Efnisyfirlit

• Welcome
• Cover
• Title Page
• Copyright
• Dedication
• Preface
• Notation
• About the Authors
• 1: Overview
• Introduction: Overview
• 1.1: Computer Security Concepts
• A Definition of Computer Security
• Examples
• The Challenges of Computer Security
• A Model for Computer Security
• 1.2: Threats, Attacks, and Assets
• 1.2: Threats, Attacks, and Assets
• Threats and Attacks
• Threats and Assets
• 1.3: Security Functional Requirements
• 1.3: Security Functional Requirements
• 1.4: Fundamental Security Design Principles
• 1.4: Fundamental Security Design Principles
• 1.5: Attack Surfaces and Attack Trees
• 1.5: Attack Surfaces and Attack Trees
• Attack Surfaces
• Attack Trees
• 1.6: Computer Security Strategy
• 1.6: Computer Security Strategy
• Security Policy
• Security Implementation
• Assurance and Evaluation
• 1.7: Standards
• 1.7: Standards
• 1.8: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• Part One: Computer Security Technology and Principles
• Part One: Computer Security Technology and Principles
• 2: Cryptographic Tools
• Introduction: Cryptographic Tools
• 2.1: Confidentiality with Symmetric Encryption
• 2.1: Confidentiality with Symmetric Encryption
• Symmetric Encryption
• Symmetric Block Encryption Algorithms
• Stream Ciphers
• 2.2: Message Authentication and Hash Functions
• 2.2: Message Authentication and Hash Functions
• Authentication Using Symmetric Encryption
• Message Authentication without Message Encryption
• Secure Hash Functions
• Other Applications of Hash Functions
• 2.3: Public-Key Encryption
• 2.3: Public-Key Encryption
• Public-Key Encryption Structure
• Applications for Public-Key Cryptosystems
• Requirements for Public-Key Cryptography
• Asymmetric Encryption Algorithms
• 2.4: Digital Signatures and Key Management
• 2.4: Digital Signatures and Key Management
• Digital Signature
• Public-Key Certificates
• Symmetric Key Exchange Using Public-Key Encryption
• Digital Envelopes
• 2.5: Random and Pseudorandom Numbers
• 2.5: Random and Pseudorandom Numbers
• The Use of Random Numbers
• Random versus Pseudorandom
• 2.6: Practical Application: Encryption of Stored Data
• 2.6: Practical Application: Encryption of Stored Data
• 2.7: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 3: User Authentication
• Introduction: User Authentication
• 3.1: Digital User Authentication Principles
• 3.1: Digital User Authentication Principles
• A Model for Digital User Authentication
• Means of Authentication
• Multifactor Authentication
• Assurance Levels for User Authentication
• 3.2: Password-Based Authentication
• 3.2: Password-Based Authentication
• The Vulnerability of Passwords
• The Use of Hashed Passwords
• Password Cracking of User-Chosen Passwords
• Password File Access Control
• Password Selection Strategies
• 3.3: Token-Based Authentication
• 3.3: Token-Based Authentication
• Memory Cards
• Smart Cards
• Electronic Identity Cards
• Hardware Authentication Tokens
• Authentication Using a Mobile Phone
• 3.4: Biometric Authentication
• 3.4: Biometric Authentication
• Physical Characteristics Used in Biometric Applications
• Operation of a Biometric Authentication System
• Biometric Accuracy
• 3.5: Remote User Authentication
• 3.5: Remote User Authentication
• Password Protocol
• Token Protocol
• Static Biometric Protocol
• Dynamic Biometric Protocol
• 3.6: Security Issues for User Authentication
• 3.6: Security Issues for User Authentication
• 3.7: Practical Application: An Iris Biometric System
• 3.7: Practical Application: An Iris Biometric System
• 3.8: Case Study: Security Problems for ATM Systems
• 3.8: Case Study: Security Problems for ATM Systems
• 3.9: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 4: Access Control
• Introduction: Access Control
• 4.1: Access Control Principles
• 4.1: Access Control Principles
• Access Control Context
• Access Control Policies
• 4.2: Subjects, Objects, and Access Rights
• 4.2: Subjects, Objects, and Access Rights
• 4.3: Discretionary Access Control
• 4.3: Discretionary Access Control
• An Access Control Model
• Protection Domains
• 4.4: Example: UNIX File Access Control
• 4.4: Example: UNIX File Access Control
• Traditional UNIX File Access Control
• Access Control Lists in UNIX
• 4.5: Mandatory Access Control
• 4.5: Mandatory Access Control
• Bell-LaPadula (BLP) Model
• 4.6: Role-Based Access Control
• 4.6: Role-Based Access Control
• RBAC Reference Models
• 4.7: Attribute-Based Access Control
• 4.7: Attribute-Based Access Control
• Attributes
• ABAC Logical Architecture
• ABAC Policies
• 4.8: Identity, Credential, and Access Management
• 4.8: Identity, Credential, and Access Management
• Identity Management
• Credential Management
• Access Management
• Identity Federation
• 4.9: Trust Frameworks
• 4.9: Trust Frameworks
• Traditional Identity Exchange Approach
• Open Identity Trust Framework
• 4.10: Case Study: RBAC System for a Bank
• 4.10: Case Study: RBAC System for a Bank
• 4.11: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 5: Database and Data Center Security
• Introduction: Database and Data Center Security
• 5.1: The Need for Database Security
• 5.1: The Need for Database Security
• 5.2: Database Management Systems
• 5.2: Database Management Systems
• 5.3: Relational Databases
• 5.3: Relational Databases
• Elements of a Relational Database System
• Structured Query Language
• 5.4: SQL Injection Attacks
• 5.4: SQL Injection Attacks
• A Typical SQLi Attack
• The Injection Technique
• SQLi Attack Avenues and Types
• SQLi Countermeasures
• 5.5: Database Access Control
• 5.5: Database Access Control
• SQL-Based Access Definition
• Cascading Authorizations
• Role-Based Access Control
• 5.6: Inference
• 5.6: Inference
• 5.7: Database Encryption
• 5.7: Database Encryption
• 5.8: Data Center Security
• 5.8: Data Center Security
• Data Center Elements
• Data Center Security Considerations
• TIA-492
• 5.9: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 6: Malicious Software
• Introduction: Malicious Software
• 6.1: Types of Malicious Software (Malware)
• 6.1: Types of Malicious Software (Malware)
• A Broad Classification of Malware
• Attack Kits
• Attack Sources
• 6.2: Advanced Persistent Threat
• 6.2: Advanced Persistent Threat
• 6.3: Propagation—Infected Content—Viruses
• 6.3: Propagation—Infected Content—Viruses
• The Nature of Viruses
• Macro and Scripting Viruses
• Viruses Classification
• 6.4: Propagation—Vulnerability Exploit—Worms
• 6.4: Propagation—Vulnerability Exploit—Worms
• Target Discovery
• Worm Propagation Model
• The Morris Worm
• A Brief History of Worm Attacks
• State of Worm Technology
• Mobile Code
• Mobile Phone Worms
• Client-Side Vulnerabilities and Drive-by-Downloads
• Clickjacking
• 6.5: Propagation—Social Engineering—Spam E-Mail, Trojans
• 6.5: Propagation—Social Engineering—Spam E-Mail, Trojans
• Spam (Unsolicited Bulk) E-Mail
• Trojan Horses
• Mobile Phone Trojans
• 6.6: Payload—System Corruption
• 6.6: Payload—System Corruption
• Data Destruction and Ransomware
• Real-World Damage
• Logic Bomb
• 6.7: Payload—Attack Agent—Zombie, Bots
• 6.7: Payload—Attack Agent—Zombie, Bots
• Uses of Bots
• Remote Control Facility
• 6.8: Payload—Information Theft—Keyloggers, Phishing, Spyware
• 6.8: Payload—Information Theft—Keyloggers, Phishing, Spyware
• Credential Theft, Keyloggers, and Spyware
• Phishing and Identity Theft
• Reconnaissance, Espionage, and Data Exfiltration
• 6.9: Payload—Stealthing—Backdoors, Rootkits
• 6.9: Payload—Stealthing—Backdoors, Rootkits
• Backdoor
• Rootkit
• Kernel Mode Rootkits
• Virtual Machine and Other External Rootkits
• 6.10: Countermeasures
• 6.10: Countermeasures
• Malware Countermeasure Approaches
• Host-Based Scanners and Signature-Based Anti-Virus
• Perimeter Scanning Approaches
• Distributed Intelligence Gathering Approaches
• 6.11: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 7: Denial-of-Service Attacks
• Introduction: Denial-of-Service Attacks
• 7.1: Denial-of-Service Attacks
• 7.1: Denial-of-Service Attacks
• The Nature of Denial-of-Service Attacks
• Classic Denial-of-Service Attacks
• Source Address Spoofing
• SYN Spoofing
• 7.2: Flooding Attacks
• 7.2: Flooding Attacks
• ICMP Flood
• UDP Flood
• TCP SYN Flood
• 7.3: Distributed Denial-of-Service Attacks
• 7.3: Distributed Denial-of-Service Attacks
• 7.4: Application-Based Bandwidth Attacks
• 7.4: Application-Based Bandwidth Attacks
• SIP Flood
• HTTP-Based Attacks
• 7.5: Reflector and Amplifier Attacks
• 7.5: Reflector and Amplifier Attacks
• Reflection Attacks
• Amplification Attacks
• DNS Amplification Attacks
• 7.6: Defenses Against Denial-of-Service Attacks
• 7.6: Defenses Against Denial-of-Service Attacks
• 7.7: Responding to a Denial-of-Service Attack
• 7.7: Responding to a Denial-of-Service Attack
• 7.8: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 8: Intrusion Detection
• Introduction: Intrusion Detection
• 8.1: Intruders
• 8.1: Intruders
• Intruder Behavior
• 8.2: Intrusion Detection
• 8.2: Intrusion Detection
• Basic Principles
• The Base-Rate Fallacy
• Requirements
• 8.3: Analysis Approaches
• 8.3: Analysis Approaches
• Anomaly Detection
• Signature or Heuristic Detection
• 8.4: Host-Based Intrusion Detection
• 8.4: Host-Based Intrusion Detection
• Data Sources and Sensors
• Anomaly HIDSs
• Signature or Heuristic HIDSs
• Distributed HIDSs
• 8.5: Network-Based Intrusion Detection
• 8.5: Network-Based Intrusion Detection
• Types of Network Sensors
• NIDS Sensor Deployment
• Intrusion Detection Techniques
• Logging of Alerts
• 8.6: Distributed or Hybrid Intrusion Detection
• 8.6: Distributed or Hybrid Intrusion Detection
• 8.7: Intrusion Detection Exchange Format
• 8.7: Intrusion Detection Exchange Format
• 8.8: Honeypots
• 8.8: Honeypots
• 8.9: Example System: Snort
• 8.9: Example System: Snort
• Snort Architecture
• Snort Rules
• 8.10: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 9: Firewalls and Intrusion Prevention Systems
• Introduction: Firewalls and Intrusion Prevention Systems
• 9.1: The Need for Firewalls
• 9.1: The Need for Firewalls
• 9.2: Firewall Characteristics and Access Policy
• 9.2: Firewall Characteristics and Access Policy
• 9.3: Types of Firewalls
• 9.3: Types of Firewalls
• Packet Filtering Firewall
• Stateful Inspection Firewalls
• Application-Level Gateway
• Circuit-Level Gateway
• 9.4: Firewall Basing
• 9.4: Firewall Basing
• Bastion Host
• Host-Based Firewalls
• Network Device Firewall
• Virtual Firewall
• Personal Firewall
• 9.5: Firewall Location and Configurations
• 9.5: Firewall Location and Configurations
• DMZ Networks
• Virtual Private Networks
• Distributed Firewalls
• Summary of Firewall Locations and Topologies
• 9.6: Intrusion Prevention Systems
• 9.6: Intrusion Prevention Systems
• Host-Based IPS
• Network-Based IPS
• Distributed or Hybrid IPS
• Snort Inline
• 9.7: Example: Unified Threat Management Products
• 9.7: Example: Unified Threat Management Products
• 9.8: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• Part Two: Software and System Security
• Part Two: Software and System Security
• 10: Buffer Overflow
• Introduction: Buffer Overflow
• 10.1: Stack Overflows
• Buffer Overflow Basics
• Stack Buffer Overflows
• Shellcode
• 10.2: Defending Against Buffer Overflows
• 10.2: Defending Against Buffer Overflows
• Compile-Time Defenses
• Run-Time Defenses
• 10.3: Other Forms of Overflow Attacks
• 10.3: Other Forms of Overflow Attacks
• Replacement Stack Frame
• Return to System Call
• Heap Overflows
• Global Data Area Overflows
• Other Types of Overflows
• 10.4: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 11: Software Security
• Introduction: Software Security
• 11.1: Software Security Issues
• 11.1 Software Security Issues
• 11.2: Handling Program Input
• 11.2: Handling Program Input
• Input Size and Buffer Overflow
• Interpretation of Program Input
• Validating Input Syntax
• Input Fuzzing
• 11.3: Writing Safe Program Code
• 11.3: Writing Safe Program Code
• Correct Algorithm Implementation
• Ensuring that Machine Language Corresponds to Algorithm
• Correct Interpretation of Data Values
• Correct Use of Memory
• Preventing Race Conditions with Shared Memory
• 11.4: Interacting with the Operating System and Other Programs
• 11.4: Interacting with the Operating System and Other Programs
• Environment Variables
• Using Appropriate, Least Privileges
• Systems Calls and Standard Library Functions
• Preventing Race Conditions with Shared System Resources
• Safe Temporary File Use
• Interacting with Other Programs
• 11.5: Handling Program Output
• 11.5: Handling Program Output
• 11.6: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 12: Operating System Security
• Introduction: Operating System Security
• 12.1: Introduction to Operating System Security
• 12.1: Introduction to Operating System Security
• 12.2: System Security Planning
• 12.2: System Security Planning
• 12.3: Operating Systems Hardening
• 12.3: Operating Systems Hardening
• Operating System Installation: Initial Setup and Patching
• Remove Unnecessary Services, Applications, and Protocols
• Configure Users, Groups, and Authentication
• Configure Resource Controls
• Install Additional Security Controls
• Test the System Security
• 12.4: Application Security
• 12.4: Application Security
• Application Configuration
• Encryption Technology
• 12.5: Security Maintenance
• 12.5: Security Maintenance
• Logging
• Data Backup and Archive
• 12.6: Linux/Unix Security
• 12.6: Linux/Unix Security
• Patch Management
• Application and Service Configuration
• Users, Groups, and Permissions
• Remote Access Controls
• Logging and Log Rotation
• Application Security Using a Chroot Jail
• Security Testing
• 12.7: Windows Security
• 12.7: Windows Security
• Patch Management
• Users Administration and Access Controls
• Application and Service Configuration
• Other Security Controls
• Security Testing
• 12.8: Virtualization Security
• 12.8: Virtualization Security
• Virtualization Alternatives
• Virtualization Security Issues
• Securing Virtualization Systems
• Virtualized Infrastructure Security
• Virtual Firewall
• 12.9: Trusted Computer Systems
• 12.9: Trusted Computer Systems
• Reference Monitors
• TCSEC and Common Criteria
• 12.10: Trusted Platform Module
• 12.10: Trusted Platform Module
• Authenticated Boot Service
• Certification Service
• Encryption Service
• TPM Functions
• Protected Storage
• 12.11: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 13: Cloud and IoT Security
• Introduction: Cloud and IoT Security
• 13.1: Cloud Computing
• 13.1: Cloud Computing
• Cloud Computing Elements
• Cloud Service Models
• Cloud Deployment Models
• Cloud Computing Reference Architecture
• 13.2: Cloud Security Concepts
• 13.2: Cloud Security Concepts
• Security Issues for Cloud Computing
• Addressing Cloud Computing Security Concerns
• 13.3: Cloud Security Approaches
• Risks and Countermeasures
• Data Protection in the Cloud
• Security Approaches for Cloud Computing Assets
• Cloud Security as a Service
• An Open-source Cloud Security Module
• 13.4: The Internet of Things
• 13.4: The Internet of Things
• Things on the Internet of Things
• Evolution
• Components of IoT-enabled Things
• IoT and Cloud Context
• 13.5: IoT Security
• 13.5: IoT Security
• The Patching Vulnerability
• IoT Security and Privacy Requirements Defined by ITU-T
• An IoT Security Framework
• An Open-source IoT Security Module
• 13.6: Key Terms and Review Questions
• Key Terms
• Review Questions
• Part Three: Management Issues
• Part Three: Management Issues
• 14: IT Security Management and Risk Assessment
• Introduction: IT Security Management and Risk Assessment
• 14.1: IT Security Management
• 14.1: IT Security Management
• 14.2: Organizational Context and Security Policy
• 14.2: Organizational Context and Security Policy
• 14.3: Security Risk Assessment
• 14.3: Security Risk Assessment
• Baseline Approach
• Informal Approach
• Detailed Risk Analysis
• Combined Approach
• 14.4: Detailed Security Risk Analysis
• 14.4: Detailed Security Risk Analysis
• Context and System Characterization
• Identification of Threats/Risks/Vulnerabilities
• Analyze Risks
• Evaluate Risks
• Risk Treatment
• 14.5: Case Study: Silver Star Mines
• 14.5: Case Study: Silver Star Mines
• 14.6: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 15: IT Security Controls, Plans, and Procedures
• Introduction: IT Security Controls, Plans, and Procedures
• 15.1: IT Security Management Implementation
• 15.1: IT Security Management Implementation
• 15.2: Security Controls or Safeguards
• 15.2: Security Controls or Safeguards
• 15.3: IT Security Plan
• 15.3: IT Security Plan
• 15.4: Implementation of Controls
• 15.4: Implementation of Controls
• Implementation of Security Plan
• Security Awareness and Training
• 15.5: Monitoring Risks
• 15.5: Monitoring Risks
• Maintenance
• Security Compliance
• Change and Configuration Management
• Incident Handling
• 15.6: Case Study: Silver Star Mines
• 15.6: Case Study: Silver Star Mines
• 15.7: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 16: Physical and Infrastructure Security
• Introduction: Physical and Infrastructure Security
• 16.1: Overview
• 16.1: Overview
• 16.2: Physical Security Threats
• 16.2: Physical Security Threats
• Natural Disasters
• Environmental Threats
• Technical Threats
• Human-Caused Physical Threats
• 16.3: Physical Security Prevention and Mitigation Measures
• 16.3: Physical Security Prevention and Mitigation Measures
• Environmental Threats
• Technical Threats
• Human-Caused Physical Threats
• 16.4: Recovery from Physical Security Breaches
• 16.4: Recovery from Physical Security Breaches
• 16.5: Example: A Corporate Physical Security Policy
• 16.5: Example: A Corporate Physical Security Policy
• 16.6: Integration of Physical and Logical Security
• 16.6: Integration of Physical and Logical Security
• Personal Identity Verification
• Use of PIV Credentials in Physical Access Control Systems
• 16.7: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 17: Human Resources Security
• Introduction: Human Resources Security
• 17.1: Security Awareness, Training, and Education
• 17.1: Security Awareness, Training, and Education
• Motivation
• A Learning Continuum
• Security Awareness
• Cybersecurity Basics and Literacy
• Role-Based Training
• Education and Certification
• 17.2: Employment Practices and Policies
• 17.2: Employment Practices and Policies
• Security in the Hiring Process
• During Employment
• Termination of Employment
• 17.3: Acceptable Use Policy
• 17.3: Acceptable Use Policy
• 17.4: Computer Security Incident Response Teams
• 17.4: Computer Security Incident Response Teams
• Detecting Incidents
• Triage Function
• Responding to Incidents
• Documenting Incidents
• Information Flow for Incident Handling
• 17.5: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 18: Security Auditing
• Introduction: Security Auditing
• 18.1: Security Auditing Architecture
• 18.1: Security Auditing Architecture
• Security Audit and Alarms Model
• Security Auditing Functions
• Requirements
• Implementation Guidelines
• 18.2: Security Audit Trail
• 18.2: Security Audit Trail
• What to Collect
• Protecting Audit Trail Data
• 18.3: Implementing the Logging Function
• 18.3: Implementing the Logging Function
• Logging at the System Level
• Logging at the Application Level
• Interposable Libraries
• Dynamic Binary Rewriting
• 18.4: Audit Trail Analysis
• 18.4: Audit Trail Analysis
• Preparation
• Timing
• Audit Review
• Approaches to Data Analysis
• 18.5: Security Information and Event Management
• 18.5: Security Information and Event Management
• SIEM Systems
• 18.6: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 19: Legal and Ethical Aspects
• Introduction: Legal and Ethical Aspects
• 19.1: Cybercrime and Computer Crime
• 19.1: Cybercrime and Computer Crime
• Types of Computer Crime
• Law Enforcement Challenges
• Working with Law Enforcement
• 19.2: Intellectual Property
• 19.2: Intellectual Property
• Types of Intellectual Property
• Intellectual Property Relevant to Network and Computer Security
• Digital Millennium Copyright Act
• Digital Rights Management
• 19.3: Privacy
• 19.3: Privacy
• Privacy Law and Regulation
• Organizational Response
• Computer Usage Privacy
• Privacy, Data Surveillance, Big Data, and Social Media
• 19.4: Ethical Issues
• 19.4: Ethical Issues
• Ethics and the Information Technology Professions
• Ethical Issues Related to Computers and Information Systems
• Codes of Conduct
• The Rules
• 19.5: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• Part Four: Cryptographic Algorithms
• Part Four: Cryptographic Algorithms
• 20: Symmetric Encryption and Message Confidentiality
• Introduction: Symmetric Encryption and Message Confidentiality
• 20.1: Symmetric Encryption Principles
• 20.1: Symmetric Encryption Principles
• Cryptography
• Cryptanalysis
• Feistel Cipher Structure
• 20.2: Data Encryption Standard
• 20.2: Data Encryption Standard
• Data Encryption Standard
• Triple DES
• 20.3: Advanced Encryption Standard
• 20.3: Advanced Encryption Standard
• Overview of the Algorithm
• Algorithm Details
• 20.4: Stream Ciphers and RC4
• 20.4: Stream Ciphers and RC4
• Stream Cipher Structure
• The RC4 Stream Cipher
• The ChaCha20 Stream Cipher
• 20.5: Cipher Block Modes of Operation
• 20.5: Cipher Block Modes of Operation
• Electronic Codebook Mode
• Cipher Block Chaining Mode
• Cipher Feedback Mode
• Counter Mode
• 20.6: Key Distribution
• 20.6: Key Distribution
• 20.7: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 21: Public-Key Cryptography and Message Authentication
• Introduction: Public-Key Cryptography and Message Authentication
• 21.1: Secure Hash Functions
• 21.1: Secure Hash Functions
• Simple Hash Functions
• The SHA Secure Hash Function
• SHA-3
• 21.2: HMAC
• 21.2: HMAC
• HMAC Design Objectives
• HMAC Algorithm
• Security of HMAC
• 21.3: Authenticated Encryption
• 21.3: Authenticated Encryption
• 21.4: The RSA Public-Key Encryption Algorithm
• 21.4: The RSA Public-Key Encryption Algorithm
• Description of the Algorithm
• The Security of RSA
• 21.5: Diffie-Hellman and Other Asymmetric Algorithms
• Diffie-Hellman Key Exchange
• Other Public-Key Cryptography Algorithms
• 21.6: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• Part Five: Network Security
• Part Five: Network Security
• 22: Internet Security Protocols and Standards
• Introduction: Internet Security Protocols and Standards
• 22.1: Secure E-mail and S/MIME
• 22.1: Secure E-mail and S/MIME
• MIME
• S/MIME
• 22.2: DomainKeys Identified Mail
• 22.2: DomainKeys Identified Mail
• Internet Mail Architecture
• DKIM Strategy
• 22.3: Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
• 22.3: Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
• TLS Architecture
• TLS Protocols
• SSL/TLS Attacks
• 22.4: HTTPS
• 22.4: HTTPS
• Connection Initiation
• Connection Closure
• 22.5: IPv4 and IPv6 Security
• IP Security Overview
• The Scope of IPsec
• Security Associations
• Encapsulating Security Payload
• Transport and Tunnel Modes
• 22.6: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 23: Internet Authentication Applications
• Introduction: Internet Authentication Applications
• 23.1: Kerberos
• 23.1: Kerberos
• The Kerberos Protocol
• Kerberos Realms and Multiple Kerberi
• Version 4 and Version 5
• Performance Issues
• 23.2: X.509
• 23.2: X.509
• 23.3: Public-Key Infrastructure
• 23.3: Public-Key Infrastructure
• Public Key Infrastructure X.509 (PKIX)
• 23.4: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• 24: Wireless Network Security
• Introduction: Wireless Network Security
• 24.1: Wireless Security
• 24.1: Wireless Security
• Wireless Network Threats
• Wireless Security Measures
• 24.2: Mobile Device Security
• 24.2: Mobile Device Security
• Security Threats
• Mobile Device Security Strategy
• 24.3: IEEE 802.11 Wireless LAN Overview
• 24.3: IEEE 802.11 Wireless LAN Overview
• The Wi-Fi Alliance
• IEEE 802 Protocol Architecture
• IEEE 802.11 Network Components and Architectural Model
• IEEE 802.11 Services
• 24.4: IEEE 802.11i Wireless LAN Security
• 24.4: IEEE 802.11i Wireless LAN Security
• IEEE 802.11i Services
• IEEE 802.11i Phases of Operation
• Discovery Phase
• Authentication Phase
• Key Management Phase
• Protected Data Transfer Phase
• The IEEE 802.11i Pseudorandom Function
• 24.5: Key Terms, Review Questions, and Problems
• Key Terms
• Review Questions
• Problems
• Appendix A: Projects and Other Student Exercises for Teaching Computer Security
• Appendix A: Projects and Other Student Exercises for Teaching Computer Security
• A.1: Hacking Project
• A.1: Hacking Project
• A.2: Laboratory Exercises
• A.2: Laboratory Exercises
• A.3: Security Education (Seed) Projects
• A.3: Security Education (Seed) Projects
• A.4: Research Projects
• A.4: Research Projects
• A.5: Programming Projects
• A.5: Programming Projects
• A.6: Practical Security Assessments
• A.6: Practical Security Assessments
• A.7: Firewall Projects
• A.7: Firewall Projects
• A.8: Case Studies
• A.8: Case Studies
• A.9: Reading/report Assignments
• A.9: Reading/report Assignments
• A.10: Writing Assignments
• A.10: Writing Assignments
• Appendix B: Some Aspects of Number Theory
• Appendix B: Some Aspects of Number Theory
• B.1: Prime and Relatively Prime Numbers
• B.1: Prime and Relatively Prime Numbers
• Divisors
• Prime Numbers
• Relatively Prime Numbers
• B.2: Modular Arithmetic
• B.2: Modular Arithmetic
• Modular Arithmetic Operations
• Inverses
• B.3: Fermat’s and Euler’s Theorems
• B.3: Fermat’s and Euler’s Theorems
• Fermat’s Theorem
• Euler’s Totient Function
• Euler’s Theorem
• Appendix C: Standards and Standard-Setting Organizations
• Appendix C: Standards and Standard-Setting Organizations
• C.1: The Importance of Standards
• C.1: The Importance of Standards
• C.2: Internet Standards and the Internet Society
• C.2: Internet Standards and the Internet Society
• The Internet Organizations and RFC Publication
• The Standardization Process
• Internet Standards Categories
• Other RFC Types
• C.3: The National Institute of Standards and Technology
• C.3: The National Institute of Standards and Technology
• C.4: The International Telecommunication Union
• C.4: The International Telecommunication Union
• ITU Telecommunication Standardization Sector
• Schedule
• C.5: The International Organization for Standardization
• C.5: The International Organization for Standardization
• C.6: Significant Security Standards and Documents
• C.6: Significant Security Standards and Documents
• International Organization for Standardization (ISO)
• National Institute of Standards and Technology (NIST)
• International Telecommunication Union Telecommunication Standardization Sector (ITU-T)
• Common Criteria for Information Technology Security Evaluation
• Internet Standards and the Internet Society
• Appendix D: Random and Pseudorandom Number Generation
• Appendix D: Random and Pseudorandom Number Generation
• D.1: The Use of Random Numbers
• D.1: The Use of Random Numbers
• Randomness
• Unpredictability
• D.2: Pseudorandom Number Generators (PRNGS)
• D.2: Pseudorandom Number Generators (PRNGS)
• Linear Congruential Generators
• Cryptographically Generated Random Numbers
• Blum Blum Shub Generator
• D.3: True Random Number Generators
• D.3: True Random Number Generators
• Skew
• Appendix E: Message Authentication Codes Based on Block Ciphers
• Appendix E: Message Authentication Codes Based on Block Ciphers
• E.1: Cipher-Based Message Authentication Code
• E.1: Cipher-Based Message Authentication Code
• E.2: Counter With Cipher Block Chaining Message Authentication Code
• E.2: Counter With Cipher Block Chaining Message Authentication Code
• E.3: Galois Counter Mode
• E.3: Galois Counter Mode
• Appendix F: The TCP/IP Protocol Architecture
• Appendix F: The TCP/IP Protocol Architecture
• F.1: TCP/IP Layers
• F.1: TCP/IP Layers
• F.2: TCP and UDP
• F.2: TCP and UDP
• F.3: Operation of TCP/IP
• F.3: Operation of TCP/IP
• F.4: TCP/IP Applications
• F.4: TCP/IP Applications
• Appendix G: Radix-64 Conversion
• Appendix G: Radix-64 Conversion
• Appendix H: The Domain Name System
• Appendix H: The Domain Name System
• H.1: Domain Names
• H.1: Domain Names
• H.2: The DNS Database
• H.2: The DNS Database
• H.3: DNS Operation
• H.3: DNS Operation
• The Server Hierarchy
• Name Resolution
• DNS Messages
• Appendix I: The Base Rate Fallacy
• Appendix I: The Base Rate Fallacy
• I.1: Conditional Probability and Independence
• I.1: Conditional Probability and Independence
• I.2: Bayes’ Theorem
• I.2: Bayes’ Theorem
• I.3: The Base Rate Fallacy Demonstrated
• I.3: The Base Rate Fallacy Demonstrated
• Appendix J: SHA-3
• Appendix J: SHA-3
• J.1: The Origins Of SHA-3
• J.1: The Origins Of SHA-3
• J.2: Evaluation Criteria For SHA-3
• J.2: Evaluation Criteria For SHA-3
• J.3: The Sponge Construction
• J.3: The Sponge Construction
• J.4: The SHA-3 Iteration Function f
• J.4: The SHA-3 Iteration Function f
• Structure of f
• Theta Step Function
• Rho Step Function
• Pi Step Function
• Chi Step Function
• Iota Step Function
• J.5: Recommended Reading
• J.5: Recommended Reading
• Acronyms
• Acronyms
• Acronyms
• List of NIST and ISO Documents
• List of NIST and ISO Documents
• List of NIST and ISO Documents
• References
• References
• References
• Credits
• Credits
• Credits
• Index
• Index
• Index
• Digital Resources for Students
• Digital Resources for Students
• Digital Resources for Students
• The William Stallings Books on Computer and Data Communications Technology
• The William Stallings Books on Computer and Data Communications Technology
• The William Stallings Books on Computer and Data Communications Technology
• Footnotes
• Glossary