Computer Security, 3rd Edition

CHAPTER 1 – History of Computer Security 1

1.1 The Dawn of Computer Security 2

1.2 1970s – Mainframes 3

1.3 1980s – Personal Computers 4

1.4 1990s – Internet 6

1.5 2000s – The Web 8

1.6 Conclusions – The Benefits of Hindsight 10

1.7 Exercises 11

CHAPTER 2 – Managing Security 13

2.1 Attacks and Attackers 14

2.2 Security Management 15

2.3 Risk and Threat Analysis 21

2.4 Further Reading 29

2.5 Exercises 29

CHAPTER 3 – Foundations of Computer Security 31

3.1 Definitions 32

3.2 The Fundamental Dilemma of Computer Security 40

3.3 Data vs Information 40

3.4 Principles of Computer Security 41

3.5 The Layer Below 45

3.6 The Layer Above 47

3.7 Further Reading 47

3.8 Exercises 48

CHAPTER 4 – Identification and Authentication 49

4.1 Username and Password 50

4.2 Bootstrapping Password Protection 51

4.3 Guessing Passwords 52

4.4 Phishing, Spoofing, and Social Engineering 54

4.5 Protecting the Password File 56

4.6 Single Sign-on 58

4.7 Alternative Approaches 59

4.8 Further Reading 63

4.9 Exercises 63

CHAPTER 5 – Access Control 65

5.1 Background 66

5.2 Authentication and Authorization 66

5.3 Access Operations 68

5.4 Access Control Structures 71

5.5 Ownership 73

5.6 Intermediate Controls 74

5.7 Policy Instantiation 79

5.8 Comparing Security Attributes 79

5.9 Further Reading 84

5.10 Exercises 84

CHAPTER 6 – Reference Monitors 87

6.1 Introduction 88

6.2 Operating System Integrity 90

6.3 Hardware Security Features 91

6.4 Protecting Memory 99

6.5 Further Reading 103

6.6 Exercises 104

CHAPTER 7 – Unix Security 107

7.1 Introduction 108

7.2 Principals 109

7.3 Subjects 111

7.4 Objects 113

7.5 Access Control 116

7.6 Instances of General Security Principles 119

7.7 Management Issues 125

7.8 Further Reading 128

7.9 Exercises 128

CHAPTER 8 – Windows Security 131

8.1 Introduction 132

8.2 Components of Access Control 135

8.3 Access Decisions 142

8.4 Managing Policies 145

8.5 Task-Dependent Access Rights 147

8.6 Administration 150

8.7 Further Reading 153

8.8 Exercises 153

CHAPTER 9 – Database Security 155

9.1 Introduction 156

9.2 Relational Databases 158

9.3 Access Control 162

9.4 Statistical Database Security 167

9.5 Integration with the Operating System 172

9.6 Privacy 173

9.7 Further Reading 175

9.8 Exercises 175

CHAPTER 10 – Software Security 177

10.1 Introduction 178

10.2 Characters and Numbers 179

10.3 Canonical Representations 183

10.4 Memory Management 184

10.5 Data and Code 191

10.6 Race Conditions 193

10.7 Defences 194

10.8 Further Reading 201

10.9 Exercises 202

CHAPTER 11 – Bell–LaPadula Model 205

11.1 State Machine Models 206

11.2 The Bell–LaPadula Model 206

11.3 The Multics Interpretation of BLP 212

11.4 Further Reading 216

11.5 Exercises 216

CHAPTER 12 – Security Models 219

12.1 The Biba Model 220

12.2 Chinese Wall Model 221

12.3 The Clark–Wilson Model 223

12.4 The Harrison–Ruzzo–Ullman Model 225

12.5 Information-Flow Models 228

12.6 Execution Monitors 230

12.7 Further Reading 232

12.8 Exercises 233

CHAPTER 13 – Security Evaluation 235

13.1 Introduction 236

13.2 The Orange Book 239

13.3 The Rainbow Series 241

13.4 Information Technology Security Evaluation Criteria 242

13.5 The Federal Criteria 243

13.6 The Common Criteria 243

13.7 Quality Standards 246

13.8 An Effort Well Spent? 247

13.9 Summary 248

13.10 Further Reading 248

13.11 Exercises 249

CHAPTER 14 – Cryptography 251

14.1 Introduction 252

14.2 Modular Arithmetic 256

14.3 Integrity Check Functions 257

14.4 Digital Signatures 260

14.5 Encryption 264

14.6 Strength of Mechanisms 270

14.7 Performance 271

14.8 Further Reading 272

14.9 Exercises 273

CHAPTER 15 – Key Establishment 275

15.1 Introduction 276

15.2 Key Establishment and Authentication 276

15.3 Key Establishment Protocols 279

15.4 Kerberos 283

15.5 Public-Key Infrastructures 288

15.6 Trusted Computing – Attestation 293

15.7 Further Reading 295

15.8 Exercises 295

CHAPTER 16 – Communications Security 297

16.1 Introduction 298

16.2 Protocol Design Principles 299

16.3 IP Security 301

16.4 IPsec and Network Address Translation 308

16.5 SSL/TLS 310

16.6 Extensible Authentication Protocol 314

16.7 Further Reading 316

16.8 Exercises 316

CHAPTER 17 – Network Security 319

17.1 Introduction 320

17.2 Domain Name System 322

17.3 Firewalls 328

17.4 Intrusion Detection 332

17.5 Further Reading 335

17.6 Exercises 336

CHAPTER 18 – Web Security 339

18.1 Introduction 340

18.2 Authenticated Sessions 342

18.3 Code Origin Policies 346

18.4 Cross-Site Scripting 347

18.5 Cross-Site Request Forgery 350

18.6 JavaScript Hijacking 352

18.7 Web Services Security 354

18.8 Further Reading 360

18.9 Exercises 361

CHAPTER 19 – Mobility 363

19.1 Introduction 364

19.2 GSM 364

19.3 UMTS 369

19.4 Mobile IPv6 Security 372

19.5 WLAN 377

19.6 Bluetooth 381

19.7 Further Reading 383

19.8 Exercises 383

CHAPTER 20 – New Access Control Paradigms 385

20.1 Introduction 386

20.2 SPKI 388

20.3 Trust Management 390

20.4 Code-Based Access Control 391

20.5 Java Security 395

20.6 .NET Security Framework 400

20.7 Digital Rights Management 405

20.8 Further Reading 406

20.9 Exercises 406

Bibliography 409

Index 423