Information Security: Principles and Practice (Hardcover, 3)

책소개

Provides systematic guidance on meeting the information security challenges of the 21st century, featuring newly revised material throughoutInformation Security: Principles and Practice is the must-have book for students, instructors, and early-stage professionals alike. Author Mark Stamp provides clear, accessible, and accurate information on the four critical components of information security: cryptography, access control, security protocols, and software. Readers are provided with a wealth of real-world examples that clarify complex topics, highlight important security issues, and demonstrate effective methods and strategies for protecting the confidentiality and integrity of data.Fully revised and updated, the third edition of Information Security features a brand-new chapter on network security basics and expanded coverage of cross-site scripting (XSS) attacks, Stuxnet and other malware, the SSH protocol, secure software development, and security protocols. Fresh examples illustrate the Rivest-Shamir-Adleman (RSA) cryptosystem, Elliptic-curve cryptography (ECC), and hash functions based on bitcoin and blockchains. Updated problem sets, figures, tables, and graphs help readers develop a working knowledge of classic cryptosystems, symmetric and public key cryptography, cryptanalysis, simple authentication protocols, intrusion and malware detection systems, and more. Presenting a highly practical approach to information security, this popular textbook:Provides up-to-date coverage of the rapidly evolving field of information security Explains session keys, perfect forward secrecy, timestamps, SSH, SSL, IPSec, Kerberos, WEP, GSM, and other authentication protocols Addresses access control techniques including authentication and authorization, ACLs and capabilities, and multilevel security and compartments Discusses software tools used for malware detection, digital rights management, and operating systems security Includes an instructor’s solution manual, PowerPoint slides, lecture videos, and additional teaching resources Information Security: Principles and Practice, Third Edition is the perfect textbook for advanced undergraduate and graduate students in all Computer Science programs, and remains essential reading for professionals working in industrial or government security.To request supplementary materials, please contact mark.stamp@sjsu.edu and visit the author-maintained website for more: https://www.cs.sjsu.edu/~stamp/infosec/. New featureProvides systematic guidance on meeting the information security challenges of the 21st century, featuring newly revised material throughoutInformation Security: Principles and Practice is the must-have book for students, instructors, and early-stage professionals alike. Author Mark Stamp provides clear, accessible, and accurate information on the four critical components of information security: cryptography, access control, network security, and software. Readers are provided with a wealth of real-world examples that clarify complex topics, highlight important security issues, and demonstrate effective methods and strategies for protecting the confidentiality and integrity of data.Fully revised and updated, the third edition of Information Security features a brand-new chapter on network security basics and expanded coverage of cross-site scripting (XSS) attacks, Stuxnet and other malware, the SSH protocol, secure software development, and security protocols. Fresh examples illustrate the Rivest-Shamir-Adleman (RSA) cryptosystem, elliptic-curve cryptography (ECC), SHA-3, and hash function applications including bitcoin and blockchains. Updated problem sets, figures, tables, and graphs help readers develop a working knowledge of classic cryptosystems, modern symmetric and public key cryptography, cryptanalysis, simple authentication protocols, intrusion and malware detection systems, quantum computing, and more. Presenting a highly practical approach to information security, this popular textbook:Provides up-to-date coverage of the rapidly evolving field of information security Explains session keys, perfect forward secrecy, timestamps, SSH, SSL, IPSec, Kerberos, WEP, GSM, and other authentication protocols Addresses access control techniques including authentication and authorization, ACLs and capabilities, and multilevel security and compartments Discusses software security issues, ranging from malware detection to secure software development Includes an instructor’s solution manual, PowerPoint slides, lecture videos, and additional teaching resources Information Security: Principles and Practice, Third Edition is the perfect textbook for advanced undergraduate and graduate students in all Computer Science programs, and remains essential reading for professionals working in industrial or government security.To request supplementary materials, please contact mark.stamp@sjsu.edu and visit the author-maintained website for more: https://www.cs.sjsu.edu/~stamp/infosec/.
저자소개

[저자] 마크 스탬프

Texas Tech University에서 수학 석사 및 박사학위를 취득하였다. 현재 실리콘밸리에 있는 산호세 주립대 전산학과 교수로 정보보안을 강의하고 있다. 정보보안 관련 기업과 학계에서 풍부한 실무 경험을 쌓았으며, 미 국가보안국(NSA)에서 암호분석가로 7년간 근무하였다.
목차

Preface xvAbout The Author xixAcknowledgments xxi1 Introductions 11.1 The Cast of Characters 11.2 Alice's Online Bank 21.2.1 Confidentiality, Integrity, and Availability 21.2.2 Beyond CIA 21.3 About This Book 41.3.1 Cryptography 41.3.2 Access Control 51.3.3 Network Security 61.3.4 Software 61.4 The People Problem 71.5 Principles and Practice 71.6 Problems 8I Crypto 132 Classic Cryptography 152.1 Introduction 152.2 How to Speak Crypto 152.3 Classic Crypto 172.3.1 Simple Substitution Cipher 182.3.2 Cryptanalysis of a Simple Substitution 202.3.3 Definition of Secure 212.3.4 Double Transposition Cipher 222.3.5 One-Time Pad 232.3.6 Codebook Cipher 27viii CONTENTS2.4 Classic Crypto in History 282.4.1 Ciphers of the Election of 1876 282.4.2 Zimmermann Telegram 302.4.3 Project VENONA 322.5 Modern Crypto History 332.6 A Taxonomy of Cryptography 362.7 A Taxonomy of Cryptanalysis 372.8 Summary 392.9 Problems 393 Symmetric Ciphers 453.1 Introduction 453.2 Stream Ciphers 463.2.1 A5/1 473.2.2 RC4 493.3 Block Ciphers 513.3.1 Feistel Cipher 513.3.2 DES 523.3.3 Triple DES 573.3.4 AES 593.3.5 TEA 623.3.6 Block Cipher Modes 643.4 Integrity 683.5 Quantum Computers and Symmetric Crypto 703.6 Summary 723.7 Problems 724 Public Key Crypto 794.1 Introduction 794.2 Knapsack 824.3 RSA 854.3.1 Textbook RSA Example 874.3.2 Repeated Squaring 884.3.3 Speeding Up RSA 904.4 Diffie-Hellman 914.5 Elliptic Curve Cryptography 934.5.1 Elliptic Curve Math 934.5.2 ECC Diffie-Hellman 954.5.3 Realistic Elliptic Curve Example 964.6 Public Key Notation 974.7 Uses for Public Key Crypto 984.7.1 Confidentiality in the Real World 984.7.2 Signatures and Non-repudiation 99CONTENTS ix4.7.3 Confidentiality and Non-repudiation 994.8 Certificates and PKI 1024.9 Quantum Computers and Public Key 1044.10 Summary 1064.11 Problems 1065 Crypto Hash Functions++ 1155.1 Introduction 1155.2 What is a Cryptographic Hash Function? 1165.3 The Birthday Problem 1175.4 A Birthday Attack 1195.5 Non-Cryptographic Hashes 1205.6 SHA-3 1215.7 HMAC 1245.8 Cryptographic Hash Applications 1265.8.1 Online Bids 1265.8.2 Blockchain 1275.9 Miscellaneous Crypto-Related Topics 1365.9.1 Secret Sharing 1365.9.2 Random Numbers 1405.9.3 Information Hiding 1435.10 Summary 1475.11 Problems 147II Access Control 1596 Authentication 1616.1 Introduction 1616.2 Authentication Methods 1626.3 Passwords 1636.3.1 Keys Versus Passwords 1646.3.2 Choosing Passwords 1646.3.3 Attacking Systems via Passwords 1666.3.4 Password Verification 1676.3.5 Math of Password Cracking 1686.3.6 Other Password Issues 1736.4 Biometrics 1746.4.1 Types of Errors 1766.4.2 Biometric Examples 1766.4.3 Biometric Error Rates 1816.4.4 Biometric Conclusions 1826.5 Something You Have 182x CONTENTS6.6 Two-Factor Authentication 1836.7 Single Sign-On and Web Cookies 1836.8 Summary 1846.9 Problems 1857 Authorization 1957.1 Introduction 1957.2 A Brief History of Authorization 1967.2.1 The Orange Book 1967.2.2 The Common Criteria 1997.3 Access Control Matrix 2007.3.1 ACLs and Capabilities 2017.3.2 Confused Deputy 2027.4 Multilevel Security Models 2047.4.1 Bell-LaPadula 2067.4.2 Biba's Model 2077.4.3 Compartments 2087.5 Covert Channels 2107.6 Inference Control 2127.7 CAPTCHA 2147.8 Summary 2167.9 Problems 216III Topics in Network Security 2218 Network Security Basics 2238.1 Introduction 2238.2 Networking Basics 2238.2.1 The Protocol Stack 2258.2.2 Application Layer 2268.2.3 Transport Layer 2288.2.4 Network Layer 2318.2.5 Link Layer 2338.3 Cross-Site Scripting Attacks 2358.4 Firewalls 2368.4.1 Packet Filter 2388.4.2 Stateful Packet Filter 2408.4.3 Application Proxy 2408.4.4 Defense in Depth 2428.5 Intrusion Detection Systems 2438.5.1 Signature-Based IDS 2458.5.2 Anomaly-Based IDS 246CONTENTS xi8.6 Summary 2508.7 Problems 2509 Simple Authentication Protocols 2579.1 Introduction 2579.2 Simple Security Protocols 2599.3 Authentication Protocols 2619.3.1 Authentication Using Symmetric Keys 2649.3.2 Authentication Using Public Keys 2679.3.3 Session Keys 2689.3.4 Perfect Forward Secrecy 2709.3.5 Mutual Authentication, Session Key, and PFS 2739.3.6 Timestamps 2739.4 ``Authentication"" and TCP 2759.5 Zero Knowledge Proofs 2789.6 Tips for Analyzing Protocols 2829.7 Summary 2849.8 Problems 28410 Real-World Security Protocols 29310.1 Introduction 29310.2 SSH 29410.2.1 SSH and the Man-in-the-Middle 29510.3 SSL 29610.3.1 SSL and the Man-in-the-Middle 29910.3.2 SSL Connections 30010.3.3 SSL Versus IPsec 30010.4 IPsec 30110.4.1 IKE Phase 1 30210.4.2 IKE Phase 2 30910.4.3 IPsec and IP Datagrams 31010.4.4 Transport and Tunnel Modes 31110.4.5 ESP and AH 31310.5 Kerberos 31410.5.1 Kerberized Login 31610.5.2 Kerberos Ticket 31610.5.3 Security of Kerberos 31810.6 WEP 31910.6.1 WEP Authentication 31910.6.2 WEP Encryption 32010.6.3 WEP Non-Integrity 32010.6.4 Other WEP Issues 32110.6.5 WEP: The Bottom Line 322xii CONTENTS10.7 GSM 32210.7.1 GSM Architecture 32310.7.2 GSM Security Architecture 32410.7.3 GSM Authentication Protocol 32610.7.4 GSM Security Flaws 32710.7.5 GSM Conclusions 32910.7.6 3GPP 33010.8 Summary 33010.9 Problems 331IV Software 33911 Software Flaws and Malware 34111.1 Introduction 34111.2 Software Flaws 34111.2.1 Buffer Overflow 34511.2.2 Incomplete Mediation 35611.2.3 Race Conditions 35611.3 Malware 35811.3.1 Malware Examples 35911.3.2 Malware Detection 36511.3.3 The Future of Malware 36711.3.4 The Future of Malware Detection 36911.4 Miscellaneous Software-Based Attacks 36911.4.1 Salami Attacks 36911.4.2 Linearization Attacks 37011.4.3 Time Bombs 37111.4.4 Trusting Software 37211.5 Summary 37311.6 Problems 37312 Insecurity in Software 38112.1 Introduction 38112.2 Software Reverse Engineering 38212.2.1 Reversing Java Bytecode 38412.2.2 SRE Example 38512.2.3 Anti-Disassembly Techniques 39012.2.4 Anti-Debugging Techniques 39112.2.5 Software Tamper Resistance 39212.3 Software Development 39312.3.1 Flaws and Testing 39512.3.2 Secure Software Development? 396CONTENTS xiii12.4 Summary 39612.5 Problems 397Appendix 403A-1 Modular Arithmetic 403A-2 Permutations 405A-3 Probability 406A-4 DES Permutations 406Index 418
출판사리뷰

내용이 없습니다.
독자리뷰
리뷰 쓰기
오탈자 보기

오탈자 등록하기
부록/예제소스

내용이 없습니다.
추천도서

내용이 없습니다.

한빛출판네트워크

대학교재

Information Security: Principles and Practice (Hardcover, 3)