18.1. Why Read This Chapter?18.2. Introduction18.2.1. What Is Computer Security?18.3. Security Goals18.3.1. From Which Threats Are We Protecting Ourselves?18.3.2. Common Sources of Security Threats18.3.3. What Is the Potential Damage?18.4. Anatomy of an Attack18.4.1. Information Gathering18.4.2. Network Scanning18.4.3. Attacking18.5. Attacking Intents18.6. Security Solution Basics18.6.1. Strategies, People, and Processes18.6.1.1. Education18.6.1.2. Corporate Security Policies18.6.1.3. Corporate Responses18.6.2. Authentication and Authorization18.6.2.1. Passwords18.6.2.2. Authentication between Software Applications or Components18.6.2.3. Cryptography18.6.2.3.1. Public Key Cryptography Basics18.6.2.3.2. Digital Certificates18.6.2.3.3. Pretty Good Privacy18.6.2.3.4. Secure Multipurpose Internet Mail Extensions (S/MIME)18.6.2.4. Other Web Security Technologies18.6.3. Perimeter-Based Security: Firewalls, DMZs, and Intrusion Detection Systems18.6.3.1. Firewalls18.6.3.1.1. Packet-Screening Firewalls (Routers)18.6.3.1.2. Proxy-Based Firewalls (Gateways)18.6.3.2. Setting Up a DMZ18.6.3.3. Intrusion Detection Systems (IDS)18.7. Common Vulnerabilities and Attacks18.7.1. Software Bugs, Poor Design, and Programming Practice18.7.1.1. Buffer Overflows18.7.1.2. Malicious Input Data18.7.1.3. Command-Line (Shell) Execution18.7.1.4. Backdoors18.7.1.5. JavaScript18.7.1.6. CGI Programs18.7.1.7. Java18.7.1.8. ActiveX18.7.2. Cookies18.7.3. Spoofing18.7.4. Malicious Programs18.7.4.1. Virus and Worm18.7.4.2. Trojan Horses18.7.5. Misuse Access Privilege Attacks18.7.6. Password Cracking18.7.7. Denial-of-Service Attacks18.7.8. Physical Attacks18.7.9. Exploiting the Trust Computational Base18.7.10. Information Leaks18.7.10.1. Social Engineering18.7.10.2. Keystroke Capturing18.7.10.3. Garbage Rummaging18.7.10.4. Packet Sniffing18.7.10.5. Scanning and Probing18.7.10.6. Network Mapping18.7.11. Network Attacks18.8. Testing Goals and Responsibilities18.8.1. Functionality Side Effect: An Error-Handling Bug Example18.9. Testing for Security18.9.1. Testing the Requirements and Design18.9.1.1. Requirements Are Key18.9.1.2. Trusted Computational Base (TCB)18.9.1.3. Access Control18.9.1.4. Which Resources Need to Be Protected?18.9.1.5. Client Privacy Issues: What Information Needs to Be Private?18.9.2. Testing the Application Code18.9.2.1. Backdoors18.9.2.2. Exception Handling and Failure Notification18.9.2.3. ID and Password Testing18.9.2.4. Testing for Information Leaks18.9.2.5. Random Numbers versus Unique Numbers18.9.2.6. Testing the Use of GET and POST18.9.2.7. Parameter-Tampering Attacks18.9.3. SQL Injection Attacks18.9.3.1. Cookie Attacks18.9.3.2. Testing for Buffer Overflows18.9.3.3. Testing for Bad Data18.9.3.4. Reliance on Client-Side Scripting18.9.3.5. When Input Becomes Output18.9.4. Testing Third-Party Code18.9.4.1. Known Vulnerabilities18.9.4.2. Race Conditions18.9.5. Testing the Deployment18.9.5.1. Installation Defaults18.9.5.2. Default Passwords18.9.5.3. Internationalization18.9.5.4. Program Forensics18.9.5.5. Working with Customer Support Folks18.9.6. Penetration Testing18.9.7. Testing with User Protection via Browser Settings18.9.7.1. Testing with Firewalls18.9.8. The Challenges Testers Face18.10. Other Testing Considerations18.11. Bibliography and Additional Resources18.11.1. Bibliography18.11.2. Additional Resources18.11.3. Useful Net Resources18.11.4. Tools