Preface Goals Philosophy Organization Roadmap Dependencies Background Undergraduate Level Graduate Level Practitioners Special Acknowledgment Acknowledgments PART 1:INTRODUCTION Chapter 1 An Overview of Computer Security 1.1 The Basic Components 1.1.1 Confidentiality 1.1.2 Integrity 1.1.3 Availability 1.2 Threats 1.3 Policy and Mechanism 1.3.1 Goals of Security 1.4 Assumptions and Trust 1.5 Assurance 1.5.1 Specification 1.5.2 Design 1.5.3 Implementation 1.6 Operational Issues 1.6.1 Cost-Benefit Analysis 1.6.2 Risk Analysis 1.6.3 Laws and Customs 1.7 Human Issues 1.7.1 Organizational Problems 1.7.2 People Problems 1.8 Tying It All Together 1.9 Summary 1.10 Research Issues 1.11 Further Reading 1.12 Exercises PART 2:FOUNDATIONS Chapter 2 Access Control Matrix 2.1 Protection State 2.2 Access Control Matrix Model 2.2.1 Access Control by Boolean Expression Evaluation 2.2.2 Access Controlled by History 2.3 Protection State Transitions 2.3.1 Conditional Commands 2.4 Copying,Owning,and the Attenuation of Privilege 2.4.1 Copy Right 2.4.2 Own Right 2.4.3 Principle of Attenuation of Privilege 2.5 Summary 2.6 Research Issues 2.7 Further Reading 2.8 Exercises Chapter 3 Foundational Results 3.1 The General Question 3.2 Basic Results 3.3 The Take-Grant Protection Model 3.3.1 Sharing of Rights 3.3.2 Interpretation of the Model 3.3.3 Theft in the Take-Grant Protection Model 3.3.4 Conspiracy 3.3.5 Summary 3.4 Closing the Gap 3.4.1 Schematic Protection Model 3.4.1.1 Link Predicate 3.4.1.2 Filter Function 3.4.1.3 Putting It All Together 3.4.1.4 Demand and Create Operations 3.4.1.5 Safety Analysis 3.5 Expressive Power and the Models 3.5.1 Brief Comparison of HRU and SPM 3.5.2 Extending SPM 3.5.3 Simulation and Expressiveness 3.5.4 Typed Access Matrix Model 3.6 Summary 3.7 Research Issues 3.8 Further Reading 3.9 Exercises PART 3:POLICY Chapter 4 Security Policies 4.1 Security Policies 4.2 Types of Security Policies 4.3 The Role of Trust 4.4 Types of Access Control 4.5 Policy Languages 4.5.1 High-Level Policy Languages 4.5.2 Low-Level Policy Languages 4.6 Example:Academic Computer Security Policy 4.6.1 general University Policy 4.6.2 Electronic Mail Policy 4.6.2.1 The Electronic Mail Policy Summary 4.6.2.2 The Full Policy 4.6.2.3 Implementation at UC Davis 4.7 Security and Precision 4.8 Summary 4.9 Research Issues 4.10 Further Reading 4.11 Exercises Chapter 5 Confidentiality Policies 5.1 Goals of Confidentiality Policies 5.2 The Bell-LaPadula Model 5.2.1 Informal Description 5.2.2 Example:The Data General B2 UNIX System 5.2.2.1 Assigning MAC Labels 5.2.2.2 Using MAC Labels 5.2.3 Formal Model 5.2.3.1 Basic Security Theorem 5.2.3.2 Rules of Transformation 5.2.4 Example Model Instantiation:Multics 5.2.4.1 The get-read Rule 5.2.4.2 The give-read Rule 5.3 Tranquility 5.4 The Controversy over the Bell-LaPadula Model 5.4.1 McLean's +-Property and the Basic Security Theorem 5.4.2 McLean's System Z and More Questions 5.4.3 Summary 5.5 Summary 5.6 Research Issues 5.7 Further Reading 5.8 Exercises Chapter 6 Integrity Policies 6.1 Goals 6.2 Biba Integrity Model 6.2.1 Low-Water-Mark Policy 6.2.2 Ring Policy 6.2.3 Biba's Model(Strict Integrity Policy) 6.3 Lipner's Integrity Matrix Model 6.3.1 Lipner's Use of the Bell-LaPadula Model 6.3.2 Lipner's Full Model 6.3.3 Comparison with Biba 6.4 Clark-Wilson Integrity Model 6.4.1 The Model 6.4.1.1 A UNIX Approximation to Clark-Wilson 6.4.2 Comparison with the Requirements 6.4.3 Comparison with Other Models 6.5 Summary 6.6 Research Issues 6.7 Further Reading 6.8 Exercises Chapter 7 Hybrid Policies 7.1 Chinese Wall Model 7.1.1 Informal Description 7.1.2 Formal Model 7.1.3 Bell-LaPadula and Chinese Wall Models 7.1.4 Clark-Wilson and Chinese Wall Models 7.2 Clinical Information Systems Security Policy 7.2.1 Bell-LaPadula and Clark-Wilson Models 7.3 Originator Controlled Access Control 7.4 Role-Based Access Control 7.5 Summary 7.6 Research Issues 7.7 Further Reading 7.8 Exercises Chapter 8 Noninterference and Policy Composition 8.1 The Problem 8.1.1 Composition of Bell-LaPadula Models 8.2 Deterministic Noninterference 8.2.1 Unwinding Theorem 8.2.2 Access Control Matrix Interpretation 8.2.3 Security Policies That Change over Time 8.2.4 Composition of Deterministic Noninterference-Secure Systems 8.3 Nondeducibility 8.3.1 Composition of Deducibly Secure Systems 8.4 Generalized Noninterference 8.4.1 Composition of Generalized Noninterference Systems 8.5 Restrictiveness 8.5.1 State Machine Model 8.5.2 Composition of Restrictive Systems 8.6 Summary 8.7 Research Issues 8.8 Further Reading 8.9 Exercises PART 4:IMPLEMENTATION I:CRYPTOGRAPHY Chapter 9 Basic Cryptography 9.1 What Is Cryptography? 9.2 Classical Cryptosystems 9.2.1 Transposition Ciphers 9.2.2 Substitution Ciphers 9.2.2.1 Vigenere Cipher 9.2.2.2 One-Time Pad 9.2.3 Data Encryption Standard 9.2.4 Other Classical Ciphers 9.3 Public Key Cryptography 9.3.1 Diffie-Hellman 9.3.2 RSA 9.4 Cryptographic Checksums 9.4.1 HMAC 9.5 Summary 9.6 Research Issues 9.7 Further Reading 9.8 Exercises Chapter 10 Key Management 10.1 Session and Interchange Keys 10.2 Key Exchange 10.2.1 Classical Cryptographic Key Exchange and Authentication 10.2.2 Kerberos 10.2.3 Public Key Cryptographic Key Exchange and Authentication 10.3 Key Generation 10.4 Cryptographic Key Infrastructures 10.4.1 Merkle's Tree authentication Scheme 10.4.2 Certificate Signature Chains 10.4.2.1 X.509:Certification Signature Chains 10.4.2.2 PGP Certificate Signature Chains 10.4.3 Summary 10.5 Storing and Revoking Keys 10.5.1 Key Storage 10.5.1.1 Key Escrow 10.5.1.2 Key Escrow System and the Clipper Chip 10.5.1.3 The yaksha Security System 10.5.1.4 Other Approaches 10.5.2 Key Revocation 10.6 Digital Signatures 10.6.1 Classical Signatures 10.6.2 Public Key Signatures 10.6.2.1 RSA Digital Signatures 10.6.2.2 El Gamal Digital Signature 10.7 Summary 10.8 Research Issues 10.9 Further Reading 10.10 Exercises Chapter 11 Cipher Techniques 11.1 Problems 11.1.1 Precomputing the Possible Messages 11.1.2 Misordered Blocks 11.1.3 Statistical Regularities 11.1.4 Summary 11.2 Stream and Block Ciphers 11.2.1 Stream Ciphers 11.2.1.1 Synchronous Stream Ciphers 11.2.1.2 Self-Synchronous Stream Ciphers 11.2.2 Block Ciphers 11.2.2.1 Multiple Encryption 11.3 Networks and Cryptography 11.4 Example Protocols 11.4.1 Secure Electronic Mail:PEM 11.4.1.1 Design Principles 11.4.1.2 Basic Design 11.4.1.3 Other Considerations 11.4.1.4 Conclusion 11.4.2 Security at the Transport Layer:SSL 11.4.2.1 Supporting Cryptographic Mechanisms 11.4.2.2 Lower Layper:SSL Record Protocol 11.4.2.3 Upper Layer:SSL Handshake Protocol 11.4.2.4 Upper Layer:SSL Change Cipher Spec Protocol 11.4.2.5 Upper Layer:SSL Alert Protocol 11.4.2.6 Upper Layer:Application Data Protocol 11.4.2.7 Summary 11.4.3 Security at the Network Layer:IPsec 11.4.3.1 IPsec Architecture 11.4.3.2 Authentication Header Protocol 11.4.3.3 Encapsulating Security Payload Protocol 11.4.4 Conclusion 11.5 Summary 11.6 Research Issues 11.7 Further Reading 11.8 Exercises Chapter 12 Authentication 12.1 Authentication Basics 12.2 Passwords 12.2.1 Attacking a Password System 12.2.2 Countering Password Guessing 12.2.2.1 Random Selection of Passwords 12.2.2.2 Pronounceable and Other Computer-Generated Passwords 12.2.2.3 User Selection of Passwords 12.2.2.4 Reusable Passwords and Dictionary Attacks 12.2.2.5 Guessing Through Authentication Functions 12.2.3 Password Aging 12.3 Challenge-Response 12.3.1 Pass Algorithms 12.3.2 One-Time Passwords 12.3.3 Hardware-Supported Challenge-Response Procedures 12.3.4 Challenge-Response and Dictionary Attacks 12.4 Biometrics 12.4.1 Fingerprints 12.4.2 Voices 12.4.3 Eyes 12.4.4 Faces 12.4.5 Keystrokes 12.4.6 Combinations 12.4.7 Caution 12.5 Location 12.6 Multiple Methods 12.7 Summary 12.8 Research Issues 12.9 Further Reading 12.10 Exercises PART 5:IMPLEMENTATION II:SYSTEMS Chapter 13 Design Principles 13.1 Overview 13.2 Design Principles 13.2.1 Principle of Least Privilege 13.2.2 Principle of Fail-Safe Defaults 13.2.3 Principle of Economy of Mechanism 13.2.4 Principle of Complete Mediation 13.2.5 Principle of Open Design 13.2.6 Principle of Separation of Privilege 13.2.7 Principle of Least Common Mechanism 13.2.8 Principle of Psychological Acceptability 13.3 Summary 13.4 Research Issues 13.5 Further Reading 13.6 Exercises Chapter 14 Representing Identity 14.1 What Is Identity? 14.2 Files and Objects 14.3 Users 14.4 Groups and Roles 14.5 Naming and Certificates 14.5.1 Conflicts 14.5.2 The Meaning of the Identity 14.5.3 Trust 14.6 Identity on the Web 14.6.1 Host Identity 14.6.1.1 Static and Dynamic Identifiers 14.6.1.2 Security Issues with the Domain Name Service 14.6.2 State and Cookies 14.6.3 Anonymity on the Web 14.6.3.1 Anonymity for Better or Worse 14.7 Summary 14.8 Research Issues 14.9 Further Reading 14.10 Exercises Chapter 15 Access Control Mechanisms 15.1 Access Control Lists 15.1.1 Abbreviations of Access Control Lists 15.1.2 Creation and Maintenance of Access Control Lists 15.1.2.1 Which Subjects Can Modify an Object's ACL? 15.1.2.2 Do the ACLs Apply to a Privileged User? 15.1.2.3 Does the ACL Support Groups and Wildcards? 15.1.2.4 Conflicts 15.1.2.5 ACLs and Default Permissions 15.1.3 Revocation of Rights 15.1.4 Example:Windows NT Access Control Lists 15.2 Capabilities 15.2.1 Implementation of Capabilities 15.2.2 Copying and Amplifying Capabilities 15.2.3 Revocation of Rights 15.2.4 Limits of Capabilities 15.2.5 Comparison with Access Control Lists 15.3 Locks and Keys 15.3.1 Type Checking 15.3.2 Sharing Secrets 15.4 Ring-Based Access Control 15.5 Propagated Access Control Lists 15.6 Summary 15.7 Research Issues 15.8 Further Reading 15.9 Exercises Chapter 16 Information Flow 16.1 Basics and Background 16.1.1 Entropy-Based Analysis 16.1.2 Information Flow Models and Mechanisms 16.2 Nonlattice Information Flow Policies 16.2.1 Confinement Flow Model 16.2.2 Transitive Nonlattice Information Flow Policies 16.2.3 Nontransitive Information Flow Policies 16.3 Compiler-Based Mechanisms 16.3.1 Declarations 16.3.2 Program Statements 16.3.2.1 Assignment Statements 16.3.2.2 Compound Statements 16.3.2.3 Conditional Statements 16.3.2.4 Iterative Statements 16.3.2.5 Goto Statements 16.3.2.6 Procedure Calls 16.3.3 Exceptions and Infinite Loops 16.3.4 Concurrency 16.3.5 Soundness 16.4 Execuition-Based Mechanisms 16.4.1 Fenton's Data Mark Machine 16.4.2 Variable Classes 16.5 Example Information Flow Controls 16.5.1 Security Pipeline Interface 16.5.2 Secure Network Server Mail Guard 16.6 Summary 16.7 Research Issues 16.8 Further Reading 16.9 Exercises Chapter 17 Confinement Problem 17.1 The Confinement Problem 17.2 Isolation 17.2.1 Virtual Machines 17.2.2 Sandboxes 17.3 Covert Channels 17.3.1 Detection of Covert Channels 17.3.1.1 Noninterference 17.3.1.2 The Shared Resource Matrix Methodology 17.3.1.3 Information Flow Analysis 17.3.1.4 Covert Flow Trees 17.3.2 Analysis of Covert Channels 17.3.2.1 Covert Channel Capacity and Noninterference 17.3.2.2 Measuring Covert Channel Capacity 17.3.2.3 Analyzing a Noisy Covert Channel's Capacity 17.3.3 Mitigation of Covert Channels 17.4 Summary 17.5 Research Issues 17.6 Further Reading 17.7 Exercises PART 6:ASSURANCE Contributed by Elisabeth Sullivan Chapter 18 Introduction to Assurance 18.1 Assurance and Trust 18.1.1 The Need for Assurance 18.1.2 The Role of Requirements in Assurance 18.1.3 Assurance Throughout the Life Cycle 18.2 Building Secure and Trusted Systems 18.2.1 Life Cycle 18.2.1.1 Conception 18.2.1.2 Manufacture 18.2.1.3 Deployment 18.2.1.4 Fielded Product Life 18.2.2 The Waterfall Life Cycle Model 18.2.2.1 Requirements Definition and Analysis 18.2.2.2 System and Software Design 18.2.2.3 Implementation and Unit Testing 18.2.2.4 Integration and System Testing 18.2.2.5 Operation and Maintenance 18.2.2.6 Discussion 18.2.3 Other Mdoels of Software Development 18.2.3.1 Exploratory Programming 18.2.3.2 Prototyping 18.2.3.3 Formal Transformation 18.2.3.4 System Assembly from Reusable Components 18.2.3.5 Extreme Programming 18.3 Summary 18.4 Research Issues 18.5 Further Reading 18.6 Exercises Chapter 19 Building Systems with Assurance 19.1 Assurance in Requirements Definition and Analysis 19.1.1 Threats and Security Objectives 19.1.2 Architectural Considerations 19.1.2.1 Security Mechanisms and Layered Architecture 19.1.2.2 Building Security in or Adding Security Later 19.1.3 Policy Definition and Requirements Specification 19.1.4 Justifying Requirements 19.2 Assurance During System and Software Design 19.2.1 Design Techniques That Support Assurance 19.2.2 Design Document Contents 19.2.2.1 Security Functions Summary Specification 19.2.2.2 External Functional Specification 19.2.2.3 Internal Design Description 19.2.2.4 Internal Design Specification 19.2.3 Building Documentation and Specifications 19.2.3.1 Modification Specifications 19.2.3.2 Security Specifications 19.2.3.3 Formal Specifications 19.2.4 Justifying That Design Meets Requirements 19.2.4.1 Requirements Tracing and Informal Correspondence 19.2.4.2 Informal Arguments 19.2.4.3 Formal Methods:Proof Techniques 19.2.4.4 Review 19.3 Assurance in Implementation and Integration 19.3.1 Implementation Considerations That Support Assurance 19.3.2 Assurance Through Implementation Management 19.3.3 Justifying That the Implementation Meets the Design 19.3.3.1 Security Testing 19.3.3.2 Security Testing Using PGWG 19.3.3.2 Test Matrices 19.3.3.3 Formal Methods:Proving That Programs Are Correct 19.4 Assurance During Operation and Maintenance 19.5 Summary 19.6 Research Issues 19.7 Further Reading 19.8 Exercises Chapter 20 Formal Methods 20.1 Formal Verification Techniques 20.2 Formal Specification 20.3 Early Formal Verification Techniques 20.3.1 The Hierarchical Development Methodology 20.3.1.1 Verification in HDM 20.3.1.2 The Boyer-Moore Theorem Prover 20.3.2 Enhanced HDM 20.3.3 The Gypsy Verification Environment 20.3.3.1 The Gypsy Language 20.3.3.2 The Bledsoe Theorem Prover 20.4 Current Verification Systems 20.4.1 The Prototype Verification System 20.4.1.1 The PVS Specification Language 20.4.1.2 The PVS Proof Checker 20.4.1.3 Experience with PVS 20.4.2 The Symbolic Model Verifier 20.4.2.1 The SMV Language 20.4.2.2 The XMV ProofTheory 20.4.2.3 SMV Experience 20.4.3 The Naval Research Laboratory Protocol Analyzer 20.4.3.1 NPA Languages 20.4.3.2 NPA Experience 20.5 Summary 20.6 Research Issues 20.7 Further Reading 20.8 Exercises Chapter 21 Evaluating Systems 21.1 Goals of Formal Evaluation 21.1.1 Deciding to Evaluate 21.1.2 Historical Perspective of Evaluation Methodologies 21.2 TCSEC:1983-1999 21.2.1 TCSEC Requirements 21.2.1.1 TCSEC Functional Requirements 21.2.1.2 TCSEC Assurance Requirements 21.2.2 The TCSEC Evaluatoin Classes 21.2.3 The TCSEC Evaluatoin Process 21.2.4 Impacts 21.2.4.1 Scope Limitations 21.2.4.2 Process Limitations 24.2.4.3 Contributions 21.3 International Efforts and the ITSEC:1991-2001 21.3.1 ITSEC Assurance Requirements 21.3.1.1 Requirements in the TCSEC Not Found in the ITSEC 21.3.1.2 Requirements in the ITSEC Not Found in the TCSEC 21.3.2 The ITSEC Evaluation Levels 21.3.3 The ITSEC Evaluation Process 21.3.4 Impacts 21.3.4.1 Vendor-Provided Security Targets 21.3.4.2 Process Limitations 21.4 Commercial International Security Requirements:1991 21.4.1 CISR Requirements 21.4.2 Impacts 21.5 Other Commercial Efforts:Early 1990s 21.6 The Federal Criteria:1992 21.6.1 FC Requirements 21.6.2 Impacts 21.7 FIPS 140:1994-Present 21.7.1 FIPS 140 Requirements 21.7.2 FIPS 140-2 Security Levels 21.7.3 Impact 21.8 The Common Criteria:1998-Present 21.8.1 Overview of the Methodology 21.8.2 CC Requirements 21.8.3 CC Security Functional Requirements 21.8.4 Assurance Requirements 21.8.5 Evaluation Assurance Levels 21.8.6 Evaluation Process 21.8.7 Impacts 21.8.8 Future of the Common Criteria 21.8.8.1 Interpretations 21.8.8.2 Assurance Class AMA and Family ALC_FLR 21.8.8.3 Products Versus Systems 21.8.8.4 Protection Profiles and Security Targets 21.8.8.5 Assurance Class AVA 21.8.8.6 EAL5 21.9 SSE-CMM:1997-Present 21.9.1 The SSE-CMM Model 21.9.2 Using the SSE-CMM 21.10 Summary 21.11 Research Issues 21.12 Further Reading 21.13 Exercises PART 7:SPECIAL TOPICS Chapter 22 Malicious Logic 22.1 Introduction 22.2 Trojan Horses 22.3 Computer Viruses 22.3.1 Boot Sector Infectors 22.3.2 Executable Infectors 22.3.3 Multipartite Viruses 22.3.4 TSR Viruses 22.3.5 Stealth Viruses 22.3.6 Encrypted Viruses 22.3.7 Polymorphic Viruses 22.3.8 Macro Viruses 22.4 Computer Worms 22.5 Other Forms of Malicious Logic 22.5.1 Rabbits and Bacteria 22.5.2 Logic Bombs 22.6 Theory of Malicious Logic 22.6.1 Theory of Computer Viruses 22.7 Defenses 22.7.1 Malicious Logic Acting as Both Data and Instructions 22.7.2 Malicious Logic Assuming the Identity of a User 22.7.2.1 Information Flow Metrics 22.7.2.2 Reducing the Rights 22.7.2.3 Sandboxing 22.7.3 Malicious Logic Crossing Protection Domain Boundaries by Sharing 22.7.4 Malicious Logic Altering Files 22.7.5 Malicious Logic Performing Actions Beyond Specification 22.7.5.1 Proof-Carrying Code 22.7.6 Malicious Logic Altering Statistical Characteristics 22.7.7 The Notion of Trust 22.8 Summary 22.9 Research Issues 22.10 Further Reading 22.11 Exercises Chapter 23 Vulnerability Analysis 23.1 Introduction 23.2 Penetration Studies 23.2.1 Goals 23.2.2 Layering of Tests 23.2.3 Methodology at Each Layer 23.2.4 Flaw Hypothesis Methodology 23.2.4.1 Information Gathering and Flaw Hypothesis 23.2.4.2 Flaw Testing 23.2.4.3 Flaw Generalization 23.2.4.4 Flaw Elimination 23.2.5 Example:Penetration of the Michigan Terminal System 23.2.6 Example:Compromise of a Burroughs System 23.2.7 Example:Penetration of a Corporate Computer System 23.2.8 Example:Penetrating a UNIX System 23.2.9 Example:Penetrating a Windows NT System 23.2.10 Debate 23.2.11 Conclusion 23.3 Vulnerability Classification 23.3.1 Two Security Flaws 23.4 Frameworks 23.4.1 The RISOS Study 23.4.1.1 The Flaw Classes 23.4.1.2 Legacy 23.4.2 Protection Analysis Model 23.4.2.1 The Flaw Classes 23.4.2.2 Analysis Procedure 23.4.2.3 Legacy 23.4.3 The NRL Taxonomy 23.4.3.1 The Flaw Classes 23.4.3.2 Legacy 23.4.4 Aslam's Model 23.4.4.1 The Flaw Classes 23.4.4.2 Legacy 23.4.5 Comparison and Analysis 23.4.5.1 The xterm Log File Flaw 23.4.5.2 The fingerd Buffer Overflow Flaw 23.4.5.3 Summary 23.5 Gupta Gligor's Theory of Penetration Analysis 23.5.1 The Flow-Based Model of Penetration Analysis 23.5.2 The Automated Penetration Analysis Tool 23.5.3 Discussion 23.6 Summary 23.7 Research Issues 23.8 Further Reading 23.9 Exercises Chapter 24 Auditing 24.1 Definitions 24.2 Anatomy of an Auditing System 24.2.1 Logger 24.2.2 Analyzer 24.2.3 Notifier 24.3 Designing an Auditing System 24.3.1 Implementation Considerations 24.3.2 Syntactic Issues 24.3.3 Log Sanitization 24.3.4 Application and System Logging 24.4 A Posteriori Design 24.4.1 Auditing to Detect Violations of a Known Policy 24.4.1.1 State-Based Auditing 24.4.1.2 Transition-Based Auditing 24.4.2 Auditing to Detect Known Violations of a Policy 24.5 Auditing Mechanisms 24.5.1 Secure Systems 24.5.2 Nonsecure Systems 24.6 Examples:Auditing File Systems 24.6.1 Audit Analysis of the NFS Version 2 Protocol 24.6.2 The Logging and Auditing File System(LAFS) 24.6.3 Comparison 24.7 Audit Browsing 24.8 Summary 24.9 Research Issues 24.10 Further Reading 24.11 Exercises Chapter 25 Intrusion Detection 25.1 Principles 25.2 Basic Intrusion Detection 25.3 Models 25.3.1 Anomaly Modeling 25.3.1.1 Derivation of Statistics 25.3.2 Misuse Modeling 25.3.3 Specification Modeling 25.3.4 Summary 25.4 Architecture 25.4.1 Agent 25.4.1.1 Host-Based Information Gathering 25.4.1.2 Network-Baseed Information Gathering 25.4.1.3 Combining Sources 25.4.2 Director 25.4.3 Notifier 25.5 Organization of Intrusion Detection Systems 25.5.1 Monitoring Network Traffic for Intrusions:NSM 25.5.2 Combining Host and Network Monitoring:DIDS 25.5.3 Autonomous Agents:AAFID 25.6 Intrusion Response 25.6.1 Incident Prevention 25.6.2 Intrusion Handling 25.6.2.1 Containment Phase 25.6.2.2 Eradication Phase 25.6.2.3 Follow-Up Phase 25.7 Summary 25.8 Research Issues 25.9 Further Reading 25.10 Exercises PART 8:PRACTICUM Chapter 26 Network Security 26.1 Introduction 26.2 Policy Development 26.2.1 Data Classes 26.2.2 User Classes 26.2.3 Availability 26.2.4 Consistency Check 26.3 Network Organization 26.3.1 Firewalls and Proxies 26.3.2 Analysis of the Network Infrastructure 26.3.2.1 Outer Firewall Configuration 26.3.2.2 Inner Firewall Configuration 26.3.3 In the DMZ 26.3.3.1 DMZ Mail Server 26.3.3.2 DMZ WWW Server 26.3.3.3 DMZ DNS Server 26.3.3.4 DMZ Log Server 26.3.3.5 Summary 26.3.4 In the Internal Network 26.3.5 General Comment on Assurance 26.4 Availability and Network Flooding 26.4.1 Intermediate Hosts 26.4.2 TCP State and Memory Allocations 26.5 Anticipating Attacks 26.6 Summary 26.7 Research Issues 26.8 Further Reading 26.9 Exercises Chapter 27 System Security 27.1 Introduction 27.2 Policy 27.2.1 The Web Server System in the DMZ 27.2.2 The Development System 27.2.3 Comparison 27.2.4 Conclusion 27.3 Networks 27.3.1 The Web Server System in the DMZ 27.3.2 The Development System 27.3.3 Comparison 27.4 Users 27.4.1 The Web Server System in the DMZ 27.4.2 The Development System 27.4.3 Comparison 27.5 Authentication 27.5.1 The Web Server System in the DMZ 27.5.2 Development Network System 27.5.3 Comparison 27.6 Processes 27.6.1 The Web Server System in the DMZ 27.6.2 The Development System 27.6.3 Comparison 27.7 Files 27.7.1 The Web Server System in the DMZ 27.7.2 The Development System 27.7.3 Comparison 27.8 Retrospective 27.8.1 The Web Server System in the DMZ 27.8.2 The Development System 27.9 Summary 27.10 Research Issues 27.11 Further Reading 27.12 Exercises Chapter 28 User Security 28.1 Policy 28.2 Access 28.2.1 Passwords 28.2.2 The Login Procedure 28.2.2.1 Trusted Hosts 28.2.3 Leaving the System 28.3 Files and Devices 28.3.1 Files 28.3.1.1 File Permissions on Creation 28.3.1.2 Group Access 28.3.1.3 File Deletion 28.3.2 Devices 28.3.2.1 Writable Devices 28.3.2.2 Smart Terminals 28.3.2.3 Monitors and Window Systems 28.4 Processes 28.4.1 Copying and Moving Files 28.4.2 Accidentally Overwriting Files 28.4.3 Encryption,Cryptographic Keys,and Passwords 28.4.4 Start-up Settings 28.4.5 Limiting Privileges 28.4.6 Malicious Logic 28.5 Electronic Communications 28.5.1 Automated Electronic Mail Processing 28.5.2 Failure to Check Certificates 28.5.3 Sending Unexpected Conteht 28.6 Summary 28.7 Research Issues 28.8 Further Reading 28.9 Exercises Chapter 29 Program Security 29.1 Introduction 29.2 Requirements and Policy 29.2.1 Requirements 29.2.2 Threats 29.2.2.1 Group 1:Unauthorized Users Accessing Role Accounts 29.2.2.2 Group 2:Authorized Users Accessing Role Accounts 29.2.2.3 Summary 29.3 Design 29.3.1 Framework 29.3.1.1 User Interface 29.3.1.2 High-Level Design 29.3.2 Access to Roles and Commands 29.3.2.1 Interface 29.3.2.2 Internals 29.3.2.3 Storage of the Access Control Data 29.4 Refinement and Implementation 29.4.1 First-Level Refinement 29.4.2 Second-Level Refinement 29.4.3 Functions 29.4.3.1 Obtaining Location 29.4.3.2 The Access Control Record 29.4.3.3 Error Handling in the Reading and Matching Routines 29.4.4 Summary 29.5 Common Security-Related Programming Problems 29.5.1 Improper Choice of Initial Protection Domain 29.5.1.1 Process Privileges 29.5.1.2 Access Control File Permissions 29.5.1.3 Memory Protection 29.5.1.4 Trust in the System 29.5.2 Improper Isolation of Implementation Detail 29.5.2.1 Resource Exhaustion and User Identifiers 29.5.2.2 Validating the Access Control Entries 29.5.2.3 Restricting the Protection Domain of the Role Process 29.5.3 Improper Change 29.5.3.1 Memory 29.5.3.2 Changes in File Contents 29.5.3.3 Race Conditions in File Accesses 29.5.4 Improper Naming 29.5.5 Improper Deallocation or Deletion 29.5.6 Improper Validation 29.5.6.1 Bounds Checking 29.5.6.2 Type Checking 29.5.6.3 Error Checking 29.5.6.4 Checking for Valid,not Invalid,Data 29.5.6.5 Checking Input 29.5.6.6 Designing for Validation 29.5.7 Improper Indivisibility 29.5.8 Improper Sequencing 29.5.9 Improper Choice of Operand or Operation 29.5.10 Summary 29.6 Testing,Maintenance,and Operation 29.6.1 Testing 29.6.1.1 Testing the Modules 29.6.2 Testing Composed Modules 29.6.3 Testing the Program 29.7 Distribution 29.8 Conclusion 29.9 Summary 29.10 Research Issues 29.11 Further Reading 29.12 Exercises PART 9:END MATTER Chapter 30 Lattices 30.1 Basics 30.2 Lattices 30.3 Exercises Chapter 31 The Extended Euclidean Algorithm 31.1 The Euclidean Algorithm 31.2 The Extended Euclidean Algorithm 31.3 Solving ax mod n=1 31.4 Solving ax mod n=b 31.5 Exercises Chapter 32 Entropy and Uncertainty 32.1 Conditional and Joint Probability 32.2 Entropy and Uncertainty 32.3 Joint and Conditional Entropy 32.3.1 Joint Entropy 32.3.2 Conditional Entropy 32.3.3 Perfect Secrecy 32.4 Exercises Chapter 33 Virtual Machines 33.1 Virtual Machine Structure 33.2 Virtual Machine Monitor 33.2.1 Privilege and Virtual Machines 33.2.2 Physical Resources and Virtual Machines 33.2.3 Paging and Virtual Machines 33.3 Exercises Chapter 34 Symbolic Logic 34.1 Propositional Logic 34.1.1 Natural Deduction in Propositional Logic 34.1.1.1 Rules 34.1.1.2 Derived Rules 34.1.2 Well-Formed Formulas 34.1.3 Truth Tables 34.1.4 Mathematical Induction 34.2 Predicate Logic 34.2.1 Natural Deduction in Predicate Logic 34.3 Temporal Logic Systems 34.3.1 Syntax of CTL 34.3.2 Semantics of CTL 34.4 Exercises Chapter 35 Example Academic Security Policy 35.1 University of Califormia E-mail Policy 35.1.1 Summary:E-mail Policy Highlights 35.1.1.1 Cautions 35.1.1.2 Do 35.1.1.3 Do Not 35.1.1.4 Does This Policy Apply to You? 35.1.2 University of California Electronic Mail Policy 35.1.2.1 Introduction 35.1.2.2 Purpose 35.1.2.3 Definitions 35.1.2.4 Scope 35.1.2.5 General Provisions 35.1.2.6 Specific Provisions 35.1.2.7 Policy Violations 35.1.2.8 Responsibility for Policy 35.1.2.9 Campus Responsibilities and Discretion 35.1.2.10 Appendix A-Definitions 35.1.2.11 Appendix B-References 35.1.2.12 Appendix C-Policies Relating to Nonconsensual Access 35.1.3 UC Davis Implementation of the Electronic Mail Policy 35.1.3.1 Purpose and Scope 35.1.3.2 Definitions 35.1.3.3 Policy 35.1.4 References and Related Policy 35.2 The Acceptable Use Policy for the University of California,Davis 35.2.1 Part I 35.2.1.1 Introduction 35.2.1.2 Rights and Responsibilities 35.2.1.3 Existing Legal Context 35.2.1.4 Enforcement 35.2.2 Part II Bibliography Index
鄂公網(wǎng)安備 42010302001612號(hào) 