Security in Computing

by Charles Pfleeger, Shari Pfleeger, Lizzie Coles-Kemp

Overview

The Art of Computer and Information Security: From Apps and Networks to Cloud and Crypto

Security in Computing, Sixth Edition, is today's essential text for anyone teaching, learning, and practicing cybersecurity. It defines core principles underlying modern security policies, processes, and protection; illustrates them with up-to-date examples; and shows how to apply them in practice. Modular and flexibly organized, this book supports a wide array of courses, strengthens professionals' knowledge of foundational principles, and imparts a more expansive understanding of modern security.

This extensively updated edition adds or expands coverage of artificial intelligence and machine learning tools; app and browser security; security by design; securing cloud, IoT, and embedded systems; privacy-enhancing technologies; protecting vulnerable individuals and groups; strengthening security culture; cryptocurrencies and blockchain; cyberwarfare; post-quantum computing; and more. It contains many new diagrams, exercises, sidebars, and examples, and is suitable for use with two leading frameworks: the US NIST National Initiative for Cybersecurity Education (NICE) and the UK Cyber Security Body of Knowledge (CyBOK).

• Core security concepts: Assets, threats, vulnerabilities, controls, confidentiality, integrity, availability, attackers, and attack types
• The security practitioner's toolbox: Identification and authentication, access control, and cryptography
• Areas of practice: Securing programs, user–internet interaction, operating systems, networks, data, databases, and cloud computing
• Cross-cutting disciplines: Privacy, management, law, and ethics
• Using cryptography: Formal and mathematical underpinnings, and applications of cryptography
• Emerging topics and risks: AI and adaptive cybersecurity, blockchains and cryptocurrencies, cyberwarfare, and quantum computing

Register your book for convenient access to downloads, updates, and/or corrections as they become available. See inside book for details.

Product Details

ISBN-13:	9780137891252
Publisher:	Pearson Education
Publication date:	07/24/2023
Sold by:	Barnes & Noble
Format:	eBook
Pages:	1040
File size:	18 MB
Note:	This product may take a few minutes to download.
Age Range:	18 Years

About the Author

Charles P. Pfleeger is an internationally known expert on computer and communications security. He spent 14 years as professor of computer science at the University of Tennessee, before moving on to computer research and consulting company, Trusted Information Systems, where he was director of European operations and senior consultant. He was also director of research, member of the staff, and chief security officer at Cable and Wireless. He has chaired the IEEE Computer Society Technical Committee on Security and Privacy and was on the editorial board of IEEE Security & Privacy magazine.

Shari Lawrence Pfleeger is a widely known software engineering and computer security researcher. She served as president of Systems/Software and then as senior researcher with the Rand Corporation. As research director of the Institute for Information Infrastructure Protection, she oversaw large, high-impact computer security research projects for international government and industry clients. She has served as associate editor in chief of IEEE Software magazine, and as editor in chief of IEEE Security & Privacy magazine.

Lizzie Coles-Kemp is a professor of information security at the Information Security Group, Royal Holloway University of London (RHUL). Prior to joining RHUL in 2007, Lizzie work in security practice for 17 years and held several managerial and directorship roles. During this time, she worked on the design and implementation of software access control systems, taught network security to practitioners, worked as a lead assessor in security standards for a UK certification body, and was global security officer for the British Council (a UK NGO).

Read an Excerpt

Every day, the news media give more and more visibility to the effects of computer security on our daily lives. For example, on a single day in June 2006, the Washington Post included three important articles about security. On the front page, one article discussed the loss of a laptop computer containing personal data on 26.5 million veterans. A second article, on the front page of the business section, described Microsoft's new product suite to combat malicious code, spying, and unsecured vulnerabilities in its operating system. Further back, a third article reported on a major consumer electronics retailer that inadvertently installed software on its customers' computers, making them part of a web of compromised slave computers. The sad fact is that news like this appears almost every day, and has done so for a number of years. There is no end in sight.

Even though the language of computer security—terms such as virus, Trojan horse, phishing, spyware—is common, the application of solutions to computer security problems is uncommon. Moreover, new attacks are clever applications of old problems. The pressure to get a new product or new release to market still in many cases overrides security requirements for careful study of potential vulnerabilities and countermeasures. Finally, many people are in denial, blissfully ignoring the serious harm that insecure computing can cause.

Why Read This Book?

Admit it. You know computing entails serious risks to the privacy and integrity of your data, or the operation of your computer. Risk is a fact of life: Crossing the street is risky, perhaps more so in some places than others, but you still cross the street. As a child you learned to stop and look both ways before crossing. As you became older you learned to gauge the speed of oncoming traffic and determine whether you had the time to cross. At some point you developed a sense of whether an oncoming car would slow down or yield. We hope you never had to practice this, but sometimes you have to decide whether darting into the street without looking is the best means of escaping danger. The point is all these matters depend on knowledge and experience. We want to help you develop the same knowledge and experience with respect to the risks of secure computing.

How do you control the risk of computer security?

• Learn about the threats to computer security.
• Understand what causes these threats by studying how vulnerabilities arise in the development and use of computer systems.
• Survey the controls that can reduce or block these threats.
• Develop a computing style—as a user, developer, manager, consumer, and voter—that balances security and risk.

The field of computer security changes rapidly, but the underlying problems remain largely unchanged. In this book you will find a progression that shows you how current complex attacks are often instances of more fundamental concepts.

Users and Uses of This Book

This book is intended for the study of computer security. Many of you want to study this topic: college and university students, computing professionals, managers, and users of all kinds of computer-based systems. All want to know the same thing: how to control the risk of computer security. But you may differ in how much information you need about particular topics: Some want a broad survey, while others want to focus on particular topics, such as networks or program development.

This book should provide the breadth and depth that most readers want. The book is organized by general area of computing, so that readers with particular interests can find information easily. The chapters of this book progress in an orderly manner, from general security concerns to the particular needs of specialized applications, and finally to overarching management and legal issues. Thus, the book covers five key areas of interest:

• introduction: threats, vulnerabilities, and controls
• encryption: the "Swiss army knife" of security controls
• code: security in programs, including applications, operating systems, database management systems, and networks
• management: building and administering a computing installation, from one computer to thousands, and understanding the economics of cybersecurity
• law, privacy, ethics: non-technical approaches by which society controls computer security risks

These areas are not equal in size; for example, more than half the book is devoted to code because so much of the risk is at least partly caused by program code that executes on computers.

The first chapter introduces the concepts and basic vocabulary of computer security. Studying the second chapter provides an understanding of what encryption is and how it can be used or misused. Just as a driver's manual does not address how to design or build a car, Chapter 2 is not for designers of new encryption schemes, but rather for users of encryption. Chapters 3 through 7 cover successively larger pieces of software: individual programs, operating systems, complex applications like database management systems, and finally networks, which are distributed complex systems. Chapter 8 discusses managing and administering security, and describes how to find an acceptable balance between threats and controls. Chapter 9 addresses an important management issue by exploring the economics of cybersecurity: understanding and communicating the costs and benefits. In Chapter 10 we turn to the personal side of computer security as we consider how security, or its lack, affects personal privacy. Chapter 11 covers the way society at large addresses computer security, through its laws and ethical systems. Finally, Chapter 12 returns to cryptography, this time to look at the details of the encryption algorithms themselves.

Within that organization, you can move about, picking and choosing topics of particular interest. Everyone should read Chapter 1 to build a vocabulary and a foundation. It is wise to read Chapter 2 because cryptography appears in so many different control techniques. Although there is a general progression from small programs to large and complex networks, you can in fact read Chapters 3 through 7 out of sequence or pick topics of greatest interest. Chapters 8 and 9 may be just right for the professional looking for non-technical controls to complement the technical ones of the earlier chapters. These chapters may also be important for the computer science student who wants to look beyond a narrow view of bytes and protocols. We recommend Chapters 10 and 11 for everyone, because those chapters deal with the human aspects of security: privacy, laws, and ethics. All computing is ultimately done to benefit humans, and so we present personal risks and approaches to computing. Chapter 12 is for people who want to understand some of the underlying mathematics and logic of cryptography.

What background should you have to appreciate this book? The only assumption is an understanding of programming and computer systems. Someone who is an advanced undergraduate or graduate student in computer science certainly has that background, as does a professional designer or developer of computer systems. A user who wants to understand more about how programs work can learn from this book, too; we provide the necessary background on concepts of operating systems or networks, for example, before we address the related security concerns.

This book can be used as a textbook in a one- or two-semester course in computer security. The book functions equally well as a reference for a computer professional or as a supplement to an intensive training course. And the index and extensive bibliography make it useful as a handbook to explain significant topics and point to key articles in the literature. The book has been used in classes throughout the world; instructors often design one-semester courses that focus on topics of particular interest to the students or that relate well to the rest of a curriculum.

What Is New In This Book?

This is the fourth edition of Security in Computing, first published in 1989. Since then, the specific threats, vulnerabilities, and controls have changed, even though many of the basic notions have remained the same.

The two changes most obvious to people familiar with the previous editions are the additions of two new chapters, on the economics of cybersecurity and privacy. These two areas are receiving more attention both in the computer security community and in the rest of the user population.

But this revision touched every existing chapter as well. The threats and vulnerabilities of computing systems have not stood still since the previous edition in 2003, and so we present new information on threats and controls of many types. Change include:

• the shift from individual hackers working for personal reasons to organized attacker groups working for financial gain
• programming flaws leading to security failures, highlighting man-in-the-middle, timing, and privilege escalation errors
• recent malicious code attacks, such as false interfaces and keystroke loggers
• approaches to code quality, including software engineering, testing, and liability approaches
• rootkits, including ones from unexpected sources
• web applications' threats and vulnerabilities
• privacy issues in data mining
• WiFi network security
• cryptanalytic attacks on popular algorithms, such as RSA, DES, and SHA, and recommendations for more secure use of these
• bots, botnets, and drones, making up networks of compromised systems
• update to the Advanced Encryption System (AES) with experience from its first several years of its use
• the divide between sound authentication approaches and users' actions
• biometric authentication capabilities and limitations
• the conflict between efficient production and use of digital content (e.g., music and videos) and control of piracy

In addition to these major changes, there are numerous small corrective and clarifying ones, ranging from wording and notational changes for pedagogic reasons to replacement, deletion, rearrangement, and expansion of sections.

Table of Contents

	Foreword	xix
	Preface to the Third Edition	xxv
Chapter 1	Is There a Security Problem in Computing?	1
1.1	What Does "Secure" Mean?	1
1.2	Attacks	5
1.3	The Meaning of Computer Security	9
1.4	Computer Criminals	19
1.5	Methods of Defense	22
1.6	What's Next	27
1.7	Summary	29
1.8	Terms and Concepts	30
1.9	Where the Field Is Headed	31
1.10	To Learn More	31
1.11	Exercises	32
Chapter 2	Elementary Cryptography	35
2.1	Terminology and Background	36
2.2	Substitution Ciphers	41
2.3	Transpositions (Permutations)	52
2.4	Making "Good" Encryption Algorithms	55
2.5	The Data Encryption Standard (DES)	65
2.6	The AES Encryption Algorithm	69
2.7	Public Key Encryption	73
2.8	The Uses of Encryption	76
2.9	Summary of Encryption	88
2.10	Terms and Concepts	89
2.11	Where the Field Is Headed	90
2.12	To Learn More	90
2.13	Exercises	91
Chapter 3	Program Security	95
3.1	Secure Programs	96
3.2	Nonmalicious Program Errors	100
3.3	Viruses and Other Malicious Code	108
3.4	Targeted Malicious Code	137
3.5	Controls Against Program Threats	150
3.6	Summary of Program Threats and Controls	172
3.7	Terms and Concepts	173
3.8	Where the Field Is Headed	174
3.9	To Learn More	175
3.10	Exercises	176
Chapter 4	Protection in General-Purpose Operating Systems	179
4.1	Protected Objects and Methods of Protection	180
4.2	Memory and Address Protection	183
4.3	Control of Access to General Objects	194
4.4	File Protection Mechanisms	204
4.5	User Authentication	209
4.6	Summary of Security for Users	223
4.7	Terms and Concepts	224
4.8	Where the Field Is Headed	225
4.9	To Learn More	226
4.10	Exercises	226
Chapter 5	Designing Trusted Operating Systems	229
5.1	What Is a Trusted System?	230
5.2	Security Policies	232
5.3	Models of Security	238
5.4	Trusted Operating System Design	250
5.5	Assurance in Trusted Operating Systems	273
5.6	Implementation Examples	297
5.7	Summary of Security in Operating Systems	302
5.8	Terms and Concepts	303
5.9	Where the Field Is Headed	305
5.10	To Learn More	305
5.11	Exercises	305
Chapter 6	Database Security	309
6.1	Introduction to Databases	310
6.2	Security Requirements	314
6.3	Reliability and Integrity	320
6.4	Sensitive Data	326
6.5	Inference	331
6.6	Multilevel Databases	343
6.7	Proposals for Multilevel Security	346
6.8	Summary of Database Security	357
6.9	Terms and Concepts	358
6.10	Where the Field Is Headed	358
6.11	To Learn More	359
6.12	Exercises	359
Chapter 7	Security in Networks	363
7.1	Network Concepts	364
7.2	Threats in Networks	387
7.3	Network Security Controls	425
7.4	Firewalls	457
7.5	Intrusion Detection Systems	468
7.6	Secure E-Mail	473
7.7	Summary of Network Security	479
7.8	Terms and Concepts	481
7.9	Where the Field Is Headed	483
7.10	To Learn More	484
7.11	Exercises	485
Chapter 8	Administering Security	491
8.1	Security Planning	492
8.2	Risk Analysis	506
8.3	Organizational Security Policies	529
8.4	Physical Security	538
8.5	Summary	548
8.6	Terms and Concepts	549
8.7	To Learn More	550
8.8	Exercises	551
Chapter 9	Legal, Privacy, and Ethical Issues in Computer Security	553
9.1	Protecting Programs and Data	555
9.2	Information and the Law	568
9.3	Rights of Employees and Employers	575
9.4	Software Failures	578
9.5	Computer Crime	583
9.6	Privacy	595
9.7	Ethical Issues in Computer Security	605
9.8	Case Studies of Ethics	610
9.9	Terms and Concepts	626
9.10	To Learn More	626
9.11	Exercises	627
Chapter 10	Cryptography Explained	629
10.1	Mathematics for Cryptography	630
10.2	Symmetric Encryption	642
10.3	Public Key Encryption Systems	666
10.4	Quantum Cryptography	683
10.5	Summary of Encryption	686
10.6	Terms and Concepts	687
10.7	Where the Field Is Headed	688
10.8	To Learn More	688
10.9	Exercises	688
	Bibliography	691
	Index	727

Preface

Preface to the Third Edition

Every day, the news media give more and more visibility to the effects of computer security on our daily lives. For example, on a single day in June 2002, the Washington Post included three important articles about security. On the front page, one article described the possibility that a terrorist group was plotting to—and actually could—invade computer systems and destroy huge dams, disable the power grid, or wreak havoc with the air traffic control system. A second article, also on the front page, considered the potential loss of personal privacy as governments and commercial establishments begin to combine and correlate data in computer-maintained databases. Further back, a third article discussed yet another software flaw that could have widespread effect. Thus, computer security is no longer relegated to esoteric discussions of what might happen; it is instead a hot news topic, prominently featured in newspapers, magazines, radio talk shows, and documentary television programs. The audience is no longer just the technical community; it is ordinary people, who feel the effects of pervasive computing.

In just a few years the world's public has learned the terms "virus," "worm," and "Trojan horse" and now appreciates the concepts of "unauthorized access," "sabotage," and "denial of service." During this same time, the number of computer users has increased dramatically; with those new users have come new uses: electronic stock trading, sharing of medical records, and remote control of sensitive equipment, to name just three. It should be no surprise that threats to security in computing have increased along with the users anduses.

Why Read This Book?

Are your data or programs at risk? If you answer "yes" to any of the following questions, you have a potential security risk.

• Do you connect to the Internet?
• Do you read e-mail?
• Have you gotten any new programs—or any new versions of old programs—within, say, the last year?
• Is there any important program or data item of which you do not have a second copy stored somewhere other than on your computer?

Almost every computer user today meets at least one of these conditions, and so you, and almost every other computer user, are at risk of some harmful computer security event. Risk does not mean you should stop using computers. You are at risk of being hit by a falling meteorite or of being robbed by a thief on the street, but you do not hide in a fortified underground bunker all day. You learn what puts you at risk and how to control it. Controlling a risk is not the same as eliminating it; you simply want to bring it to a tolerable level.

How do you control the risk of computer security?

• Learn about the threats to computer security.
• Understand what causes these threats by studying how vulnerabilities arise in the development and use of computer systems.
• Survey the controls that can reduce or block these threats.
• Develop a computing style—as a user, developer, manager, consumer, and voter—that balances security and risk.

Users and Uses of This Book

This book is intended for the study of computer security. Many of you want to study this topic: college and university students, computing professionals, managers, and use computer-based systems. All want to know the same thing: how to control the risk of computer security. But you may differ in how much information you need about particular topics: Some want a broad survey, whereas others want to focus on particular topics, such as networks or program development.

This book should provide the breadth and depth that most readers want. The book is organized by general area of computing, so that readers with particular interests can find information easily. The chapters of this book progress in an orderly manner, from general security concerns to the particular needs of specialized applications, and finally to overarching management and legal issues. Thus, the book covers five key areas of interest:

• Introduction: threats, vulnerabilities, and controls
• Encryption: the "Swiss army knife" of security controls
• Code: security in programs, including applications, operating systems, database management systems, and networks
• Management: implementing and maintaining a computing style
• Law, privacy, ethics: nontechnical approaches by which society controls computer security risks

These areas are not equal in size; for example, more than half the book is devoted to code because so much of the risk is at least partly caused by program code that executes on computers.

The first chapter introduces the concepts and basic vocabulary of computer security. The second chapter provides an understanding of what encryption is and how it can be used or misused. Just as a driver's manual does not address how to design or build a car, Chapter 2 is for users of encryption, not designers of new encryp through 7 cover successively larger pieces of software: individual programs, operating systems, complex applications like database management systems, and finally networks, which are distributed complex systems. Chapter 8 discusses managing and administering security, and finding an acceptable balance between threats and controls. Chapter 9 covers the way society at large addresses computer security, through its laws and ethical systems and through its concern for privacy. Finally, Chapter 10 returns to cryptography, this time to look at the details of the encryption algorithms themselves.

Within that organization, you can move about, picking and choosing topics of particular interest. Everyone should read Chapter 1 to build a vocabulary and a foundation. It is wise to read Chapter 2 because cryptography appears in so many different control techniques. Although there is a general progression from small programs to large and complex networks, you can in fact read Chapters 3 through 7 out of sequence or pick topics of greatest interest. Chapters 8 and 9 may be just right for the professional looking for nontechnical controls to complement the technical ones of the earlier chapters. These chapters may also be important for the computer science student who wants to look beyond a narrow view of bytes and protocols. Chapter 10 is for people who want to understand some of the underlying mathematics and logic of cryptography.

What background should you have to appreciate this book? The only assumption is an understanding of programming and computer systems. Someone who is an advanced undergraduate or graduate student in computer science certainly has that background, as does a professional designer or developer of computer systems. A user who wants to understand more about how programs work can learn from this book, too; we provide the necessary background on concepts of operating systems or networks, for example, before we address the related security concerns.

This book can be used as a textbook in a one- or two-semester course in computer security. The book functions equally well as a reference for a computer professional or as a supplement to an intensive training course. And the index and extensive bibliography make it useful as a handbook to explain significant topics and point to key articles in the literature. The book has been used in classes throughout the world; instructors often design one-semester courses that focus on topics of particular interest to students or that relate well to the rest of a curriculum.

What Is New in This Book?This is the third edition of Security in Computing, first published in 1989. Since then, the specific threats, vulnerabilities, and controls have changed, even though many of the basic notions have remained the same.The two changes most obvious to people familiar with the previous editions are networks and encryption. Networking has evolved even since the second edition was published, and there are many new concepts to master, such as distributed denial-of-service attacks or scripted vulnerability probing. As a consequence, the networks chapter is almost entirely new. Previous editions of this book presented encryption details in the same chapter as encryption uses. Although encryption is a fundamental tool in computer security, in this edition the what is presented straightforwardly in Chapter 2, while the how is reserved for the later Chapter 10. This structure lets readers get to the technical uses of encryption in programs and networks more quickly.There are numerous other additions, of which these are the most significant ones:

• the Advanced Encryption System (AES), the replacement for the Data Encryption System (DES) from the 1970s
• programming flaws leading to security failures, highlighting buffer overflows, incomplete mediation, and time-of-check to time-of-use errors
• recent malicious code attacks, such as Code Red
• software engineering practices to improve program quality
• assurance of code quality
• authentication techniques such as biometrics and password generators
• privacy issues in database management system security
• mobile code, agents, and assurance of them
• denial-of-service and distributed denial-of-service attacks
• flaws in network protocols
• security issues in wireless computing
• honeypots and intrusion detection
• copyright controls for digital media
• threats to and controls for personal privacy
• software quality, vulnerability reporting, and vendors' responsibilities
• the ethics of hacking

In addition to these major changes, there are numerous small corrective and clarifying ones, ranging from wording changes to subtle notational changes for pedagogic reasons to replacement, deletion, rearrangement, and expansion of sections.

Editorial Reviews

Covers all aspects of security in computing, including viruses, worms, Trojan horses, and other forms of malicious code; firewalls and the protection of networked systems; e-mail privacy, including PEM, PGP, key management, and certificates; key escrow--both as a technology and in the "Clipper" program; evaluation of trusted systems, including the Common Criteria, the ITSEC, and the OrangeBook; standards for program development and quality, including ISO9000; secure installations of PCs, UNIX, and networked environments; and ethical and legal issues in computing. Annotation c. Book News, Inc., Portland, OR (booknews.com)

Booknews