book

Computer and Information Security Handbook

Name: Computer and Information Security Handbook
Author: John R. Vacca
ISBN: 9780080921945

by John R. Vacca

May 2009

Intermediate to advanced

928 pages

43h 9m

English

Morgan Kaufmann

Read now

Unlock full access

Cover image
Title page
Table of Contents
Copyright
Dedication
Foreword
Preface
Organization of this Book
Acknowledgments
About the Editor
Contributors

Part I: Overview of System and Network Security: A Comprehensive Introduction
Chapter 1. Building a Secure Organization
1. Obstacles to Security2. Ten Steps to Building a Secure Organization
Chapter 2. A Cryptography Primer
1. What is Cryptography? What is Encryption?2. Famous Cryptographic Devices3. Ciphers4. Modern Cryptography5. The Computer Age
Chapter 3. Preventing System Intrusions
1. So, What is an Intrusion?2. Sobering Numbers3. Know Your Enemy: Hackers Versus Crackers4. Motives5. Tools of the Trade6. Bots7. Symptoms of Intrusions8. What Can You Do?9. Security Policies10. Risk Analysis11. Tools of Your Trade12. Controlling User Access13. Conclusion
Chapter 4. Guarding Against Network Intrusions
1. Traditional Reconnaissance and Attacks2. Malicious Software3. Defense in Depth4. Preventive Measures5. Intrusion Monitoring and Detection6. Reactive Measures7. Conclusions
Chapter 5. Unix and Linux Security
1. Unix and Security2. Basic Unix Security3. Protecting User Accounts and Strengthening Authentication4. Reducing Exposure to Threats by Limiting Superuser Privileges5. Safeguarding Vital Data by Securing Local and Network File Systems
Chapter 6. Linux and Unix Security
1. Introduction to Linux and Unix2. Hardening Linux and Unix3. Proactive Defense for Linux and Unix
Chapter 7. Internet Security
1. Internet Protocol Architecture2. An Internet Threat Model3. Defending Against Attacks on the Internet4. Conclusion
Chapter 8. The Botnet Problem
1. Introduction2. Botnet Overview3. Typical Bot Life Cycle4. The Botnet Business Model5. Botnet Defense6. Botmaster Traceback7. Summary
Chapter 9. Intranet Security
1. Plugging the Gaps: NAC and Access Control2. Measuring Risk: Audits3. Guardian at the Gate: Authentication and Encryption4. Wireless Network Security5. Shielding the Wire: Network Protection6. Weakest Link in Security: User Training7. Documenting the Network: Change Management8. Rehearse the Inevitable: Disaster Recovery9. Controlling Hazards: Physical and Environmental Protection10. Know Your Users: Personnel Security11. Protecting Data Flow: Information and System Integrity12. Security Assessments13. Risk Assessments14. Conclusion
Chapter 10. Local Area Network Security
1. Identify Network Threats2. Establish Network Access Controls3. Risk Assessment4. Listing Network Resources5. Threats6. Security Policies7. The Incident-Handling Process8. Secure Design Through Network Access Controls9. IDS Defined10. NIDS: Scope and Limitations11. A Practical Illustration of NIDS12. Firewalls13. Dynamic NAT Configuration14. The Perimeter15. Access List Details16. Types of Firewalls17. Packet Filtering: IP Filtering Routers18. Application-layer Firewalls: Proxy Servers19. Stateful Inspection Firewalls20. NIDS Complements Firewalls21. Monitor and Analyze System Activities22. Signature Analysis23. Statistical Analysis24. Signature Algorithms
Chapter 11. Wireless Network Security
1. Cellular Networks2. Wireless Ad Hoc Networks3. Security Protocols4. Secure Routing5. Key EstablishmentReferences
Chapter 12. Cellular Network Security
1. Introduction2. Overview of Cellular Networks3. The State of the Art of Cellular Network Security4. Cellular Network Attack Taxonomy5. Cellular Network Vulnerability Analysis6. DiscussionReferences
Chapter 13. RFID Security
1. RFID Introduction2. RFID Challenges3. RFID ProtectionsReferences
Part II: Managing Information Security
Chapter 14. Information Security Essentials for IT Managers: Protecting Mission-Critical Systems
1. Information Security Essentials for it Managers, Overview2. Protecting Mission-critical Systems3. Information Security from the Ground up4. Security Monitoring and EffectivenessReferences
Chapter 15. Security Management Systems
1. Security Management System Standards2. Training Requirements3. Principles of Information Security4. Roles and Responsibilities of Personnel5. Security Policies6. Security Controls7. Network Access8. Risk Assessment9. Incident Response10. Summary
Chapter 16. Information Technology Security Management
1. Information Security Management Standards2. Information Technology Security Aspects3. Conclusion
Chapter 17. Identity Management
1. Introduction2. Evolution of Identity Management Requirements3. The Requirements Fulfilled by Current Identity Management Technologies4. Identity 2.0 for mobile users5. Conclusion
Chapter 18. Intrusion Prevention and Detection Systems
1. What is an “Intrusion,” Anyway?2. Unauthorized Access by an Outsider3. Malware Infection4. The Role of the “0-Day”5. The Rogue’s Gallery: Attackers and Motives6. A Brief Introduction to TCP/IP7. The TCP/IP Data Architecture and Data Encapsulation8. Survey of Intrusion Detection and Prevention Technologies9. Anti-Malware Software10. Network-based Intrusion Detection Systems11. Network-based Intrusion Prevention Systems12. Host-based Intrusion Prevention Systems13. Security Information Management Systems14. Network Session Analysis15. Digital Forensics16. System Integrity Validation17. Putting it all Together
Chapter 19. Computer Forensics
1. What is Computer Forensics?2. Analysis of Data3. Computer Forensics in the Court System4. Understanding Internet History5. Temporary Restraining Orders and Labor Disputes5. First Principles6. Hacking a Windows XP Password7. Network Analysis8. Computer Forensics Applied9. Testifying as an Expert10. Beginning to End in Court
Chapter 20. Network Forensics
1. Scientific Overview2. The Principles of Network Forensics3. Attack Traceback and Attribution4. Critical Needs Analysis5. Research Directions
Chapter 21. Firewalls
1. Network Firewalls2. Firewall Security Policies3. A Simple Mathematical Model for Policies, Rules, and Packets4. First-match Firewall Policy Anomalies5. Policy Optimization6. Firewall Types7. Host and Network Firewalls8. Software and Hardware Firewall Implementations9. Choosing the Correct Firewall10. Firewall Placement and Network Topology11. Firewall Installation and Configuration12. Supporting Outgoing Services Through Firewall Configuration13. Secure External Services Provisioning14. Network Firewalls for Voice and Video Applications15. Firewalls and Important Administrative Service Protocols16. Internal IP Services Protection17. Firewall Remote Access Configuration18. Load Balancing and Firewall Arrays19. Highly Available Firewalls20. Firewall Management21. Conclusion
Chapter 22. Penetration Testing
1. What is Penetration Testing?2. How does Penetration Testing Differ from an Actual “Hack?”3. Types of Penetration Testing4. Phases of Penetration Testing5. Defining What’s Expected6. The Need for a Methodology7. Penetration Testing Methodologies8. Methodology in Action9. Penetration Testing Risks10. Liability Issues11. Legal Consequences12. “Get Out of Jail Free” Card13. Penetration Testing Consultants14. Required Skill Sets15. Accomplishments16. Hiring a Penetration Tester17. Why Should a Company Hire You?18. All’s Well that Ends Well
Chapter 23. What Is Vulnerability Assessment?
1. Reporting2. The “It Won’t Happen to Us” Factor3. Why Vulnerability Assessment?4. Penetration Testing Versus Vulnerability Assessment5. Vulnerability Assessment Goal6. Mapping the Network7. Selecting the Right Scanners8. Central Scans Versus Local Scans9. Defense in Depth Strategy10. Vulnerability Assessment Tools11. Scanner Performance12. Scan Verification13. Scanning Cornerstones14. Network Scanning Countermeasures15. Vulnerability Disclosure Date16. Proactive Security Versus Reactive Security17. Vulnerability Causes18. DIY Vulnerability Assessment19. Conclusion
Part III: Encryption Technology
Chapter 24. Data Encryption
1. Need for Cryptography2. Mathematical Prelude to Cryptography3. Classical Cryptography4. Modern Symmetric Ciphers5. Algebraic Structure6. The Internal Functions of Rijndael in AES Implementation7. Use of Modern Block Ciphers8. Public-key Cryptography9. Cryptanalysis of RSA10. Diffie-Hellman Algorithm11. Elliptic Curve Cryptosystems12. Message Integrity and Authentication13. SummaryReferences
Chapter 25. Satellite Encryption
1. The Need for Satellite Encryption2. Satellite Encryption Policy3. Implementing Satellite Encryption4. The Future of Satellite Encryption
Chapter 26. Public Key Infrastructure
1. Cryptographic Background2. Overview of PKI3. The X.509 Model4. X.509 Implementation Architectures5. X.509 Certificate Validation6. X.509 Certificate Revocation7. Server-based Certificate Validity Protocol8. X.509 Bridge Certification Systems9. X.509 Certificate Format10. PKI Policy Description11. PKI Standards Organizations12. PGP Certificate Formats13. PGP PKI Implementations14. W3C15. Alternative PKI architectures16. Modified X.509 Architectures17. Alternative Key Management Models
Chapter 27. Instant-Messaging Security
1. Why Should I Care About Instant Messaging?2. What is Instant Messaging?3. The Evolution of Networking Technologies4. Game Theory and Instant Messaging5. The Nature of the Threat6. Common IM Applications7. Defensive Strategies8. Instant-messaging Security Maturity and Solutions9. Processes10. Conclusion
Part IV: Privacy and Access Management
Chapter 28. NET Privacy
1. Privacy in the Digital Society2. The Economics of Privacy3. Privacy-Enhancing Technologies4. Network Anonymity5. Conclusion
Chapter 29. Personal Privacy Policies
1. Introduction2. Content of Personal Privacy Policies3. Semiautomated Derivation of Personal Privacy Policies4. Specifying Well-Formed Personal Privacy Policies5. Preventing Unexpected Negative Outcomes6. The Privacy Management Model7. Discussion and Related Work8. Conclusions and Future Work
Chapter 30. Virtual Private Networks
1. History2. Who is in Charge?3. VPN Types4. Authentication Methods5. Symmetric Encryption6. Asymmetric Cryptography7. Edge Devices8. Passwords9. Hackers and Crackers
Chapter 31. Identity Theft
1. Experimental Design2. Results and Analysis3. Implications for Crimeware4. Conclusion
Chapter 32. VoIP Security
1. Introduction2. Overview of Threats3. Security in Voip4. Future Trends5. Conclusion
Part V: Storage Security
Chapter 33. SAN Security
1. Organizational Structure2. Access Control Lists (ACL) and Policies3. Physical Access4. Change Management5. Password Policies6. Defense in Depth7. Vendor Security Review8. Data Classification9. Security Management10. Auditing11. Management Access: Separation of Functions12. Host Access: Partitioning13. Data Protection: Replicas15. Encryption in Storage16. Application of Encryption17. ConclusionReferences
Chapter 34. Storage Area Networking Security Devices
1. What is a SAN?2. SAN Deployment Justifications3. The Critical Reasons for SAN Security4. SAN Architecture and Components5. SAN General Threats and Issues6. Conclusion
Chapter 35. Risk Management
1. The Concept of Risk2. Expressing and Measuring Risk3. The Risk Management Methodology4. Risk Management Laws and Regulations5. Risk Management Standards6. Summary
Part VI: Physical Security
Chapter 36. Physical Security Essentials
1. Overview2. Physical Security Threats3. Physical Security Prevention and Mitigation Measures4. Recovery from physical security breaches5. Threat Assessment, Planning, and Plan Implementation6. Example: a Corporate Physical Security Policy7. Integration of Physical and Logical SecurityReferences
Chapter 37. Biometrics
1. Relevant Standards2. Biometric System Architecture3. Using Biometric Systems4. Security Considerations5. Conclusion
Chapter 38. Homeland Security
1. Statutory Authorities2. Homeland Security Presidential Directives3. Organizational Actions4. Conclusion
Chapter 39. Information Warfare
1. Information Warfare Model2. Information Warfare Defined3. IW: Myth or Reality?4. Information Warfare: Making Iw Possible5. Preventative Strategies6. Legal Aspects of IW7. Holistic View of Information Warfare8. Conclusion
Part VII: Advanced Security
Chapter 40. Security Through Diversity
1. Ubiquity2. Example Attacks Against Uniformity3. Attacking Ubiquity with Antivirus Tools4. The Threat of Worms5. Automated Network Defense6. Diversity and the Browser7. Sandboxing and Virtualization8. DNS Example of Diversity Through Security9. Recovery from Disaster is Survival10. Conclusion
Chapter 41. Reputation Management
1. The Human Notion of Reputation2. Reputation Applied to the Computing World3. State of the Art of Attack-Resistant Reputation Computation4. Overview of Current Online Reputation Service5. Conclusion
Chapter 42. Content Filtering
1. The Problem with Content Filtering2. User Categories, Motivations, and Justifications3. Content Blocking Methods4. Technology and Techniques for Content-Filtering Control5. Categories6. Legal Issues7. Issues and Problems with Content Filtering9. Related Products10. Conclusion
Chapter 43. Data Loss Protection
1. Precursors of DLP2. What is DLP?3. Where to Begin?4. Data is Like Water5. You Don’t Know What You Don’t Know6. How Do DLP Applications Work?7. Eat Your Vegetables8. It’s a Family Affair, Not Just It Security’s Problem9. Vendors, Vendors Everywhere! Who Do You Believe?10. Conclusion
Part VIII: Appendices
Appendix A. Configuring Authentication Service on Microsoft Windows Vista
1. Backup and Restore of Stored Usernames and Passwords2. Credential Security Service Provider and SSO for Terminal Services Logon3. TLS/SSL Cryptographic Enhancements4. Kerberos Enhancements5. Smart Card Authentication Changes6. Previous Logon Information
Appendix B. Security Management and Resiliency
Appendix C. List of Top Security Implementation and Deployment Companies
List of SAN Implementation and Deployment CompaniesSAN Security Implementation and Deployment Companies:
Appendix D. List of Security Products
Security Software
Appendix E. List of Security Standards
Appendix F. List of Miscellaneous Security Resources
ConferencesConsumer InformationDirectoriesHelp and TutorialsMailing ListsNews and MediaOrganizationsProducts and ToolsResearchContent Filtering LinksOther Logging Resources
Appendix G. Ensuring Built-in Frequency Hopping Spread Spectrum Wireless Network Security
AccomplishmentBackgroundAdditional Information
Appendix H. Configuring Wireless Internet Security Remote Access
Adding the Access Points as RADIUS Clients to IASAdding Access Points to the First IAS ServerScripting the Addition of Access Points to IAS Server (Alternative Procedure)Configuring the Wireless Access PointsEnabling Secure WLAN Authentication on Access PointsAdditional Settings to Secure Wireless Access PointsReplicating RADIUS Client Configuration to Other IAS Servers
Appendix I. Frequently Asked Questions
Appendix J. Glossary
Index

Content preview from Computer and Information Security Handbook

Chapter 18

Intrusion Prevention and Detection Systems

Christopher Day, Terremark Worldwide, Inc.

With the increasing importance of information systems in today’s complex and global economy, it has become mission and business critical to defend those information systems from attack and compromise by any number of adversaries. Intrusion prevention and detection systems are critical components in the defender’s arsenal and take on a number of different forms. Formally, intrusion detection systems (IDSs) can be defined as “software or hardware systems that automate the process of monitoring the events occurring in a computer system or network, analyzing them for signs of security problems.”¹ Intrusion prevention systems (IPSs) are systems that attempt ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Computer and Information Security Handbook, 2nd Edition

Publisher Resources

ISBN: 9780080921945

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Computer and Information Security Handbook

by John R. Vacca

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.