Introduction to Computer Security / Edition 1

Hardcover (Print)
Rent
Rent from BN.com
$14.10
(Save 83%)
Est. Return Date: 12/22/2014
Used and New from Other Sellers
Used and New from Other Sellers
from $37.49
Usually ships in 1-2 business days
(Save 55%)
Other sellers (Hardcover)
  • All (16) from $37.49   
  • New (10) from $52.01   
  • Used (6) from $37.49   

Overview

In this authoritative book, widely respected practitioner and teacher Matt Bishop presents a clear and useful introduction to the art and science of information security. Bishop's insights and realistic examples will help any practitioner or student understand the crucial links between security theory and the day-to-day security challenges of IT environments.

Bishop explains the fundamentals of security: the different types of widely used policies, the mechanisms that implement these policies, the principles underlying both policies and mechanisms, and how attackers can subvert these tools--as well as how to defend against attackers. A practicum demonstrates how to apply these ideas and mechanisms to a realistic company.

Coverage includes

  • Confidentiality, integrity, and availability
  • Operational issues, cost-benefit and risk analyses, legal and human factors
  • Planning and implementing effective access control
  • Defining security, confidentiality, and integrity policies
  • Using cryptography and public-key systems, and recognizing their limits
  • Understanding and using authentication: from passwords to biometrics
  • Security design principles: least-privilege, fail-safe defaults, open design, economy of mechanism, and more
  • Controlling information flow through systems and networks
  • Assuring security throughout the system lifecycle
  • Malicious logic: Trojan horses, viruses, boot sector and executable infectors, rabbits, bacteria, logic bombs--and defenses against them
  • Vulnerability analysis, penetration studies, auditing, and intrusion detection and prevention
  • Applying security principles to networks, systems, users, and programs

Introduction to Computer Security is adapted from Bishop's comprehensive and widely praised book, Computer Security: Art and Science. This shorter version of the original work omits much mathematical formalism, making it more accessible for professionals and students who have a less formal mathematical background, or for readers with a more practical than theoretical interest.

Read More Show Less

Product Details

  • ISBN-13: 9780321247445
  • Publisher: Addison-Wesley
  • Publication date: 10/29/2004
  • Edition description: New Edition
  • Edition number: 1
  • Pages: 784
  • Sales rank: 733,433
  • Product dimensions: 7.75 (w) x 9.62 (h) x 1.19 (d)

Meet the Author

Matt Bishop is a professor in the Department of Computer Science at the University of California at Davis. A recognized expert in vulnerability analysis, secure systems/software design, network security, access control, authentication, and UNIX security, Bishop also works to improve computer security instruction.

Read More Show Less

Read an Excerpt

Hortensio: Madam, before you touch the instrument
To learn the order of my fingering,
I must begin with rudiments of art
To teach you gamouth in a briefer sort,
More pleasant, pithy and effectual,
Than hath been taught by any of my trade;
And there it is in writing, fairly drawn.
The Taming of the Shrew, III, i, 62-68.

On September 11, 2001, terrorists seized control of four airplanes. Three were flown into buildings, and a fourth crashed, with catastrophic loss of life. In the aftermath, the security and reliability of many aspects of society drew renewed scrutiny. One of these aspects was the widespread use of computers and their interconnecting networks.

The issue is not new. In 1988, approximately 5,000 computers throughout the Internet were rendered unusable within 4 hours by a program called a worm. While the spread, and the effects, of this program alarmed computer scientists, most people were not worried because the worm did not affect their lives or their ability to do their jobs. In 1993, more users of computer systems were alerted to such dangers when a set of programs called sniffers were placed on many computers run by network service providers and recorded login names and passwords.

After an attack on Tsutomu Shimomura's computer system, and the fascinating way Shimomura followed the attacker's trail, which led to his arrest, the public's interest and apprehension were finally aroused. Computers were now vulnerable. Their once reassuring protections were now viewed as flimsy.

Several films explored these concerns. Movies such as War Games and Hackers provided images of people who can, at will, wander throughoutcomputers and networks, maliciously or frivolously corrupting or destroying information it may have taken millions of dollars to amass. (Reality intruded on Hackers when the World Wide Web page set up by MGM/United Artists was quickly altered to present an irreverent commentary on the movie and to suggest that viewers see The Net instead. Paramount Pictures denied doing this.) Another film, Sneakers, presented a picture of those who test the security of computer (and other) systems for their owners and for the government.Goals

This book has three goals. The first is to show the importance of theory to practice and of practice to theory. All too often, practitioners regard theory as irrelevant and theoreticians think of practice as trivial. In reality, theory and practice are symbiotic. For example, the theory of covert channels, in which the goal is to limit the ability of processes to communicate through shared resources, provides a mechanism for evaluating the effectiveness of mechanisms that confine processes, such as sandboxes and firewalls. Similarly, business practices in the commercial world led to the development of several security policy models such as the Clark-Wilson model and the Chinese Wall model. These models in turn help the designers of security policies better understand and evaluate the mechanisms and procedures needed to secure their sites.

The second goal is to emphasize that computer security and cryptography are different. Although cryptography is an essential component of computer security, it is by no means the only component. Cryptography provides a mechanism for performing specific functions, such as preventing unauthorized people from reading and altering messages on a network. However, unless developers understand the context in which they are using cryptography, and unless the assumptions underlying the protocol and the cryptographic mechanisms apply to the context, the cryptography may not add to the security of the system. The canonical example is the use of cryptography to secure communications between two low-security systems. If only trusted users can access the two systems, cryptography protects messages in transit. But if untrusted users can access either system (through authorized accounts or, more likely, by breaking in), the cryptography is not sufficient to protect the messages. The attackers can read the messages at either endpoint.

The third goal is to demonstrate that computer security is not just a science but also an art. It is an art because no system can be considered secure without an examination of how it is to be used. The definition of a "secure computer" necessitates a statement of requirements and an expression of those requirements in the form of authorized actions and authorized users. (A computer engaged in work at a university may be considered "secure" for the purposes of the work done at the university. When moved to a military installation, that same system may not provide sufficient control to be deemed "secure" for the purposes of the work done at that installation.) How will people, as well as other computers, interact with the computer system? How clear and restrictive an interface can a designer create without rendering the system unusable while trying to prevent unauthorized use or access to the data or resources on the system?

Just as an artist paints his view of the world onto canvas, so does a designer of security features articulate his view of the world of human/machine interaction in the security policy and mechanisms of the system. Two designers may use entirely different designs to achieve the same creation, just as two artists may use different subjects to achieve the same concept.

Computer security is also a science. Its theory is based on mathematical constructions, analyses, and proofs. Its systems are built in accordance with the accepted practices of engineering. It uses inductive and deductive reasoning to examine the security of systems from key axioms and to discover underlying principles. These scientific principles can then be applied to untraditional situations and new theories, policies, and mechanisms.Philosophy

Key to understanding the problems that exist in computer security is a recognition that the problems are not new. They are old problems, dating from the beginning of computer security (and, in fact, arising from parallel problems in the noncomputer world). But the locus has changed as the field of computing has changed. Before the mid-1980s, mainframe and mid-level computers dominated the market, and computer security problems and solutions were phrased in terms of securing files or processes on a single system. With the rise of networking and the Internet, the arena has changed. Workstations and servers, and the networking infrastructure that connects them, now dominate the market. Computer security problems and solutions now focus on a networked environment. However, if the workstations and servers, and the supporting network infrastructure, are viewed as a single system, the models, theories, and problem statements developed for systems before the mid-1980s apply equally well to current systems.

As an example, consider the issue of assurance. In the early period, assurance arose in several ways: formal methods and proofs of correctness, validation of policy to requirements, and acquisition of data and programs from trusted sources, to name a few. Those providing assurance analyzed a single system, the code on it, and the sources (vendors and users) from which the code could be acquired to ensure that either the sources could be trusted or the programs could be confined adequately to do minimal damage. In the later period, the same basic principles and techniques apply, except that the scope of some has been greatly expanded (from a single system and a small set of vendors to the world-wide Internet). The work on proof-carrying code, an exciting development in which the proof that a downloadable program module satisfies a stated policy is incorporated into the program itself, is an example of this expansion. It extends the notion of a proof of consistency with a stated policy. It advances the technology of the earlier period into the later period. But in order to understand it properly, one must understand the ideas underlying the concept of proof-carrying code, and these ideas lie in the earlier period.

As another example, consider Saltzer and Schroeder's principles of secure design. Enunciated in 1975, they promote simplicity, confinement, and understanding. When security mechanisms grow too complex, attackers can evade or bypass them. Many programmers and vendors are learning this when attackers break into their systems and servers. The argument that the principles are old, and somehow outdated, rings hollow when the result of their violation is a nonsecure system.

The work from the earlier period is sometimes cast in terms of systems that no longer exist and that differ in many ways from modern systems. This does not vitiate the ideas and concepts, which also underlie the work done today. Once these ideas and concepts are properly understood, applying them in a multiplicity of environments becomes possible. Furthermore, the current mechanisms and technologies will become obsolete and of historical interest themselves as new forms of computing arise, but the underlying principles will live on, to underlie the next generation—indeed the next era—of computing.

The philosophy of this book is that certain key concepts underlie all of computer security, and that the study of all parts of computer security enriches the understanding of all parts. Moreover, critical to an understanding of the applications of security-related technologies and methodologies is an understanding of the theory underlying those applications.

Advances in the theory of computer protection have illuminated the foundations of security systems. Issues of abstract modeling, and modeling to meet specific environments, lead to systems designed to achieve a specific and rewarding goal. Theorems about the undecidability of the general security question have indicated the limits of what can be done.

Application of these results has improved the quality of the security of the systems being protected. However, the issue is how compatibly the assumptions of the model (and theory) conform to the environment to which the theory is applied. Although our knowledge of how to apply these abstractions is continually increasing, we still have difficulty correctly transposing the relevant information from a realistic setting to one in which analyses can then proceed. Such abstraction often eliminates vital information. The omitted data may pertain to security in nonobvious ways. Without this information, the analysis is flawed.

Unfortunately, no single work can cover all aspects of computer security, so this book focuses on those parts that are, in the author's opinion, most fundamental and most pervasive. The mechanisms exemplify the applications of these principles.Organization

The organization of this book reflects its philosophy. It begins with fundamentals and principles that provide boundaries within which security can be modeled and analyzed effectively. This provides a framework for expressing and analyzing the requirements of the security of a system. These policies constrain what is allowed and what is not allowed. Mechanisms provide the ability to implement these policies. The degree to which the mechanisms correctly implement the policies, and indeed the degree to which the policies themselves meet the requirements of the organizations using the system, are questions of assurance. Exploiting failures in policy, in implementation, and in assurance comes next, as well as mechanisms for providing information on the attack. The book concludes with the applications of both theory and policy focused on realistic situations. This natural progression emphasizes the development and application of the principles existent in computer security.

The first chapter describes what computer security is all about and explores the problems and challenges to be faced. It sets the context for the remainder of the book.

Chapters 2 and 3 deal with basic questions such as how "security" can be clearly and functionally defined, whether or not it is realistic, and whether or not it is decidable.

Chapters 4 through 7 probe the relationship between policy and security. The definition of "security" depends on policy. We examine several types of policies, including the ever-present fundamental questions of trust, analysis of policies, and the use of policies to constrain operations and transitions.Chapters 9 through 12 discuss cryptography and its role in security, focusing on applications and issues such as key management, key distribution, and how cryptosystems are used in networks. A quick study of authentication completes this part.

Chapters 13 through 16 consider how to implement the requirements imposed by policies using system-oriented techniques. Certain design principles are fundamental to effective security mechanisms. Policies define who can act and how they can act, and so identity is a critical aspect of implementation. Mechanisms implementing access control and flow control enforce various aspects of policies.

Chapters 17 and 18 present concepts and standards used to ascertain how well a system, or a product, meets its goals.

Chapters 19 through 22 discuss some miscellaneous aspects of computer security. Malicious logic thwarts many mechanisms. Despite our best efforts at high assurance, systems today are replete with vulnerabilities. Why? How can a system be analyzed to detect vulnerabilities? What models might help us improve the state of the art? Given these security holes, how can we detect attackers who exploit them? A discussion of auditing flows naturally into a discussion of intrusion detection—a detection method for such attacks.

Chapters 23 through 26 present examples of how to apply the principles discussed throughout the book. They begin with networks and proceed to systems, users, and programs. Each chapter states a desired policy and shows how to translate that policy into a set of mechanisms and procedures that support the policy. This part tries to demonstrate that the material covered elsewhere can be, and should be, used in practice.

Each chapter in this book ends with a summary and some suggestions for further reading. The summary highlights the important ideas in the chapter. Interested readers who wish to pursue the topics in any chapter in more depth can go to some of the suggested readings. They expand on the material in the chapter or present other interesting avenues.Differences Between this Book and Computer Security: Art and Science

The differences between this book and Computer Security: Art and Science result from the different intended audiences. This book is a shorter version of the latter, omitting much of the mathematical formalism. It is suited for computer security professionals, students, and prospective readers who have a less formal mathematical background, or who are not interested in the mathematical formalisms and would only be distracted by them, or for courses with a more practical than theoretical focus.

The foundations and policy sections of this book do not present results involving formal modeling or derivations of limits on the decidability of security (although it does present the central result, that the generic safety problem is undecidable). Some policies, significant in the history of the development of policy models but no longer used widely, have been omitted, as has discussion of the notions of nondeducibility and noninterference. Further, the section on assurance omits the presentation of formal methods and the detailed discussion of designing and building secure systems. It preserves the exposition of the basic concepts and ideas, especially those related to reference monitors, and discusses commonly encountered evaluation criteria.

The reasons for these differences come from the different backgrounds expected of readers. This book is intended for readers who may not be familiar with highly mathematical concepts, or for classes in which the instructor does not intend to expound upon formalisms, such as those required for the development of high assurance systems, but wants students to be exposed to the ideas underlying a "high assurance system." These situations most often arise in classes in which students' backgrounds may not include classes that provide the understanding needed to assimilate the mathematical details of the work. As a consequence, students are often intimidated by the formalism even if the instructor skips it. The original version of this book is intended for classes where the instructor wishes to explain, or allow the students to explore on their own, the rich mathematical background and formalisms of computer security.

Some students learn best by an informal description of a subject. What is the intuition underlying the ideas and principles of the field? How does the practitioner apply these to improve the state of the art? For these students, this version of the book is more appropriate. Other students are most comfortable with intuition augmented by a formal mathematical exposition of the underlying concepts. How does one make the intuition formal? How does one apply the ideas rigorously to assure a secure system (for an appropriate definition of security)? For these students, the original book, Computer Security: Art and Science, would be more appropriate.

Practitioners who are less interested in mathematical expositions of the theories underlying computer security will find this version more to their liking. This version keeps the intuitive, non-mathematical exposition of the underlying principles, but does so using a small amount of formal mathematics. Practitioners will find this version shorter and, most likely, easier to read because they will not be distracted by material they would find irrelevant.Special Acknowledgment

Elisabeth Sullivan contributed the assurance part of this book. She wrote several drafts, all of which reflect her extensive knowledge and experience in that aspect of computer security. I am particularly grateful to her for contributing her real-world knowledge of how assurance is managed. Too often, books recount the mathematics of assurance without recognizing that other aspects are equally important and more widely used. These other aspects shine through in the assurance section, thanks to Liz. As if that were not enough, she made several suggestions that improved the policy part of this book. I will always be grateful for her contribution, her humor, and especially her friendship.

Read More Show Less

Table of Contents

Preface.

Goals.

Philosophy.

Organization.

Differences Between this Book and Computer Security: Art and Science.

Special Acknowledgment.

Acknowledgments.

1. An Overview of Computer Security.

The Basic Components.

Threats.

Policy and Mechanism.

Assumptions and Trust.

Assurance.

Operational Issues.

Human Issues.

Tying It All Together.

Summary.

Further Reading.

Exercises.

2. Access Control Matrix.

Protection State.

Access Control Matrix Model.

Protection State Transitions.

Conditional Commands.

Summary.

Further Reading.

Exercises.

3. Foundational Results.

The General Question.

Basic Results.

Summary.

Further Reading.

Exercises.

4. Security Policies.

Security Policies.

Types of Security Policies.

The Role of Trust.

Types of Access Control.

Example: Academic Computer Security Policy.

Summary.

Further Reading.

Exercises.

5. Confidentiality Policies.

Goals of Confidentiality Policies.

The Bell-LaPadula Model.

Summary.

Further Reading.

Exercises.

6. Integrity Policies.

Goals.

Biba Integrity Model.

Clark-Wilson Integrity Model.

Summary.

Further Reading.

Exercises.

7. Hybrid Policies.

Chinese Wall Model.

Bell-LaPadula and Chinese Wall Models.

Clinical Information Systems Security Policy.

Originator Controlled Access Control.

Role-Based Access Control.

Summary.

Further Reading.

Exercises.

8. Basic Cryptography.

What Is Cryptography?

Classical Cryptosystems.

Public Key Cryptography.

Cryptographic Checksums.

Summary.

Further Reading.

Exercises.

9. Key Management.

Session and Interchange Keys.

Key Exchange.

Cryptographic Key Infrastructures.

Storing and Revoking Keys.

Digital Signatures.

Summary.

Further Reading.

Exercises.

10. Cipher Techniques.

Problems.

Stream and Block Ciphers.

Networks and Cryptography.

Example Protocols.

Summary.

Further Reading.

Exercises.

11. Authentication.

Authentication Basics.

Passwords.

Challenge-Response.

Biometrics.

Location.

Multiple Methods.

Summary.

Further Reading.

Exercises.

12. Design Principles.

Overview.

Design Principles.

Summary.

Further Reading.

Exercises.

13. Representing Identity.

What Is Identity?

Files and Objects.

Users.

Groups and Roles.

Naming and Certificates.

Identity on the Web.

Summary.

Further Reading.

Exercises.

14. Access Control Mechanisms.

Access Control Lists.

Capabilities.

Locks and Keys.

Ring-Based Access Control.

Propagated Access Control Lists.

Summary.

Further Reading.

Exercises.

15. Information Flow.

Basics and Background.

Compiler-Based Mechanisms.

Execution-Based Mechanisms.

Example Information Flow Controls.

Summary.

Further Reading.

Exercises.

16. Confinement Problem.

The Confinement Problem.

Isolation.

Covert Channels.

Summary.

Further Reading.

Exercises.

17. Introduction to Assurance.

Assurance and Trust.

Building Secure and Trusted Systems.

Building Security In or Adding Security Later.

Summary.

Further Reading.

Exercises.

18. Evaluating Systems.

Goals of Formal Evaluation.

TCSEC: 19831999.

FIPS 140: 1994Present.

The Common Criteria: 1998Present.

SSE-CMM: 1997Present.

Summary.

Further Reading.

Exercises.

19. Malicious Logic.

Introduction.

Trojan Horses.

Computer Viruses.

Computer Worms.

Other Forms of Malicious Logic.

Defenses.

Summary.

Further Reading.

Exercises.

20. Vulnerability Analysis.

Introduction.

Penetration Studies.

Vulnerability Classification.

Frameworks.

Summary.

Further Reading.

Exercises.

21. Auditing.

Definitions.

Anatomy of an Auditing System.

Designing an Auditing System.

A Posteriori Design.

Auditing Mechanisms.

Examples: Auditing File Systems.

Audit Browsing.

Summary.

Further Reading.

Exercises.

22. Intrusion Detection.

Principles.

Basic Intrusion Detection.

Models.

Architecture.

Organization of Intrusion Detection Systems.

Intrusion Response.

Summary.

Further reading.

Exercises.

23. Network Security.

Introduction.

Policy Development.

Network Organization.

Availability and Network Flooding.

Anticipating Attacks.

Summary.

Further Reading.

Exercises.

24. System Security.

Introduction.

Policy.

Networks.

Users.

Authentication.

Processes.

Files.

Retrospective.

Summary.

Further Reading.

Exercises.

25. User Security.

Policy.

Access.

Files and Devices.

Processes.

Electronic Communications.

Summary.

Further Reading.

Exercises.

26. Program Security.

Introduction.

Requirements and Policy.

Design.

Refinement and Implementation.

Common Security-Related Programming Problems.

Testing, Maintenance, and Operation.

Distribution.

Conclusion.

Summary.

Further Reading.

Exercises.

27. Lattices.

Basics.

Lattices.

Exercises.

28. The Extended Euclidean Algorithm.

The Euclidean Algorithm.

The Extended Euclidean Algorithm.

Solving ax mod n = 1.

Solving ax mod n = b.

Exercises.

29. Virtual Machines.

Virtual Machine Structure.

Virtual Machine Monitor.

Exercises.

Bibliography.

Index.

Read More Show Less

Preface

Hortensio: Madam, before you touch the instrument
To learn the order of my fingering,
I must begin with rudiments of art
To teach you gamouth in a briefer sort,
More pleasant, pithy and effectual,
Than hath been taught by any of my trade;
And there it is in writing, fairly drawn.
The Taming of the Shrew, III, i, 62-68.

On September 11, 2001, terrorists seized control of four airplanes. Three were flown into buildings, and a fourth crashed, with catastrophic loss of life. In the aftermath, the security and reliability of many aspects of society drew renewed scrutiny. One of these aspects was the widespread use of computers and their interconnecting networks.

The issue is not new. In 1988, approximately 5,000 computers throughout the Internet were rendered unusable within 4 hours by a program called a worm. While the spread, and the effects, of this program alarmed computer scientists, most people were not worried because the worm did not affect their lives or their ability to do their jobs. In 1993, more users of computer systems were alerted to such dangers when a set of programs called sniffers were placed on many computers run by network service providers and recorded login names and passwords.

After an attack on Tsutomu Shimomura's computer system, and the fascinating way Shimomura followed the attacker's trail, which led to his arrest, the public's interest and apprehension were finally aroused. Computers were now vulnerable. Their once reassuring protections were now viewed as flimsy.

Several films explored these concerns. Movies such as War Games and Hackers provided images of people who can, at will, wander throughout computers and networks, maliciously or frivolously corrupting or destroying information it may have taken millions of dollars to amass. (Reality intruded on Hackers when the World Wide Web page set up by MGM/United Artists was quickly altered to present an irreverent commentary on the movie and to suggest that viewers see The Net instead. Paramount Pictures denied doing this.) Another film, Sneakers, presented a picture of those who test the security of computer (and other) systems for their owners and for the government.

Goals

This book has three goals. The first is to show the importance of theory to practice and of practice to theory. All too often, practitioners regard theory as irrelevant and theoreticians think of practice as trivial. In reality, theory and practice are symbiotic. For example, the theory of covert channels, in which the goal is to limit the ability of processes to communicate through shared resources, provides a mechanism for evaluating the effectiveness of mechanisms that confine processes, such as sandboxes and firewalls. Similarly, business practices in the commercial world led to the development of several security policy models such as the Clark-Wilson model and the Chinese Wall model. These models in turn help the designers of security policies better understand and evaluate the mechanisms and procedures needed to secure their sites.

The second goal is to emphasize that computer security and cryptography are different. Although cryptography is an essential component of computer security, it is by no means the only component. Cryptography provides a mechanism for performing specific functions, such as preventing unauthorized people from reading and altering messages on a network. However, unless developers understand the context in which they are using cryptography, and unless the assumptions underlying the protocol and the cryptographic mechanisms apply to the context, the cryptography may not add to the security of the system. The canonical example is the use of cryptography to secure communications between two low-security systems. If only trusted users can access the two systems, cryptography protects messages in transit. But if untrusted users can access either system (through authorized accounts or, more likely, by breaking in), the cryptography is not sufficient to protect the messages. The attackers can read the messages at either endpoint.

The third goal is to demonstrate that computer security is not just a science but also an art. It is an art because no system can be considered secure without an examination of how it is to be used. The definition of a "secure computer" necessitates a statement of requirements and an expression of those requirements in the form of authorized actions and authorized users. (A computer engaged in work at a university may be considered "secure" for the purposes of the work done at the university. When moved to a military installation, that same system may not provide sufficient control to be deemed "secure" for the purposes of the work done at that installation.) How will people, as well as other computers, interact with the computer system? How clear and restrictive an interface can a designer create without rendering the system unusable while trying to prevent unauthorized use or access to the data or resources on the system?

Just as an artist paints his view of the world onto canvas, so does a designer of security features articulate his view of the world of human/machine interaction in the security policy and mechanisms of the system. Two designers may use entirely different designs to achieve the same creation, just as two artists may use different subjects to achieve the same concept.

Computer security is also a science. Its theory is based on mathematical constructions, analyses, and proofs. Its systems are built in accordance with the accepted practices of engineering. It uses inductive and deductive reasoning to examine the security of systems from key axioms and to discover underlying principles. These scientific principles can then be applied to untraditional situations and new theories, policies, and mechanisms.

Philosophy

Key to understanding the problems that exist in computer security is a recognition that the problems are not new. They are old problems, dating from the beginning of computer security (and, in fact, arising from parallel problems in the noncomputer world). But the locus has changed as the field of computing has changed. Before the mid-1980s, mainframe and mid-level computers dominated the market, and computer security problems and solutions were phrased in terms of securing files or processes on a single system. With the rise of networking and the Internet, the arena has changed. Workstations and servers, and the networking infrastructure that connects them, now dominate the market. Computer security problems and solutions now focus on a networked environment. However, if the workstations and servers, and the supporting network infrastructure, are viewed as a single system, the models, theories, and problem statements developed for systems before the mid-1980s apply equally well to current systems.

As an example, consider the issue of assurance. In the early period, assurance arose in several ways: formal methods and proofs of correctness, validation of policy to requirements, and acquisition of data and programs from trusted sources, to name a few. Those providing assurance analyzed a single system, the code on it, and the sources (vendors and users) from which the code could be acquired to ensure that either the sources could be trusted or the programs could be confined adequately to do minimal damage. In the later period, the same basic principles and techniques apply, except that the scope of some has been greatly expanded (from a single system and a small set of vendors to the world-wide Internet). The work on proof-carrying code, an exciting development in which the proof that a downloadable program module satisfies a stated policy is incorporated into the program itself, is an example of this expansion. It extends the notion of a proof of consistency with a stated policy. It advances the technology of the earlier period into the later period. But in order to understand it properly, one must understand the ideas underlying the concept of proof-carrying code, and these ideas lie in the earlier period.

As another example, consider Saltzer and Schroeder's principles of secure design. Enunciated in 1975, they promote simplicity, confinement, and understanding. When security mechanisms grow too complex, attackers can evade or bypass them. Many programmers and vendors are learning this when attackers break into their systems and servers. The argument that the principles are old, and somehow outdated, rings hollow when the result of their violation is a nonsecure system.

The work from the earlier period is sometimes cast in terms of systems that no longer exist and that differ in many ways from modern systems. This does not vitiate the ideas and concepts, which also underlie the work done today. Once these ideas and concepts are properly understood, applying them in a multiplicity of environments becomes possible. Furthermore, the current mechanisms and technologies will become obsolete and of historical interest themselves as new forms of computing arise, but the underlying principles will live on, to underlie the next generation--indeed the next era--of computing.

The philosophy of this book is that certain key concepts underlie all of computer security, and that the study of all parts of computer security enriches the understanding of all parts. Moreover, critical to an understanding of the applications of security-related technologies and methodologies is an understanding of the theory underlying those applications.

Advances in the theory of computer protection have illuminated the foundations of security systems. Issues of abstract modeling, and modeling to meet specific environments, lead to systems designed to achieve a specific and rewarding goal. Theorems about the undecidability of the general security question have indicated the limits of what can be done.

Application of these results has improved the quality of the security of the systems being protected. However, the issue is how compatibly the assumptions of the model (and theory) conform to the environment to which the theory is applied. Although our knowledge of how to apply these abstractions is continually increasing, we still have difficulty correctly transposing the relevant information from a realistic setting to one in which analyses can then proceed. Such abstraction often eliminates vital information. The omitted data may pertain to security in nonobvious ways. Without this information, the analysis is flawed.

Unfortunately, no single work can cover all aspects of computer security, so this book focuses on those parts that are, in the author's opinion, most fundamental and most pervasive. The mechanisms exemplify the applications of these principles.

Organization

The organization of this book reflects its philosophy. It begins with fundamentals and principles that provide boundaries within which security can be modeled and analyzed effectively. This provides a framework for expressing and analyzing the requirements of the security of a system. These policies constrain what is allowed and what is not allowed. Mechanisms provide the ability to implement these policies. The degree to which the mechanisms correctly implement the policies, and indeed the degree to which the policies themselves meet the requirements of the organizations using the system, are questions of assurance. Exploiting failures in policy, in implementation, and in assurance comes next, as well as mechanisms for providing information on the attack. The book concludes with the applications of both theory and policy focused on realistic situations. This natural progression emphasizes the development and application of the principles existent in computer security.

The first chapter describes what computer security is all about and explores the problems and challenges to be faced. It sets the context for the remainder of the book.

Chapters 2 and 3 deal with basic questions such as how "security" can be clearly and functionally defined, whether or not it is realistic, and whether or not it is decidable.

Chapters 4 through 7 probe the relationship between policy and security. The definition of "security" depends on policy. We examine several types of policies, including the ever-present fundamental questions of trust, analysis of policies, and the use of policies to constrain operations and transitions.Chapters 9 through 12 discuss cryptography and its role in security, focusing on applications and issues such as key management, key distribution, and how cryptosystems are used in networks. A quick study of authentication completes this part.

Chapters 13 through 16 consider how to implement the requirements imposed by policies using system-oriented techniques. Certain design principles are fundamental to effective security mechanisms. Policies define who can act and how they can act, and so identity is a critical aspect of implementation. Mechanisms implementing access control and flow control enforce various aspects of policies.

Chapters 17 and 18 present concepts and standards used to ascertain how well a system, or a product, meets its goals.

Chapters 19 through 22 discuss some miscellaneous aspects of computer security. Malicious logic thwarts many mechanisms. Despite our best efforts at high assurance, systems today are replete with vulnerabilities. Why? How can a system be analyzed to detect vulnerabilities? What models might help us improve the state of the art? Given these security holes, how can we detect attackers who exploit them? A discussion of auditing flows naturally into a discussion of intrusion detection--a detection method for such attacks.

Chapters 23 through 26 present examples of how to apply the principles discussed throughout the book. They begin with networks and proceed to systems, users, and programs. Each chapter states a desired policy and shows how to translate that policy into a set of mechanisms and procedures that support the policy. This part tries to demonstrate that the material covered elsewhere can be, and should be, used in practice.

Each chapter in this book ends with a summary and some suggestions for further reading. The summary highlights the important ideas in the chapter. Interested readers who wish to pursue the topics in any chapter in more depth can go to some of the suggested readings. They expand on the material in the chapter or present other interesting avenues.

Differences Between this Book and Computer Security: Art and Science

The differences between this book and Computer Security: Art and Science result from the different intended audiences. This book is a shorter version of the latter, omitting much of the mathematical formalism. It is suited for computer security professionals, students, and prospective readers who have a less formal mathematical background, or who are not interested in the mathematical formalisms and would only be distracted by them, or for courses with a more practical than theoretical focus.

The foundations and policy sections of this book do not present results involving formal modeling or derivations of limits on the decidability of security (although it does present the central result, that the generic safety problem is undecidable). Some policies, significant in the history of the development of policy models but no longer used widely, have been omitted, as has discussion of the notions of nondeducibility and noninterference. Further, the section on assurance omits the presentation of formal methods and the detailed discussion of designing and building secure systems. It preserves the exposition of the basic concepts and ideas, especially those related to reference monitors, and discusses commonly encountered evaluation criteria.

The reasons for these differences come from the different backgrounds expected of readers. This book is intended for readers who may not be familiar with highly mathematical concepts, or for classes in which the instructor does not intend to expound upon formalisms, such as those required for the development of high assurance systems, but wants students to be exposed to the ideas underlying a "high assurance system." These situations most often arise in classes in which students' backgrounds may not include classes that provide the understanding needed to assimilate the mathematical details of the work. As a consequence, students are often intimidated by the formalism even if the instructor skips it. The original version of this book is intended for classes where the instructor wishes to explain, or allow the students to explore on their own, the rich mathematical background and formalisms of computer security.

Some students learn best by an informal description of a subject. What is the intuition underlying the ideas and principles of the field? How does the practitioner apply these to improve the state of the art? For these students, this version of the book is more appropriate. Other students are most comfortable with intuition augmented by a formal mathematical exposition of the underlying concepts. How does one make the intuition formal? How does one apply the ideas rigorously to assure a secure system (for an appropriate definition of security)? For these students, the original book, Computer Security: Art and Science, would be more appropriate.

Practitioners who are less interested in mathematical expositions of the theories underlying computer security will find this version more to their liking. This version keeps the intuitive, non-mathematical exposition of the underlying principles, but does so using a small amount of formal mathematics. Practitioners will find this version shorter and, most likely, easier to read because they will not be distracted by material they would find irrelevant.

Special Acknowledgment

Elisabeth Sullivan contributed the assurance part of this book. She wrote several drafts, all of which reflect her extensive knowledge and experience in that aspect of computer security. I am particularly grateful to her for contributing her real-world knowledge of how assurance is managed. Too often, books recount the mathematics of assurance without recognizing that other aspects are equally important and more widely used. These other aspects shine through in the assurance section, thanks to Liz. As if that were not enough, she made several suggestions that improved the policy part of this book. I will always be grateful for her contribution, her humor, and especially her friendship.

Read More Show Less

Customer Reviews

Average Rating 5
( 1 )
Rating Distribution

5 Star

(1)

4 Star

(0)

3 Star

(0)

2 Star

(0)

1 Star

(0)

Your Rating:

Your Name: Create a Pen Name or

Barnes & Noble.com Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & Noble.com that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & Noble.com does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at BN.com or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation

Reminder:

  • - By submitting a review, you grant to Barnes & Noble.com and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Noble.com Terms of Use.
  • - Barnes & Noble.com reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & Noble.com also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on BN.com. It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

 
Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously
Sort by: Showing 1 Customer Reviews
  • Anonymous

    Posted October 20, 2004

    more rigour than most computer books

    Most books on computer security describe and show how to use cryptography. But often due to lack of space and audience expertise, they often do not give any detailed theory of cryptosystems. There is relatively little maths in such books. In turn, cryptography books fall into roughly two piles. One is highly mathematical and abstract; deliberately independent of any operating system or implementation. The other uses those theorems from the previous type of book, and is more tied to some software package that implements them. Bishop's book stands differently. The level of the maths and the notation and the rigour with which he describes the cryptosystems would not be out of place in an algorithms book. But it is not all maths. There are chapters on Identity and on Access Control Mechanisms that are traditional sysadmin-type discussions. Veterans of running DEC's VMS machines will see much familiar material. But these discussions are also characterised by a level of analysis uncommonly seen in most sysadmin books. Bishop tries to show how behind such things like Access Control Lists, there is a systematic logic. Other books that might be tied to a given operating system or package might bury you in details, and obscure a general model. If you have wanted to dig deeper into the subject and have good background in discrete maths, Bishop is worth reading.

    Was this review helpful? Yes  No   Report this review
Sort by: Showing 1 Customer Reviews

If you find inappropriate content, please report it to Barnes & Noble
Why is this product inappropriate?
Comments (optional)