Applied Information Security: A Hands-on Approach

by David Basin, Patrick Schaller, Michael Schlïpfer

Overview

This book explores fundamental principles for securing IT systems and illustrates them with hands-on experiments that may be carried out by the reader using accompanying software. The experiments highlight key information security problems that arise in modern operating systems, networks, and web applications. The authors explain how to identify and exploit such problems and they show different countermeasures and their implementation. The reader thus gains a detailed understanding of how vulnerabilities arise and practical experience tackling them.

After presenting the basics of security principles, virtual environments, and network services, the authors explain the core security principles of authentication and access control, logging and log analysis, web application security, certificates and public-key cryptography, and risk management. The book concludes with appendices on the design of related courses, report templates, and the basics of Linux as needed for the assignments.

The authors have successfully taught IT security to students and professionals using the content of this book and the laboratory setting it describes. The book can be used in undergraduate or graduate laboratory courses, complementing more theoretically oriented courses, and it can also be used for self-study by IT professionals who want hands-on experience in applied information security. The authors' supporting software is freely available online and the text is supported throughout with exercises.

Product Details

ISBN-13:	9783642244735
Publisher:	Springer Berlin Heidelberg
Publication date:	10/27/2011
Edition description:	2011
Pages:	202
Product dimensions:	6.40(w) x 9.30(h) x 0.80(d)

About the Author

Prof. Dr. David Basin is the Chair of Information Security at ETH Zürich; his research focuses on information security, in particular methods and tools for modeling, building, and validating secure and reliable systems. Dr. Patrick Schaller is a lecturer at ETH Zürich, his research is concerned with the formalization and analysis of security prools. Michael Schläpfer is a graduate student of ETH Zürich.

Table of Contents

Chap. 1, Security Principles.- Chap. 2, The Virtual Environment.- Chap. 3, Network Services.- Chap. 4, Authentication and Access Control.- Chap. 5, Logging and Log Analysis.- Chap. 6, Web Application Security.- Chap. 7, Certificates and Public-Key Cryptography.- Chap. 8, Risk Management.- App. A, Using This Book in a Lab Course.- App. B, Report Template.- App. C, Linux Basics and Tools.- App. D, Answers to Questions.- References.- Index.

Editorial Reviews

"This book is a good way for newcomers to the security field, or those who want an overview of a goodly sampling of security issues, to start understanding both the issues and possible defenses. It is very much a workbook, with numerous in-line problems to work on and a nice set of questions and exercises for each chapter; answers appear in an appendix. Many of the exercises involve using specific software to look at events as they occur. ... It is very readable and well organized, and the questions and exercises are generally very good. It is an excellent introduction to the subject and would make a good upper-level undergraduate text. It would also be quite useful as a self-study text for someone new to the field." (Jeffrey Putnam, ACM Computing Reviews, August 2012)

"My students and I are big fans of this book. I have been using it regularly, since its publication, in the course "Network Security" that I teach in the Master of Science Program "Engineering and Computer Science" at the University of Verona, Italy. The course is structured in a number of theory lectures, covering the main aspects of network security, accompanied by a lab in which I have adopted [this] book. [It] delivers successfully and elegantly what it promises: it complements in an interesting and unique way the theory lectures. It allows students to carry out exercises and experiments on the topics that have been discussed in the lectures and, thanks to the accompanying software, they can choose to do this in the university lab or at home (or both). The assignment project proposed at the end of the book challenges the students in a very proficient way and, indeed, the ratings of the course by students have risen considerably since I adopted the book."   (Luca Viganò, Università di Verona, Italy)

"[F]or those looking for an intense but brief and concentrated introduction to some of the fundamentals of information security, to supplement other more comprehensivereferences, [this] is an excellent book." (Ben Rothke)

From the Publisher