THE INTERNATIONAL HANDBOOK OF COMPUTER SECURITY
CONTENTS CHAPTER 0 READER’S AND INSTRUCTOR’S GUIDE OUTLINE OF THIS BOOK A ROADMAP FOR READERS AND INSTRUCTORS SUPPORT FOR CISSP CERTIFICATION SUPPORT FOR NSA/DHS CERTIFICATION SUPPORT FOR ACM/IEEE COMPUTER SOCIETY COMPUTER SCIENCE CURRICULA 2013 INTERNET AND WEB RESOURCES STANDARDS CHAPTER 1 OVERVIEW COMPUTER SECURITY CONCEPTS THREATS, ATTACKS, AND ASSETS SECURITY FUNCTIONAL REQUIREMENTS FUNDAMENTAL SECURITY DESIGN PRINCIPLES ATTACK SURFACES AND ATTACK TREES COMPUTER SECURITY STRATEGY RECOMMENDED READING KEY TERMS, REVIEW QUESTIONS, AND PROBLEMS PART ONE COMPUTER SECURITY TECHNOLOGY AND PRINCIPLES CHAPTER 2 CRYPTOGRAPHIC TOOLS CONFIDENTIALITY WITH SYMMETRIC ENCRYPTION MESSAGE AUTHENTICATION AND HASH FUNCTIONS PUBLIC-KEY ENCRYPTION DIGITAL SIGNATURES AND KEY MANAGEMENT RANDOM AND PSEUDORANDOM NUMBERS PRACTICAL APPLICATION: ENCRYPTION OF STORED DATA CHAPTER 3 USER AUTHENTICATION ELECTRONIC USER AUTHENTICATION PRINCIPLES PASSWORD-BASED AUTHENTICATION TOKEN-BASED AUTHENTICATION BIOMETRIC AUTHENTICATION REMOTE USER AUTHENTICATION SECURITY ISSUES FOR USER AUTHENTICATION PRACTICAL APPLICATION: AN IRIS BIOMETRIC SYSTEM CASE STUDY: SECURITY PROBLEMS FOR ATM SYSTEMS CHAPTER 4 ACCESS CONTROL ACCESS CONTROL PRINCIPLES SUBJECTS, OBJECTS, AND ACCESS RIGHTS DISCRETIONARY ACCESS CONTROL EXAMPLE: UNIX FILE ACCESS CONTROL ROLE-BASED ACCESS CONTROL ATTRIBUTE-BASED ACCESS CONTROL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT TRUST FRAMEWORKS CASE STUDY: RBAC SYSTEM FOR A BANK CHAPTER 5 DATABASE AND CLOUD SECURITY THE NEED FOR DATABASE SECURITY DATABASE MANAGEMENT SYSTEMS RELATIONAL DATABASES SQL INJECTION ATTACKS DATABASE ACCESS CONTROL INFERENCE DATABASE ENCRYPTION CLOUD COMPUTING CLOUD SECURITY RISKS AND COUNTERMEASURES DATA PROTECTION IN THE CLOUD CLOUD SECURITY AS A SERVICE CHAPTER 6 MALICIOUS SOFTWARE TYPES OF MALICIOUS SOFTWARE (MALWARE) ADVANCED PERSISTENT THREAT PROPAGATION—INFECTED CONTENT—VIRUSES PROPAGATION—VULNERABILITY EXPLOIT—WORMS PROPAGATION—SOCIAL ENGINEERING—SPAM E-MAIL, TROJANS PAYLOAD—SYSTEM CORRUPTION PAYLOAD—ATTACK AGENT—ZOMBIE, BOTS PAYLOAD—INFORMATION THEFT—KEYLOGGERS, PHISHING, SPYWARE PAYLOAD—STEALTHING—BACKDOORS, ROOTKITS COUNTERMEASURES CHAPTER 7 DENIAL-OF-SERVICE ATTACKS DENIAL-OF-SERVICE ATTACKS FLOODING ATTACKS DISTRIBUTED DENIAL-OF-SERVICE ATTACKS APPLICATION-BASED BANDWIDTH ATTACKS REFLECTOR AND AMPLIFIER ATTACKS DEFENSES AGAINST DENIAL-OF-SERVICE ATTACKS RESPONDING TO A DENIAL-OF-SERVICE ATTACK CHAPTER 8 INTRUSION DETECTION INTRUDERS INTRUSION DETECTION ANALYSIS APPROACHES HOST-BASED INTRUSION DETECTION NETWORK-BASED INTRUSION DETECTION DISTRIBUTED OR HYBRID INTRUSION DETECTION INTRUSION DETECTION EXCHANGE FORMAT HONEYPOTS EXAMPLE SYSTEM: SNORT CHAPTER 9 FIREWALLS AND INTRUSION PREVENTION SYSTEMS THE NEED FOR FIREWALLS FIREWALL CHARACTERISTICS AND ACCESS POLICY TYPES OF FIREWALLS FIREWALL BASING FIREWALL LOCATION AND CONFIGURATIONS INTRUSION PREVENTION SYSTEMS EXAMPLE: UNIFIED THREAT MANAGEMENT PRODUCTS PART TWO SOFTWARE SECURITY AND TRUSTED SYSTEMS CHAPTER 10 BUFFER OVERFLOW STACK OVERFLOWS DEFENDING AGAINST BUFFER OVERFLOWS OTHER FORMS OF OVERFLOW ATTACKS CHAPTER 11 SOFTWARE SECURITY SOFTWARE SECURITY ISSUES HANDLING PROGRAM INPUT WRITING SAFE PROGRAM CODE INTERACTING WITH THE OPERATING SYSTEM AND OTHER PROGRAMS HANDLING PROGRAM OUTPUT CHAPTER 12 OPERATING SYSTEM SECURITY INTRODUCTION TO OPERATING SYSTEM SECURITY SYSTEM SECURITY PLANNING OPERATING SYSTEMS HARDENING APPLICATION SECURITY SECURITY MAINTENANCE LINUX/UNIX SECURITY WINDOWS SECURITY VIRTUALIZATION SECURITY CHAPTER 13 TRUSTED COMPUTING AND MULTILEVEL SECURITY THE BELL-LAPADULA MODEL FOR COMPUTER SECURITY OTHER FORMAL MODELS FOR COMPUTER SECURITY THE CONCEPT OF TRUSTED SYSTEMS APPLICATION OF MULTILEVEL SECURITY TRUSTED COMPUTING AND THE TRUSTED PLATFORM MODULE COMMON CRITERIA FOR INFORMATION TECHNOLOGY SECURITY EVALUATION ASSURANCE AND EVALUATION PART THREE MANAGEMENT ISSUES CHAPTER 14 IT SECURITY MANAGEMENT AND RISK ASSESSMENT IT SECURITY MANAGEMENT ORGANIZATIONAL CONTEXT AND SECURITY POLICY SECURITY RISK ASSESSMENT DETAILED SECURITY RISK ANALYSIS CASE STUDY: SILVER STAR MINES CHAPTER 15 IT SECURITY CONTROLS, PLANS, AND PROCEDURES IT SECURITY MANAGEMENT IMPLEMENTATION SECURITY CONTROLS OR SAFEGUARDS IT SECURITY PLAN IMPLEMENTATION OF CONTROLS MONITORING RISKS CHAPTER 16 PHYSICAL AND INFRASTRUCTURE SECURITY OVERVIEW PHYSICAL SECURITY THREATS PHYSICAL SECURITY PREVENTION AND MITIGATION MEASURES RECOVERY FROM PHYSICAL SECURITY BREACHES EXAMPLE: A CORPORATE PHYSICAL SECURITY POLICY INTEGRATION OF PHYSICAL AND LOGICAL SECURITY CHAPTER 17 HUMAN RESOURCES SECURITY SECURITY AWARENESS, TRAINING, AND EDUCATION EMPLOYMENT PRACTICES AND POLICIES E-MAIL AND INTERNET USE POLICIES COMPUTER SECURITY INCIDENT RESPONSE TEAMS CHAPTER 18 SECURITY AUDITING SECURITY AUDITING ARCHITECTURE SECURITY AUDIT TRAIL IMPLEMENTING THE LOGGING FUNCTION AUDIT TRAIL ANALYSIS EXAMPLE: AN INTEGRATED APPROACH CHAPTER 19 LEGAL AND ETHICAL ASPECTS CYBERCRIME AND COMPUTER CRIME INTELLECTUAL PROPERTY PRIVACY ETHICAL ISSUES PART FOUR CRYPTOGRAPHIC ALGORITHMS CHAPTER 20 SYMMETRIC ENCRYPTION AND MESSAGE CONFIDENTIALITY SYMMETRIC ENCRYPTION PRINCIPLES DATA ENCRYPTION STANDARD ADVANCED ENCRYPTION STANDARD STREAM CIPHERS AND RC4 CIPHER BLOCK MODES OF OPERATION LOCATION OF SYMMETRIC ENCRYPTION DEVICES KEY DISTRIBUTION CHAPTER 21 PUBLIC-KEY CRYPTOGRAPHY AND MESSAGE AUTHENTICATION SECURE HASH FUNCTIONS HMAC THE RSA PUBLIC-KEY ENCRYPTION ALGORITHM DIFFIE-HELLMAN AND OTHER ASYMMETRIC ALGORITHMS PART FIVE NETWORK SECURITY CHAPTER 22 INTERNET SECURITY PROTOCOLS AND STANDARDS SECURE E-MAIL AND S/MIME DOMAINKEYS IDENTIFIED MAIL SECURE SOCKETS LAYER (SSL) AND TRANSPORT LAYER SECURITY (TLS) HTTPS IPV4 AND IPV6 SECURITY CHAPTER 23 INTERNET AUTHENTICATION APPLICATIONS KERBEROS X 509 PUBLIC-KEY INFRASTRUCTURE CHAPTER 24 WIRELESS NETWORK SECURITY WIRELESS SECURITY MOBILE DEVICE SECURITY IEEE 802 11 WIRELESS LAN OVERVIEW IEEE 802 11I WIRELESS LAN SECURITY 0 1 OUTLINE OF THIS BOOK 0 2 A ROADMAP FOR READERS AND INSTRUCTORS 0 3 SUPPORT FOR CISSP CERTIFICATION 0 4 SUPPORT FOR NSA/DHS CERTIFICATION 0 5 SUPPORT FOR ACM/IEEE COMPUTER SOCIETY COMPUTER SCIENCE CURRICULA