Computer Security Basics, 2nd Edition

Computer Security Basics, 2nd Edition

by Rick Lehtinen, G.T. Gangemi
Released June 2006
Publisher(s): O'Reilly Media, Inc.
ISBN: 9780596006693

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Buy on Amazon Buy on ebooks.com
Start your free trial

Book description

This is the must-have book for a must-know field. Today, general security knowledge is mandatory, and, if you who need to understand the fundamentals, Computer Security Basics 2nd Edition is the book to consult.



The new edition builds on the well-established principles developed in the original edition and thoroughly updates that core knowledge. For anyone involved with computer security, including security administrators, system administrators, developers, and IT managers, Computer Security Basics 2nd Edition offers a clear overview of the security concepts you need to know, including access controls, malicious software, security policy, cryptography, biometrics, as well as government regulations and standards.



This handbook describes complicated concepts such as trusted systems, encryption, and mandatory access control in simple terms. It tells you what you need to know to understand the basics of computer security, and it will help you persuade your employees to practice safe computing.



Topics include:
  • Computer security concepts
  • Security breaches, such as viruses and other malicious programs
  • Access controls
  • Security policy
  • Web attacks
  • Communications and network security
  • Encryption
  • Physical security and biometrics
  • Wireless network security
  • Computer security and requirements of the Orange Book
  • OSI Model and TEMPEST

Publisher resources

View/Submit Errata

Table of contents

  1. Preface
    1. About This Book
    2. Summary of Contents
      1. Part I, Security for Today
      2. Part II, Computer Security
      3. Part III, Communications Security
      4. Part IV, Other Types of Security
      5. Part V, Appendixes
    3. Using Code Examples
    4. Comments and Questions
    5. Safari® Enabled
    6. Acknowledgments
  2. I. Security for Today
    1. 1. Introduction
      1. The New Insecurity
        1. Who You Gonna Call?
          1. Information Sharing and Analysis Centers
          2. Vulnerable broadband
          3. No computer is an island
        2. The Sorry Trail
          1. Computer crime
      2. What Is Computer Security?
        1. A Broader Definition of Security
        2. Secrecy and Confidentiality
        3. Accuracy, Integrity, and Authenticity
        4. Availability
      3. Threats to Security
        1. Vulnerabilities
          1. Physical vulnerabilities
          2. Natural vulnerabilities
          3. Hardware and software vulnerabilities
          4. Media vulnerabilities
          5. Emanation vulnerabilities
          6. Communications vulnerabilities
          7. Human vulnerabilities
          8. Exploiting vulnerabilities
        2. Threats
          1. Natural and physical threats
          2. Unintentional threats
          3. Intentional threats
          4. Insiders and outsiders
        3. Countermeasures
          1. Computer security
          2. Communications security
          3. Physical security
      4. Why Buy Security?
        1. Government Requirements
        2. Information Protection
      5. What’s a User to Do?
      6. Summary
    2. 2. Some Security History
      1. Information and Its Controls
      2. Computer Security: Then and Now
      3. Early Computer Security Efforts
        1. Tiger Teams
        2. Research and Modeling
        3. Secure Systems Development
      4. Building Toward Standardization
        1. Standards for Secure Systems
          1. National Computer Security Center
          2. Birth of the Orange Book
        2. Standards for Cryptography
        3. Standards for Emanations
      5. Computer Security Mandates and Legislation
        1. The Balancing Act
        2. Computer Fraud and Abuse Act
        3. Computer Security Act
        4. Searching for a Balance
        5. Recent Government Security Initiatives
        6. Modern Standards for Computer Security
        7. GASSP and GAISP Overview
        8. Privacy Considerations
      6. Summary
  3. II. Computer Security
    1. 3. Computer System Security and Access Controls
      1. What Makes a System Secure?
      2. System Access: Logging into Your System
        1. Identification and Authentication
          1. Multifactor authentication
        2. Login Processes
          1. Password Authentication Protocol
          2. Challenge Handshake Authentication Protocol (CHAP)
          3. Mutual authentication
          4. One-time password
          5. Per-session authentication
          6. Tokens
          7. Biometrics
          8. Remote access (TACACS and RADIUS)
          9. DIAMETER
          10. Kerberos
        3. Passwords
          1. Protecting passwords
          2. Protecting your login and password on entry
          3. Protecting your password in storage
          4. Password attacks
        4. Authorization
          1. Sensitivity labels
          2. Access models
            1. Bell-LaPadula model
            2. Biba model
        5. Access Control in Practice
          1. Discretionary access control
            1. Ownership
            2. Self/group/public controls
            3. File permissions
          2. Mandatory access control
            1. Data import and export
          3. Access decisions
          4. Role-based access control
          5. Access control lists
        6. Directory Services
          1. Email example
          2. About X.500
          3. Lightweight Directory Access Protocol
            1. The LDAP namespace
            2. Hierarchy
            3. LDAP storage capabilities
        7. Identity Management
          1. Financial and legal pressures
      3. Summary
    2. 4. Viruses and Other Wildlife
      1. Financial Effects of Malicious Programs
      2. Viruses and Public Health
      3. Viruses, Worms, and Trojans (Oh, My!)
        1. Viruses
          1. The history of viruses
        2. Worms
        3. Trojan Horses
        4. Bombs
        5. Trap Doors
        6. Spoofs and Masquerades
      4. Who Writes Viruses?
      5. Remedies
        1. Firewalls
        2. Antivirus
      6. The Virus Hype
      7. An Ounce of Prevention
      8. Summary
    3. 5. Establishing and Maintaining a Security Policy
      1. Administrative Security
      2. Overall Planning and Administration
        1. Analyzing Costs and Risks
          1. What information do you have, and how important is it?
          2. How vulnerable is the information?
          3. What is the cost of losing or compromising the information?
          4. What is the cost of protecting the information?
          5. Who are you going to call?
        2. Planning for Disaster
        3. Setting Security Rules for Employees
        4. Training Users
      3. Day-to-Day Administration
        1. Performing Backups
        2. Hardware and Software Security Tools
        3. Performing a Security Audit
      4. Separation of Duties
      5. Summary
    4. 6. Web Attacks and Internet Vulnerabilities
      1. About the Internet
        1. History of Data and Voice Communications
        2. Packets, Addresses, and Ports
      2. What Are the Network Protocols?
        1. Data Navigation Protocols
        2. Data Navigation Protocol Attacks
        3. Other Internet Protocols
          1. File Transfer Protocol
          2. Simple Mail Transfer Protocol
            1. SMTP and spam
          3. Domain Name Service
          4. Dynamic Host Configuration Protocol
          5. Network Address Translation
          6. Port Address Translation
      3. The Fragile Web
        1. How HTML Formats the Web
        2. Advanced Web Services
          1. What is a script?
          2. Client-side scripting languages
          3. Server-side scripting languages
        3. Web Attacks and Preventions
          1. Client-side web attacks
            1. General client-side attack preventatives
          2. Server-side web attacks
      4. Summary
  4. III. Communications Security
    1. 7. Encryption
      1. Some History
      2. What Is Encryption?
        1. Why Encryption?
        2. Transposition and Substitution Ciphers
          1. More about transposition
          2. More about substitution
        3. Cryptographic Keys: Private and Public
          1. Private key cryptography
          2. Public key cryptography
        4. Key Management and Distribution
        5. One-Time Pad
        6. End-to-End and Link Encryption
      3. The Data Encryption Standard
        1. What Is the DES?
        2. Application of the DES
        3. The Advanced Encryption Standard
        4. Overview of the AES Development Effort
        5. How AES Works
          1. SubBytes
          2. Row shift and mix columns
          3. Round keys
          4. Do it again
      4. Other Cryptographic Algorithms
        1. AES Round 1 Candidate Algorithms
        2. Public Key Algorithms
        3. The RSA Algorithm
        4. Digital Signatures and Certificates
          1. Certificates
          2. Certificate Authorities
        5. Government Algorithms
      5. Message Authentication
      6. Government Cryptographic Programs
        1. NSA
        2. NIST
        3. Treasury
      7. Cryptographic Export Restrictions
      8. Summary
    2. 8. Communications and Network Security
      1. What Makes Communication Secure?
        1. Communications Vulnerabilities
        2. Communications Threats
      2. Modems
      3. Networks
        1. Network Terms
          1. Protocols and layers
        2. Some Network History
        3. Network Media
          1. Twisted pair cable
          2. Coaxial cable
          3. Fiber-optic cable
          4. Microwave
          5. Satellite
      4. Network Security
        1. Access Control Methods
          1. Discretionary access control
          2. Role-based access control
          3. Mandatory access control
        2. Auditing
        3. Perimeters and Gateways
        4. Security in Heterogeneous Environments
        5. Encrypted Communications
          1. End-to-end encryption
          2. Link encryption
        6. Through the Tunnel
          1. VPNs for remote access
          2. VPNs for internetworking
          3. VPNs inside the firewall
          4. VPN tunneling protocols
        7. Network Security Tasks
          1. Communications integrity
          2. Denial of service
          3. Compromise protection
        8. Securing Communications
          1. Internet Protocol Security (IPSec)
        9. Kerberos
      5. Summary
  5. IV. Other Types of Security
    1. 9. Physical Security and Biometrics
      1. Physical Security
        1. Natural Disasters
          1. Fire and smoke
          2. Climate
          3. Earthquakes and vibration
          4. Water
          5. Electricity
          6. Lightning
        2. Risk Analysis and Disaster Planning
      2. Locks and Keys: Old and New
        1. Types of Locks
        2. Tokens
        3. Challenge-Response Systems
        4. Cards: Smart and Dumb
      3. Biometrics
        1. Retina Patterns
        2. Iris Scans
        3. Fingerprints
        4. Handprints
        5. Voice Patterns
        6. Keystrokes
        7. Signature and Writing Patterns
      4. Gentle Reminder
      5. Summary
    2. 10. Wireless Network Security
      1. How We Got Here
      2. Today’s Wireless Infrastructure
        1. Wireless Costs
      3. How Wireless Works
      4. Playing the Fields
        1. Keeping the Waves Inside
      5. What Is This dB Stuff?
      6. Why Does All This Matter?
      7. Encouraging Diversity
      8. Physical Layer Wireless Attacks
        1. Hardening Wireless Access Points
        2. The Tie That Binds
        3. Sophisticated Physical Layer Attacks
        4. Forced Degradation Attacks
        5. Eavesdropping Attacks
        6. Eavesdropping Defenses
        7. Advanced Eavesdropping Attacks
        8. Rogue Access Points
      9. Summary
  6. V. Appendixes
    1. A. OSI Model
    2. B. TEMPEST
      1. The Problem of Emanations
      2. The TEMPEST Program
        1. Faraday Screens
        2. Source Suppression
      3. TEMPEST Standards
      4. Hard As You Try
    3. C. The Orange Book, FIPS PUBS, and the Common Criteria
      1. About the Orange Book
        1. Orange Book Security Concepts
          1. Security policy
          2. Accountability
          3. Assurance
            1. Life-cycle assurance.
          4. Documentation
      2. Rating by the Book
        1. Discretionary and Mandatory Access Control
        2. Object Reuse
        3. Labels
          1. Label integrity
          2. Exportation of labeled information
          3. Subject sensitivity labels
          4. Device labels
      3. Summary of Orange Book Classes
        1. D Systems: Minimal Security
        2. C1 Systems: Discretionary Security Protection
        3. C2 Systems: Controlled Access Protection
        4. B1 Systems: Labeled Security Protection
        5. B2 Systems: Structured Protection
        6. B3 Systems: Security Domains
        7. A1 Systems: Verified Design
        8. Complaints About the Orange Book
      4. FIPS by the Numbers
      5. I Don’t Want You Smelling My Fish
        1. Common Criteria Evaluation Assurance Levels (EALs)
  7. Index
  8. About the Authors
  9. Colophon
  10. Copyright

Product information

  • Title: Computer Security Basics, 2nd Edition
  • Author(s): Rick Lehtinen, G.T. Gangemi
  • Release date: June 2006
  • Publisher(s): O'Reilly Media, Inc.
  • ISBN: 9780596006693