book

Computer Security Handbook, Fifth Edition

Name: Computer Security Handbook, Fifth Edition
ISBN: 9780471716525

by SEYMOUR BOSWORTH, ERIC WHYNE, M.E. KABAY

February 2009

Intermediate to advanced

2048 pages

80h 12m

English

Wiley

Read now

Unlock full access

Volume I: Computer Security Handbook
Title Page
Copyright
Contents
PREFACE
ACKNOWLEDGMENTS
ABOUT THE EDITORS
ABOUT THE CONTRIBUTORS
A NOTE TO INSTRUCTORS
INTRODUCTION TO PART I: FOUNDATIONS OF COMPUTER SECURITY

CHAPTER 1: BRIEF HISTORY AND MISSION OF INFORMATION SYSTEM SECURITY
1.1 INTRODUCTION TO INFORMATION SYSTEM SECURITY.1.2 EVOLUTION OF INFORMATION SYSTEMS.1.3 GOVERNMENT RECOGNITION OF INFORMATION ASSURANCE.1.4 RECENT DEVELOPMENTS.1.5 ONGOING MISSION FOR INFORMATION SYSTEM SECURITY.1.6 NOTES
CHAPTER 2: HISTORY OF COMPUTER CRIME
2.1 WHY STUDY HISTORICAL RECORDS?2.2 OVERVIEW.2.3 1960S AND 1970S: SABOTAGE.2.4 IMPERSONATION.2.5 PHONE PHREAKING.2.6 DATA DIDDLING.2.7 SALAMI FRAUD.2.8 LOGIC BOMBS.2.9 EXTORTION.2.10 TROJAN HORSES.2.11 NOTORIOUS WORMS AND VIRUSES.2.12 SPAM.2.13 DENIAL OF SERVICE.2.14 HACKER UNDERGROUND OF THE 1980S AND 1990S.2.15 CONCLUDING REMARKS.2.16 FURTHER READING2.17 NOTES
CHAPTER 3: TOWARD A NEW FRAMEWORK FOR INFORMATION SECURITY*
3.1 PROPOSAL FOR A NEW INFORMATION SECURITY FRAMEWORK.3.2 SIX ESSENTIAL SECURITY ELEMENTS.3.3 WHAT THE DICTIONARIES SAY ABOUT THE WORDS WE USE.3.4 COMPREHENSIVE LISTS OF SOURCES AND ACTS CAUSING INFORMATION LOSSES.3.5 FUNCTIONS OF INFORMATION SECURITY.3.6 SELECTING SAFEGUARDS USING A STANDARD OF DUE DILIGENCE.3.7 THREATS, ASSETS, VULNERABILITIES MODEL.3.8 CONCLUSION.
CHAPTER 4: HARDWARE ELEMENTS OF SECURITY
4.1 INTRODUCTION.4.2 BINARY DESIGN.4.3 PARITY.4.4 HARDWARE OPERATIONS.4.5 INTERRUPTS.4.6 MEMORY AND DATA STORAGE.4.7 TIME.4.8 NATURAL DANGERS.4.9 DATA COMMUNICATIONS.4.10 CRYPTOGRAPHY.4.11 BACKUP.4.12 RECOVERY PROCEDURES.4.13 MICROCOMPUTER CONSIDERATIONS.4.14 CONCLUSION.4.15 HARDWARE SECURITY CHECKLIST4.16 FURTHER READING
CHAPTER 5: DATA COMMUNICATIONS AND INFORMATION SECURITY
5.1 INTRODUCTION.5.2 SAMPLING OF NETWORKS.5.3 NETWORK PROTOCOLS AND VULNERABILITIES.5.4 STANDARDS.5.5 INTERNET PROTOCOL (IP).5.6 TRANSMISSION CONTROL PROTOCOL (TCP).5.7 USER DATAGRAM PROTOCOL.5.8 TCP/IP SUPERVISORY STANDARDS.5.9 APPLICATION STANDARDS.5.10 CONCLUDING REMARKS.5.11 FURTHER READING5.12 NOTES
CHAPTER 6: NETWORK TOPOLOGIES, PROTOCOLS, AND DESIGN
6.1 OVERVIEW.6.2 LAN TOPOLOGY.6.3 MEDIA.6.4 MEDIA ACCESS CONTROL.6.5 LAN PROTOCOLS AND STANDARDS.6.6 INTERCONNECTION DEVICES.6.7 NETWORK OPERATING SYSTEMS.6.8 SUMMARY.6.9 WEB SITES6.10 FURTHER READING6.11 NOTES
CHAPTER 7: ENCRYPTION
7.1 INTRODUCTION TO CRYPTOGRAPHY.7.2 BASIC CRYPTOGRAPHY.7.3 DES AND MODERN ENCRYPTION.7.4 PUBLIC KEY ENCRYPTION.7.5 PRACTICAL ENCRYPTION.7.6 BEYOND RSA AND DES.7.7 FURTHER READING.7.8 NOTES
CHAPTER 8: USING A COMMON LANGUAGE FOR COMPUTER SECURITY INCIDENT INFORMATION
8.1 INTRODUCTION.8.2 WHY A COMMON LANGUAGE IS NEEDED.8.3 DEVELOPMENT OF THE COMMON LANGUAGE.8.4 COMPUTER SECURITY INCIDENT INFORMATION TAXONOMY.8.5 ADDITIONAL INCIDENT INFORMATION TERMS.8.6 HOW TO USE THE COMMON LANGUAGE.8.7 NOTES
CHAPTER 9: MATHEMATICAL MODELS OF COMPUTER SECURITY
9.1 WHY MODELS ARE IMPORTANT.9.2 MODELS AND SECURITY.9.3 MODELS AND CONTROLS.9.4 CLASSIC MODELS.9.5 OTHER MODELS.9.6 CONCLUSION.9.7 FURTHER READING9.8 NOTES
CHAPTER 10: UNDERSTANDING STUDIES AND SURVEYS OF COMPUTER CRIME
10.1 INTRODUCTION.10.2 BASIC RESEARCH METHODOLOGY.10.3 SUMMARY.10.4 FURTHER READING10.5 NOTES
CHAPTER 11: FUNDAMENTALS OF INTELLECTUAL PROPERTY LAW
11.1 INTRODUCTION.11.2 THE MOST FUNDAMENTAL BUSINESS TOOL FOR PROTECTION OF TECHNOLOGY IS THE CONTRACT.11.3 PROPRIETARY RIGHTS AND TRADE SECRETS.11.4 COPYRIGHT LAW AND SOFTWARE.11.5 DIGITAL MILLENNIUM COPYRIGHT ACT.11.6 CIRCUMVENTING TECHNOLOGY MEASURES.11.7 PATENT PROTECTION.11.8 PIRACY AND OTHER INTRUSIONS.11.9 OTHER TOOLS TO PREVENT UNAUTHORIZED INTRUSIONS.11.10 OPEN SOURCE.11.11 APPLICATION INTERNATIONALLY.11.12 CONCLUDING REMARKS.11.13 FURTHER READING11.14 NOTES
INTRODUCTION TO PART II: THREATS AND VULNERABILITIES
CHAPTER 12: THE PSYCHOLOGY OF COMPUTER CRIMINALS
12.1 INTRODUCTION.12.2 SELF-REPORTED MOTIVATIONS.12.3 PSYCHOLOGICAL PERSPECTIVES ON COMPUTER CRIME.12.4 SOCIAL DISTANCE, ANONYMITY, AGGRESSION, AND COMPUTER CRIME.12.5 INDIVIDUAL DIFFERENCES AND COMPUTER CRIMINALS.12.6 ETHICS AND COMPUTER CRIME.12.7 CLASSIFICATIONS OF COMPUTER CRIMINALS.12.8 SUMMARY AND CONCLUSIONS.12.9 NOTES
CHAPTER 13: THE DANGEROUS INFORMATION TECHNOLOGY INSIDER: PSYCHOLOGICAL CHARACTERISTICS AND CAREER PATTERNS1
13.1 COMPUTER INFORMATION TECHNOLOGY INSIDERS.13.2 PSYCHOLOGICAL CHARACTERISTICS OF INFORMATION TECHNOLOGY SPECIALISTS.13.3 CHARACTERISTICS OF THE DANGEROUS COMPUTER INFORMATION TECHNOLOGY INSIDER (CITI).13.4 ESCALATING PATHWAY TO MAJOR COMPUTER CRIME.13.5 STRESS AND ATTACKS ON COMPUTER SYSTEMS.13.6 TYPOLOGY OF COMPUTER CRIME PERPETRATORS.13.7 CONCLUSION AND IMPLICATIONS.13.8 NOTE
CHAPTER 14: INFORMATION WARFARE
14.1 INTRODUCTION.14.2 VULNERABILITIES.14.3 GOALS AND OBJECTIVES.14.4 SOURCES OF THREATS AND ATTACKS.14.5 WEAPONS OF CYBERWAR.14.6 DEFENSES.14.7 FURTHER READING14.8 NOTES
CHAPTER 15: PENETRATING COMPUTER SYSTEMS AND NETWORKS
15.1 MULTIPLE FACTORS INVOLVED IN SYSTEM PENETRATION.15.2 NONTECHNICAL PENETRATION TECHNIQUES.15.3 TECHNICAL PENETRATION TECHNIQUES.15.4 POLITICAL AND LEGAL ISSUES.15.5 SUMMARY15.6 FURTHER READING15.7 NOTES
CHAPTER 16: MALICIOUS CODE
16.1 INTRODUCTION.16.2 MALICIOUS CODE THREAT MODEL.16.3 SURVEY OF MALICIOUS CODE16.4 DETECTION OF MALICIOUS CODE.16.5 PREVENTION OF MALICIOUS CODE ATTACKS16.6 CONCLUSION.16.7 FURTHER READING16.8 NOTES
CHAPTER 17: MOBILE CODE
17.1 INTRODUCTION.17.2 SIGNED CODE.17.3 RESTRICTED OPERATING ENVIRONMENTS.17.4 DISCUSSION.17.5 SUMMARY.17.6 FURTHER READING17.7 NOTES
CHAPTER 18: DENIAL-OF-SERVICE ATTACKS
18.1 INTRODUCTION.18.2 DENIAL-OF-SERVICE ATTACKS.18.3 DISTRIBUTED DENIAL-OF-SERVICE ATTACKS.18.4 MANAGEMENT ISSUES.18.5 FURTHER READING18.6 NOTE
CHAPTER 19: SOCIAL ENGINEERING AND LOW-TECH ATTACKS
19.1 INTRODUCTION.19.2 BACKGROUND AND HISTORY.19.3 SOCIAL ENGINEERING METHODS.19.4 PSYCHOLOGY AND SOCIAL PSYCHOLOGY OF SOCIAL ENGINEERING.19.5 DANGERS OF SOCIAL ENGINEERING AND ITS IMPACT ON BUSINESSES.19.6 DETECTION.19.7 RESPONSE.19.8 DEFENSE AND MITIGATION.19.9 CONCLUSION.19.10 FURTHER READING19.11 NOTES
CHAPTER 20: SPAM, PHISHING, AND TROJANS: ATTACKS MEANT TO FOOL
20.1 UNWANTED E-MAIL AND OTHER PESTS: A SECURITY ISSUE.20.2 E-MAIL: AN ANATOMY LESSON.20.3 SPAM DEFINED.20.4 FIGHTING SPAM.20.5 PHISHING.20.6 TROJAN CODE.20.7 CONCLUDING REMARKS.20.8 FURTHER READING20.9 NOTES
CHAPTER 21: WEB-BASED VULNERABILITIES
21.1 INTRODUCTION.21.2 BREAKING E-COMMERCE SYSTEMS.21.3 CASE STUDY OF BREAKING AN E-BUSINESS.21.4 WEB APPLICATION SYSTEM SECURITY.21.5 PROTECTING WEB APPLICATIONS.21.6 COMPONENTS AND VULNERABILITIES IN E-COMMERCE SYSTEMS.21.7 SUMMARY.21.8 FURTHER READING21.9 NOTES
CHAPTER 22: PHYSICAL THREATS TO THE INFORMATION INFRASTRUCTURE
22.1 INTRODUCTION.22.2 BACKGROUND AND PERSPECTIVE.22.3 THREAT ASSESSMENT PROCESS.22.4 GENERAL THREATS.22.5 WORKPLACE VIOLENCE AND TERRORISM.22.6 OTHER THREAT SITUATIONS22.7 CONFIDENTIAL THREAT INFORMATION.22.8 SUMMARY.22.9 FURTHER READING22.10 NOTES
INTRODUCTION TO PART III: PREVENTION: TECHNICAL DEFENSES
CHAPTER 23: PROTECTING THE INFORMATION INFRASTRUCTURE
23.1 INTRODUCTION.23.2 SECURITY PLANNING AND MANAGEMENT.23.3 STRATEGIC PLANNING PROCESS.23.4 ELEMENTS OF GOOD PROTECTION.23.5 OTHER CONSIDERATIONS.23.6 ACCESS CONTROL.23.7 SURVEILLANCE SYSTEMS.23.8 OTHER DESIGN CONSIDERATIONS.23.9 MITIGATING SPECIFIC THREATS.23.10 INFORMATION NOT PUBLICLY AVAILABLE.23.11 COMPLETING THE SECURITY PLANNING PROCESS.23.12 SUMMARY AND CONCLUSIONS.23.13 FURTHER READING23.14 NOTES
CHAPTER 24: OPERATING SYSTEM SECURITY
24.1 INFORMATION PROTECTION AND SECURITY.24.2 REQUIREMENTS FOR OPERATING SYSTEM SECURITY24.3 PROTECTION MECHANISMS.24.4 FILE SHARING.24.5 TRUSTED SYSTEMS.24.6 WINDOWS 2000 SECURITY.24.7 FURTHER READING24.8 NOTES
CHAPTER 25: LOCAL AREA NETWORKS
25.1 INTRODUCTION.25.2 POLICY AND PROCEDURE ISSUES.25.3 PHYSICAL SITE SECURITY.25.4 PHYSICAL LAYER ISSUES.25.5 NETWORK OPERATING SYSTEM ISSUES.25.6 CONCLUSION.25.7 FURTHER READING25.8 NOTES
CHAPTER 26: GATEWAY SECURITY DEVICES
26.1 INTRODUCTION.26.2 HISTORY AND BACKGROUND.26.3 NETWORK SECURITY MECHANISMS.26.4 DEPLOYMENT.26.5 NETWORK SECURITY DEVICE EVALUATION.26.6 CONCLUDING REMARKS.26.7 FURTHER READING
CHAPTER 27: INTRUSION DETECTION AND INTRUSION PREVENTION DEVICES
27.1 SECURITY BEHIND THE FIREWALL.27.2 MAIN CONCEPTS.27.3 INTRUSION PREVENTION.27.4 INFORMATION SOURCES.27.5 ANALYSIS SCHEMES.27.6 RESPONSE.27.7 NEEDS ASSESSMENT AND PRODUCT SELECTION.27.8 CONCLUSION.27.9 FURTHER READING27.10 NOTES
CHAPTER 28: IDENTIFICATION AND AUTHENTICATION
28.1 INTRODUCTION.28.2 FOUR PRINCIPLES OF AUTHENTICATION.28.3 PASSWORD-BASED AUTHENTICATION.28.4 TOKEN-BASED AUTHENTICATION.28.5 BIOMETRIC AUTHENTICATION.28.6 CROSS-DOMAIN AUTHENTICATION.28.7 RELATIVE COSTS OF AUTHENTICATION TECHNOLOGIES.28.8 CONCLUDING REMARKS.28.9 SUMMARY.28.10 FURTHER READING28.11 NOTES
CHAPTER 29: BIOMETRIC AUTHENTICATION
29.1 INTRODUCTION.29.2 IMPORTANCE OF IDENTIFICATION AND VERIFICATION.29.3 FUNDAMENTALS AND APPLICATIONS.29.4 TYPES OF BIOMETRIC TECHNOLOGIES.29.5 TYPES OF ERRORS AND SYSTEM METRICS.29.6 DISADVANTAGES AND PROBLEMS29.7 RECENT TRENDS IN BIOMETRIC AUTHENTICATION29.8 SUMMARY AND RECOMMENDATIONS.29.9 FURTHER READING29.10 NOTES
CHAPTER 30: E-COMMERCE AND WEB SERVER SAFEGUARDS
30.1 INTRODUCTION.30.2 BUSINESS POLICIES AND STRATEGIES.30.3 RULES OF ENGAGEMENT.30.4 RISK ANALYSIS.30.5 OPERATIONAL REQUIREMENTS.30.6 TECHNICAL ISSUES.30.7 ETHICAL AND LEGAL ISSUES.30.8 SUMMARY.30.9 FURTHER READING30.10 NOTES
CHAPTER 31: WEB MONITORING AND CONTENT FILTERING
31.1 INTRODUCTION.31.2 SOME TERMINOLOGY31.3 MOTIVATION.31.4 GENERAL TECHNIQUES.31.5 IMPLEMENTATION.31.6 ENFORCEMENT.31.7 VULNERABILITIES.31.8 THE FUTURE.31.9 SUMMARY.31.10 FURTHER READING31.11 NOTES
CHAPTER 32: VIRTUAL PRIVATE NETWORKS AND SECURE REMOTE ACCESS
32.1 INTRODUCTION.32.2 SECURE CLIENT VPNs.32.3 TRUSTED VPNs.32.4 EXTRANETS.32.5 CONCLUSION.32.6 FURTHER READING
CHAPTER 33: 802.11 WIRELESS LAN SECURITY
33.1 INTRODUCTION.33.2 802.11 ARCHITECTURE AND PRODUCT TYPES.33.3 WIRELESS LAN SECURITY THREATS.33.4 ORIGINAL 802.11 SECURITY FUNCTIONALITY.33.5 IEEE 802.11I.33.6 802.11 SECURITY AUDITING TOOLS.33.7 CONCLUSION.33.8 APPENDIX 33A–802.11 STANDARDS.33.9 APPENDIX 33B: ABBREVIATIONS, TERMINOLOGY, AND DEFINITIONS.33.10 FURTHER READING33.11 NOTES
CHAPTER 34: SECURING VOIP
34.1 INTRODUCTION.34.2 REGULATORY COMPLIANCE AND RISK ANALYSIS.34.3 TECHNICAL ASPECTS OF VOIP SECURITY.34.4 PROTECTING THE INFRASTRUCTURE.34.5 ENCRYPTION.34.6 CONCLUDING REMARKS.34.7 FURTHER READING34.8 NOTES
CHAPTER 35: SECURING P2P, IM, SMS, AND COLLABORATION TOOLS
35.1 INTRODUCTION.35.2 GENERAL CONCEPTS AND DEFINITIONS.35.3 PEER-TO-PEER NETWORKS.35.4 SECURING INSTANT MESSAGING.35.5 SECURING SMS.35.6 SECURING COLLABORATION TOOLS.35.7 CONCLUDING REMARKS.35.8 FURTHER READING35.9 NOTES
CHAPTER 36: SECURING STORED DATA
36.1 INTRODUCTION TO SECURING STORED DATA.36.2 FIBER CHANNEL WEAKNESS AND EXPLOITS.36.3 NFS WEAKNESS AND EXPLOITS.36.4 CIFS EXPLOITS.36.5 ENCRYPTION.36.6 DATA DISPOSAL.36.7 CONCLUDING REMARKS.36.8 FURTHER READING36.9 NOTES
CHAPTER 37: PKI AND CERTIFICATE AUTHORITIES
37.1 INTRODUCTION.37.2 NEED FOR PUBLIC KEY INFRASTRUCTURE.37.3 PUBLIC KEY CERTIFICATE.37.4 ENTERPRISE PUBLIC KEY INFRASTRUCTURE.37.5 CERTIFICATE POLICY.37.6 GLOBAL PUBLIC KEY INFRASTRUCTURE.37.7 FORMS OF REVOCATION.37.8 REKEY.37.9 KEY RECOVERY.37.10 PRIVILEGE MANAGEMENT.37.11 TRUSTED ARCHIVAL SERVICES AND TRUSTED TIME STAMPS.37.12 COST OF PUBLIC KEY INFRASTRUCTURE.37.13 FURTHER READING37.14 NOTES
CHAPTER 38: WRITING SECURE CODE
38.1 INTRODUCTION.38.2 POLICY AND MANAGEMENT ISSUES.38.3 TECHNICAL AND PROCEDURAL ISSUES.38.4 TYPES OF SOFTWARE ERRORS.38.5 ASSURANCE TOOLS AND TECHNIQUES.38.6 CONCLUDING REMARKS.38.7 FURTHER READING
CHAPTER 39: SOFTWARE DEVELOPMENT AND QUALITY ASSURANCE
39.1 INTRODUCTION.39.2 GOALS OF SOFTWARE QUALITY ASSURANCE.39.3 SOFTWARE DEVELOPMENT LIFE CYCLE.39.4 TYPES OF SOFTWARE ERRORS39.5 DESIGNING SOFTWARE TEST CASES39.6 BEFORE GOING INTO PRODUCTION39.7 MANAGING CHANGE.39.8 SOURCES OF BUGS AND PROBLEMS.39.9 CONCLUSION.39.10 FURTHER READING
CHAPTER 40: MANAGING SOFTWARE PATCHES AND VULNERABILITIES
40.1 INTRODUCTION.40.2 MOTIVATION FOR USING AUTOMATED PATCHING SOLUTIONS.40.3 PATCH AND VULNERABILITY MANAGEMENT PROCESS.40.4 PATCH AND VULNERABILITY MANAGEMENT ISSUES.40.5 CONCLUSION AND SUMMARY OF MAJOR RECOMMENDATIONS.40.6 FURTHER READING40.7 NOTES
CHAPTER 41: ANTIVIRUS TECHNOLOGY
41.1 INTRODUCTION.41.2 HISTORY OF VIRAL CHANGES.41.3 ANTIVIRUS BASICS.41.4 SCANNING METHODOLOGIES.41.5 CONTENT FILTERING.41.6 ANTIVIRUS DEPLOYMENT.41.7 POLICIES AND STRATEGIES.41.8 CONCLUDING REMARKS.41.9 FURTHER READING41.10 NOTE
CHAPTER 42: PROTECTING DIGITAL RIGHTS: TECHNICAL APPROACHES
42.1 INTRODUCTION.42.2 SOFTWARE-BASED ANTIPIRACY TECHNIQUES.42.3 HARDWARE-BASED ANTIPIRACY TECHNIQUES.42.4 DIGITAL RIGHTS MANAGEMENT.42.5 PRIVACY-ENHANCING TECHNOLOGIES.42.6 FUNDAMENTAL PROBLEMS.42.7 SUMMARY.42.8 GLOSSARY.42.9 FURTHER READING42.10 NOTES
Volume II: Computer Security Handbook
Title Page
Copyright
Contents
PREFACE
ACKNOWLEDGMENTS
INTRODUCTION TO PART IV: PREVENTION: HUMAN FACTORS
CHAPTER 43: ETHICAL DECISION MAKING AND HIGH TECHNOLOGY
43.1 INTRODUCTION: THE ABCs OF COMPUTER ETHICS43.2 AWARENESS.43.3 BASICS.43.4 CONSIDERATIONS.43.5 CONCLUDING REMARKS.43.6 FURTHER READING.
CHAPTER 44: SECURITY POLICY GUIDELINES
44.1 INTRODUCTION.44.2 TERMINOLOGY.44.3 RESOURCES FOR POLICY WRITERS.44.4 WRITING THE POLICIES.44.5 ORGANIZING THE POLICIES.44.6 PRESENTING THE POLICIES.44.7 MAINTAINING POLICIES.44.8 SUMMARY.44.9 FURTHER READING44.10 NOTES
CHAPTER 45: EMPLOYMENT PRACTICES AND POLICIES
45.1 INTRODUCTION.45.2 HIRING.45.3 MANAGEMENT.45.4 TERMINATION OF EMPLOYMENT.45.5 SUMMARY.45.6 FURTHER READING45.7 NOTES
CHAPTER 46: VULNERABILITY ASSESSMENT
46.1 SCOREKEEPER OF SECURITY MANAGEMENT.46.2 TAXONOMY OF VULNERABILITY ASSESSMENT TECHNOLOGIES.46.3 PENETRATION TESTING.46.4 FURTHER READING46.5 NOTES
CHAPTER 47: OPERATIONS SECURITY AND PRODUCTION CONTROLS
47.1 INTRODUCTION.47.2 OPERATIONS MANAGEMENT.47.3 PROVIDING A TRUSTED OPERATING SYSTEM.47.4 PROTECTION OF DATA47.5 DATA VALIDATION.47.6 CONCLUDING REMARKS.47.7 FURTHER READING47.8 NOTES
CHAPTER 48: E-MAIL AND INTERNET USE POLICIES
48.1 INTRODUCTION.48.2 DAMAGING THE REPUTATION OF THE ENTERPRISE.48.3 THREATS TO PEOPLE AND SYSTEMS.48.4 THREATS TO PRODUCTIVITY.48.5 LEGAL LIABILITY.48.6 RECOMMENDATIONS.48.7 CONCLUDING REMARKS.48.8 FURTHER READING48.9 NOTES
CHAPTER 49: IMPLEMENTING A SECURITY AWARENESS PROGRAM
49.1 INTRODUCTION.49.2 AWARENESS AS A SURVIVAL TECHNIQUE.49.3 CRITICAL SUCCESS FACTORS.49.4 OBSTACLES AND OPPORTUNITIES.49.5 APPROACH.49.6 CONTENT.49.7 TECHNIQUES AND PRINCIPLES.49.8 TOOLS.49.9 MEASUREMENT AND EVALUATION.49.10 CONCLUSION.49.11 GLOSSARY49.12 FURTHER READING49.13 NOTES
CHAPTER 50: USING SOCIAL PSYCHOLOGY TO IMPLEMENT SECURITY POLICIES
50.1 INTRODUCTION.50.2 RATIONALITY IS NOT ENOUGH.50.3 BELIEFS AND ATTITUDES.50.4 ENCOURAGING INITIATIVE.50.5 GROUP BEHAVIOR.50.6 TECHNOLOGICAL GENERATION GAPS.50.7 SUMMARY OF RECOMMENDATIONS.50.8 FURTHER READING50.9 NOTES
CHAPTER 51: SECURITY STANDARDS FOR PRODUCTS
51.1 INTRODUCTION.51.2 NONSTANDARD PRODUCT ASSESSMENT ALTERNATIVES.51.3 SECURITY ASSESSMENT STANDARDS FOR PRODUCTS.51.4 STANDARDS FOR ASSESSING PRODUCT BUILDERS.51.5 COMBINED PRODUCT AND PRODUCT BUILDER ASSESSMENT STANDARDS.51.6 COMMON CRITERIA PARADIGM OVERVIEW.51.7 DETAILS ABOUT THE COMMON CRITERIA STANDARD.51.8 USING THE CC TO DEFINE SECURITY REQUIREMENTS AND SECURITY SOLUTIONS.51.9 COMMON TEST METHODOLOGY FOR CC TESTS AND EVALUATIONS.51.10 GLOBAL RECOGNITION OF CEM/CC-BASED ASSESSMENTS.51.11 EXAMPLE NATIONAL SCHEME: CCEVS.51.12 VALIDATED PROFILES AND PRODUCTS.51.13 BENEFITS OF CC EVALUATION.51.14 CONCLUDING REMARKS.51.15 NOTES
INTRODUCTION TO PART V: DETECTING SECURITY BREACHES
CHAPTER 52: APPLICATION CONTROLS
52.1 PROTECTION IN APPLICATION DEVELOPMENT.52.2 PROTECTING ONLINE FILES.52.3 PROTECTING BATCH FILES52.4 ENSURING THAT INFORMATION IN THE SYSTEM IS VALID.52.5 CONCLUDING REMARKS.52.6 FURTHER READING52.7 NOTE
CHAPTER 53: MONITORING AND CONTROL SYSTEMS
53.1 INTRODUCTION.53.2 CHANGE AND SECURITY IMPLICATIONS53.3 SYSTEM MODELS53.4 TARGETS AND METHODS.53.5 LOG MANAGEMENT53.6 DATA AGGREGATION AND REDUCTION53.7 NOTIFICATIONS AND REPORTING53.8 MONITORING AND CONTROL CHALLENGES53.9 SUMMARY.53.10 REFERENCES53.11 NOTES
CHAPTER 54: SECURITY AUDITS, STANDARDS, AND INSPECTIONS
54.1 INTRODUCTION.54.2 AUDITING STANDARDS.54.3 SAS 70 AUDITS.54.4 SARBANES-OXLEY54.5 ADDRESSING MULTIPLE REGULATIONS FOR INFORMATION SECURITY.54.6 TECHNICAL FRAMEWORKS FOR IT AUDITS.54.7 FURTHER READING54.8 NOTES
CHAPTER 55: CYBER INVESTIGATION1
55.1 INTRODUCTION.55.2 END-TO-END DIGITAL INVESTIGATION.55.3 APPLYING THE FRAMEWORK AND EEDI.55.4 USING EEDI AND THE FRAMEWORK.55.5 MOTIVE, MEANS, AND OPPORTUNITY: PROFILING ATTACKERS.55.6 SOME USEFUL TOOLS.55.7 CONCLUDING REMARKS.55.8 FURTHER READING55.9 NOTES
INTRODUCTION TO PART VI: RESPONSE AND REMEDIATION
CHAPTER 56: COMPUTER SECURITY INCIDENT RESPONSE TEAMS1
56.1 OVERVIEW.56.2 PLANNING THE TEAM.56.3 SELECTING AND BUILDING THE TEAM.56.4 PRINCIPLES UNDERLYING EFFECTIVE RESPONSE TO COMPUTER SECURITY INCIDENTS.56.5 RESPONDING TO COMPUTER EMERGENCIES.56.6 MANAGING THE CSIRT.56.7 POSTINCIDENT ACTIVITIES.56.8 CONCLUDING REMARKS.56.9 FURTHER READING56.10 NOTES
CHAPTER 57: DATA BACKUPS AND ARCHIVES
57.1 INTRODUCTION.57.2 MAKING BACKUPS.57.3 BACKUP STRATEGIES.57.4 DATA LIFE CYCLE MANAGEMENT.57.5 SAFEGUARDING BACKUPS.57.6 DISPOSAL.57.7 COSTS.57.8 OPTIMIZING FREQUENCY OF BACKUPS.57.9 CONCLUDING REMARKS.57.10 FURTHER READING57.11 NOTES
CHAPTER 58: BUSINESS CONTINUITY PLANNING
58.1 INTRODUCTION.58.2 DEFINING THE GOALS.58.3 PERFORMING A BUSINESS IMPACT ANALYSIS.58.4 BUSINESS IMPACT ANALYSIS MATRIX ANALYSIS.58.5 JUSTIFYING THE COSTS.58.6 PLAN PRESENTATION.58.7 CONCLUDING REMARKS.58.8 FURTHER READING
CHAPTER 59: DISASTER RECOVERY
59.1 INTRODUCTION.59.2 IDENTIFYING THREATS AND DISASTER SCENARIOS.59.3 DEVELOPING RECOVERY STRATEGIES.59.4 DESIGNING RECOVERY TASKS.59.5 IMPLEMENTATION AND READINESS.59.6 CONCLUDING REMARKS.59.7 FURTHER READING
CHAPTER 60: INSURANCE RELIEF
60.1 INTRODUCTION.60.2 INTELLECTUAL PROPERTY COVERAGE.60.3 PROPERTY COVERAGE.60.4 CRIME/FIDELITY COVERAGE.60.5 E-COMMERCE POLICIES.60.6 PRIVACY AND IDENTITY THEFT EXPOSURES.60.7 CONCLUDING REMARKS.60.8 FURTHER READING60.9 NOTES
CHAPTER 61: WORKING WITH LAW ENFORCEMENT
61.1 INTRODUCTION.61.2 RELEVANT LAWS.61.3 PLAN AHEAD.61.4 MEMORANDUM OF AGREEMENT.61.5 HANDLING EVIDENCE AND THE CHAIN OF CUSTODY.61.6 ISSUES OF LIABILITY.61.7 ASK LAW ENFORCEMENT TO GIVE BACK.61.8 THE KNOCK AT THE DOOR.61.9 KEEPING YOUR OPERATION RUNNING DURING AN INVESTIGATION.61.10 NONELECTRONIC RECORDS AND THE INSIDER THREAT61.11 INFORMATION SHARING (THE HUMAN FACTOR).61.12 CONCLUSION.61.13 FURTHER READING61.14 NOTES
INTRODUCTION TO PART VII: MANAGEMENT'S ROLE IN SECURITY
CHAPTER 62: RISK ASSESSMENT AND RISK MANAGEMENT
62.1 INTRODUCTION TO RISK MANAGEMENT62.2 OBJECTIVE OF A RISK ASSESSMENT.62.3 LIMITATIONS OF QUESTIONNAIRES IN ASSESSING RISKS.62.4 MODEL OF RISK.62.5 RISK MITIGATION.62.6 RISK ASSESSMENT TECHNIQUES.62.7 SUMMARY.62.8 FURTHER READING62.9 NOTES
CHAPTER 63: MANAGEMENT RESPONSIBILITIES AND LIABILITIES
63.1 INTRODUCTION.63.2 RESPONSIBILITIES.63.3 LIABILITIES.63.4 COMPUTER MANAGEMENT FUNCTIONS.63.5 SECURITY ADMINISTRATION.63.6 CONCLUDING REMARKS.63.7 FURTHER READING63.8 NOTES
CHAPTER 64: U.S. LEGAL AND REGULATORY SECURITY ISSUES
64.1 INTRODUCTION.64.2 SARBANES-OXLEY ACT OF 2002.64.3 GRAMM-LEACH-BLILEY ACT.64.4 EXAMINATION PROCEDURES TO EVALUATE COMPLIANCE WITH GUIDELINES FOR SAFEGUARDING CUSTOMER INFORMATION.64.5 CONCLUDING REMARKS.64.6 FURTHER READING64.7 NOTES
CHAPTER 65: ROLE OF THE CISO
65.1 CISO AS CHANGE AGENT.65.2 CISO AS STRATEGIST.65.3 STRATEGY, GOVERNANCE, AND THE STANDARD OF CARE.65.4 SUMMARY OF ACTIONS.65.5 RECOMMENDATIONS FOR SUCCESS FOR CISOs.65.6 CONCLUDING REMARKS.65.7 NOTES
CHAPTER 66: DEVELOPING SECURITY POLICIES
66.1 INTRODUCTION.66.2 COLLABORATING IN BUILDING SECURITY POLICIES.66.3 PHASE 1: PRELIMINARY EVALUATION.66.4 PHASE 2: MANAGEMENT SENSITIZATION.66.5 PHASE 3: NEEDS ANALYSIS.66.6 PHASE 4: POLICIES AND PROCEDURES.66.7 PHASE 5: IMPLEMENTATION.66.8 PHASE 6: MAINTENANCE.66.9 CONCLUDING REMARKS.66.10 NOTES
CHAPTER 67: DEVELOPING CLASSIFICATION POLICIES FOR DATA
67.1 INTRODUCTION.67.2 WHY DATA CLASSIFICATION IS PERFORMED.67.3 DATA CLASSIFICATION'S ROLE IN INFORMATION SECURITY.67.4 LEGAL REQUIREMENTS, COMPLIANCE STANDARDS, AND DATA CLASSIFICATION.67.5 DESIGNING AND IMPLEMENTING DC.67.6 CONCLUDING REMARKS.67.7 NOTES
CHAPTER 68: OUTSOURCING AND SECURITY
68.1 INTRODUCTION.68.2 WHY OUTSOURCE?68.3 CAN OUTSOURCING FAIL?68.4 CONTROLLING THE RISKS.68.5 OUTSOURCING SECURITY FUNCTIONS.68.6 CONCLUDING REMARKS.68.7 FURTHER READING68.8 NOTES
INTRODUCTION TO PART VIII: PUBLIC POLICY AND OTHER CONSIDERATIONS
CHAPTER 69: PRIVACY IN CYBERSPACE: U.S. AND EUROPEAN PERSPECTIVES
69.1 INTRODUCTION: WORLDWIDE TRENDS.69.2 EUROPEAN APPROACHES TO PRIVACY69.3 UNITED STATES69.4 COMPLIANCE MODELS.69.5 FURTHER READING69.6 NOTES
CHAPTER 70: ANONYMITY AND IDENTITY IN CYBERSPACE
70.1 INTRODUCTION.70.2 DEFINITIONS.70.3 SOCIAL PSYCHOLOGY OF ANONYMITY.70.4 BALANCING RIGHTS AND DUTIES.70.5 SYSTEMS ANALYSIS OF ANONYMITY.70.6 IMPLICATIONS AND DISCUSSION.70.7 CONCLUDING REMARKS.70.8 SUMMARY.70.9 FURTHER READING70.10 NOTES
CHAPTER 71: MEDICAL RECORDS PROTECTION
71.1 INTRODUCTION.71.2 INFORMATION AND INFORMATION TECHNOLOGY IN HEALTHCARE71.3 INFORMATION PRIVACY AND SECURITY ARE IMPORTANT IN HEALTHCARE.71.4 NONMEDICAL DRIVERS FOR HEALTHCARE INFORMATION PROTECTION.71.5 UNITED STATES LAWS AND GOVERNMENT POLICIES.71.6 HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT.71.7 SUMMARY.71.8 FURTHER READING71.9 NOTES
CHAPTER 72: LEGAL AND POLICY ISSUES OF CENSORSHIP AND CONTENT FILTERING
72.1 INTRODUCTION72.2 U.S. CONTEXT: FIRST AMENDMENT RIGHTS.72.3 PARENTAL INVOLVEMENT/RESPONSIBILITY.72.4 SUMMARY.72.5 FURTHER READING72.6 NOTES
CHAPTER 73: EXPERT WITNESSES AND THE DAUBERT CHALLENGE
73.1 INTRODUCTION.73.2 DAUBERT .73.3 WHETHER THE DAUBERT CHALLENGE IS APPLICABLE: REFINING DAUBERT .73.4 DIVIDED WE FALL?73.5 BEING THE BEST YOU CAN BE.73.6 SUMMARY.73.7 FURTHER READING73.8 NOTES
CHAPTER 74: PROFESSIONAL CERTIFICATION AND TRAINING IN INFORMATION ASSURANCE
74.1 BUILDING SKILLS THROUGH PROFESSIONAL EDUCATION.74.2 INFORMATION SECURITY CERTIFICATIONS.74.3 PREPARING FOR SECURITY CERTIFICATION EXAMINATIONS.74.4 COMMERCIAL TRAINING IN INFORMATION ASSURANCE.74.5 CONCLUDING REMARKS.74.6 NOTES
CHAPTER 75: UNDERGRADUATE AND GRADUATE EDUCATION IN INFORMATION ASSURANCE
75.1 INTRODUCTION.75.2 U.S. INITIATIVES IN TRAINING AND EDUCATION OF INFORMATION ASSURANCE75.3 DISTANCE LEARNING IN HIGHER EDUCATION75.4 BUSINESS CONTINUITY MANAGEMENT.75.5 CONCLUDING REMARKS.75.6 NOTES
CHAPTER 76: EUROPEAN GRADUATE WORK IN INFORMATION ASSURANCE AND THE BOLOGNA DECLARATION1
76.1 UNDERGRADUATE AND GRADUATE EDUCATION.76.2 CONVERGENCE OF EDUCATIONAL PROGRAMS.76.3 BACHELOR'S AND MASTER'S IN INFORMATION SECURITY.76.4 COMPUTER SCIENCE: DOES IT ENCOMPASS INFORMATION SECURITY, ASSURANCE, AND SECURITY ASSURANCE?76.5 BOLOGNA BACHELOR'S DEGREE.76.6 MOVING FROM UNDERGRADUATE TO GRADUATE EDUCATION: BOLOGNA.76.7 EXECUTIVE AND SPECIALIZED MASTER'S DEGREES.76.8 SIMILARITIES AND DIFFERENCES: ARTS AND SCIENCE.76.9 WHAT DO PROGRAMS IN INFORMATION SECURITY TEACH STUDENTS?76.10 UNDERGRADUATE EDUCATION: POLYTECHNICS AND UNIVERSITY.76.11 INFORMATION ASSURANCE: DEFINING THE TERRITORY.76.12 TEACHING INFORMATION SECURITY: THE MALWARE EXAMPLE.76.13 CONCLUSION OF EUROPEAN INITIATIVES OVERVIEW.76.14 IMPLICATIONS FOR EDUCATION.76.15 IMPLICATIONS FOR MANAGERS.76.16 NOTES
CHAPTER 77: THE FUTURE OF INFORMATION ASSURANCE1
77.1 INTRODUCTION77.2 VIEW OF THE FUTURE.77.3 FOUNDATIONS OF ASSURANCE77.4 BEST PRACTICES FOR INCREASING ASSURANCE.77.5 ASSURANCE-BASED RISK REDUCTION.77.6 ILLUSTRATIVE APPLICATION: COMPUTER-AIDED VOTING.77.7 CONCLUSIONS.77.8 FURTHER READING77.9 NOTES
INDEX

Content preview from Computer Security Handbook, Fifth Edition

CHAPTER 55 CYBER INVESTIGATION¹

Peter Stephenson

55.1 INTRODUCTION

55.1.1 Defining Cyber Investigation

55.1.2 Distinguishing between Cyber Forensics and Cyber Investigation

55.1.3 DFRWS Framework Classes

55.2 END-TO-END DIGITAL INVESTIGATION

55.2.1 Collecting Evidence

55.2.2 Analysis of Individual Events

55.2.3 Preliminary Correlation

55.2.4 Event Normalizing

55.2.5 Event Deconfliction

55.2.6 Second-Level Correlation

55.2.7 Timeline Analysis

55.2.8 Chain of Evidence Construction

55.2.9 Corroboration

55.3 APPLYING THE FRAMEWORK AND EEDI

55.3.1 Supporting the EEDI Process

55.3.2 Investigative Narrative

55.3.3 Intrusion Process

55.3.4 Describing Attacks

55.3.5 Strategic Campaigns

55.4 USING EEDI AND THE FRAMEWORK

55.5 MOTIVE, MEANS, AND OPPORTUNITY: PROFILING ATTACKERS

55.5.1 Motive

55.5.2 Means

55.5.3 Opportunity

55.6 SOME USEFUL TOOLS

55.6.1 Link Analysis

55.6.2 Attack-Tree Analysis

55.6.3 Modeling

55.7 CONCLUDING REMARKS

55.8 FURTHER READING

55.9 NOTES

55.1 INTRODUCTION.

Cyber investigation (also widely known as digital investigation) as a discipline has changed markedly since publication of the fourth edition of this Handbook in 2002. In 1999, when Investigating Computer Related Crime² was published, practitioners in the field were just beginning to speculate as to how cyber investigations would be carried out. At that time, the idea of cyber investigation was almost completely congruent with the practice of computer forensics. Today (as this is being written in April 2008), we ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Computer and Information Security Handbook, 3rd Edition

Publisher Resources

ISBN: 9780471716525Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Computer Security Handbook, Fifth Edition

by SEYMOUR BOSWORTH, ERIC WHYNE, M.E. KABAY

CHAPTER 55

CYBER INVESTIGATION¹

55.1 INTRODUCTION.

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.