Charles Pfleeger is an internationally known expert on computer and communications security. He was originally a professor at the University of Tennessee, leaving there to join computer security research and consulting companies Trusted Information Systems and Arca Systems (later Exodus Communications and Cable and Wireless). With Trusted Information Systems he was Director of European Operations and Senior Consultant. With Cable and Wireless he was Director of Research and a member of the staff of the Chief Security Officer. He was chair of the IEEE Computer Society Technical Committee on Security and Privacy.Shari Lawrence Pfleeger is widely known as a software engineering and computer security researcher, most recently as a Senior Computer Scientist with the Rand Corporation and as Research Director of the Institute for Information Infrastructure Protection. She is currently Editor in Chief of IEEE Security & Privacy magazine.Jonathan Margulies is the CTO of Qmulos, a cybersecurity consulting firm. After receiving his Masters Degree in Computer Science from Cornell University, Mr. Margulies spent nine years at Sandia National Labs, researching and developing solutions to protect national security and critical infrastructure systems from advanced persistent threats. He then went on to NIST's National Cybersecurity Center of Excellence, where he worked with a variety of critical infrastructure companies to create industry-standard security architectures. In his free time, Mr. Margulies edits the “Building Security In” section of IEEE Security & Privacy magazine.

• Foreword xixPreface xxvAcknowledgments xxxiAbout the Authors xxxiiiChapter 1: Introduction 11.1 What Is Computer Security? 21.2 Threats 61.3 Harm 211.4 Vulnerabilities 281.5 Controls 281.6 Conclusion 311.7 What’s Next? 321.8 Exercises 34Chapter 2: Toolbox: Authentication, Access Control, and Cryptography 362.1 Authentication 382.2 Access Control 722.3 Cryptography 862.4 Exercises 127Chapter 3: Programs and Programming 1313.1 Unintentional (Nonmalicious) Programming Oversights 1333.2 Malicious Code—Malware 1663.3 Countermeasures 196Chapter 4: The Web—User Side 2324.1 Browser Attacks 2344.2 Web Attacks Targeting Users 2454.3 Obtaining User or Website Data 2604.4 Email Attacks 2674.5 Conclusion 2774.6 Exercises 278Chapter 5: Operating Systems 2805.1 Security in Operating Systems 2805.2 Security in the Design of Operating Systems 3085.3 Rootkit 3295.4 Conclusion 3385.5 Exercises 339Chapter 6: Networks 3416.1 Network Concepts 342Part I—War on Networks: Network Security Attacks 3536.2 Threats to Network Communications 3546.3 Wireless Network Security 3746.4 Denial of Service 3966.5 Distributed Denial-of-Service 421Part II—Strategic Defenses: Security Countermeasures 4326.6 Cryptography in Network Security 4326.7 Firewalls 4516.8 Intrusion Detection and Prevention Systems 4746.9 Network Management 4896.10 Conclusion 4966.11 Exercises 496Chapter 7: Databases 5017.1 Introduction to Databases 5027.2 Security Requirements of Databases 5077.3 Reliability and Integrity 5137.4 Database Disclosure 5187.5 Data Mining and Big Data 5357.6 Conclusion 549Chapter 8: Cloud Computing 5518.1 Cloud Computing Concepts 5518.2 Moving to the Cloud 5538.3 Cloud Security Tools and Techniques 5608.4 Cloud Identity Management 5688.5 Securing IaaS 5798.6 Conclusion 5838.7 Exercises 584Chapter 9: Privacy 5869.1 Privacy Concepts 5879.2 Privacy Principles and Policies 5969.3 Authentication and Privacy 6109.4 Data Mining 6169.5 Privacy on the Web 6199.6 Email Security 6329.7 Privacy Impacts of Emerging Technologies 6369.8 Where the Field Is Headed 6449.9 Conclusion 6459.10 Exercises 645Chapter 10: Management and Incidents 64710.1 Security Planning 64710.2 Business Continuity Planning 65810.3 Handling Incidents 66210.4 Risk Analysis 66810.5 Dealing with Disaster 68610.6 Conclusion 69910.7 Exercises 700Chapter 11: Legal Issues and Ethics 70211.1 Protecting Programs and Data 70411.2 Information and the Law 71711.3 Rights of Employees and Employers 72511.4 Redress for Software Failures 72811.5 Computer Crime 73311.6 Ethical Issues in Computer Security 74411.7 Incident Analysis with Ethics 750Chapter 12: Details of Cryptography 76812.1 Cryptology 76912.2 Symmetric Encryption Algorithms 77912.3 Asymmetric Encryption with RSA 79512.4 Message Digests 79912.5 Digital Signatures 80212.6 Quantum Cryptography 80712.7 Conclusion 811Chapter 13: Emerging Topics 81313.1 The Internet of Things 81413.2 Economics 82113.3 Electronic Voting 83413.4 Cyber Warfare 84113.5 Conclusion 850Bibliography 851Index 877

Charles Pfleeger is an internationally known expert on computer and communications security. He was originally a professor at the University of Tennessee, leaving there to join computer security research and consulting companies Trusted Information Systems and Arca Systems (later Exodus Communications and Cable and Wireless). With Trusted Information Systems he was Director of European Operations and Senior Consultant. With Cable and Wireless he was Director of Research and a member of the staff of the Chief Security Officer. He was chair of the IEEE Computer Society Technical Committee on Security and Privacy.Shari Lawrence Pfleeger is widely known as a software engineering and computer security researcher, most recently as a Senior Computer Scientist with the Rand Corporation and as Research Director of the Institute for Information Infrastructure Protection. She is currently Editor in Chief of IEEE Security & Privacy magazine.Jonathan Margulies is the CTO of Qmulos, a cybersecurity consulting firm. After receiving his Masters Degree in Computer Science from Cornell University, Mr. Margulies spent nine years at Sandia National Labs, researching and developing solutions to protect national security and critical infrastructure systems from advanced persistent threats. He then went on to NIST's National Cybersecurity Center of Excellence, where he worked with a variety of critical infrastructure companies to create industry-standard security architectures. In his free time, Mr. Margulies edits the “Building Security In” section of IEEE Security & Privacy magazine.

• Foreword xixPreface xxvAcknowledgments xxxiAbout the Authors xxxiiiChapter 1: Introduction 11.1 What Is Computer Security? 21.2 Threats 61.3 Harm 211.4 Vulnerabilities 281.5 Controls 281.6 Conclusion 311.7 What’s Next? 321.8 Exercises 34Chapter 2: Toolbox: Authentication, Access Control, and Cryptography 362.1 Authentication 382.2 Access Control 722.3 Cryptography 862.4 Exercises 127Chapter 3: Programs and Programming 1313.1 Unintentional (Nonmalicious) Programming Oversights 1333.2 Malicious Code—Malware 1663.3 Countermeasures 196Chapter 4: The Web—User Side 2324.1 Browser Attacks 2344.2 Web Attacks Targeting Users 2454.3 Obtaining User or Website Data 2604.4 Email Attacks 2674.5 Conclusion 2774.6 Exercises 278Chapter 5: Operating Systems 2805.1 Security in Operating Systems 2805.2 Security in the Design of Operating Systems 3085.3 Rootkit 3295.4 Conclusion 3385.5 Exercises 339Chapter 6: Networks 3416.1 Network Concepts 342Part I—War on Networks: Network Security Attacks 3536.2 Threats to Network Communications 3546.3 Wireless Network Security 3746.4 Denial of Service 3966.5 Distributed Denial-of-Service 421Part II—Strategic Defenses: Security Countermeasures 4326.6 Cryptography in Network Security 4326.7 Firewalls 4516.8 Intrusion Detection and Prevention Systems 4746.9 Network Management 4896.10 Conclusion 4966.11 Exercises 496Chapter 7: Databases 5017.1 Introduction to Databases 5027.2 Security Requirements of Databases 5077.3 Reliability and Integrity 5137.4 Database Disclosure 5187.5 Data Mining and Big Data 5357.6 Conclusion 549Chapter 8: Cloud Computing 5518.1 Cloud Computing Concepts 5518.2 Moving to the Cloud 5538.3 Cloud Security Tools and Techniques 5608.4 Cloud Identity Management 5688.5 Securing IaaS 5798.6 Conclusion 5838.7 Exercises 584Chapter 9: Privacy 5869.1 Privacy Concepts 5879.2 Privacy Principles and Policies 5969.3 Authentication and Privacy 6109.4 Data Mining 6169.5 Privacy on the Web 6199.6 Email Security 6329.7 Privacy Impacts of Emerging Technologies 6369.8 Where the Field Is Headed 6449.9 Conclusion 6459.10 Exercises 645Chapter 10: Management and Incidents 64710.1 Security Planning 64710.2 Business Continuity Planning 65810.3 Handling Incidents 66210.4 Risk Analysis 66810.5 Dealing with Disaster 68610.6 Conclusion 69910.7 Exercises 700Chapter 11: Legal Issues and Ethics 70211.1 Protecting Programs and Data 70411.2 Information and the Law 71711.3 Rights of Employees and Employers 72511.4 Redress for Software Failures 72811.5 Computer Crime 73311.6 Ethical Issues in Computer Security 74411.7 Incident Analysis with Ethics 750Chapter 12: Details of Cryptography 76812.1 Cryptology 76912.2 Symmetric Encryption Algorithms 77912.3 Asymmetric Encryption with RSA 79512.4 Message Digests 79912.5 Digital Signatures 80212.6 Quantum Cryptography 80712.7 Conclusion 811Chapter 13: Emerging Topics 81313.1 The Internet of Things 81413.2 Economics 82113.3 Electronic Voting 83413.4 Cyber Warfare 84113.5 Conclusion 850Bibliography 851Index 877

Charles Pfleeger is an internationally known expert on computer and communications security. He was originally a professor at the University of Tennessee, leaving there to join computer security research and consulting companies Trusted Information Systems and Arca Systems (later Exodus Communications and Cable and Wireless). With Trusted Information Systems he was Director of European Operations and Senior Consultant. With Cable and Wireless he was Director of Research and a member of the staff of the Chief Security Officer. He was chair of the IEEE Computer Society Technical Committee on Security and Privacy.Shari Lawrence Pfleeger is widely known as a software engineering and computer security researcher, most recently as a Senior Computer Scientist with the Rand Corporation and as Research Director of the Institute for Information Infrastructure Protection. She is currently Editor in Chief of IEEE Security & Privacy magazine.Jonathan Margulies is the CTO of Qmulos, a cybersecurity consulting firm. After receiving his Masters Degree in Computer Science from Cornell University, Mr. Margulies spent nine years at Sandia National Labs, researching and developing solutions to protect national security and critical infrastructure systems from advanced persistent threats. He then went on to NIST's National Cybersecurity Center of Excellence, where he worked with a variety of critical infrastructure companies to create industry-standard security architectures. In his free time, Mr. Margulies edits the “Building Security In” section of IEEE Security & Privacy magazine.

• Foreword xixPreface xxvAcknowledgments xxxiAbout the Authors xxxiiiChapter 1: Introduction 11.1 What Is Computer Security? 21.2 Threats 61.3 Harm 211.4 Vulnerabilities 281.5 Controls 281.6 Conclusion 311.7 What’s Next? 321.8 Exercises 34Chapter 2: Toolbox: Authentication, Access Control, and Cryptography 362.1 Authentication 382.2 Access Control 722.3 Cryptography 862.4 Exercises 127Chapter 3: Programs and Programming 1313.1 Unintentional (Nonmalicious) Programming Oversights 1333.2 Malicious Code—Malware 1663.3 Countermeasures 196Chapter 4: The Web—User Side 2324.1 Browser Attacks 2344.2 Web Attacks Targeting Users 2454.3 Obtaining User or Website Data 2604.4 Email Attacks 2674.5 Conclusion 2774.6 Exercises 278Chapter 5: Operating Systems 2805.1 Security in Operating Systems 2805.2 Security in the Design of Operating Systems 3085.3 Rootkit 3295.4 Conclusion 3385.5 Exercises 339Chapter 6: Networks 3416.1 Network Concepts 342Part I—War on Networks: Network Security Attacks 3536.2 Threats to Network Communications 3546.3 Wireless Network Security 3746.4 Denial of Service 3966.5 Distributed Denial-of-Service 421Part II—Strategic Defenses: Security Countermeasures 4326.6 Cryptography in Network Security 4326.7 Firewalls 4516.8 Intrusion Detection and Prevention Systems 4746.9 Network Management 4896.10 Conclusion 4966.11 Exercises 496Chapter 7: Databases 5017.1 Introduction to Databases 5027.2 Security Requirements of Databases 5077.3 Reliability and Integrity 5137.4 Database Disclosure 5187.5 Data Mining and Big Data 5357.6 Conclusion 549Chapter 8: Cloud Computing 5518.1 Cloud Computing Concepts 5518.2 Moving to the Cloud 5538.3 Cloud Security Tools and Techniques 5608.4 Cloud Identity Management 5688.5 Securing IaaS 5798.6 Conclusion 5838.7 Exercises 584Chapter 9: Privacy 5869.1 Privacy Concepts 5879.2 Privacy Principles and Policies 5969.3 Authentication and Privacy 6109.4 Data Mining 6169.5 Privacy on the Web 6199.6 Email Security 6329.7 Privacy Impacts of Emerging Technologies 6369.8 Where the Field Is Headed 6449.9 Conclusion 6459.10 Exercises 645Chapter 10: Management and Incidents 64710.1 Security Planning 64710.2 Business Continuity Planning 65810.3 Handling Incidents 66210.4 Risk Analysis 66810.5 Dealing with Disaster 68610.6 Conclusion 69910.7 Exercises 700Chapter 11: Legal Issues and Ethics 70211.1 Protecting Programs and Data 70411.2 Information and the Law 71711.3 Rights of Employees and Employers 72511.4 Redress for Software Failures 72811.5 Computer Crime 73311.6 Ethical Issues in Computer Security 74411.7 Incident Analysis with Ethics 750Chapter 12: Details of Cryptography 76812.1 Cryptology 76912.2 Symmetric Encryption Algorithms 77912.3 Asymmetric Encryption with RSA 79512.4 Message Digests 79912.5 Digital Signatures 80212.6 Quantum Cryptography 80712.7 Conclusion 811Chapter 13: Emerging Topics 81313.1 The Internet of Things 81413.2 Economics 82113.3 Electronic Voting 83413.4 Cyber Warfare 84113.5 Conclusion 850Bibliography 851Index 877