计算机安全：原理与实践（英文版影印）

.part one computer security technology and principles 40
chapter 2 cryptographic tools 41
2.1 confidentiality with symmetric encryption 42
2.2 message authentication and hash functions 49
2.3 public-key encryption 56
2.4 digital signatures and key management 61
2.5 random and pseudorandom numbers 65
2.6 practical application: encryption of stored data 67
2.7 recommended reading and web sites 68
2.8 key terms, review questions, and problems 69
chapter 3 user authentication 74
3.1 means of authentication 75
3.2 password-based authentication 76
3.3 token-based authentication 88
3.4 biometric authentication 92
3.5 remote user authentication 97
3.6 security issues for user authentication 99
3.7 practical application: an iris biometric system 101
3.8 case study: security problems for atm systems 103
3.9 recommended reading and web sites 106
3.10 key terms, review questions, and problems 107
chapter 4 access control 110
4.1 access control principles 111
4.2 subjects, objects, and access rights 115
4.3 discretionary access control 116
4.4 example: unix file access control 122
4.5 role-based access control 125
4.6 case study: rbac system for a bank 134
4.7 recommended reading andweb sites 137
4.8 keyterms, review questions, and problems 138
chapter 5 database security 142
5.1 database management systems 143
5.2 relational databases 144
5.3 database access control 148
5.4 inference 153
5.5 statistical databases 156
5.6 database encryption 166
5.7 recommended reading 170
5.8 key terms, review questions and problems 171
chapter 6 intrusion detection 176
6.1 intruders 177
6.2 intrusion detecuon 181
6.3 ttost-based intrusion detection 183
6.4 distributed host-based intrusion detection 190
6.5 network-based intrusion detection 193
6.6 distributed adaptive intrusion detection 197
6.7 intrusion detection exchange format 200
6.8 honeypots 202
6.9 example system: snort 204
6.10 recommended reading and web sites 208
6.11 key terms, review questions, and problems 209
appendix 6a:the base-rate fallacy 211
chapter 7 malicious software 215
7.1 types of malicious software 216
7.2 viruses 220
7.3 virus countermeasures 226
7.4 worms 231
7.5 bots 240
7.6 rootkits 242
7.7 recommended reading and web sites 245
7.8 key terms, review questions, and problems 246
chapter 8 denial of service 249
8.1 denial of service attacks 250
8.2 flooding attacks 257
8.3 distributed denial of service attacks 259
8.4 reflector and amplifier attacks 261
8.5 defenses against denial of service attacks 265
8.6 responding to a denial of service attack 269
8.7 recommended reading andweb sites 270
8.8 key terms, review questions, and problems 271
chapter 9 firewalls and intrusion prevention systems 273
9.1 the need for firewalls 274
9.2 firewau characteristics 275
9.3 types of firewalls 276
9.4 firewall basing 283
9.5 firewall location and configurations 286
9.6 intrusion prevention systems 291
9.7 example: unifiedthreat management products 294
9.8 recommended reading and web sites 298
9.9 key terms, review questions, and problems 299
chapter 10 trusted computing and multilevel security 303
10.1 the bell-lapadula model for computer security 304
10.2 other formal models for computer security 314
10.3 the concept of trusted systems 320
10.4 application of multilevel security 323
10.5 trusted computing and thetrusted platform module 330
10.6 common criteria for information technology security evaluation 334
10.7 assurance and evaluation 340
10.8 recommended reading and web sites 345
10.9 key terms, review questions, and problems 346
part two software security 349
chapter 11 buffer overflow 350
11.1 stack overflows 352
11.2 defending against buffer overflows 373
11.3 other forms of overflow attacks 379
11.4 recommended reading and web sites 385
11.5 key terms, review questions, and problems 386
chapter 12 other software security issues 388
12.1 software security issues 389
12.2 handling program input 392
12.3 writing safe program code 403
12.4 interacting with the operating system and other programs 408
12.5 handling program input 419
12.6 recommended reading andweb sites 422
12.7 key terms, review questions, and problems 423
part three management issues 426
chapter 13 physical and infrastructure security 427
13.1 overview 428
13.2 physical security threats 429
15.3 physical security prevention and mitigation measures 435
15.4 recovery from physical security breaches 438
13.5 threat assessment, planning, and plan implementation 439
13.6 example:a corporate physical security policy 440
13.7 integration of physical and logical security 44l
13.8 recommended reading and web sites 446
13.9 key terms, revaew questions, and problems 447
chapter 14 human factors 449
14.1 security awareness, training, and education 450
14.2 organizational security policy 455
14.3 employment practices and policies 461
14.4 e-mail and internet use policies 464
14.5 example:a corporate security policy document 465
14.6 recommended reading and web sites 467
14.7 key terms, review questions, and problems 468
appendix 14a: security awareness standard of good practice 469
appendix 14b: security policy standard of good practice 473
chapter 1s security auditing 475
15.1 security auditing architecture 476
15.2 the security audit trail 481
15.3 implementing the logging function 486
15.4 audit trail analysis 497
15.5 example: an integrated approach 501
15.6 recommended reading and web sites 504
15.7 key terms, review questions, and problems 505
chapter 16 it security management and risk assessment 508
16.1 it security management 509
16.2 organizational context and security policy 512
16.3 security risk assessment 515
16.4 detailed security risk analysis 518
16.5 case study: silver star mines 530
16.6 recommended reading and web sites 534
16.7 key terms, review questions, and problems 536
chapter 17 it security controls, plans and procedures 538
17.1 it security management implementation 539
17.2 security controls or safeguards 539
17.3 it security plan 547
17.4 implementation of controls 548
17.5 implementation followup 550
17.6 case study: silver star mines 556
17.7 recommended r. eading 559
17.8 key terms, review questions, and problems 559
chapter 18 legal and ethical aspects 562
18.1 cyhercrime and computer crime 563
18.2 intellectual property 567
18.3 privacy 574
18.4 ethical issues 580
18.5 recommended reading andweb sites 586
18.6 keyterms, review questions, and problems 587
appendix 18a: information privacy standard of good practice 590
part four cryptographic algorithms 592
chapter 19 symmetric encryption and message confidentiality 593
19.1 symmetric encryption and message confidentiality 594
19.2 data encryption standard 598
19.3 advanced encryption standard 600
19.4 stream ciphers and rc4 607
19.5 cipher block modes of operation 610
19.6 location of symmetric encrypfion devices 616
19.7 key distribution 618
19.8 recommended reading andweb sites 620
19.9 key terms review questions, and problems 620
chapter 20 public-key cryptography and message authentication 625
20.1 secure hash functions 626
20.2 hmac 632
20.3 the ksa public-key encryption algorithm 635
20.4 diffie-hellman and other asymmetric algorithms 641
20.5 recommended reading and web sites 646
20.6 key terms, review questions, and problems 646
part five internet security 650
chapter 21 internet security protocols and standards 651
21.1 secure sockets layer (ssl) and transport layer security (tls) 652
21.2 ipv4 and ipv6 security 656
21.3 secure email and s/mime 662
21.4 recommended reading and web sites 665
21.5 key terms, review questions, and problems 666
appendix 21a: radix-64 conversion 668
chapter 22 internet authentication applications 671
22.1 kerberos 672
22.2 x.509 678
22.3 public-key infrastructure 680
22.4 federated identity management 683
22.5 recommended reading and web sites 687
22.6 key terms, review questions, and problems 688
part six operating system security 689
chapter 23 linux security 690
23.1 introduction 691
23.2 linux's security model 691
23.3 the linux dac in depth: filesystem security 693
23.4 linux vulnerabilities 699
23.5 linux system hardening 701
23.6 application security 709
23.7 mandatory access controls 711
23.8 recommended reading and web sites 711
23.9 key terms, review questions, and problems 718
chapter 24 windows and windows vista security 720
24.1 windows security architecture 721
24.2 windows vuln erabilities 728
24.3 windows security defenses 729
24.4 browser defenses 737
24.5 cryptographic services 737
24.6 common criteria 738
24.7 recommended reading andweb sites 739
24.8 key terms, review questions, problems, and projects 740
appendices
appendix a some aspects of number theory 742
a.1 prime and relatively prime numbers 743
a.2 modular arithmetic 744
a.3 fermat's and euler's theorems 746
appendix b random and pseudorandom number generation 750
b.1 the use of random numbers 751
b.2 pseudorandom number generators (prngs) 752
b.3 true random number generators 757
appendix c projects for teaching computer security 759
c.1 research projects 760
c.2 hacking projects 761
c.3 programming projects 761
c.4 laboratory exercises 762
c.5 practical security assessments 762
c.6 writing assignments 762
c.7 reading/report assignments 763
references 765
index 783
online appendices
appendix d standards and standard-setting organizations
d.1 the importance of standards
d.2 internet standards and the internet society
d.3 national institute of standards and technology
d.4 the international telecommunication union
d.5 the international orgamzation for standardization
appendix e tcp/ip protocol architecture
e.1 tcp/ip layers
e.2 tcp and udp
e.3 operation of tcp/ip
e.4 tcp/ip applications
appendix f glossary

.　　·Cryptographic Algorithms
　　·Internet Security
　　·Operating System Security
　　The section on OS security covers two real-world examples in detail: Linux and Windows Vista. There are also a number of appendices in the book to provide additional background.The book is also accompanied by a number of online appendices that provide more detail on selected topics
　　The book includes an extensive glossary, a list of frequently used acronyms, and a bibliography. Each chapter includes homework problems, review questions, a list of key words,suggestions for further reading, and recommended Web sites.
　　HACKING EXERCISES
　　The instructor's support materials include two Web related hacking exercises: (1) Cross site scripting attacks (2) Server side SQL injection type attacks For both of the above the instructor needs a Linux system with a web server installed (Apache is freely available and could work as a web server) as well as PhP installed (again, its freely available). You simply download the files from the instructor support site and save them in the public html directory, and unpack them for the projects to be ready to use. You would of course also need to change the permissions on the folders and the files after you unpack it but that's easy. Also included is a short step-by-step instruction manual that tells the instructor exactly what to do with this package of files in order to create the environment for the student exercises.
　　These projects have been used in computer security courses and have been the highlight of the courses; students felt the most excited because of them and they are very rewarding indeed.
　　An additional hacking exercise is included that involves attempting to reverse engineer an application-level protocol. This is a sockets programming exercise.
　　See Appendix C in this book for more details.
　　OTHER PROJECTS AND STUDENT EXERCISES
　　For many instructors, an important component of a computer security course is a project or set of projects by which the student gets hands-on experience to reinforce concepts from the text. Tnis book provides an unparalleled degree of support for including a projects component in the course. The instructor's supplement not only includes guidance on how to assign and structure the projects but also includes a set of user's manuals for various project types plus specific assignments, all written especially for this book. Instructors can assign work in the following areas:
　　·Programming projects: A series of programming projects that cover a broad range of topics and that can be implemented in any suitable language on any platform
　　·Research projects: A series of research assignments that instruct the student to research a particular topic on the Intemet and write a report
　　·Laboratory exercises: A series of projects that involve programming and experimenting with concepts from the book
　　·Practical security assessments: A set of exercises to examine current infrastructure and practices of an existing organization
　　·Reading/report assignments: A list of papers that can be assigned for reading and writing a report, plus suggested assignment wording
　　·Writing assignments: A list of writing assignments to facilitate learning the material
　　This diverse set of projects and other student exercises enables the instructor to use the book as one component in a rich and varied learning experience and to tailor a course plan to meet the specific needs of the instructor and students, See Appendix C in this book for details.
　　INSTRUCTIONAL SUPPORT MATERIALS
　　To support instructors, the following materials are provided:
　　·Solutions Manual: Solutions to end-of-chapter Review Questions and Problems
　　·PowerPoint slides: A set of slides covering all chapters, suitable for use in lecturing.
　　·PDF files: Reproductions of all figures and tables from the book
　　·Projects manual: Suggested project assignments for all of the project categories listed below
　　 Instructors may contact their Pearson Education or Prentice Hall representative for access to these materials
　　 In addition, the book's Web site supports instructors with
　　·Links to Webs sites for other courses being taught using this book
　　·Sign-up information for an Internet mailing list for instructors
　　INTERNET SERVICES FOR INSTRUCTORS AND STUDENTS
　　There is a Web site for this book that provides support for students and instructors. The site includes links to other relevant sites. The Web page is at WilliamStalling&com/CompSec/CompSecle.html; see Chapter 0 for more information. An Intemet mailing list has been set up so that instructors using this book can exchange information, suggestions, and questions with each other and with the author. As soon as typos or other errors are discovered, an errata list for this book will be available at WilliamStalhngs. com.
　　ACKNOWLEDGMENTS
　　This book has benefited from review by a number of people, who gave generously of their time and expertise. The following professors and instructors reviewed all or a large part of the manuscript: James Bret Michael (Naval Postgraduate School), Scott Campbell (Miami University), Jim Aires-Foss (University of Idaho), Gregory B. White (University of Texas-San Antonio), Corey D. Shou (Idaho State University), Weining Zhang (University of Texas--San Antonio), Sreekanth Malladi (Dakota State University), Breno Fonseca De Medeiros (Florida State University), Kent E. Seamons (Brigham Young University),Krishna M. Sivalingam (University of Maryland, Baltimore County), and Alec Yasinsac (Florida State University).
　　Thanks also to the many people who provided detailed technical reviews of one or more chapters: Pradeep Navalkar (TechTonics Group Limited); Manish Gupta (M&T Bank Corporation, Buffalo); Scott W. DeVault (CISSP, MCP, The AEgis Technologies Group, Inc.); Arturo 'Buanzo' Busleiman (Independent Security Consultant, Buenos Aires); David Grant (MICDDS, Group Security Manager, Halcrow Group Ltd); Spike Ouatrone; Jaspreet Singh (Senior Consultant, Ernst and Young, India): Jean-Charles Demarque (IT Consultant in France); Steve Fletcher; David Oillett (CISSP, CCNP, CCSE,MCSE); Robert Slade (author and prolific book reviewer); Rob J. Meijer (Dutch National Police Agency); Marc Blitz (aacompsec.com); Kevin Sanchez-Cherry (IT security and assurance specialist); Don Munro; Edward Lewis (Australian Defence Force Academy, University of New South Wales); and Jerome Athias (Independant Security Researcher).
　　Sreekanth Malladi of Dakota State University developed the Web hacking projects.Arnold Patton of Bradley University developed the reverse engineering hacking project.
　　We also thank Ricky Magalhaes of Fastennet Security, who developed a series of Windows security projects for this book.
　　The following people provided homework problems: Zubair Baig (Monash University);Spike Quatrone; Edward Lewis (University of New South Wales), and Rob J Meijer.
　　Dr Lawrie Brown would first like to thank Bill Stallings for the pleasure of working with him to produce this text. I would also like to thank my colleagues in the School of Information Technology and Electrical Engineering, University of New South Wales at the Australian Defence Force Academy in Canberra, Australia for their encouragement and support.I particularly wish to acknowledge the insightful comments and critiques by Ed Lewis and Don Munro, who I believe have helped produce a more accurate and succinct text.
　　Finally, we would like to thank the many people responsible for the publication of the book, all of whom did their usual excellent job. This includes the staff at Prentice Hall, particularly my editor, Tracy Dunkelberger, her assistants, Christianna Lee and Carole Snyder, and production manager, Rose Kernan. Thanks also to Patricia M. Daly, who did the copy editing.