Charles P. Pfleeger is an internationally known expert on computer and communications security. He spent 14 years as professor of computer science at the University of Tennessee, before moving on to computer research and consulting company, Trusted Information Systems, where he was director of European operations and senior consultant. He was also director of research, member of the staff, and chief security officer at Cable and Wireless. He has chaired the IEEE Computer Society Technical Committee on Security and Privacy and was on the editorial board of IEEE Security & Privacy magazine.Shari Lawrence Pfleeger is a widely known software engineering and computer security researcher. She served as president of Systems/Software and then as senior researcher with the Rand Corporation. As research director of the Institute for Information Infrastructure Protection, she oversaw large, high-impact computer security research projects for international government and industry clients. She has served as associate editor in chief of IEEE Software magazine, and as editor in chief of IEEE Security & Privacy magazine.Lizzie Coles-Kemp is a professor of information security at the Information Security Group, Royal Holloway University of London (RHUL). Prior to joining RHUL in 2007, Lizzie work in security practice for 17 years and held several managerial and directorship roles. During this time, she worked on the design and implementation of software access control systems, taught network security to practitioners, worked as a lead assessor in security standards for a UK certification body, and was global security officer for the British Council (a UK NGO).

• Foreword xixPreface xxvAcknowledgments xxxiAbout the Authors xxxiiiChapter 1: Introduction 11.1 What Is Computer Security? 31.2 Threats 61.3 Harm 241.4 Vulnerabilities 301.5 Controls 301.6 Conclusion 331.7 What's Next? 341.8 Exercises 36Chapter 2: Toolbox: Authentication, Access Control, and Cryptography 382.1 Authentication 402.2 Access Control 782.3 Cryptography 932.4 Conclusion 1372.5 Exercises 138Chapter 3: Programs and Programming 1413.1 Unintentional (Nonmalicious) Programming Oversights 1433.2 Malicious Code--Malware 1783.3 Countermeasures 2113.4 Conclusion 2453.5 Exercises 245Chapter 4: The Internet--User Side 2484.1 Browser Attacks 2514.2 Attacks Targeting Users 2654.3 Obtaining User or Website Data 2804.4 Mobile Apps 2894.5 Email and Message Attacks 3104.6 Conclusion 3204.7 Exercises 321Chapter 5: Operating Systems 3235.1 Security in Operating Systems 3235.2 Security in the Design of Operating Systems 3515.3 Rootkits 3715.4 Conclusion 3825.5 Exercises 382Chapter 6: Networks 3856.1 Network Concepts 386Part I--War on Networks: Network Security Attacks 3996.2 Threats to Network Communications 4006.3 Wireless Network Security 4216.4 Denial of Service 4436.5 Distributed Denial of Service 468Part II--Strategic Defenses: Security Countermeasures 4796.6 Cryptography in Network Security 4796.7 Firewalls 4976.8 Intrusion Detection and Prevention Systems 5226.9 Network Management 5366.10 Conclusion 5456.11 Exercises 545Chapter 7: Data and Databases 5497.1 Introduction to Databases 5507.2 Security Requirements of Databases 5557.3 Reliability and Integrity 5617.4 Database Disclosure 5667.5 Data Mining and Big Data 5857.6 Conclusion 5997.7 Exercises 599Chapter 8: New Territory 6018.1 Introduction 6018.2 Cloud Architectures and Their Security 6058.3 IoT and Embedded Devices 6278.4 Cloud, IoT, and Embedded Devices--The Smart Home 6388.5 Smart Cities, IoT, Embedded Devices, and Cloud 6438.6 Cloud, IoT, and Critical Services 6488.7 Conclusion 6578.8 Exercises 658Chapter 9: Privacy 6599.1 Privacy Concepts 6609.2 Privacy Principles and Policies 6719.3 Authentication and Privacy 6889.4 Data Mining 6949.5 Privacy on the Internet 6989.6 Email and Message Security 7139.7 Privacy Impacts of Newer Technologies 7179.8 Conclusion 7249.9 Exercises 725Chapter 10: Management and Incidents 72710.1 Security Planning 72710.2 Business Continuity Planning 73810.3 Handling Incidents 74210.4 Risk Analysis 74910.5 Physical Threats to Systems 76710.6 New Frontiers in Security Management 77610.7 Conclusion 77810.8 Exercises 779Chapter 11: Legal Issues and Ethics 78111.1 Protecting Programs and Data 78311.2 Information and the Law 80011.3 Rights of Employees and Employers 80511.4 Redress for Software Failures 80811.5 Computer Crime 81411.6 Ethical Issues in Computer Security 82211.7 An Ethical Dive into Artificial Intelligence 82811.8 Incident Analyses with Ethics 83011.9 Conclusion 84611.10 Exercises 847Chapter 12: Details of Cryptography 85012.1 Cryptology 85112.2 Symmetric Encryption Algorithms 86312.3 Asymmetric Encryption 87712.4 Message Digests 88312.5 Digital Signatures 88812.6 Quantum Key Distribution 88912.7 Conclusion 894Chapter 13: Emerging Topics 89513.1 AI and Cybersecurity 89613.2 Blockchains and Cryptocurrencies 90813.3 Offensive Cyber and Cyberwarfare 92413.4 Quantum Computing and Computer Security 93613.5 Conclusion 937Bibliography 939Index 963

Charles P. Pfleeger is an internationally known expert on computer and communications security. He spent 14 years as professor of computer science at the University of Tennessee, before moving on to computer research and consulting company, Trusted Information Systems, where he was director of European operations and senior consultant. He was also director of research, member of the staff, and chief security officer at Cable and Wireless. He has chaired the IEEE Computer Society Technical Committee on Security and Privacy and was on the editorial board of IEEE Security & Privacy magazine.Shari Lawrence Pfleeger is a widely known software engineering and computer security researcher. She served as president of Systems/Software and then as senior researcher with the Rand Corporation. As research director of the Institute for Information Infrastructure Protection, she oversaw large, high-impact computer security research projects for international government and industry clients. She has served as associate editor in chief of IEEE Software magazine, and as editor in chief of IEEE Security & Privacy magazine.Lizzie Coles-Kemp is a professor of information security at the Information Security Group, Royal Holloway University of London (RHUL). Prior to joining RHUL in 2007, Lizzie work in security practice for 17 years and held several managerial and directorship roles. During this time, she worked on the design and implementation of software access control systems, taught network security to practitioners, worked as a lead assessor in security standards for a UK certification body, and was global security officer for the British Council (a UK NGO).

• Foreword xixPreface xxvAcknowledgments xxxiAbout the Authors xxxiiiChapter 1: Introduction 11.1 What Is Computer Security? 31.2 Threats 61.3 Harm 241.4 Vulnerabilities 301.5 Controls 301.6 Conclusion 331.7 What's Next? 341.8 Exercises 36Chapter 2: Toolbox: Authentication, Access Control, and Cryptography 382.1 Authentication 402.2 Access Control 782.3 Cryptography 932.4 Conclusion 1372.5 Exercises 138Chapter 3: Programs and Programming 1413.1 Unintentional (Nonmalicious) Programming Oversights 1433.2 Malicious Code--Malware 1783.3 Countermeasures 2113.4 Conclusion 2453.5 Exercises 245Chapter 4: The Internet--User Side 2484.1 Browser Attacks 2514.2 Attacks Targeting Users 2654.3 Obtaining User or Website Data 2804.4 Mobile Apps 2894.5 Email and Message Attacks 3104.6 Conclusion 3204.7 Exercises 321Chapter 5: Operating Systems 3235.1 Security in Operating Systems 3235.2 Security in the Design of Operating Systems 3515.3 Rootkits 3715.4 Conclusion 3825.5 Exercises 382Chapter 6: Networks 3856.1 Network Concepts 386Part I--War on Networks: Network Security Attacks 3996.2 Threats to Network Communications 4006.3 Wireless Network Security 4216.4 Denial of Service 4436.5 Distributed Denial of Service 468Part II--Strategic Defenses: Security Countermeasures 4796.6 Cryptography in Network Security 4796.7 Firewalls 4976.8 Intrusion Detection and Prevention Systems 5226.9 Network Management 5366.10 Conclusion 5456.11 Exercises 545Chapter 7: Data and Databases 5497.1 Introduction to Databases 5507.2 Security Requirements of Databases 5557.3 Reliability and Integrity 5617.4 Database Disclosure 5667.5 Data Mining and Big Data 5857.6 Conclusion 5997.7 Exercises 599Chapter 8: New Territory 6018.1 Introduction 6018.2 Cloud Architectures and Their Security 6058.3 IoT and Embedded Devices 6278.4 Cloud, IoT, and Embedded Devices--The Smart Home 6388.5 Smart Cities, IoT, Embedded Devices, and Cloud 6438.6 Cloud, IoT, and Critical Services 6488.7 Conclusion 6578.8 Exercises 658Chapter 9: Privacy 6599.1 Privacy Concepts 6609.2 Privacy Principles and Policies 6719.3 Authentication and Privacy 6889.4 Data Mining 6949.5 Privacy on the Internet 6989.6 Email and Message Security 7139.7 Privacy Impacts of Newer Technologies 7179.8 Conclusion 7249.9 Exercises 725Chapter 10: Management and Incidents 72710.1 Security Planning 72710.2 Business Continuity Planning 73810.3 Handling Incidents 74210.4 Risk Analysis 74910.5 Physical Threats to Systems 76710.6 New Frontiers in Security Management 77610.7 Conclusion 77810.8 Exercises 779Chapter 11: Legal Issues and Ethics 78111.1 Protecting Programs and Data 78311.2 Information and the Law 80011.3 Rights of Employees and Employers 80511.4 Redress for Software Failures 80811.5 Computer Crime 81411.6 Ethical Issues in Computer Security 82211.7 An Ethical Dive into Artificial Intelligence 82811.8 Incident Analyses with Ethics 83011.9 Conclusion 84611.10 Exercises 847Chapter 12: Details of Cryptography 85012.1 Cryptology 85112.2 Symmetric Encryption Algorithms 86312.3 Asymmetric Encryption 87712.4 Message Digests 88312.5 Digital Signatures 88812.6 Quantum Key Distribution 88912.7 Conclusion 894Chapter 13: Emerging Topics 89513.1 AI and Cybersecurity 89613.2 Blockchains and Cryptocurrencies 90813.3 Offensive Cyber and Cyberwarfare 92413.4 Quantum Computing and Computer Security 93613.5 Conclusion 937Bibliography 939Index 963

Charles P. Pfleeger is an internationally known expert on computer and communications security. He spent 14 years as professor of computer science at the University of Tennessee, before moving on to computer research and consulting company, Trusted Information Systems, where he was director of European operations and senior consultant. He was also director of research, member of the staff, and chief security officer at Cable and Wireless. He has chaired the IEEE Computer Society Technical Committee on Security and Privacy and was on the editorial board of IEEE Security & Privacy magazine.Shari Lawrence Pfleeger is a widely known software engineering and computer security researcher. She served as president of Systems/Software and then as senior researcher with the Rand Corporation. As research director of the Institute for Information Infrastructure Protection, she oversaw large, high-impact computer security research projects for international government and industry clients. She has served as associate editor in chief of IEEE Software magazine, and as editor in chief of IEEE Security & Privacy magazine.Lizzie Coles-Kemp is a professor of information security at the Information Security Group, Royal Holloway University of London (RHUL). Prior to joining RHUL in 2007, Lizzie work in security practice for 17 years and held several managerial and directorship roles. During this time, she worked on the design and implementation of software access control systems, taught network security to practitioners, worked as a lead assessor in security standards for a UK certification body, and was global security officer for the British Council (a UK NGO).

• Foreword xixPreface xxvAcknowledgments xxxiAbout the Authors xxxiiiChapter 1: Introduction 11.1 What Is Computer Security? 31.2 Threats 61.3 Harm 241.4 Vulnerabilities 301.5 Controls 301.6 Conclusion 331.7 What's Next? 341.8 Exercises 36Chapter 2: Toolbox: Authentication, Access Control, and Cryptography 382.1 Authentication 402.2 Access Control 782.3 Cryptography 932.4 Conclusion 1372.5 Exercises 138Chapter 3: Programs and Programming 1413.1 Unintentional (Nonmalicious) Programming Oversights 1433.2 Malicious Code--Malware 1783.3 Countermeasures 2113.4 Conclusion 2453.5 Exercises 245Chapter 4: The Internet--User Side 2484.1 Browser Attacks 2514.2 Attacks Targeting Users 2654.3 Obtaining User or Website Data 2804.4 Mobile Apps 2894.5 Email and Message Attacks 3104.6 Conclusion 3204.7 Exercises 321Chapter 5: Operating Systems 3235.1 Security in Operating Systems 3235.2 Security in the Design of Operating Systems 3515.3 Rootkits 3715.4 Conclusion 3825.5 Exercises 382Chapter 6: Networks 3856.1 Network Concepts 386Part I--War on Networks: Network Security Attacks 3996.2 Threats to Network Communications 4006.3 Wireless Network Security 4216.4 Denial of Service 4436.5 Distributed Denial of Service 468Part II--Strategic Defenses: Security Countermeasures 4796.6 Cryptography in Network Security 4796.7 Firewalls 4976.8 Intrusion Detection and Prevention Systems 5226.9 Network Management 5366.10 Conclusion 5456.11 Exercises 545Chapter 7: Data and Databases 5497.1 Introduction to Databases 5507.2 Security Requirements of Databases 5557.3 Reliability and Integrity 5617.4 Database Disclosure 5667.5 Data Mining and Big Data 5857.6 Conclusion 5997.7 Exercises 599Chapter 8: New Territory 6018.1 Introduction 6018.2 Cloud Architectures and Their Security 6058.3 IoT and Embedded Devices 6278.4 Cloud, IoT, and Embedded Devices--The Smart Home 6388.5 Smart Cities, IoT, Embedded Devices, and Cloud 6438.6 Cloud, IoT, and Critical Services 6488.7 Conclusion 6578.8 Exercises 658Chapter 9: Privacy 6599.1 Privacy Concepts 6609.2 Privacy Principles and Policies 6719.3 Authentication and Privacy 6889.4 Data Mining 6949.5 Privacy on the Internet 6989.6 Email and Message Security 7139.7 Privacy Impacts of Newer Technologies 7179.8 Conclusion 7249.9 Exercises 725Chapter 10: Management and Incidents 72710.1 Security Planning 72710.2 Business Continuity Planning 73810.3 Handling Incidents 74210.4 Risk Analysis 74910.5 Physical Threats to Systems 76710.6 New Frontiers in Security Management 77610.7 Conclusion 77810.8 Exercises 779Chapter 11: Legal Issues and Ethics 78111.1 Protecting Programs and Data 78311.2 Information and the Law 80011.3 Rights of Employees and Employers 80511.4 Redress for Software Failures 80811.5 Computer Crime 81411.6 Ethical Issues in Computer Security 82211.7 An Ethical Dive into Artificial Intelligence 82811.8 Incident Analyses with Ethics 83011.9 Conclusion 84611.10 Exercises 847Chapter 12: Details of Cryptography 85012.1 Cryptology 85112.2 Symmetric Encryption Algorithms 86312.3 Asymmetric Encryption 87712.4 Message Digests 88312.5 Digital Signatures 88812.6 Quantum Key Distribution 88912.7 Conclusion 894Chapter 13: Emerging Topics 89513.1 AI and Cybersecurity 89613.2 Blockchains and Cryptocurrencies 90813.3 Offensive Cyber and Cyberwarfare 92413.4 Quantum Computing and Computer Security 93613.5 Conclusion 937Bibliography 939Index 963