Computer Security: Principles and Practice (Hardcover)

William Stallings, Lawrence Brown

  • 出版商: Prentice Hall
  • 出版日期: 2007-08-12
  • 售價: $1,060
  • 貴賓價: 9.8$1,039
  • 語言: 英文
  • 頁數: 512
  • 裝訂: Hardcover
  • ISBN: 0136004245
  • ISBN-13: 9780136004240
  • 相關分類: 資訊安全

立即出貨(限量) (庫存=1)

買這商品的人也買了...

商品描述

Description

For courses in Computer/Network Security.

 

In recent years, the need for education in computer security and related topics has grown dramatically – and is essential for anyone studying Computer Science or Computer Engineering. This is the only text available to provide integrated, comprehensive, up-to-date coverage of the broad range of topics in this subject. In addition to an extensive pedagogical program, the book provides unparalleled support for both research and modeling projects, giving students a broader perspective.

Table of Contents

Notation   Preface   Chapter 0 Reader's and Instructor's Guide

0.1  Outline of the Book

0.2 A Roadmap for Readers and Instructors

0.3 Internet and Web Resources

0.4  Standards

 

  Chapter 1 Overview

1.1 Computer Security Concepts

1.2 Threats, Attacks, and Assets

1.3  Security Functional Requirements

1.4 A Security Architecture for Open Systems

1.5 The Scope of Computer Security

1.6 Computer Security Trends

1.7  Computer Security Strategy

1.8  Recommended Reading and Web Sites

1.9  Key Terms, Review Questions, and Problems

Appendix 1A   Signficant Security Standards and Documents

 

  PART ONE  COMPUTER SECURITY TECHNOLOGY AND PRINCIPLES

 

Chapter 2 Cryptographic Tools

2.1 Confidentiality with Symmetric Encryption

2.2  Message Authentication and Hash Functions

2.3  Public-Key Encryption

2.4  Digital Signatures and Key Management

2.5  Random and Pseudorandom Numbers

2.6  Practical Application: Encryption of Stored Data

2.7  Recommended Reading and Web Sites

2.8  Key Terms, Review Questions, and Problems

 

Chapter 3 User Authentication

3.1 Means of Authentication

3.2  Password-Based Authentication

3.3  Token-Based Authentication

3.4  Biometric Authentication

3.5  Remote User Authentication

3.6  Security Issues for User Authentication

3.7  Practical Application: An Iris Biometric System

3.8  Case Study: Security Problems for ATM Systems

3.9  Recommended Reading and Web Sites

3.10 Key Terms, Review Questions, and Problems

 

Chapter 4 Access Control

4.1  Access Control Principles

4.2  Subjects, Objects, and Access Rights

4.3  Discretionary Access Control

4.4  Example: UNIX File Access Control

4.5  Role-Based Access Control

4.6  Case Study: RBAC System for a Bank

4.7  Recommended Reading and Web Sites

4.8  Key Terms, Review Questions, and Problems

 

Chapter 5 Database Security

5.1  Relational Databases

5.2  Database Access Control

5.3  Inference

5.4  Statistical Databases

5.5  Database Encryption

5.6  Recommended Reading

5.7  Key Terms, Review Questions, and Problems

 

  Chapter 6 Intrusion Detection

6.1  Intruders

6.2  Intrusion Detection

6.3  Host-Based Intrusion Detection

6.4  Distributed Host-Based Intrusion Detection

6.5  Network-Based Intrusion Detection

6.6  Distributed Adaptive Intrusion Detection

6.7  Intrustion Detection Exchange Format

6.8  Honeypots

6.9  Example System: Snort

6.10 Recommended Reading and Web Sites

6.11 Key Terms, Review Questions, and Problems

Appendix 6A:The Base-Rate Fallacy

 

Chapter 7 Malicious Software

7.1  Types of Malicious Software

7.2  Viruses

7.3  Virus Countermeasures

7.4  Worms

7.5  Bots

7.6  Rootkits

7.7  Recommended Reading and Web Sites

7.8  Key Terms, Review Questions, and Problems

 

Chapter 8 Denial of Service

8.1  Denial of Service Attacks

8.2  Flooding Attacks

8.3  Distributed Denial of Service Attacks

8.4  Reflector and Amplifier Attacks

8.5  Defenses Against Denial of Service Attacks

8.6  Responding to a Denial of Service Attack

8.7  Recommended Reading and Web Sites

8.8  Key Terms, Review Questions, and Problems

 

Chapter 9 Firewalls and Intrusion Prevention Systems

9.1  The Need for Firewalls

9.2  Firewall Characteristics

9.3  Types of Firewalls

9.4  Firewall Basing

9.5  Firewall Location and Configurations

9.6  Intrusion Prevention Systems

9.7  Example: Unified Threat Management Products

9.8  Recommended Reading and Web Sites

9.9  Key Terms, Review Questions, and Problems

 

Chapter 10    Trusted Computing and Multilevel Security

10.1 The Bell-LaPadula Model for Computer Security

10.2 Other Formal Models for Computer Security

10.3 The Concept of Trusted Systems

10.4 Application of Multilevel Security

10.5 Trusted Computing and the Trusted Platform Module

10.6 Common Criteria for Information Technology Security Evaluation

10.7 Assurance and Evaluation

10.8 Recommended Reading and Web Sites

10.9 Key Terms, Review Questions, and Problems

 

 

PART TWO  SOFTWARE SECURITY

 

Chapter 11    Buffer Overflow

11.1    Stack Overflows

11.2    Defending Against Buffer Overflows

11.3    Other Forms of Overflow Attacks

11.4    Recommended Reading and Web Sites

11.5    Key Terms, Review Questions, and Problems

 

Chapter 12    Other Software Security Issues

12.1    Software Security Issues

12.2    Handling Program Input

12.3    Writing Safe Program Code

12.4    Interacting with the Operating System

12.5    Handling Program Input

12.6    Recommended Reading and Web Sites

12.7    Key Terms, Review Questions, and Problems

 

 

PART THREE    MANAGEMENT ISSUES

 

Chapter 13    Physical and Infrastructure Security

13.1 Overview

13.2 Physical Security Threats

13.3 Physical Security Prevention and Mitigation Measures

13.4 Recovery from Physical Security Breaches

13.5 Threat Assessment, Planning, and Plan Implementation

13.6 Example: A Corporate Physical Security Policy.

13.7 Integration of Physical and Logical Security

13.8 Recommended Reading and Web Sites

13.9 Key Terms, Review Questions, and Problems

 

Chapter 14    Human Factors

14.1 Security Awareness, Training, and Education

14.2 Organizational Security Policy

14.3 Employment Practices and Policies

14.4   E-Mail and Internet Use Policies

14.5 Example: A Corporate Security Policy Document

14.6 Recommended Reading and Web Sites

14.7 Key Terms, Review Questions, and Problems

Appendix 14A: Security Awareness Standard of Good Practice

Appendix 14B: Security Policy Standard of Good Practice

 

Chapter 15    Security Auditing

15.1 Security Auditing Architecture

15.2 The Security Audit Trail

15.3   Implementing the Logging Function

15.4 Audit Trail Analysis

15.5 Example: An Integrated Approach

15.6 Recommended Reading and Web Sites

15.7 Key Terms, Review Questions, and Problems

 

Chapter 16    IT Security Management and Risk Assessment

16.1   IT Security Management

16.2 Organizational Context and Security Policy

16.3 Security Risk Assessment

16.4 Detailed Security Risk Analysis

16.5 Case Study: Silver Star Mines

16.6 Recommended Reading and Web Sites

16.7 Key Terms, Review Questions, and Problems

 

Chapter 17    IT Security Controls, Plans and Procedures

17.1   IT Security Management Implementation

17.2 Security Controls or Safeguards

17.3 IT Security Plan

17.4 Implementation of Controls

17.5 Implementation Followup

17.6 Case Study: Silver Star Mines

17.7 Recommended Reading and Web Sites

17.8 Key Terms, Review Questions, and Problems

 

Chapter 18    Legal and Ethical Aspects

18.1   Cybercrime and Computer Crime

18.2 Intellectual Property

18.3 Privacy

18.4 Ethical Issues

18.5 Recommended Reading and Web Sites

18.6 Key Terms, Review Questions, and Problems

Appendix 18A: Information Privacy Standard of Good Practice

 

 

PART FOUR  CRYPTOGRAPHIC ALGORITHMS

 

Chapter 19    Symmetric Encryption and Message Confidentiality

19.1 Symmetric Encryption and Message Confidentiality

19.2 Data Encryption Standard

19.3 Advanced Encryption Standard

19.4 Stream Ciphers and RC4

19.5 Cipher Block Modes of Operation

19.6 Location of Symmetric Encryption Devices

19.7 Key Distribution

19.8 Recommended Reading and Web Sites

19.9 Key Terms, Review Questions, and Problems

 

Chapter 20    Public-Key Cryptography and Message Authentication

20.1 Secure Hash Functions

20.2 HMAC

20.3 The RSA Public-Key Encryption Algorithm

20.4 Diffie-Hellman and Other Asymmetric Algorithms

20.5 Recommended Reading and Web Sites

20.6 Key Terms, Review Questions, and Problems

 

  PART FIVE INTERNET SECURITY   Chapter 21    Internet Security Protocols and Standards

21.1 Secure Sockets Layer (SSL) and Transport Layer Security (TLS)

21.2 IPv4 and IPv6 Security

21.3 Secure Email and S/MIME

21.4 Recommended Reading and Web Sites

21.5 Key Terms, Review Questions, and Problems

Appendix 21A Radix-64 Conversion

 

  Chapter 22    Internet Authentication Applications

22.1 Kerberos

22.2 X.509

22.3 Public-Key Infrastructure

22.4 Federated Identity Management

22.5 Recommended Reading and Web Sites

22.6 Key Terms, Review Questions, and Problems

 

PART SIX  OPERATING SYSTEM SECURITY*

 

Chapter 23    Linux Security

23.1    Introduction

23.2    Linux's Security Model

23.3    The Linux DAC in Depth: Filesystem Security

23.4    Linux Vulnerabilities

23.5    Linux System Hardening

23.6    Application Security

23.7    Mandatory Access Controls

23.8    Recommended Reading and Web Sites

23.9    Key Terms, Review Questions, and Problems

 

Chapter 24    Windows Security

–Windows Overview

–Windows Security Basics

–Windows User Security

–Windows Network Security

 

 

APPENDICES

 

Appendix A  Some Aspects of Number Theory

A.1 Prime and Relatively Prime Numbers

A.2  Modular Arithmetic

A.3  Fermat's and Euler's Theorems

 

  Appendix B  Random and Pseudorandom Number Generation

B.1 The Use of Random Numbers

B.2 Pseudorandom Number Generators (PRNGs)

B.3 True Random Number Generators

 

  Appendix  C Projects for Teaching Computer Security

C.1    Research Projects

C.2 Programming Projects

C.3 Laboratory Exercises

C.4 Writing Assignments

C.5    Reading/Report Assignments

  REFERENCES   INDEX   LIST OF ACRONYMS

 

 

ONLINE APPENDICES

 

 

Appendix D   Standards and Standard-Setting Organizations

    A.1 The Importance of Standards

       A.2    Internet Standards and the Internet Society

       A.3    National Institute of Standards and Technology

       A.4    ITU-T

       A.5    ISO

  Appendix E TCP/IP Protocol Architecture

 

Appendix F Glossary