Computer Security

Dieter Gollmann, Technical University of Hamburg-Harburg.

• Preface xvii CHAPTER 1 – History of Computer Security 11.1 The Dawn of Computer Security 21.2 1970s – Mainframes 31.3 1980s – Personal Computers 41.4 1990s – Internet 61.5 2000s – The Web 81.6 Conclusions – The Benefits of Hindsight 101.7 Exercises 11CHAPTER 2 – Managing Security 132.1 Attacks and Attackers 142.2 Security Management 152.3 Risk and Threat Analysis 212.4 Further Reading 292.5 Exercises 29CHAPTER 3 – Foundations of Computer Security 313.1 Definitions 323.2 The Fundamental Dilemma of Computer Security 403.3 Data vs Information 403.4 Principles of Computer Security 413.5 The Layer Below 453.6 The Layer Above 473.7 Further Reading 473.8 Exercises 48CHAPTER 4 – Identification and Authentication 494.1 Username and Password 504.2 Bootstrapping Password Protection 514.3 Guessing Passwords 524.4 Phishing, Spoofing, and Social Engineering 544.5 Protecting the Password File 564.6 Single Sign-on 584.7 Alternative Approaches 594.8 Further Reading 634.9 Exercises 63CHAPTER 5 – Access Control 655.1 Background 665.2 Authentication and Authorization 665.3 Access Operations 685.4 Access Control Structures 715.5 Ownership 735.6 Intermediate Controls 745.7 Policy Instantiation 795.8 Comparing Security Attributes 795.9 Further Reading 845.10 Exercises 84CHAPTER 6 – Reference Monitors 876.1 Introduction 886.2 Operating System Integrity 906.3 Hardware Security Features 916.4 Protecting Memory 996.5 Further Reading 1036.6 Exercises 104CHAPTER 7 – Unix Security 1077.1 Introduction 1087.2 Principals 1097.3 Subjects 1117.4 Objects 1137.5 Access Control 1167.6 Instances of General Security Principles 1197.7 Management Issues 1257.8 Further Reading 1287.9 Exercises 128CHAPTER 8 – Windows Security 1318.1 Introduction 1328.2 Components of Access Control 1358.3 Access Decisions 1428.4 Managing Policies 1458.5 Task-Dependent Access Rights 1478.6 Administration 1508.7 Further Reading 1538.8 Exercises 153CHAPTER 9 – Database Security 1559.1 Introduction 1569.2 Relational Databases 1589.3 Access Control 1629.4 Statistical Database Security 1679.5 Integration with the Operating System 1729.6 Privacy 1739.7 Further Reading 1759.8 Exercises 175CHAPTER 10 – Software Security 17710.1 Introduction 17810.2 Characters and Numbers 17910.3 Canonical Representations 18310.4 Memory Management 18410.5 Data and Code 19110.6 Race Conditions 19310.7 Defences 19410.8 Further Reading 20110.9 Exercises 202CHAPTER 11 – Bell–LaPadula Model 20511.1 State Machine Models 20611.2 The Bell–LaPadula Model 20611.3 The Multics Interpretation of BLP 21211.4 Further Reading 21611.5 Exercises 216CHAPTER 12 – Security Models 21912.1 The Biba Model 22012.2 Chinese Wall Model 22112.3 The Clark–Wilson Model 22312.4 The Harrison–Ruzzo–Ullman Model 22512.5 Information-Flow Models 22812.6 Execution Monitors 23012.7 Further Reading 23212.8 Exercises 233CHAPTER 13 – Security Evaluation 23513.1 Introduction 23613.2 The Orange Book 23913.3 The Rainbow Series 24113.4 Information Technology Security Evaluation Criteria 24213.5 The Federal Criteria 24313.6 The Common Criteria 24313.7 Quality Standards 24613.8 An Effort Well Spent? 24713.9 Summary 24813.10 Further Reading 24813.11 Exercises 249CHAPTER 14 – Cryptography 25114.1 Introduction 25214.2 Modular Arithmetic 25614.3 Integrity Check Functions 25714.4 Digital Signatures 26014.5 Encryption 26414.6 Strength of Mechanisms 27014.7 Performance 27114.8 Further Reading 27214.9 Exercises 273CHAPTER 15 – Key Establishment 27515.1 Introduction 27615.2 Key Establishment and Authentication 27615.3 Key Establishment Protocols 27915.4 Kerberos 28315.5 Public-Key Infrastructures 28815.6 Trusted Computing – Attestation 29315.7 Further Reading 29515.8 Exercises 295CHAPTER 16 – Communications Security 29716.1 Introduction 29816.2 Protocol Design Principles 29916.3 IP Security 30116.4 IPsec and Network Address Translation 30816.5 SSL/TLS 31016.6 Extensible Authentication Protocol 31416.7 Further Reading 31616.8 Exercises 316CHAPTER 17 – Network Security 31917.1 Introduction 32017.2 Domain Name System 32217.3 Firewalls 32817.4 Intrusion Detection 33217.5 Further Reading 33517.6 Exercises 336CHAPTER 18 – Web Security 33918.1 Introduction 34018.2 Authenticated Sessions 34218.3 Code Origin Policies 34618.4 Cross-Site Scripting 34718.5 Cross-Site Request Forgery 35018.6 JavaScript Hijacking 35218.7 Web Services Security 35418.8 Further Reading 36018.9 Exercises 361CHAPTER 19 – Mobility 36319.1 Introduction 36419.2 GSM 36419.3 UMTS 36919.4 Mobile IPv6 Security 37219.5 WLAN 37719.6 Bluetooth 38119.7 Further Reading 38319.8 Exercises 383CHAPTER 20 – New Access Control Paradigms 38520.1 Introduction 38620.2 SPKI 38820.3 Trust Management 39020.4 Code-Based Access Control 39120.5 Java Security 39520.6 .NET Security Framework 40020.7 Digital Rights Management 40520.8 Further Reading 40620.9 Exercises 406Bibliography 409Index 423