Foreword |
|
vii | |
Editor |
|
ix | |
About the Authors |
|
xi | |
Introduction |
|
xiii | |
|
|
1 | (42) |
|
|
|
3 | (9) |
|
|
4 | (1) |
|
Subject Group Considerations |
|
|
5 | (1) |
|
|
5 | (1) |
|
Object Group Considerations |
|
|
6 | (1) |
|
Discretionary Access Control |
|
|
6 | (1) |
|
Rule Set-Based Access Controls |
|
|
7 | (1) |
|
Role-Based Access Controls |
|
|
7 | (1) |
|
Constrained User Interface |
|
|
8 | (1) |
|
Content-Dependent Access Control |
|
|
9 | (1) |
|
Context-Based Access Control |
|
|
10 | (1) |
|
Temporal Isolation (Time-Based) Access Control |
|
|
10 | (1) |
|
Nondiscretionary Access Control |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
12 | (2) |
|
|
12 | (1) |
|
|
12 | (1) |
|
|
13 | (1) |
|
Other Considerations of Clark-Wilson |
|
|
13 | (1) |
|
Brewer---Nash: Chinese Wall |
|
|
13 | (1) |
|
Identification, Authentication, Authorization, and Accountability |
|
|
14 | (19) |
|
Identity (Who Is the Subject?) |
|
|
14 | (1) |
|
Methods (User ID, PIN, Account Number) |
|
|
14 | (1) |
|
Registration of New Users |
|
|
15 | (1) |
|
Periodic Review of Access Levels |
|
|
15 | (1) |
|
|
15 | (1) |
|
Authentication (Proof of Identity |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (2) |
|
|
18 | (4) |
|
Multifactor Authentication |
|
|
22 | (1) |
|
Two-Factor vs. Three-Factor Authentication |
|
|
22 | (2) |
|
|
24 | (1) |
|
Continuous Authentication |
|
|
24 | (1) |
|
|
25 | (1) |
|
Certificate-Based Authentication |
|
|
25 | (1) |
|
|
25 | (1) |
|
Access to Systems vs. Data, Networks |
|
|
26 | (1) |
|
Access Control Lists/Matrix |
|
|
26 | (1) |
|
|
27 | (1) |
|
|
28 | (4) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
33 | (3) |
|
Centralized Remote Access |
|
|
33 | (1) |
|
Remote Authentication Dial-In User Services |
|
|
33 | (1) |
|
Terminal Access Controller Access Control System |
|
|
34 | (1) |
|
Extended Terminal Access Controller Access Control System |
|
|
34 | (1) |
|
Terminal Access Controller Access Control System Plus |
|
|
34 | (1) |
|
|
35 | (1) |
|
Decentralized Remote Access |
|
|
35 | (1) |
|
Password Authentication Protocol/Challenge Handshake Authentication Protocol |
|
|
36 | (1) |
|
Other Access Control Areas |
|
|
36 | (3) |
|
|
36 | (1) |
|
|
36 | (1) |
|
|
36 | (1) |
|
|
37 | (1) |
|
Bypass of Logical Security |
|
|
38 | (1) |
|
Access to Computers and Equipment |
|
|
38 | (1) |
|
|
39 | (1) |
|
|
39 | (4) |
|
|
43 | (36) |
|
|
|
45 | (10) |
|
|
47 | (1) |
|
|
48 | (1) |
|
|
48 | (2) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
52 | (3) |
|
|
55 | (9) |
|
|
55 | (1) |
|
|
56 | (1) |
|
Introduction to Public Key |
|
|
57 | (1) |
|
Hashes and Digital Signatures |
|
|
58 | (1) |
|
Public Key Infrastructure |
|
|
59 | (1) |
|
|
60 | (1) |
|
|
61 | (1) |
|
|
62 | (2) |
|
|
64 | (1) |
|
|
64 | (10) |
|
Problems, Weaknesses, and Concerns |
|
|
64 | (3) |
|
Algorithms, Ciphers, and Types |
|
|
67 | (1) |
|
Data Encryption Standard and Triple Data Encryption Standard |
|
|
67 | (1) |
|
Advanced Encryption Standard |
|
|
67 | (1) |
|
International Data Encryption Algorithm |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
69 | (1) |
|
Digital Signature Algorithm and Digital Signature Standard |
|
|
69 | (1) |
|
Elliptical Curve Cryptography |
|
|
69 | (1) |
|
Public Key Cryptography Standards |
|
|
70 | (1) |
|
Rivest Ciphers 2, 4, and 5 |
|
|
70 | (1) |
|
|
70 | (1) |
|
|
71 | (1) |
|
Message Digest 2, 4, and 5 |
|
|
71 | (1) |
|
Secure Hash Algorithm 0, 1, and 2 |
|
|
71 | (1) |
|
|
71 | (1) |
|
|
72 | (1) |
|
|
72 | (1) |
|
Diffie---Hellman Key Exchange |
|
|
72 | (1) |
|
|
72 | (1) |
|
|
72 | (1) |
|
IP Security, Internet Key Exchange, and Internet Security Association and Key Management Protocol |
|
|
73 | (1) |
|
|
74 | (1) |
|
|
74 | (5) |
|
|
79 | (64) |
|
|
Introduction to Windows Malcode Security Management |
|
|
82 | (2) |
|
CIA Triangle: Applicability to Malcode |
|
|
84 | (1) |
|
Malcode Naming Conventions and Types |
|
|
84 | (13) |
|
CARO-Like Naming Standards |
|
|
84 | (4) |
|
Cross-Referencing Malcode Names |
|
|
88 | (1) |
|
Common Malware Enumeration |
|
|
88 | (1) |
|
|
89 | (1) |
|
|
89 | (1) |
|
|
89 | (2) |
|
|
91 | (1) |
|
|
91 | (1) |
|
|
91 | (1) |
|
|
91 | (1) |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
93 | (1) |
|
|
93 | (1) |
|
|
94 | (1) |
|
Adware, Spyware, and Potentially Unwanted Programs |
|
|
95 | (1) |
|
|
96 | (1) |
|
|
97 | (1) |
|
|
97 | (8) |
|
|
97 | (1) |
|
|
98 | (1) |
|
Polymorphism and Virus Creation Kits |
|
|
98 | (1) |
|
|
98 | (1) |
|
|
99 | (1) |
|
Hacktivism Moving toward Cyberwar and Cyberterrorism? |
|
|
100 | (1) |
|
|
101 | (1) |
|
1995: Turning of the Tide and a New Threat, Macro Viruses |
|
|
102 | (1) |
|
|
102 | (1) |
|
|
102 | (1) |
|
DDoS Attacks on Major Web Properties |
|
|
103 | (1) |
|
Legal and Law Enforcement Challenges |
|
|
103 | (1) |
|
|
104 | (1) |
|
Maturation of an Internet Criminal Marketplace |
|
|
105 | (1) |
|
|
105 | (7) |
|
Social Engineering or Exploitation |
|
|
106 | (1) |
|
|
106 | (1) |
|
|
106 | (1) |
|
|
107 | (1) |
|
|
107 | (1) |
|
Password-Protected ZIP Files/RAR |
|
|
107 | (1) |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
109 | (1) |
|
|
109 | (1) |
|
|
109 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
Contractors Over Virtual Private Network |
|
|
110 | (1) |
|
Rogue Products and Search Engines |
|
|
111 | (1) |
|
Infected Factory Builds and CDs |
|
|
111 | (1) |
|
|
111 | (1) |
|
Web Exploitation Frameworks |
|
|
111 | (1) |
|
|
112 | (5) |
|
|
112 | (1) |
|
|
112 | (1) |
|
Man-in-the-Middle Malcode |
|
|
112 | (4) |
|
|
116 | (1) |
|
|
117 | (6) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
Third-Party Certifications |
|
|
119 | (1) |
|
|
119 | (1) |
|
Questionable Behavior on the Computer |
|
|
120 | (1) |
|
|
120 | (1) |
|
|
120 | (1) |
|
Modified HOSTS File and DNS Changes |
|
|
121 | (1) |
|
|
121 | (1) |
|
Inspection of the Windows Registry |
|
|
122 | (1) |
|
Inspection of Common File Locations |
|
|
122 | (1) |
|
Behavioral Analysis of Malcode |
|
|
123 | (12) |
|
|
124 | (1) |
|
|
124 | (1) |
|
|
124 | (1) |
|
Portable Executables Header |
|
|
125 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
Unpacking Files and Memory Dumps |
|
|
126 | (2) |
|
Testing Remote Web Sites Found in Network Log Files |
|
|
128 | (1) |
|
|
129 | (1) |
|
WHOIS, Reverse IP, Name Servers |
|
|
129 | (1) |
|
|
130 | (1) |
|
|
131 | (1) |
|
VMware Testing of Samples |
|
|
132 | (1) |
|
Advanced File Capture Techniques |
|
|
133 | (1) |
|
Free Online Sandbox Solutions |
|
|
134 | (1) |
|
Interactive Behavioral Testing |
|
|
134 | (1) |
|
|
135 | (3) |
|
|
135 | (1) |
|
|
136 | (2) |
|
|
138 | (5) |
|
4 Monitoring and Analysis |
|
|
143 | (60) |
|
|
Policy, Controls, and Enforcement |
|
|
144 | (6) |
|
|
144 | (2) |
|
|
146 | (1) |
|
|
147 | (1) |
|
|
148 | (1) |
|
|
148 | (1) |
|
|
149 | (1) |
|
|
149 | (1) |
|
|
149 | (1) |
|
|
150 | (1) |
|
|
150 | (9) |
|
Security Auditing Overview |
|
|
150 | (3) |
|
|
153 | (1) |
|
|
154 | (1) |
|
|
154 | (1) |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
156 | (2) |
|
|
158 | (1) |
|
|
159 | (41) |
|
Security Monitoring Concepts |
|
|
159 | (1) |
|
|
159 | (1) |
|
Implementation Issues for Monitoring |
|
|
160 | (3) |
|
Who Are These People Attacking Us? |
|
|
163 | (1) |
|
|
164 | (1) |
|
|
165 | (1) |
|
What Kinds of Monitoring Are There? |
|
|
165 | (1) |
|
|
166 | (1) |
|
|
167 | (14) |
|
|
181 | (1) |
|
|
182 | (1) |
|
|
182 | (5) |
|
|
187 | (6) |
|
Penetration Testing High-Level Steps |
|
|
193 | (7) |
|
|
200 | (3) |
|
5 Networks and Telecommunications |
|
|
203 | (60) |
|
|
|
Introduction to Networks and Telecommunications |
|
|
205 | (9) |
|
The Basic OSI Model: Its Security Strengths and Weaknesses |
|
|
206 | (1) |
|
|
206 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
208 | (1) |
|
|
208 | (1) |
|
|
208 | (1) |
|
Network Topologies and Their Security Issues |
|
|
209 | (2) |
|
WAN Access and Its Security Issues |
|
|
211 | (3) |
|
Network Protocols and Security Characteristics |
|
|
214 | (13) |
|
Network Protocols Introduction |
|
|
214 | (4) |
|
|
218 | (4) |
|
Wide Area Network Protocols |
|
|
222 | (2) |
|
Transport Layer Security Protocols |
|
|
224 | (2) |
|
Application Layer Security |
|
|
226 | (1) |
|
Data Communications and Network Infrastructure Components and Security Characteristics |
|
|
227 | (16) |
|
Physical Transmission Media |
|
|
227 | (1) |
|
Different Transmission Media |
|
|
228 | (2) |
|
The Enterprise Network Environment and Its Vulnerabilities |
|
|
230 | (1) |
|
|
231 | (1) |
|
|
231 | (1) |
|
|
232 | (1) |
|
|
232 | (1) |
|
|
233 | (1) |
|
|
233 | (2) |
|
|
235 | (2) |
|
Identification and Authentication for Remote Users |
|
|
237 | (6) |
|
Wireless Local Area Networking |
|
|
243 | (16) |
|
New Network and Telecommunications Frontiers |
|
|
252 | (2) |
|
Need for Security Policies, Standards, and Procedures for the IT Infrastructure |
|
|
254 | (1) |
|
Securing the IT Infrastructure |
|
|
254 | (1) |
|
Domains of IT Security Responsibility |
|
|
255 | (2) |
|
Defining Standard and Enhanced Security Requirements |
|
|
257 | (1) |
|
Implementing Standard and Enhanced Security Solutions |
|
|
258 | (1) |
|
|
259 | (4) |
|
6 Security Operations and Administration |
|
|
263 | (92) |
|
|
Security Program Objectives: The C-I-A Triad |
|
|
266 | (2) |
|
|
266 | (1) |
|
|
267 | (1) |
|
|
268 | (1) |
|
|
268 | (1) |
|
|
269 | (1) |
|
Designing a Security Architecture |
|
|
269 | (6) |
|
|
269 | (2) |
|
|
271 | (1) |
|
|
272 | (1) |
|
Authorization and Accountability |
|
|
273 | (1) |
|
|
274 | (1) |
|
Security Program Frameworks |
|
|
275 | (3) |
|
Aligning Business, IT, and Security |
|
|
278 | (1) |
|
Security Architecture and Models |
|
|
278 | (2) |
|
Bell-LaPadula Confidentiality Model |
|
|
278 | (1) |
|
Biba and Clark-Wilson Integrity Models |
|
|
279 | (1) |
|
|
280 | (1) |
|
Identity and Access Management |
|
|
281 | (1) |
|
Managing Privileged User Accounts |
|
|
282 | (1) |
|
Outsourcing Security and Managed Security Service Providers |
|
|
283 | (3) |
|
Business Partner Security Controls |
|
|
286 | (1) |
|
Security Policies, Standards, Guidelines, and Procedures |
|
|
287 | (9) |
|
|
287 | (1) |
|
|
288 | (1) |
|
|
289 | (3) |
|
|
292 | (2) |
|
|
294 | (2) |
|
|
296 | (1) |
|
Considerations for Safeguarding Confidentiality |
|
|
296 | (3) |
|
Regulations and Contractual Obligations |
|
|
296 | (1) |
|
|
297 | (2) |
|
|
299 | (1) |
|
|
299 | (1) |
|
|
300 | (1) |
|
Protecting Confidentiality and Information Classification |
|
|
300 | (3) |
|
|
301 | (1) |
|
|
302 | (1) |
|
Information Classification Process |
|
|
302 | (1) |
|
Role of Classification in Business Continuity Planning Risk |
|
|
303 | (1) |
|
Information Handling Policy |
|
|
303 | (1) |
|
|
303 | (1) |
|
Secure Information Storage |
|
|
303 | (6) |
|
|
306 | (1) |
|
|
307 | (2) |
|
|
309 | (1) |
|
Record Retention and Disposal |
|
|
309 | (8) |
|
Disclosure Controls: Data Leakage Prevention |
|
|
317 | (1) |
|
Secure Application Development |
|
|
318 | (5) |
|
|
319 | (3) |
|
Additional Application Development Methods |
|
|
322 | (1) |
|
|
322 | (1) |
|
Extreme Programming and Rapid Application Development |
|
|
322 | (1) |
|
|
322 | (1) |
|
Component Development and Reuse |
|
|
323 | (1) |
|
Web Application Vulnerabilities and Secure Development Practices |
|
|
323 | (4) |
|
Protecting against Buffer Overflows |
|
|
327 | (1) |
|
Implementation and Release Management |
|
|
327 | (2) |
|
Systems Assurance and Controls Validation |
|
|
329 | (1) |
|
Certification and Accreditation |
|
|
330 | (1) |
|
Certification and Accreditation Roles |
|
|
330 | (1) |
|
Security Assurance Rating: Common Criteria |
|
|
331 | (2) |
|
|
333 | (1) |
|
|
334 | (2) |
|
|
334 | (1) |
|
|
335 | (1) |
|
|
335 | (1) |
|
|
335 | (1) |
|
|
336 | (1) |
|
Automated Configuration Management Tools |
|
|
336 | (1) |
|
|
336 | (2) |
|
Monitoring System Integrity |
|
|
338 | (1) |
|
|
339 | (3) |
|
Endpoint Antivirus Solutions |
|
|
341 | (1) |
|
|
341 | (1) |
|
Personal Firewalls and Host Intrusion Prevention Systems |
|
|
341 | (1) |
|
Thin Client Implementations |
|
|
342 | (1) |
|
|
343 | (3) |
|
Security Awareness and Training |
|
|
346 | (4) |
|
|
349 | (1) |
|
|
350 | (3) |
|
|
353 | (2) |
|
7 Risk, Response, and Recovery |
|
|
355 | (46) |
|
|
Introduction to Risk Management |
|
|
358 | (12) |
|
|
358 | (1) |
|
|
359 | (1) |
|
|
359 | (1) |
|
Step 1 System Characterization |
|
|
360 | (1) |
|
Step 2 Threat Identification |
|
|
360 | (2) |
|
Step 3 Vulnerability Identification |
|
|
362 | (1) |
|
|
363 | (1) |
|
Step 5 Likelihood Determination |
|
|
364 | (1) |
|
|
364 | (2) |
|
Step 7 Risk Determination |
|
|
366 | (1) |
|
Step 8 Control Recommendation |
|
|
367 | (1) |
|
Step 9 Results Documentation |
|
|
367 | (1) |
|
|
367 | (1) |
|
Risk Reduction and Limitation |
|
|
367 | (2) |
|
|
369 | (1) |
|
|
369 | (1) |
|
|
369 | (1) |
|
|
369 | (1) |
|
|
370 | (5) |
|
|
371 | (1) |
|
|
371 | (2) |
|
Containment, Eradication, and Recovery |
|
|
373 | (1) |
|
|
374 | (1) |
|
Incident Response Summary |
|
|
375 | (1) |
|
|
375 | (2) |
|
|
375 | (1) |
|
|
376 | (1) |
|
|
377 | (19) |
|
Disaster Recovery Planning |
|
|
382 | (2) |
|
Recovery Strategy Alternatives |
|
|
384 | (1) |
|
|
384 | (1) |
|
|
385 | (1) |
|
|
385 | (1) |
|
Multiple Processing Sites |
|
|
386 | (1) |
|
|
386 | (1) |
|
|
386 | (1) |
|
|
387 | (1) |
|
Structured Walkthrough Test |
|
|
387 | (1) |
|
|
388 | (1) |
|
Full Interruption Testing |
|
|
388 | (1) |
|
Plan Review and Maintenance |
|
|
389 | (1) |
|
Data Backup and Restoration |
|
|
390 | (1) |
|
|
390 | (1) |
|
|
390 | (1) |
|
|
390 | (1) |
|
|
391 | (1) |
|
|
392 | (1) |
|
|
392 | (1) |
|
System and Data Availability |
|
|
392 | (1) |
|
|
393 | (1) |
|
High-Availability Clustering |
|
|
393 | (1) |
|
Load-Balancing Clustering |
|
|
394 | (1) |
|
Redundant Array of Independent Disks |
|
|
394 | (1) |
|
|
395 | (1) |
|
|
396 | (1) |
|
|
396 | (5) |
Appendix |
|
401 | (38) |
Index |
|
439 | |