book

Handbook of Information Security: Threats, Vulnerabilities, Prevention, Detection, and Management, Volume 3

Name: Handbook of Information Security: Threats, Vulnerabilities, Prevention, Detection, and Management, Volume 3
Author: Hossein Bidgoli
ISBN: 9780471648321

by Hossein Bidgoli

January 2006

Beginner

1152 pages

75h 49m

English

Wiley

Read now

Unlock full access

Cover Page
Title Page
Copyright
Dedication
About the Editor-in-Chief
Editorial Board
Contents
Contributors
Preface
TOPIC CATEGORIES
Guide to the Handbook of Information Security
OrganizationTable of ContentsIndexChaptersOutlineIntroductionBodyConclusionGlossaryCross-ReferencesReferences

PART 1: Threats and Vulnerabilities to Information and Computing Infrastructures
Internal Security Threats
INTRODUCTIONEXTENT OF THE PROBLEMCHARACTERISTICS AND MOTIVATIONSINSIDER TYPOLOGYFACTORS AND CAUSESMITIGATIONCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Physical Security Threats
INTRODUCTIONFUNDAMENTAL THREATS TO SUSTAINING INFORMATIONDISASTERS AND THE THREATS THEY BRINGPHYSICAL MEANS OF MISAPPROPRIATING RESOURCESCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Fixed-Line Telephone System Vulnerabilities
INTRODUCTIONIMPLICATIONS OF A SECURE FIXED-LINE TELEPHONE SYSTEMVULNERABILITIES OF TRADITIONAL FIXED-LINE TELEPHONE SYSTEMSVULNERABILITIES OF THE EMERGING TELEPHONE TECHNOLOGYCOUNTERMEASURES FOR TELEPHONE SYSTEM VULNERABILITIESCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
E-Mail Threats and Vulnerabilities
INTRODUCTIONSOCIAL AND ANTISOCIAL E-MAIL ISSUESSPAM AND RELATED E-MAIL ABUSEE-MAIL ABUSE AND POLICY-BASED SOLUTIONSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
E-Commerce Vulnerabilities
INTRODUCTIONE-SHOPLIFTINGCREDIT CARD PAYMENTSPROTECTING CREDIT CARD PAYMENTSONLINE AUCTIONSNONREPUDIATIONTRUST AND REPUTATIONCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Hacking Techniques in Wired Networks
INTRODUCTIONPRINCIPLES OF HACKINGATTACKS AGAINST THE INTERNET INFRASTRUCTUREATTACKS AGAINST END SYSTEMS OF THE INTERNETATTACKS AGAINST ENTERPRISE NETWORK SYSTEMSCONCLUSIONACKNOWLEDGEMENTSGLOSSARYCROSS REFERENCESREFERENCES
Hacking Techniques in Wireless Networks
INTRODUCTIONWIRELESS LAN OVERVIEWWIRELESS NETWORK SNIFFINGWIRELESS SPOOFINGWIRELESS NETWORK PROBINGAP WEAKNESSESEQUIPMENT FLAWSDENIAL OF SERVICEMAN-IN-THE-MIDDLE ATTACKSWireless MITMWAR DRIVINGWIRELESS SECURITY BEST PRACTICESCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Computer Viruses and Worms
INTRODUCTIONTROJAN HORSES, VIRUSES, WORMS, RATS, AND OTHER BEASTSMACRO VIRUSESE-MAIL VIRUSESWORMS (FIRST AND THIRD GENERATION)DETECTION TECHNIQUESPREVENTION AND PROTECTION TECHNIQUESNON-PC PLATFORM VIRUSESCONCLUSIONGLOSSARYCROSS REFERENCESFURTHER READING
Trojan Horse Programs
INTRODUCTIONHISTORY OF TROJAN HORSESCOVERT TROJAN HORSE ATTACKSOVERT TROJAN HORSE ATTACKSDEFENSES AGAINST TROJAN HORSE PROGRAMSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Hoax Viruses and Virus Alerts
INTRODUCTIONRELATED ITEMSVIRUS WARNING HOAXESCHARACTERISTICS AND IDENTIFICATIONPROTECTION AND POLICYCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Hostile Java Applets
INTRODUCTIONJAVA SECURITY OVERVIEWLOW-LEVEL CODE SAFETY MECHANISMSHIGH-LEVEL CODE SAFETY MECHANISMSMALICIOUS BEHAVIORCIRCUMVENTING POLICIESCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Spyware
INTRODUCTIONTECHNICAL ASPECTS OF SPYWARESPYWARE FROM A SOCIAL PERSPECTIVETHE EFFECTS OF SPYWARELEGAL RAMIFICATIONSCOUNTERMEASURES FOR SPYWARECONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Mobile Code and Security
INTRODUCTIONA SURVEY OF MOBILE CODE SYSTEMSDESIGN ISSUES IN MOBILE CODERESEARCH CHALLENGES OF MOBILE AGENT SECURITYAGENT HOST PROTECTIONMOBILE AGENT PROTECTIONCONCLUSIONSGLOSSARYCROSS REFERENCESREFERENCES
Wireless Threats and Attacks
INTRODUCTIONTAXONOMY OF ATTACKSATTACKS AGAINST WIRELESS NETWORKSSUMMARYGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
WEP Security
INTRODUCTIONBACKGROUNDWIRED EQUIVALENT PRIVACYVULNERABILITIESDEPLOYMENTNEW PROTOCOLSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Bluetooth Security
INTRODUCTIONDETAILS OF THE BLUETOOTH SPECIFICATIONSECURITY WEAKNESSES IN THE BLUETOOTH SPECIFICATIONCOUNTERMEASURES TO THE VULNERABILITIES IN BLUETOOTH SECURITYCOMPARISON OF SECURITY MECHANISMS IN BLUETOOTH AND IEEE 802.11BCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Cracking WEP
INTRODUCTIONWIRELESS THREATSDESIGN WEAKNESSESIMPLEMENTATION WEAKNESSESAUTOMATED WEP CRACKERS AND SNIFFERSALTERNATIVES TO WEPCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Denial of Service Attacks
WHAT ARE DoS ATTACKS?TYPES OF DoS ATTACKSPREVENTION OF DoS ATTACKSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Network Attacks
INTRODUCTIONNETWORK INFRASTRUCTURE ATTACKSNETWORK PROTOCOL ATTACKSAPPLICATION-BASED NETWORK WORMS AND VIRUSESCONCLUSION AND FURTHER READINGGLOSSARYCROSS REFERENCESREFERENCES
Fault Attacks
INTRODUCTIONFAULT INJECTIONFAULT ANALYSISCOUNTERMEASURESCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Side-Channel Attacks
INTRODUCTIONTIMING ATTACKSPOWER ANALYSIS ATTACKSEM ANALYSISADVANCED SIDE-CHANNEL ANALYSIS TECHNIQUESCOUNTERMEASURESFURTHER READINGReverse Engineering Using Side Channels: First StepsGLOSSARYCROSS REFERENCESREFERENCES
PART 2: Prevention: Keeping the Hackers and Crackers at Bay
Physical Security Measures
INTRODUCTIONOVERVIEW OF THE PHYSICAL SECURITY DOMAINCONTROLLING PHYSICAL ACCESS AND FIRESUSTAINING INFORMATION ASSETSRECOVERING FROM BREACHES OF PHYSICAL SECURITYCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
RFID and Security
INTRODUCTIONHISTORY OF RADIO FREQUENCY IDENTIFICATIONRADIO FREQUENCY IDENTIFICATION SYSTEM PRIMERADVERSARIAL MODEL AND ATTACKSSECURITY COUNTERMEASURESCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Cryptographic Privacy Protection Techniques
INTRODUCTIONWHERE IS PRIVACY IMPORTANT?CONTROLLED PRIVACYCONCLUSION: FURTHER READINGGLOSSARYCROSS REFERENCESREFERENCES
Cryptographic Hardware Security Modules
INTRODUCTIONLIMITATIONS OF SOFTWARE SECURITYPHYSICAL SECURITY CONSIDERATIONSVALIDATION AND STANDARDSMANAGEMENTACCESS CONTROL ENFORCEMENTAPPLICATION PROGRAMMING INTERFACESCDSAEXAMPLES OF HSMSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Smart Card Security
INTRODUCTIONHARDWARE SECURITYSIDE CHANNEL ANALYSISFAULT ANALYSISAPPLICATION AND PROTOCOL SECURITYOTHER USESSECURITY EVALUATIONCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Client-Side Security
INTRODUCTIONWHY WORRY ABOUT THE SECURITY OF CLIENTS?RFC 2196 Site Security HandbookTYPES OF ATTACKSHOW CAN CRACKERS ACCOMPLISH THEIR GOALS?CLASSES OF CLIENTSACTIVE CONTENT AND CLIENT-SIDE SECURITYSECURING CLIENTSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Server-Side Security
SERVER VULNERABILITIESSERVER SECURITY ISSUESPROTECTING SERVERS FROM OVERLOADSERVER SCRIPTING ISSUESACCESS CONTROLGUIDELINES FOR IMPROVING SERVER SECURITYADVANCED ISSUESGLOSSARYCROSS REFERENCESREFERENCES
Protecting Web Sites
INTRODUCTIONBACKGROUNDVULNERABILITIES, THREATS/ATTACKS, AND COUNTERMEASURESWEB SITE SECURITY ASSESSMENTCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Database Security
INTRODUCTIONDATABASE SECURITY MODELS AND MECHANISMSDATABASE SECURITY DESIGNDATABASE SECURITY EVALUATION AND RECONFIGURATIONCONCLUSIONS AND FUTURE DIRECTIONSACKNOWLEDGMENTSGLOSSARYCROSS REFERENCESREFERENCES
Medical Records Security
INTRODUCTIONHEALTH RECORDSELECTRONIC HEALTH RECORD STANDARDS BODIESSECURITY CONCERNSTHE SECURITY SOLUTIONREGULATIONS, POLICIES, AND ORGANIZATIONSGLOSSARYCROSS REFERENCESREFERENCESFURTHER RESOURCES
Access Control: Principles and Solutions
INTRODUCTIONACCESS CONTROL POLICIESACCESS CONTROL IN OPERATING SYSTEMSACCESS CONTROL IN DATABASE MANAGEMENT SYSTEMSACCESS CONTROL FOR INTERNET-BASED SOLUTIONSCONCLUSIONSACKNOWLEDGMENTSGLOSSARYCROSS REFERENCESREFERENCES
Password Authentication
INTRODUCTIONTYPES OF IDENTIFICATION/AUTHENTICATIONHISTORY OF PASSWORDS IN MODERN COMPUTINGPASSWORD SECURITY—BACKGROUNDPASSWORD CRACKING TOOLSPASSWORD SECURITY ISSUES AND EFFECTIVE MANAGEMENTPASSWORD LENGTH AND HUMAN MEMORYAN ARGUMENT FOR SIMPLIFIED PASSWORDSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESSOFTWARE TOOL REFERENCEFURTHER READING
Computer and Network Authentication
AUTHENTICATIONCREDENTIALSWEB AUTHENTICATIONHOST AUTHENTICATIONCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Antivirus Technology
INTRODUCTIONANTIVIRUS TECHNOLOGIES AND TECHNIQUESANTIVIRUS POLICIES AND PRACTICESSUMMARYGLOSSARYCROSS REFERENCESREFERENCES
Biometric Basics and Biometric Authentication
INTRODUCTIONFUNDAMENTAL CONCEPTSA SHORT HISTORYSYSTEM DESCRIPTIONPERFORMANCE TESTINGBIOMETRICS AND INFORMATION SECURITYEXAMPLE APPLICATIONSBIOMETRICS AND PRIVACYSUGGESTED RULES FOR SECURE USE OF BIOMETRICSCONCLUSIONSGLOSSARYCROSS REFERENCESREFERENCES
Issues and Concerns in Biometric IT Security
SPOOFING, MIMICRY, AND LIVENESS DETECTIONPROTECTING DATA WITHIN THE BIOMETRIC SYSTEMMISCELLANEOUS TOPICSBIOMETRIC SECURITY CONCERNSSECURITY EVALUATION AND CERTIFICATION OF BIOMETRIC SYSTEMSAUDITING OF BIOMETRIC SYSTEMSBIOMETRIC STANDARDSACKNOWLEDGMENTSGLOSSARYCROSS REFERENCESREFERENCES
Firewall Basics
INTRODUCTIONFIREWALL FUNCTIONALITYFIREWALL TYPESFIREWALL FUNCTIONALITY AND TECHNOLOGY ANALYSISCONCLUSIONGLOSSARYCROSS REFERENCESFURTHER READING
Firewall Architectures
INTRODUCTIONREQUIREMENTS ANALYSIS FOR FIREWALL ARCHITECTURESENTERPRISE FIREWALL ARCHITECTURESPACKET-FILTERING ROUTERSPERIMETER FIREWALL ARCHITECTURESERVER/HOST FIREWALL ARCHITECTURESCREENED SUBNET FIREWALL ARCHITECTUREMULTITIERED/DISTRIBUTED DMZ ARCHITECTUREAIR GAP ARCHITECTURECONCLUSIONGLOSSARYCROSS REFERENCESFURTHER READING
Packet Filtering and Stateful Firewalls
INTRODUCTIONBASIC PACKET FILTERINGSTATEFUL PACKET FILTERINGMATCHING ALGORITHMSCOMMON CONFIGURATION ERRORSDIRECTION-BASED FILTERINGADVANCED FIREWALL MANAGEMENTGLOSSARYCROSS REFERENCESREFERENCES
Proxy Firewalls
INTRODUCTIONPROXY TERMINOLOGYWHY AND WHEN TO USE A PROXYPROXY CHARACTERISTICS AND CAPABILITIESTYPES OF PROXIESPROXY CONFIGURATIONSCASE STUDY: TRAFFIC ANALYSIS OF A PROXY OPERATIONCONCLUSIONGLOSSARYCROSS REFERENCESFURTHER READING
E-Commerce Safeguards
INTRODUCTIONCONSUMER CONCERNS ABOUT E-COMMERCE TRANSACTIONSE-COMMERCE RISK ASSESSMENT PRINCIPLES AND RECOMMENDATIONSRECOMMENDATIONS FOR HOME OFFICE E-COMMERCE MERCHANTSE-COMMERCE SAFEGUARDS BEGIN WITH BUILDING TRUSTA SECURE PAYMENT PROCESSING TECHNICAL ENVIRONMENTADDITIONAL SERVER CONTROLSRECAPPING NETWORK SECURITY RESPONSIBILITIESSOFTWARE SUPPORTCONFIGURATION MANAGEMENTBACKUPSCONTROLSDOCUMENTATIONMAINTENANCEINTERDEPENDENCESCOST CONSIDERATIONSPAYMENT CARD BEST PRACTICESCONCLUSIONGLOSSARYCROSS REFERENCESFURTHER READING
Digital Signatures and Electronic Signatures
INTRODUCTIONBACKGROUNDDIGITAL SIGNATURESMESSAGE AUTHENTICATION CODES (MACs)OTHER ELECTRONIC SIGNATURE TECHNOLOGIESSELECTING AN ELECTRONIC SIGNATURE METHODLEGAL AND REGULATORY ENVIRONMENTCONCLUSIONGLOSSARYCROSS REFERENCESFURTHER READING
E-Mail Security
INTRODUCTIONSECURITY REQUIREMENTSENCRYPTION AND SIGNING OPTIONSS/MIME OverviewAUTHENTICITY SYSTEMSIMPLEMENTIONSSUMMARYGLOSSARYCROSS REFERENCESFURTHER READING
Security for ATM Networks
INTRODUCTIONATM OVERVIEWNONCRYPTOGRAPHIC ATM VPNSCRYPTOGRAPHIC ATM SECURITY MECHANISMSCONTROL PLANE SECURITY MECHANISMSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
VPN Basics
INTRODUCTIONTYPES OF VPN SERVICESTUNNELINGSECURITY CONCERNSVPN IMPLEMENTATIONSPROTOCOLS EMPLOYED BY VPNsQUALITY OF SERVICE SUPPORTCONCLUSIONSGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
VPN Architecture
INTRODUCTIONVPN SolutionsVPN ARCHITECTUREVPN GATEWAYSVPN CLIENTSSUMMARYGLOSSARYCROSS REFERENCESREFERENCES
IP-Based VPN
INTRODUCTION TO IP-BASED VPNsCUSTOMER EDGE (CE)-BASED VPNsPROVIDER EDGE (PE)-BASED L3 VPNsDESIGN CONSIDERATIONS AND EXAMPLE VPN DEPLOYMENTGLOSSARYCROSS REFERENCESREFERENCES
Identity Management
INTRODUCTIONIDENTITY MANAGEMENT: MOTIVATION, GOALS, AND ISSUESIDENTITY MANAGEMENT ELEMENTSNETWORKING AND APPLICATION INTEGRATION ISSUESSECURITY AND PRIVACY ISSUESARCHITECTURE EXAMPLESCONCLUSIONSGLOSSARYCROSS REFERENCESREFERENCES
The Use of Deception Techniques: Honeypots and Decoys
BACKGROUND AND HISTORYTHEORETICAL RESULTS ON DECEPTIONSEXPERIMENTS AND THE NEED FOR AN EXPERIMENTAL BASISSUMMARY, CONCLUSIONS, AND FURTHER WORKGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Active Response to Computer Intrusions
INTRODUCTION: THE CONCEPT OF ACTIVE RESPONSELEVELS OF INTRUSION RESPONSEPOTENTIAL TECHNICAL BARRIERS FOR INTRUSION RESPONSEINVOLVING LAW ENFORCEMENT AGENCIESLEVELS OF FORCE: BENIGN THROUGH AGGRESSIVE RESPONSESTHE ETHICS OF ACTIVE RESPONSETHE LEGALITY OF ACTIVE RESPONSECONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
PART 3: Detection, Recovery, Management, and Policy Considerations
Intrusion Detection Systems Basics
INTRODUCTIONANOMALY DETECTIONMISUSE DETECTIONINTRUSION DETECTION IN DISTRIBUTED SYSTEMSINTRUSION ALERT CORRELATIONCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Host-Based Intrusion Detection Systems
INTRODUCTIONOPERATING SYSTEM–LEVEL INTRUSION DETECTIONAPPLICATION-LEVEL INTRUSION DETECTIONRELATED TECHNIQUESHOST-BASED IDSs VERSUS NETWORK-BASED IDSsFUTURE TRENDSCONCLUSIONSGLOSSARYCROSS REFERENCESREFERENCES
Network-Based Intrusion Detection Systems
INTRODUCTIONNETWORK INTRUSION DETECTION MODELSSIGNATURE-BASED NIDSSPROTOCOL-BASED INTRUSION DETECTIONEVASION TECHNIQUESTESTING NIDSNIDS DEPLOYMENT AND MANAGEMENTECONOMICS OF NIDSsLIMITATIONS OF NIDSs AND INNOVATIVE RESEARCH EFFORTSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
The Use of Agent Technology for Intrusion Detection
INTRODUCTIONNETWORK INTRUSION DETECTIONINTRUSION DETECTION USING AGENTSANALYSIS TECHNIQUES, TESTING AND VALIDATION, AND PERFORMANCE OF IDS AGENTSA DISTRIBUTED SECURITY AGENT SYSTEMCONCLUSIONSACKNOWLEDGEMENTSGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Contingency Planning Management
INTRODUCTIONGROWING DEPENDENCE ON THE IT INFRASTRUCTURECAUSES OF DOWNTIMES: THE PREVALENCE OF SMALL DISASTERSTHE COST OF DOWNTIMEBCM PLANNINGRISK MANAGEMENTRECOVERY STRATEGIES: BACKUP AND RECOVERY OF DATAENSURING CONTINUITY OF OPERATIONS: ALTERNATE SITES STRATEGYBACKUP AND RECOVERY FOR WEB-BASED HOSTING SERVICESTRAINING, EXERCISING, AND REVIEWING THE PLANBCM/DR PLANNING TEMPLATEBUSINESS CONTINUITY AND INVESTMENT SHORTAGECONCLUSIONSGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Computer Security Incident Response Teams (CSIRTs)
INTRODUCTIONBEFORE THE INCIDENTDURING THE ATTACKAFTER THE ATTACKCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Implementing a Security Awareness Program
AWARENESS AS A SURVIVAL TECHNIQUECRITICAL SUCCESS FACTORSOBSTACLES AND OPPORTUNITIESAPPROACHCONTENTTECHNIQUES AND PRINCIPLESTOOLSMEASUREMENT AND EVALUATIONCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Risk Management for IT Security
INTRODUCTIONRISK ASSESSMENT METHODOLOGIESMANAGEMENT OF INFORMATION SECURITY STANDARDSRISK MODELSPRACTICAL STRATEGIC RISK MODELSPRACTICAL RISK EXPOSURE ESTIMATIONSUMMARYGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Security Insurance and Best Practices
INTRODUCTIONINSURANCE AND RISK TRANSFER BASICSCYBERSECURITY AND CYBERINSURANCELEGAL PRINCIPLES AND REGULATIONSCOVERAGE TYPESA TYPICAL POLICYHYPOTHETICAL CASEBEST PRACTICESISO 17799/BS 7799GLOSSARYCROSS REFERENCESREFERENCES
Auditing Information Systems Security
WHY AUDIT INFORMATION SYSTEMS AND SECURITY?WHAT IS THE SCOPE OF THE INFORMATION SECURITY AUDIT?WHO PERFORMS THE INFORMATION SYSTEMS SECURITY AUDITS?WHAT IS THE AUDIT PROCESS?WHAT IS THE MANAGEMENT'S RESPONSE TO THE AUDIT RESULTS?AUDIT OBJECTIVES, AUDIT WORK PROGRAMS, AND AUDIT TOOLS AND TECHNIQUESCONCLUSIONSGLOSSARYAPPENDIX: GOVERNMENT LAWS, DIRECTIVES, AND REGULATIONSCROSS REFERENCESREFERENCESFURTHER READING
Evidence Collection and Analysis Tools
INTRODUCTIONTYPES OF INVESTIGATIONS AND TOOL SELECTIONTOOL TESTING, ADMISSIBILITY, AND STANDARDSCLASSES OF TOOLSINTEGRATED COLLECTION (IMAGING) AND ANALYSIS TOOLSDATA RECOVERY UTILITIESSPECIALIZED TOOLS FOR E-MAIL AND INTERNET HISTORY ANALYSISPDAs AND OTHER DEVICESEVIDENCE COLLECTION HARDWARECOLLECTION AND ANALYSIS WORKSTATIONEVIDENCE COLLECTION FIELD KITCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Information Leakage: Detection and Countermeasures
INTRODUCTIONSCOPE OF ILLEGITIMATE USE OF LEGITIMATE AUTHORITY IN THE CONTEXT OF LEAKAGELEAKAGE CHANNELS OVERVIEWPHYSICAL CHANNELSELECTRONIC CHANNELSHUMAN CHANNELSCOUNTERMEASURESCONCLUSIONSGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Digital Rights Management
INTRODUCTIONOVERVIEWDRM-ARCHITECTURESINFORMATION MODELSTANDARDSCASE STUDY: MOBILE DRMSUMMARYACKNOWLEDGMENTSGLOSSARYCROSS REFERENCESREFERENCES
Web Hosting
INTRODUCTIONCATEGORIESCOMPONENTS OF WEB HOSTINGSHARED AND DEDICATED SERVERSCOLOCATIONMANAGED SERVICESMANAGED SECURITY PROVIDERSSECURITY AUDITSROOT ACCESSSECURITY AND WEB-HOSTING ARCHITECTURESDATA RECOVERY: AN IMPORTANT DEFENSEFIREWALLSADMINISTRATIVE NETWORKSCONCLUSIONGLOSSARYCROSS REFERENCESFURTHER READING
Managing a Network Environment
INTRODUCTIONISO NETWORK MANAGEMENT FUNCTIONSNETWORK MANAGEMENT PROTOCOLSPOLICY-BASED NETWORK MANAGEMENT; SOLUTIONS FOR THE NEXT GENERATIONCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
E-Mail and Internet Use Policies
INTRODUCTIONPURPOSE AND FUNCTION OF E-MAIL AND INTERNET USE POLICIESSCOPE OF E-MAIL AND INTERNET USE POLICIESCOMPLYING WITH LAWS PROTECTING EMPLOYEE RIGHTSPROTECTING THE EMPLOYER'S TRADE SECRETS AND OTHER PROPRIETARY INFORMATIONPREVENTING EMPLOYEES FROM ENGAGING IN CRIMINAL ACTIVITYRESERVING THE EMPLOYER'S RIGHT TO CONDUCT ELECTRONIC MONITORINGRESPONDING TO GOVERNMENT REQUESTS FOR ELECTRONIC INFORMATIONRESERVING THE EMPLOYER'S RIGHT TO DISCIPLINE EMPLOYEES UNDER THE POLICYSPECIAL ISSUES RELATED TO EMPLOYMENT STATUSSPECIAL ISSUES FOR MULTINATIONAL EMPLOYERSCOORDINATING E-MAIL AND INTERNET USE POLICIES WITH OTHER POLICIESCOMMUNICATING E-MAIL AND INTERNET USE POLICIES TO EMPLOYEESENFORCING THE POLICYCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Forward Security Adaptive Cryptography: Time Evolution
SECURITY AND SECRET KEYSINTRODUCTION BY EXAMPLE: FORWARD SECURE SIGNATURESKEY SECURITYTHRESHOLD AND FORWARD SECURITY: OVERVIEWKEY EVOLUTION: FUNCTIONAL DEFINITIONS FOR FORWARD SECURITYFORWARD SECURE PSEUDORANDOM GENERATORSFORWARD SECURE SIGNATURESFORWARD-SECURE PUBLIC KEY ENCRYPTIONCONCLUSIONGLOSSARYCROSS REFERENCESACKNOWLEDGMENTREFERENCES
Security Policy Guidelines
INTRODUCTIONSECURITY POLICY LIFE CYCLECOST-EFFECTIVENESS: THE RISK ANALYSIS PROCESSWRITING EFFICIENCY: THE DEVELOPMENT PROCESSSECURITY AWARENESS PROGRAM: THE PUBLICATION PROCESSSECURITY POLICY REASSESSMENT: THE AUDITING PROCESSLEGAL ASPECTSGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Asset–Security Goals Continuum: A Process for Security
INTRODUCTIONBUILDING YOUR SECURITY TEAMASSET–SECURITY CONTINUUMIDENTIFYING AND CLASSIFYING ASSETSIDENTIFYING RISKS, THREATS, AND PROBABLE LOSSESCALCULATING THE MAXIMUM COST OF CONTROLSTYPES OF SECURITY CONTROLSSECURITY GOALSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Multilevel Security
INTRODUCTIONASSURANCE PROBLEMMULTILEVEL NETWORKINGNONDEFENSE APPLICATIONS SIMILAR TO MLSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Multilevel Security Models
INTRODUCTIONMULTILEVEL SECURITY IN THE DoDCONFIDENTIALITY AND INTEGRITY POLICY MODELSMULTILATERAL SECURITYCOVERT CHANNELSAPPLICATION-SPECIFIC MLS CONCEPTSOTHER MODELS RELATED TO MLSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Security Architectures
INTRODUCTIONTHREATS TO IT SECURITYALL-EMBRACING ROLE OF SECURITYSOFTWAREHARDWAREACCESS CONTROLEMERGENCY PRECAUTIONSSUMMARYGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Quality of Security Service: Adaptive Security
INTRODUCTIONQUALITY OF SECURITY SERVICEQoSS MODELQoSS APPLIEDQoSS AND APPLICATION-CENTRIC SECURITYRELATED WORKCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Security Policy Enforcement
INTRODUCTIONKEY DEFINITIONS FOR DESCRIBING TECHNICAL POLICIESTYPES OF POLICIESPOLICY ENFORCEMENT MECHANISMSCRITICALITY OF CORRECT POLICY ENFORCEMENTCONSIDERATIONS FOR THE CONSTRUCTION OF SECURE SYSTEMSCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCES
Guidelines for a Comprehensive Security System
INTRODUCTIONFORMATION OF THE SECURITY TASK FORCEIDENTIFICATION OF BASIC SECURITY SAFEGUARDSIDENTIFICATION OF GENERAL SECURITY THREATSIDENTIFICATION OF INTENTIONAL THREATSIDENTIFICATION OF SECURITY MEASURES AND ENFORCEMENTSIDENTIFICATION OF COMPUTER EMERGENCY RESPONSE TEAM SERVICESTHE FORMATION OF A COMPREHENSIVE SECURITY PLANPREPARING FOR A DISASTERCONCLUSIONGLOSSARYCROSS REFERENCESREFERENCESFURTHER READING
Reviewers List
Index

Content preview from Handbook of Information Security: Threats, Vulnerabilities, Prevention, Detection, and Management, Volume 3

Host-Based Intrusion Detection Systems

Giovanni Vigna, Reliable Software Group

Christopher Kruegel, Technical University, Vienna, Austria

Introduction

Operating System–Level Intrusion Detection

Audit Data Gathering

Misuse-Based Approaches

Anomaly-Based Approaches

Specification-Based Approaches

Application-Level Intrusion Detection

Audit Data Gathering

Misuse-Based Approaches

Anomaly-Based Approaches

Specification-Based Approaches

Related Techniques

Host-Based IDSs versus Network-Based IDSs

INTRODUCTION

Intrusion detection (Crothers, 2002; Schultz, Endorf, & Mellander, 2003) is the process of identifying and responding to suspicious activities targeted at computing and communication resources. An intrusion detection system (IDS) monitors and collects data from a target system that should be protected, processes and correlates the gathered information, and initiates responses when evidence of an intrusion is detected. Depending on their source of input, IDSs can be classified into network-based systems and host-based systems.

Network-based intrusion detection systems (NIDSs) collect input data by monitoring network traffic (e.g., packets captured by network interfaces in promiscuous mode). Host-based intrusion detection systems (HIDSs), on the other hand, rely on events collected by the hosts they monitor.

HIDSs can be classified based on the type of audit data they analyze or based on the techniques used to analyze their ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Security on the IBM Mainframe: Volume 1 A Holistic Approach to Reduce Risk and Improve Security

Publisher Resources

ISBN: 9780471648321Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Handbook of Information Security: Threats, Vulnerabilities, Prevention, Detection, and Management, Volume 3

by Hossein Bidgoli

Host-Based Intrusion Detection Systems

INTRODUCTION

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.