network Security
      1. 1 Optical Networks
      2. 2 Securing Optical Networks
      3. 3 Identifying Vulnerabilities
      4. 4 Corrective Actions
      5. 5 Summary
      6. Chapter Review Questions/Exercises
      7. Exercise
      8. References
    20. Chapter 20. Optical Wireless Security
      1. 1 Optical Wireless Systems Overview
      2. 2 Deployment Architectures
      3. 3 High Bandwidth
      4. 4 Low Cost
      5. 5 Implementation
      6. 6 Surface Area
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
  12. Part II: Managing Information Security
    1. Chapter 21. Information Security Essentials for IT Managers: Protecting Mission-Critical Systems
      1. 1 Information Security Essentials for it Managers, Overview
      2. 2 Protecting Mission-Critical Systems
      3. 3 Information Security from the Ground Up
      4. 4 Security Monitoring and Effectiveness
      5. 5 Summary
      6. Chapter Review Questions/Exercises
      7. Exercise
    2. Chapter 22. Security Management Systems
      1. 1 Security Management System Standards
      2. 2 Training Requirements
      3. 3 Principles of Information Security
      4. 4 Roles and Responsibilities of Personnel
      5. 5 Security Policies
      6. 6 Security Controls
      7. 7 Network Access
      8. 8 Risk Assessment
      9. 9 Incident Response
      10. 10 Summary
      11. Chapter Review Questions/Exercises
      12. Exercise
    3. Chapter 23. Policy-driven System Management
      1. 1 Introduction
      2. 2 Security and Policy-based Management
      3. 3 Classification and Languages
      4. 4 Controls for Enforcing Security Policies in Distributed Systems
      5. 5 Products and Technologies
      6. 6 Research Projects
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
      10. Acknowledgments
      11. References
    4. Chapter 24. Information Technology Security Management
      1. 1 Information Security Management Standards
      2. 2 Other Organizations Involved in Standards
      3. 3 Information Technology Security Aspects
      4. 4 Summary
      5. Chapter Review Questions/Exercises
      6. Exercise
    5. Chapter 25. Online Identity and User Management Services
      1. 1 Introduction
      2. 2 Evolution of Identity Management Requirements
      3. 3 The Requirements Fulfilled by Identity Management Technologies
      4. 4 Identity Management 1.0
      5. 5 Social Login and User Management
      6. 6 Identity 2.0 for Mobile Users
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
      10. References
    6. Chapter 26. Intrusion Prevention and Detection Systems
      1. 1 What is an ‘Intrusion’ Anyway?
      2. 2 Physical Theft
      3. 3 Abuse of Privileges (The Insider Threat)
      4. 4 Unauthorized Access by Outsider
      5. 5 Malware Infection
      6. 6 The Role of the ‘0-Day’
      7. 7 The Rogue’s Gallery: Attackers and Motives
      8. 8 A Brief Introduction to TCP/IP
      9. 9 The TCP/IP Data Architecture and Data Encapsulation
      10. 10 Survey of Intrusion Detection and Prevention Technologies
      11. 11 Anti-Malware Software
      12. 12 Network-Based Intrusion Detection Systems
      13. 13 Network-Based Intrusion Prevention Systems
      14. 14 Host-Based Intrusion Prevention Systems
      15. 15 Security Information Management Systems
      16. 16 Network Session Analysis
      17. 17 Digital Forensics
      18. 18 System Integrity Validation
      19. 19 Summary
      20. Chapter Review Questions/Exercises
      21. Exercise
      22. References
    7. Chapter 27. TCP/IP Packet Analysis
      1. 1 The Internet Model
      2. 2 Summary
      3. Chapter Review Questions/Exercises
      4. Exercise
    8. Chapter 28. The Enemy (The Intruder’s Genesis)
      1. 1 Introduction
      2. 2 Active Reconnaissance
      3. 3 Enumeration
      4. 4 Penetration and Gain Access
      5. 5 Maintain Access
      6. 6 Defend Network Against Unauthorized Access
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
    9. Chapter 29. Firewalls
      1. 1 Abstract
      2. 2 Contents
    10. Chapter e29. Firewalls
      1. 1 Introduction
      2. 2 Network Firewalls
      3. 3 Firewall Security Policies
      4. 4 A Simple Mathematical Model for Policies, Rules, and Packets
      5. 5 First-Match Firewall Policy Anomalies
      6. 6 Policy Optimization
      7. 7 Firewall Types
      8. 8 Host and Network Firewalls
      9. 9 Software and Hardware Firewall Implementations
      10. 10 Choosing the Correct Firewall
      11. 11 Firewall Placement and Network Topology
      12. 12 Firewall Installation and Configuration
      13. 13 Supporting Outgoing Services Through Firewall Configuration
      14. 14 Secure External Services Provisioning
      15. 15 Network Firewalls for Voice and Video Applications
      16. 16 Firewalls and Important Administrative Service Protocols
      17. 17 Internal IP Services Protection
      18. 18 Firewall Remote Access Configuration
      19. 19 Load Balancing and Firewall Arrays
      20. 20 Highly Available Firewalls
      21. 21 Firewall Management
      22. 22 Summary
      23. Chapter Review Questions/Exercises
      24. Exercise
    11. Chapter 30. Penetration Testing
      1. 1 Introduction
      2. 2 What is Penetration Testing?
      3. 3 How Does Penetration Testing Differ from an Actual “Hack?”
      4. 4 Types of Penetration Testing
      5. 5 Phases of Penetration Testing
      6. 6 Defining What’s Expected
      7. 7 The Need for a Methodology
      8. 8 Penetration Testing Methodologies
      9. 9 Methodology in Action
      10. 10 Penetration Testing Risks
      11. 11 Liability Issues
      12. 12 Legal Consequences
      13. 13 “Get Out of Jail Free” Card
      14. 14 Penetration Testing Consultants
      15. 15 Required Skill Sets
      16. 16 Accomplishments
      17. 17 Hiring a Penetration Tester
      18. 18 Why Should a Company Hire You?
      19. 19 Summary
      20. Chapter Review Questions/Exercises
      21. Exercise
    12. Chapter 31. What is Vulnerability Assessment?
      1. 1 Introduction
      2. 2 Reporting
      3. 3 The “it Won’t Happen to US” Factor
      4. 4 Why Vulnerability Assessment?
      5. 5 Penetration Testing Versus Vulnerability Assessment
      6. 6 Vulnerability Assessment Goal
      7. 7 Mapping the Network
      8. 8 Selecting the Right Scanners
      9. 9 Central Scans Versus Local Scans
      10. 10 Defense in Depth Strategy
      11. 11 Vulnerability Assessment Tools
      12. 12 SARA
      13. 13 SAINT
      14. 14 MBSA
      15. 15 Scanner Performance
      16. 16 Scan Verification
      17. 17 Scanning Cornerstones
      18. 18 Network Scanning Countermeasures
      19. 19 Vulnerability Disclosure Date
      20. 20 Proactive Security Versus Reactive Security
      21. 21 Vulnerability Causes
      22. 22 Diy Vulnerability Assessment
      23. 23 Summary
      24. Chapter Review Questions/Exercises
      25. Exercise
    13. Chapter 32. Security Metrics: An Introduction and Literature Review
      1. 1 Introduction
      2. 2 Why Security Metrics?
      3. 3 The Nature of Security Metrics
      4. 4 Getting Started with Security Metrics
      5. 5 Metrics in Action—Towards an Intelligent Security Dashboard
      6. 6 Security Metrics in the Literature
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
      10. References
  13. Part III: Cyber, Network, and Systems Forensics Security and Assurance
    1. Chapter 33. Cyber Forensics
      1. 1 What is Cyber Forensics?
      2. 2 Analysis of Data
      3. 3 Cyber Forensics in the Court System
      4. 4 Understanding Internet History
      5. 5 Temporary Restraining Orders and Labor Disputes
      6. 6 First Principles
      7. 7 Hacking a Windows XP Password
      8. 8 Network Analysis
      9. 9 Cyber Forensics Applied
      10. 10 Tracking, Inventory, Location of Files, Paperwork, Backups, and so on
      11. 11 Testifying as an Expert
      12. 12 Beginning to End in Court
      13. 13 Summary
      14. Chapter Review Questions/Exercises
      15. Exercise
    2. Chapter 34. Cyber Forensics and Incident Response
      1. 1 Introduction to Cyber Forensics
      2. 2 Handling Preliminary Investigations
      3. 3 Controlling an Investigation
      4. 4 Conducting Disk-Based Analysis
      5. 5 Investigating Information-Hiding Techniques
      6. 6 Scrutinizing Email
      7. 7 Validating Email Header Information
      8. 8 Tracing Internet Access
      9. 9 Searching Memory in Real Time
      10. 10 Summary
      11. Chapter Review Questions/Exercises
      12. Exercise
      13. References
    3. Chapter 35. Securing e-Discovery
      1. 1 Information Management
      2. 2 Legal and Regulatory Obligation
      3. 3 Summary
      4. Chapter Review Questions/Exercises
      5. Exercise
    4. Chapter 36. Network Forensics
      1. 1 Scientific Overview
      2. 2 The Principles of Network Forensics
      3. 3 Attack Traceback and Attribution
      4. 4 Critical Needs Analysis
      5. 5 Research Directions
      6. 6 Summary
      7. Chapter Review Questions/Exercises
      8. Exercise
  14. Part IV: Encryption Technology
    1. Chapter 37. Data Encryption
      1. 1 Need for Cryptography
      2. 2 Mathematical Prelude to Cryptography
      3. 3 Classical Cryptography
      4. 4 Modern Symmetric Ciphers
      5. 5 Algebraic Structure
      6. 6 The Internal Functions of Rijndael in AES Implementation
      7. 7 Use of Modern Block Ciphers
      8. 8 Public-Key Cryptography
      9. 9 Cryptanalysis of RSA
      10. 10 Diffie-Hellman Algorithm
      11. 11 Elliptic Curve Cryptosystems
      12. 12 Message Integrity and Authentication
      13. 13 Triple Data Encryption Algorithm (TDEA) Block Cipher
      14. 14 Summary
      15. Chapter Review Questions/Exercises
      16. Exercise
      17. References
    2. Chapter 38. Satellite Encryption
      1. 1 Introduction
      2. 2 The Need for Satellite Encryption
      3. 3 Implementing Satellite Encryption
      4. 4 Pirate Decryption of Satellite Transmissions
      5. 5 Satellite Encryption Policy
      6. 6 Satellite Encryption Service
      7. 7 The Future of Satellite Encryption
      8. 8 Summary
      9. Chapter Review Questions/Exercises
      10. Exercise
    3. Chapter 39. Public Key Infrastructure
      1. 1 Abstract
      2. 2 Contents
    4. Chapter 39. Public Key Infrastructure
      1. 1 Cryptographic Background
      2. 2 Overview of PKI
      3. 3 The X.509 Model
      4. 4 X.509 Implementation Architectures
      5. 5 X.509 Certificate Validation
      6. 6 X.509 Certificate Revocation
      7. 7 Server-Based Certificate Validity Protocol
      8. 8 X.509 Bridge Certification Systems
      9. 9 X.509 Certificate Format
      10. 10 PKI Policy Description
      11. 11 PKI Standards Organizations
      12. 12 PGP Certificate Formats
      13. 13 PGP PKI Implementations
      14. 14 W3C
      15. 15 Is PKI Secure?
      16. 16 Alternative PKI Architectures
      17. 17 Modified X.509 Architectures
      18. 18 Alternative Key Management Models
      19. 19 Summary
      20. Chapter Review Questions/Exercises
      21. Exercise
      22. References
    5. Chapter 40. Password-based Authenticated Key Establishment Protocols
      1. 1 Introduction to Key Exchange
      2. 2 Password-Authenticated Key Exchange
      3. 3 Concrete Protocols
      4. 4 Summary
      5. Chapter Review Questions/Exercises
      6. Exercise
      7. References
    6. Chapter 41. Instant-Messaging Security
      1. 1 Why Should I Care about Instant Messaging?
      2. 2 What is Instant Messaging?
      3. 3 The Evolution of Networking Technologies
      4. 4 Game Theory and Instant Messaging
      5. 5 The Nature of the Threat
      6. 6 Common IM Applications
      7. 7 Defensive Strategies
      8. 8 Instant-Messaging Security Maturity and Solutions
      9. 9 Processes
      10. 10 Summary
      11. Chapter Review Questions/Exercises
      12. Exercise
  15. Part V: Privacy and Access Management
    1. Chapter 42. Privacy on the Internet
      1. 1 Privacy in the Digital Society
      2. 2 The Economics of Privacy
      3. 3 Privacy-Enhancing Technologies
      4. 4 Network Anonymity
      5. 5 Summary
      6. Chapter Review Questions/Exercises
      7. Exercise
      8. References
    2. Chapter 43. Privacy-Enhancing Technologies
      1. 1 The Concept of Privacy
      2. 2 Legal Privacy Principles
      3. 3 Classification of PETs
      4. 4 Traditional Privacy Goals of PETs
      5. 5 Privacy Metrics
      6. 6 Data Minimization Technologies
      7. 7 Transparency-Enhancing Tools
      8. 8 Summary
      9. Chapter Review Questions/Exercises
      10. Exercise
      11. References
    3. Chapter 44. Personal Privacy Policies
      1. 1 Introduction
      2. 2 Content of Personal Privacy Policies
      3. 3 Semiautomated Derivation of Personal Privacy Policies
      4. 4 Specifying Well-Formed Personal Privacy Policies
      5. 5 Preventing Unexpected Negative Outcomes
      6. 6 The Privacy Management Model
      7. 7 Discussion and Related Work
      8. 8 Summary
      9. Chapter Review Questions/Exercises
      10. Exercise
    4. Chapter 45. Detection of Conflicts in Security Policies
      1. 1 Introduction
      2. 2 Conflicts in Security Policies
      3. 3 Conflicts in Executable Security Policies
      4. 4 Conflicts in Network Security Policies
      5. 5 Query-Based Conflict Detection
      6. 6 Semantic Web Technology for Conflict Detection
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
      10. Acknowledgments
      11. References
    5. Chapter 46. Supporting User Privacy Preferences in Digital Interactions
      1. 1 Introduction
      2. 2 Basic Concepts and Desiderata
      3. 3 Cost-Sensitive Trust Negotiation
      4. 4 Point-Based Trust Management
      5. 5 Logical-Based Minimal Credential Disclosure
      6. 6 Privacy Preferences in Credential-Based Interactions
      7. 7 Fine-Grained Disclosure of Sensitive Access Policies
      8. 8 Open Issues
      9. 9 Summary
      10. Chapter Review Questions/Exercises
      11. Exercise
      12. Acknowledgments
      13. References
    6. Chapter 47. Privacy and Security in Environmental Monitoring Systems: Issues and Solutions
      1. 1 Introduction
      2. 2 System Architectures
      3. 3 Environmental Data
      4. 4 Security and Privacy Issues in Environmental Monitoring
      5. 5 Countermeasures
      6. 6 Summary
      7. Chapter Review Questions/Exercises
      8. Exercise
      9. Acknowledgments
      10. References
    7. Chapter 48. Virtual Private Networks
      1. 1 History
      2. 2 Who is in Charge?
      3. 3 VPN Types
      4. 4 Authentication Methods
      5. 5 Symmetric Encryption
      6. 6 Asymmetric Cryptography
      7. 7 Edge Devices
      8. 8 Passwords
      9. 9 Hackers and Crackers
      10. 10 Mobile VPN
      11. 11 VPN Deployments
      12. 12 Summary
      13. Chapter Review Questions/Exercises
      14. Exercise
      15. Resources
    8. Chapter 49. Identity Theft
      1. 1 Abstract
      2. 2 Contents
    9. Chapter e49. Identity Theft
      1. 1 Experimental Design
      2. 2 Results and Analysis
      3. 3 Implications for Crimeware
      4. Summary
      5. Chapter Review Questions/Exercises
      6. Exercise
    10. Chapter 50. VoIP Security
      1. 1 Introduction
      2. 2 Overview of Threats
      3. 3 Security in VoIP
      4. 4 Future Trends
      5. 5 Summary
      6. Chapter Review Questions/Exercises
      7. Exercise
  16. Part VI: Storage Security
    1. Chapter 51. SAN Security
      1. 1 Abstract
      2. 2 Contents
    2. Chapter e51. SAN Security
      1. 1 Organizational Structure
      2. 2 Access Control Lists (ACl) and policies
      3. 3 Physical Access
      4. 4 Change Management
      5. 5 Password Policies
      6. 6 Defense in Depth
      7. 7 Vendor Security Review
      8. 8 Data Classification
      9. 9 Security Management
      10. 10 Auditing
      11. 11 Security Maintenance
      12. 12 Host Access: Partitioning
      13. 13 Data Protection: Replicas
      14. 14 Encryption in Storage
      15. 15 Application of Encryption
      16. 16 Summary
      17. Chapter Review Questions/Exercises
      18. Exercise
      19. References
    3. Chapter 52. Storage Area Networking Security Devices
      1. 1 What is a San?
      2. 2 San Deployment Justifications
      3. 3 The Critical Reasons for San Security
      4. 4 San Architecture and Components
      5. 5 San General Threats and Issues
      6. 6 Summary
      7. Chapter Review Questions/Exercises
      8. Exercise
    4. Chapter 53. Risk Management
      1. 1 The Concept of Risk
      2. 2 Expressing and Measuring Risk
      3. 3 The Risk Management Methodology
      4. 4 Risk Management Laws and Regulations
      5. 5 Risk Management Standards
      6. 6 Summary
      7. Chapter Review Questions/Exercises
      8. Exercise
  17. Part VII: Physical Security
    1. Chapter 54. Physical Security Essentials
      1. 1 Overview
      2. 2 Physical Security Threats
      3. 3 Physical Security Prevention and Mitigation Measures
      4. 4 Recovery from Physical Security Breaches
      5. 5 Threat Assessment, Planning, and Plan Implementation
      6. 6 Example: A Corporate Physical Security Policy
      7. 7 Integration of Physical and Logical Security
      8. 8 Physical Security Checklist
      9. 9 Summary
      10. Chapter Review Questions/Exercises
      11. Exercise
    2. Chapter 55. Disaster Recovery
      1. 1 Introduction
      2. 2 Measuring Risk and Avoiding Disaster
      3. 3 The Business Impact Assessment (BIA)
      4. 4 Summary
      5. Chapter Review Questions/Exercises
      6. Exercise
    3. Chapter 56. Biometrics
      1. 1 Relevant Standards
      2. 2 Biometric System Architecture
      3. 3 Using Biometric Systems
      4. 4 Security Considerations
      5. 5 Summary
      6. Chapter Review Questions/Exercises
      7. Exercise
    4. Chapter 57. Homeland Security
      1. 1 Abstract
      2. 2 Contents
    5. Chapter e57. Homeland Security
      1. 1 Statutory Authorities
      2. 2 Homeland Security Presidential Directives
      3. 3 Organizational Actions
      4. 4 Summary
      5. Chapter Review Questions/Exercises
      6. Exercise
    6. Chapter 58. Cyber Warfare
      1. 1 Cyber Warfare Model
      2. 2 Cyber Warfare Defined
      3. 3 CW: Myth or Reality?
      4. 4 Cyber Warfare: Making CW Possible
      5. 5 Legal Aspects of CW
      6. 6 Holistic View of Cyber Warfare
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
  18. Part VIII: Practical Security
    1. Chapter 59. System Security
      1. 1 Foundations of Security
      2. 2 Basic Countermeasures
      3. 3 Summary
      4. Chapter Review Questions/Exercises
      5. Exercise
    2. Chapter 60. Securing the Infrastructure
      1. 1 Communication Security Goals
      2. 2 Attacks and Countermeasures
      3. 3 Summary
      4. Chapter Review Questions/Exercises
      5. Exercise
    3. Chapter 61. Access Controls
      1. 1 Infrastructure Weaknesses: DAC, MAC, and RBAC
      2. 2 Strengthening the Infrastructure: Authentication Systems
      3. 3 Summary
      4. Chapter Review Questions/Exercises
      5. Exercise
    4. Chapter 62. Assessments and Audits
      1. 1 Assessing Vulnerabilities and Risk: Penetration Testing and Vulnerability Assessments
      2. 2 Risk Management: Quantitative Risk Measurements
      3. 3 Summary
      4. Chapter Review Questions/Exercises
      5. Exercise
    5. Chapter 63. Fundamentals of Cryptography
      1. 1 Assuring Privacy with Encryption
      2. 2 Summary
      3. Chapter Review Questions/Exercises
      4. Exercise
  19. Part IX: Advanced Security
    1. Chapter 64. Security Through Diversity
      1. 1 Ubiquity
      2. 2 Example Attacks Against Uniformity
      3. 3 Attacking Ubiquity with Antivirus Tools
      4. 4 The Threat of Worms
      5. 5 Automated Network Defense
      6. 6 Diversity and the Browser
      7. 7 Sandboxing and Virtualization
      8. 8 DNS Example of Diversity Through Security
      9. 9 Recovery from Disaster is Survival
      10. 10 Summary
      11. Chapter Review Questions/Exercises
      12. Exercise
    2. Chapter 65. Online e-Reputation Management Services
      1. 1 Introduction
      2. 2 The Human Notion of Reputation
      3. 3 Reputation Applied to the Computing World
      4. 4 State of the Art of Attack—Resistant Reputation Computation
      5. 5 Overview of Current Online Reputation Service
      6. 6 Summary
      7. Chapter Review Questions/Exercises
      8. Exercise
      9. Bibliography
    3. Chapter 66. Content Filtering
      1. 1 Abstract
      2. 2 Contents
    4. Chapter e66. Content Filtering
      1. 1 Defining the Problem
      2. 2 Why Content Filtering is Important
      3. 3 Content Categorization Technologies
      4. 4 Perimeter Hardware and Software Solutions
      5. 5 Categories
      6. 6 Legal Issues
      7. 7 Circumventing Content Filtering
      8. 8 Additional Items to Consider: Overblocking and Underblocking
      9. 9 Related Products
      10. 10 Summary
      11. Chapter Review Questions/Exercises
      12. Exercise
    5. Chapter 67. Data Loss Protection
      1. 1 Precursors of DLP
      2. 2 What is DLP?
      3. 3 Where to Begin?
      4. 4 Data is Like Water
      5. 5 You Don’t Know What You Don’t Know
      6. 6 How Do DLP Applications Work?
      7. 7 Eat Your Vegetables
      8. 8 IT’s a Family Affair, not Just it Security’s Problem
      9. 9 Vendors, Vendors Everywhere! Who do you Believe?
      10. 10 Summary
      11. Chapter Review Questions/Exercises
      12. Exercise
    6. Chapter 68. Satellite Cyber Attack Search and Destroy
      1. 1 Hacks, Interference, and Jamming
      2. 2 Summary
      3. Chapter Review Questions/Exercises
      4. Exercise
      5. References
    7. Chapter 69. Verifiable Voting Systems
      1. 1 Introduction
      2. 2 Security Requirements
      3. 3 Verifiable Voting Schemes
      4. 4 Building Blocks
      5. 5 Survey of Noteworthy Schemes
      6. 6 Threats to Verifiable Voting Systems
      7. 7 Summary
      8. Chapter Review Questions/Exercises
      9. Exercise
      10. References
    8. Chapter 70. Advanced Data Encryption
      1. 1 Mathematical Concepts Reviewed
      2. 2 The RSA Cryptosystem
      3. 3 Summary
      4. Chapter Review Questions/Exercises
      5. Exercise
      6. References
  20. Part X: Appendices
    1. Appendix eA. Configuring Authentication Service on Microsoft Windows 7
      1. 1 Configuring Windows 7 Authentication (Web Server (IIS 7))
      2. 2 Configuring Authentication in IIS 7
      3. References
    2. Appendix eB. Security Management and Resiliency
    3. Appendix eC. List of Top Information and Network Security Implementation and Deployment Companies
      1. 1 List of San Implementation and Deployment Companies
      2. 2 San Security Implementation and Deployment Companies:
      3. 3 Internet Security Implementation and Deployment Companies:
    4. Appendix eD. List of Security Products
      1. 1 Security Software
      2. 2 Realtime Protection
    5. Appendix eE. List of Security Standards
    6. Appendix eF. List of Miscellaneous Security Resources
      1. 1 Conferences
      2. 2 Consumer Information
      3. 3 Directories
      4. 4 Help and Tutorials
      5. 5 Mailing Lists
      6. 6 News and Media
      7. 7 Organizations
      8. 8 Products and Tools
      9. 9 Research
      10. 10 Content Filtering Links
      11. 11 Other Logging Resources
      12. 12 Additional Miscellaneous Security Resources
    7. Appendix eG. Ensuring Built-in Frequency Hopping Spread Spectrum Wireless Network Security
      1. 1 Accomplishment
      2. 2 Background
      3. 3 Additional Information
    8. Appendix eH. Configuring Wireless Internet Security Remote Access
      1. Adding the Access Points as Radius Clients to IAS
      2. Adding Access Points to the First IAS Server
      3. Scripting the Addition of Access Points to IAS Server (Alternative Procedure)
      4. Configuring the Wireless Access Points
      5. Enabling Secure Wlan Authentication on Access Points
      6. Additional Settings to Secure Wireless Access Points
      7. Replicating Radius Client Configuration to Other IAS Servers
    9. Appendix eI. Frequently Asked Questions
    10. Appendix eJ. Case Studies
      1. 1 Case Study 1: SSL VPN Solution Planning And Implementation
      2. 2 Challenges
      3. 3 Solution
      4. 4 Case Study 2: Cyber Attacks on Critical Infrastructures—A Risk to the Nation
      5. 5 Challenges
      6. 6 Solution
      7. 7 Case Study 3: Department of Homeland Security Battle Insider Threats and Maintain National Cyber Security
      8. 8 Challenges
      9. 9 Solution
      10. 10 Case Study 4: Cyber Security Development Lifecycle
      11. 11 Challenges
      12. 12 Solution
      13. 13 Case Study 5: Cyber Security and Beyond ……
      14. 14 Challenges
    11. Appendix eK. Answers To Review Questions/Exercises, Hands-On Projects, Case Projects And Optional Team Case Project By Chapter
      1. Chapter 1: Building A Secure Organization
      2. Chapter 2: A Cryptography Primer
      3. Chapter 3: Detecting System Intrusions
      4. Chapter 4: Preventing System Intrusions
      5. Chapter 5: Guarding Against Network Intrusions
      6. Chapter 6: Securing Cloud Computing Systems
      7. Chapter 7: Fault Tolerance and Resilience in Cloud Computing Environments
      8. Chapter 8: Securing Web Applications, Services and Servers
      9. Chapter 9: UNIX and Linux Security
      10. Chapter 10: Eliminating the Security Weakness of Linux and UNIX Operating Systems
      11. Chapter 11: Internet Security
      12. Chapter 12: The Botnet Problem
      13. Chapter 13: Intranet Security
      14. Chapter 14: Local Area Network Security
      15. Chapter 15: Wireless Network Security
      16. Chapter 16: Wireless Sensor Network Security
      17. Chapter 17: Cellular Network Security
      18. Chapter 18: RFID Security
      19. Chapter 19: Optical Network Security
      20. Chapter 20: Optical Wireless Security
      21. Chapter 21: Information Security Essentials for IT Managers: Protecting Mission-Critical Systems
      22. Chapter 22: Security Management Systems
      23. Chapter 23: Policy-Driven System Management
      24. Chapter 24: Information Technology Security Management
      25. Chapter 25: Online Identity and User Management Services
      26. Chapter 26: Intrusion Detection And Prevention Systems
      27. Chapter 27: TCP/IP Packet Analysis
      28. Chapter 28: The Enemy (The Intruder’s Genesis)
      29. Chapter 29: Firewalls
      30. Chapter 30: Penetration Testing
      31. Chapter 31: Building A Secure Organization
      32. Chapter 32: Security Metrics: An Introduction and Literature Review
      33. Chapter 33: Cyber Forensics
      34. Chapter 34: Cyber Forensics And Incident Response
      35. Chapter 35: Secure E-Discovery
      36. Chapter 36: Network Forensics
      37. Chapter 37: Data Encryption
      38. Chapter 38: Satellite Encryption
      39. Chapter 39: Public Key Infrastructure
      40. Chapter 40: Password-based Authenticated Key Establishment Protocols
      41. Chapter 41: Instant-Messaging Security
      42. Chapter 42: Privacy On The Internet
      43. Chapter 43: Physical Security Essentials
      44. Chapter 44: Personal Privacy Policies
      45. Chapter 45: Detection Of Conflicts In Security Policies
      46. Chapter 46: Supporting User Privacy Preferences in Digital Interactions
      47. Chapter 47: Physical Security Essentials
      48. Chapter 48: Virtual Private Networks
      49. Chapter 49: Identity Theft
      50. Chapter 50: Physical Security Essentials
      51. Chapter 51: SAN Security
      52. Chapter 52: Storage Area Networking Security Devices
      53. Chapter 53: Risk Management
      54. Chapter 54: Physical Security Essentials
      55. Chapter 55: Disaster Recovery
      56. Chapter 56: Biometrics
      57. Chapter 57: Homeland Security
      58. Chapter 58: Cyber Warefare
      59. Chapter 59: Systems Security
      60. Chapter 60: Securing The Infrastructure
      61. Chapter 61: Access Controls
      62. Chapter 62: Assessments And Audits
      63. Chapter 63: Fundamentals Of Cryptography
      64. Chapter 64: Security Through Diversity
      65. Chapter 65: Online e-Reputation Management Services
      66. Chapter 66: Content Filtering
      67. Chapter 67: Data Loss Protection
      68. Chapter 68: Satellite Cyber Attack Search And Destroy
      69. Chapter 69: Verifiable Voting Systems
      70. Chapter 70: Advanced Data Encryption
    12. Appendix eL. Glossary
    13. Index

Product information

  • Title: Computer and Information Security Handbook, 2nd Edition
  • Author(s): John R. Vacca
  • Release date: November 2012
  • Publisher(s): Morgan Kaufmann
  • ISBN: 9780123946126