Computer Security: Art and Science / Edition 2 available in Hardcover, eBook
- ISBN-10:
- 0321712331
- ISBN-13:
- 9780321712332
- Pub. Date:
- 11/26/2018
- Publisher:
- Pearson Education
- ISBN-10:
- 0321712331
- ISBN-13:
- 9780321712332
- Pub. Date:
- 11/26/2018
- Publisher:
- Pearson Education
Buy New
$119.99Buy Used
$93.31-
-
SHIP THIS ITEM
Temporarily Out of Stock Online
Please check back later for updated availability.
-
Overview
In this updated guide, University of California at Davis Computer Security Laboratory co-director Matt Bishop offers clear, rigorous, and thorough coverage of modern computer security. Reflecting dramatic growth in the quantity, complexity, and consequences of security incidents, Computer Security, Second Edition, links core principles with technologies, methodologies, and ideas that have emerged since the first edition’s publication.
Writing for advanced undergraduates, graduate students, and IT professionals, Bishop covers foundational issues, policies, cryptography, systems design, assurance, and much more. He thoroughly addresses malware, vulnerability analysis, auditing, intrusion detection, and best-practice responses to attacks. In addition to new examples throughout, Bishop presents entirely new chapters on availability policy models and attack analysis.
- Understand computer security goals, problems, and challenges, and the deep links between theory and practice
- Learn how computer scientists seek to prove whether systems are secure
- Define security policies for confidentiality, integrity, availability, and more
- Analyze policies to reflect core questions of trust, and use them to constrain operations and change
- Implement cryptography as one component of a wider computer and network security strategy
- Use system-oriented techniques to establish effective security mechanisms, defining who can act and what they can do
- Set appropriate security goals for a system or product, and ascertain how well it meets them
- Recognize program flaws and malicious logic, and detect attackers seeking to exploit them
This is both a comprehensive text, explaining the most fundamental and pervasive aspects of the field, and a detailed reference. It will help you align security concepts with realistic policies, successfully implement your policies, and thoughtfully manage the trade-offs that inevitably arise.
Register your book for convenient access to downloads, updates, and/or corrections as they become available. See inside book for details.
Product Details
| ISBN-13: | 9780321712332 |
|---|---|
| Publisher: | Pearson Education |
| Publication date: | 11/26/2018 |
| Edition description: | New Edition |
| Pages: | 1440 |
| Product dimensions: | 7.40(w) x 9.30(h) x 2.00(d) |
About the Author
Table of Contents
Preface xxixAcknowledgments xlv
About the Author xlix
Part I: Introduction 1
Chapter 1: An Overview of Computer Security 3
1.1 The Basic Components 3
1.2 Threats 6
1.3 Policy and Mechanism 9
1.4 Assumptions and Trust 11
1.5 Assurance 12
1.6 Operational Issues 16
1.7 Human Issues 20
1.8 Tying It All Together 22
1.9 Summary 24
1.10 Research Issues 24
1.11 Further Reading 25
1.12 Exercises 25
Part II: Foundations 29
Chapter 2: Access Control Matrix 31
2.1 Protection State 31
2.2 Access Control Matrix Model 32
2.3 Protection State Transitions 37
2.4 Copying, Owning, and the Attenuation of Privilege 42
2.5 Summary 44
2.6 Research Issues 44
2.7 Further Reading 44
2.8 Exercises 45
Chapter 3: Foundational Results 49
3.1 The General Question 49
3.2 Basic Results 51
3.3 The Take-Grant Protection Model 56
3.4 Closing the Gap: The Schematic Protection Model 68
3.5 Expressive Power and the Models 81
3.6 Comparing Security Properties of Models 94
3.7 Summary 101
3.8 Research Issues 102
3.9 Further Reading 102
3.10 Exercises 103
Part III: Policy 107
Chapter 4: Security Policies 109
4.1 The Nature of Security Policies 109
4.2 Types of Security Policies 113
4.3 The Role of Trust 115
4.4 Types of Access Control 117
4.5 Policy Languages 118
4.6 Example: Academic Computer Security Policy 126
4.7 Security and Precision 131
4.8 Summary 136
4.9 Research Issues 136
4.10 Further Reading 137
4.11 Exercises 138
Chapter 5: Confidentiality Policies 141
5.1 Goals of Confidentiality Policies 141
5.2 The Bell-LaPadula Model 142
5.3 Tranquility 161
5.4 The Controversy over the Bell-LaPadula Model 164
5.5 Summary 169
5.6 Research Issues 169
5.7 Further Reading 170
5.8 Exercises 171
Chapter 6: Integrity Policies 173
6.1 Goals 173
6.2 The Biba Model 175
6.3 Lipner’s Integrity Matrix Model 178
6.4 Clark-Wilson Integrity Model 183
6.5 Trust Models 189
6.6 Summary 196
6.7 Research Issues 196
6.8 Further Reading 197
6.9 Exercises 198
Chapter 7: Availability Policies 201
7.1 Goals of Availability Policies 201
7.2 Deadlock 202
7.3 Denial of Service Models 203
7.4 Example: Availability and Network Flooding 215
7.5 Summary 222
7.6 Research Issues 222
7.7 Further Reading 223
7.8 Exercises 224
Chapter 8: Hybrid Policies 227
8.1 Chinese Wall Model 227
8.2 Clinical Information Systems Security Policy 236
8.3 Originator Controlled Access Control 239
8.4 Role-Based Access Control 244
8.5 Break-the-Glass Policies 249
8.6 Summary 250
8.7 Research Issues 250
8.8 Further Reading 251
8.9 Exercises 252
Chapter 9: Noninterference and Policy Composition 255
9.1 The Problem 255
9.2 Deterministic Noninterference 259
9.3 Nondeducibility 271
9.4 Generalized Noninterference 274
9.5 Restrictiveness 277
9.6 Side Channels and Deducibility 280
9.7 Summary 282
9.8 Research Issues 283
9.9 Further Reading 283
9.10 Exercises 285
Part IV: Implementation I: Cryptography 287
Chapter 10: Basic Cryptography 289
10.1 Cryptography 289
10.2 Symmetric Cryptosystems 291
10.3 Public Key Cryptography 306
10.4 Cryptographic Checksums 315
10.5 Digital Signatures 318
10.6 Summary 323
10.7 Research Issues 324
10.8 Further Reading 325
10.9 Exercises 326
Chapter 11: Key Management 331
11.1 Session and Interchange Keys 332
11.2 Key Exchange 332
11.3 Key Generation 341
11.4 Cryptographic Key Infrastructures 343
11.5 Storing and Revoking Keys 353
11.6 Summary 359
11.7 Research Issues 360
11.8 Further Reading 361
11.9 Exercises 362
Chapter 12: Cipher Techniques 367
12.1 Problems 367
12.2 Stream and Block Ciphers 370
12.3 Authenticated Encryption 377
12.4 Networks and Cryptography 381
12.5 Example Protocols 384
12.6 Summary 410
12.7 Research Issues 411
12.8 Further Reading 411
12.9 Exercises 413
Chapter 13: Authentication 415
13.1 Authentication Basics 415
13.2 Passwords 416
13.3 Password Selection 418
13.4 Attacking Passwords 426
13.5 Password Aging 434
13.6 Challenge-Response 438
13.7 Biometrics 441
13.8 Location 445
13.9 Multifactor Authentication 446
13.10 Summary 448
13.11 Research Issues 449
13.12 Further Reading 450
13.13 Exercises 451
Part V: Implementation II: Systems 453
Chapter 14: Design Principles 455
14.1 Underlying Ideas 455
14.2 Principles of Secure Design 457
14.3 Summary 466
14.4 Research Issues 466
14.5 Further Reading 467
14.6 Exercises 468
Chapter 15: Representing Identity 471
15.1 What Is Identity? 471
15.2 Files and Objects 472
15.3 Users 473
15.4 Groups and Roles 475
15.5 Naming and Certificates 476
15.6 Identity on the Web 484
15.7 Anonymity on the Web 490
15.8 Summary 501
15.9 Research Issues 502
15.10 Further Reading 503
15.11 Exercises 504
Chapter 16: Access Control Mechanisms 507
16.1 Access Control Lists 507
16.2 Capabilities 518
16.3 Locks and Keys 526
16.4 Ring-Based Access Control 531
16.5 Propagated Access Control Lists 533
16.6 Summary 535
16.7 Research Issues 535
16.8 Further Reading 536
16.9 Exercises 536
Chapter 17: Information Flow 539
17.1 Basics and Background 539
17.2 Nonlattice Information Flow Policies 542
17.3 Static Mechanisms 548
17.4 Dynamic Mechanisms 562
17.5 Integrity Mechanisms 566
17.6 Example Information Flow Controls 567
17.7 Summary 574
17.8 Research Issues 574
17.9 Further Reading 575
17.10 Exercises 576
Chapter 18: Confinement Problem 579
18.1 The Confinement Problem 579
18.2 Isolation 582
18.3 Covert Channels 594
18.4 Summary 619
18.5 Research Issues 620
18.6 Further Reading 620
18.7 Exercises 622
Part VI: Assurance 625
Contributed by Elisabeth Sullivan and Michelle Ruppel
Chapter 19: Introduction to Assurance 627
19.1 Assurance and Trust 627
19.2 Building Secure and Trusted Systems 634
19.3 Summary 645
19.4 Research Issues 645
19.5 Further Reading 646
19.6 Exercises 647
Chapter 20: Building Systems with Assurance 649
20.1 Assurance in Requirements Definition and Analysis 649
20.2 Assurance during System and Software Design 662
20.3 Assurance in Implementation and Integration 685
20.4 Assurance during Operation and Maintenance 695
20.5 Summary 696
20.6 Research Issues 696
20.7 Further Reading 697
20.8 Exercises 698
Chapter 21: Formal Methods 699
21.1 Formal Verification Techniques 699
21.2 Formal Specification 702
21.3 Early Formal Verification Techniques 705
21.4 Current Verification Systems 713
21.5 Functional Programming Languages 721
21.6 Formally Verified Products 722
21.7 Summary 723
21.8 Research Issues 724
21.9 Further Reading 725
21.10 Exercises 725
Chapter 22: Evaluating Systems 727
22.1 Goals of Formal Evaluation 727
22.2 TCSEC: 1983-1999 730
22.3 International Efforts and the ITSEC: 1991-2001 737
22.4 Commercial International Security Requirements: 1991 742
22.5 Other Commercial Efforts: Early 1990s 744
22.6 The Federal Criteria: 1992 744
22.7 FIPS 140: 1994-Present 746
22.8 The Common Criteria: 1998-Present 749
22.9 SSE-CMM: 1997-Present 765
22.10 Summary 768
22.11 Research Issues 769
22.12 Further Reading 769
22.13 Exercises 770
Part VII: Special Topics 773
Chapter 23: Malware 775
23.1 Introduction 775
23.2 Trojan Horses 776
23.3 Computer Viruses 780
23.4 Computer Worms 790
23.5 Bots and Botnets 793
23.6 Other Malware 796
23.7 Combinations 803
23.8 Theory of Computer Viruses 803
23.9 Defenses 808
23.10 Summary 820
23.11 Research Issues 820
23.12 Further Reading 821
23.13 Exercises 822
Chapter 24: Vulnerability Analysis 825
24.1 Introduction 825
24.2 Penetration Studies 827
24.3 Vulnerability Classification 845
24.4 Frameworks 849
24.5 Standards 864
24.6 Gupta and Gligor’s Theory of Penetration Analysis 868
24.7 Summary 873
24.8 Research Issues 874
24.9 Further Reading 875
24.10 Exercises 876
Chapter 25: Auditing 879
25.1 Definition 879
25.2 Anatomy of an Auditing System 880
25.3 Designing an Auditing System 884
25.4 A Posteriori Design 893
25.5 Auditing Mechanisms 897
25.6 Examples: Auditing File Systems 900
25.7 Summary 910
25.8 Research Issues 911
25.9 Further Reading 912
25.10 Exercises 913
Chapter 26: Intrusion Detection 917
26.1 Principles 917
26.2 Basic Intrusion Detection 918
26.3 Models 920
26.4 Architecture 942
26.5 Organization of Intrusion Detection Systems 948
26.6 Summary 954
26.7 Research Issues 954
26.8 Further Reading 955
26.9 Exercises 956
Chapter 27: Attacks and Responses 959
27.1 Attacks 959
27.2 Representing Attacks 960
27.3 Intrusion Response 971
27.4 Digital Forensics 987
27.5 Summary 996
27.6 Research Issues 997
27.7 Further Reading 998
27.8 Exercises 999
Part VIII: Practicum 1003
Chapter 28: Network Security 1005
28.1 Introduction 1005
28.2 Policy Development 1006
28.3 Network Organization 1011
28.4 Availability 1026
28.5 Anticipating Attacks 1027
28.6 Summary 1028
28.7 Research Issues 1028
28.8 Further Reading 1029
28.9 Exercises 1030
Chapter 29: System Security 1035
29.1 Introduction 1035
29.2 Policy 1036
29.3 Networks 1042
29.4 Users 1048
29.5 Authentication 1053
29.6 Processes 1055
29.7 Files 1061
29.8 Retrospective 1066
29.9 Summary 1068
29.10 Research Issues 1068
29.11 Further Reading 1069
29.12 Exercises 1070
Chapter 30: User Security 1073
30.1 Policy 1073
30.2 Access 1074
30.3 Files and Devices 1080
30.4 Processes 1087
30.5 Electronic Communications 1092
30.6 Summary 1094
30.7 Research Issues 1095
30.8 Further Reading 1095
30.9 Exercises 1096
Chapter 31: Program Security 1099
31.1 Problem 1099
31.2 Requirements and Policy 1100
31.3 Design 1104
31.4 Refinement and Implementation 1111
31.5 Common Security-Related Programming Problems 1117
31.6 Testing, Maintenance, and Operation 1141
31.7 Distribution 1146
31.8 Summary 1147
31.9 Research Issues 1147
31.10 Further Reading 1148
31.11 Exercises 1148
Part IX: Appendices 1151
Appendix A: Lattices 1153
A.1 Basics 1153
A.2 Lattices 1154
A.3 Exercises 1155
Appendix B: The Extended Euclidean Algorithm 1157
B.1 The Euclidean Algorithm 1157
B.2 The Extended Euclidean Algorithm 1158
B.3 Solving ax mod n = 1 1160
B.4 Solving ax mod n = b 1161
B.5 Exercises 1161
Appendix C: Entropy and Uncertainty 1163
C.1 Conditional and Joint Probability 1163
C.2 Entropy and Uncertainty 1165
C.3 Joint and Conditional Entropy 1166
C.4 Exercises 1169
Appendix D: Virtual Machines 1171
D.1 Virtual Machine Structure 1171
D.2 Virtual Machine Monitor 1171
D.3 Exercises 1176
Appendix E: Symbolic Logic 1179
E.1 Propositional Logic 1179
E.2 Predicate Logic 1184
E.3 Temporal Logic Systems 1186
E.4 Exercises 1188
Appendix F: The Encryption Standards 1191
F.1 Data Encryption Standard 1191
F.2 Advanced Encryption Standard 1196
F.3 Exercises 1205
Appendix G: Example Academic Security Policy 1207
G.1 Acceptable Use Policy 1207
G.2 University of California Electronic Communications Policy 1212
G.3 User Advisories 1234
G.4 Electronic Communications—Allowable Use 1241
Appendix H: Programming Rules 1247
H.1 Implementation Rules 1247
H.2 Management Rules 1249
References 1251
Index 1341
Preface
To learn the order of my fingering,
I must begin with rudiments of art
To teach you gamouth in a briefer sort,
More pleasant, pithy and effectual,
Than hath been taught by any of my trade;
And there it is in writing, fairly drawn.
— The Taming of the Shrew, III, i, 62-68
On September 11, 2001, terrorists seized control of four airplanes. Three were flown into buildings, and a fourth crashed, with catastrophic loss of life. In the aftermath, the security and reliability of many aspects of society drew renewed scrutiny. One of these aspects was the widespread use of computers and their interconnecting networks.
The issue is not new. In 1988, approximately 5,000 computers throughout the Internet were rendered unusable within 4 hours by a program called a worm. While the spread, and the effects, of this program alarmed computer scientists, most people were not worried because the worm did not affect their lives or their ability to do their jobs. In 1993, more users of computer systems were alerted to such dangers when a set of programs called sniffers were placed on many computers run by network service providers and recorded login names and passwords.
After an attack on Tsutomu Shimomura's computer system, and the fascinating way Shimomura followed the attacker's trail, which led to his arrest, the public's interest and apprehension were finally aroused. Computers were now vulnerable. Their once reassuring protections were now viewed as flimsy.
Several films explored these concerns. Movies such as War Games and Hackers provided images of people who can, at will,wander throughout computers and networks, maliciously or frivolously corrupting or destroying information it may have taken millions of dollars to amass. (Reality intruded on Hackers when the World Wide Web page set up by MGM/United Artists was quickly altered to present an irreverent commentary on the movie and to suggest that viewers see The Net instead. Paramount Pictures denied doing this.) Another film, Sneakers, presented a picture of those who test the security of computer (and other) systems for their owners and for the government.
Goals
This book has three goals. The first is to show the importance of theory to practice and of practice to theory. All too often, practitioners regard theory as irrelevant and theoreticians think of practice as trivial. In reality, theory and practice are symbiotic. For example, the theory of covert channels, in which the goal is to limit the ability of processes to communicate through shared resources, provides a mechanism for evaluating the effectiveness of mechanisms that confine processes, such as sandboxes and firewalls. Similarly, business practices in the commercial world led to the development of several security policy models such as the Clark-Wilson model and the Chinese Wall model. These models in turn help the designers of security policies better understand and evaluate the mechanisms and procedures needed to secure their sites.
The second goal is to emphasize that computer security and cryptography are different. Although cryptography is an essential component of computer security, it is by no means the only component. Cryptography provides a mechanism for performing specific functions, such as preventing unauthorized people from reading and altering messages on a network. However, unless developers understand the context in which they are using cryptography, and unless the assumptions underlying the protocol and the cryptographic mechanisms apply to the context, the cryptography may not add to the security of the system. The canonical example is the use of cryptography to secure communications between two low-security systems. If only trusted users can access the two systems, cryptography protects messages in transit. But if untrusted users can access either system (through authorized accounts or, more likely, by breaking in), the cryptography is not sufficient to protect the messages. The attack-ers can read the messages at either endpoint.
The third goal is to demonstrate that computer security is not just a science but also an art. It is an art because no system can be considered secure without an examination of how it is to be used. The definition of a "secure computer" necessitates a statement of requirements and an expression of those requirements in the form of authorized actions and authorized users. (A computer engaged in work at a university may be considered "secure" for the purposes of the work done at the university. When moved to a military installation, that same system may not provide sufficient control to be deemed "secure" for the purposes of the work done at that installation.) How will people, as well as other computers, interact with the computer system? How clear and restrictive an interface can a designer create without rendering the system unusable while trying to prevent unauthorized use or access to the data or resources on the system?
Just as an artist paints his view of the world onto canvas, so does a designer of security features articulate his view of the world of human/machine interaction in the security policy and mechanisms of the system. Two designers may use entirely different designs to achieve the same creation, just as two artists may use different subjects to achieve the same concept.
Computer security is also a science. Its theory is based on mathematical constructions, analyses, and proofs. Its systems are built in accordance with the accepted practices of engineering. It uses inductive and deductive reasoning to examine the security of systems from key axioms and to discover underlying principles. These scientific principles can then be applied to untraditional situations and new theories, policies, and mechanisms.
Philosophy
Key to understanding the problems that exist in computer security is a recognition that the problems are not new. They are old problems, dating from the beginning of computer security (and, in fact, arising from parallel problems in the noncomputer world). But the locus has changed as the field of computing has changed. Before the mid-1980s, mainframe and mid-level computers dominated the market, and computer security problems and solutions were phrased in terms of securing files or processes on a single system. With the rise of networking and the Internet, the arena has changed. Workstations and servers, and the networking infrastructure that connects them, now dominate the market. Computer security problems and solutions now focus on a networked environment. However, if the workstations and servers, and the supporting network infrastructure, are viewed as a single system, the models, theories, and problem statements developed for systems before the mid-1980s apply equally well to current systems.
As an example, consider the issue of assurance. In the early period, assurance arose in several ways: formal methods and proofs of correctness, validation of policy to requirements, and acquisition of data and programs from trusted sources, to name a few. Those providing assurance analyzed a single system, the code on it, and the sources (vendors and users) from which the code could be acquired to ensure that either the sources could be trusted or the programs could be confined adequately to do minimal damage. In the later period, the same basic principles and techniques apply, except that the scope of some has been greatly expanded (from a single system and a small set of vendors to the worldwide Internet). The work on proof-carrying code, an exciting development in which the proof that a downloadable program module satisfies a stated policy is incorporated into the program itself, is an example of this expansion. It extends the notion of a proof of consistency with a stated policy. It advances the technology of the earlier period into the later period. But in order to understand it properly, one must understand the ideas underlying the concept of proof-carrying code, and these ideas lie in the earlier period.
As another example, consider Saltzer and Schroeder's principles of secure design. Enunciated in 1975, they promote simplicity, confinement, and understanding. When security mechanisms grow too complex, attackers can evade or bypass them. Many programmers and vendors are learning this when attackers break into their systems and servers. The argument that the principles are old, and somehow outdated, rings hollow when the result of their violation is a nonsecure system.
The work from the earlier period is sometimes cast in terms of systems that no longer exist and that differ in many ways from modern systems. This does not vitiate the ideas and concepts, which also underlie the work done today. Once these ideas and concepts are properly understood, applying them in a multiplicity of environ-ments becomes possible. Furthermore, the current mechanisms and technologies will become obsolete and of historical interest themselves as new forms of computing arise, but the underlying principles will live on, to underlie the next generation—indeed the next era—of computing.
The philosophy of this book is that certain key concepts underlie all of computer security, and that the study of all parts of computer security enriches the understanding of all parts. Moreover, critical to an understanding of the applications of security-related technologies and methodologies is an understanding of the theory underlying those applications.
Advances in the theory of computer protection have illuminated the foundations of security systems. Issues of abstract modeling, and modeling to meet specific environments, lead to systems designed to achieve a specific and rewarding goal. Theorems about composability of policies and the undecidability of the general security question have indicated the limits of what can be done. Much work and effort are continuing to extend the borders of those limits.
Application of these results has improved the quality of the security of the systems being protected. However, the issue is how compatibly the assumptions of the model (and theory) conform to the environment to which the theory is applied. Although our knowledge of how to apply these abstractions is continually increasing, we still have difficulty correctly transposing the relevant information from a realistic setting to one in which analyses can then proceed. Such abstraction often eliminates vital information. The omitted data may pertain to security in nonobvious ways. Without this information, the analysis is flawed.
The practitioner needs to know both the theoretical and practical aspects of the art and science of computer security. The theory demonstrates what is possible. The practical makes known what is feasible. The theoretician needs to understand the constraints under which these theories are used, how their results are translated into practical tools and methods, and how realistic are the assumptions underlying the theories. Computer Security: Art and Science tries to meet these needs.
Unfortunately, no single work can cover all aspects of computer security, so this book focuses on those parts that are, in the author's opinion, most fundamental and most pervasive. The mechanisms exemplify the applications of these principles.
Organization
The organization of this book reflects its philosophy. It begins with mathematical fundamentals and principles that provide boundaries within which security can be modeled and analyzed effectively. The mathematics provides a framework for expressing and analyzing the requirements of the security of a system. These policies constrain what is allowed and what is not allowed. Mechanisms provide the ability to implement these policies. The degree to which the mechanisms correctly implement the policies, and indeed the degree to which the policies themselves meet the requirements of the organizations using the system, are questions of assurance. Exploiting failures in policy, in implementation, and in assurance comes next, as well as mechanisms for providing information on the attack. The book concludes with the applications of both theory and policy focused on realistic situations. This natural progression emphasizes the development and application of the principles existent in computer security.
Part 1, "Introduction," describes what computer security is all about and explores the problems and challenges to be faced. It sets the context for the remainder of the book.
Part 2, "Foundations," deals with basic questions such as how "security" can be clearly and functionally defined, whether or not it is realistic, and whether or not it is decidable. If it is decidable, under what conditions is it decidable, and if not, how must the definition be bounded in order to make it decidable?
Part 3, "Policy," probes the relationship between policy and security. The definition of "security" depends on policy. In Part 3 we examine several types of policies, including the ever-present fundamental questions of trust, analysis of policies, and the use of policies to constrain operations and transitions.
Part 4, "Implementation I: Cryptography," discusses cryptography and its role in security. It focuses on applications and discusses issues such as key management and escrow, key distribution, and how cryptosystems are used in networks. A quick study of authentication completes Part 4.
Part 5, "Implementation II: Systems," considers how to implement the requirements imposed by policies using system-oriented techniques. Certain design principles are fundamental to effective security mechanisms. Policies define who can act and how they can act, and so identity is a critical aspect of implementation. Mechanisms implementing access control and flow control enforce various aspects of policies.
Part 6, "Assurance," presents methodologies and technologies for ascertaining how well a system, or a product, meets its goals. After setting the background, to explain exactly what "assurance" is, the art of building systems to meet varying levels of assurance is discussed. Formal verification methods play a role. Part 6 shows how the progression of standards has enhanced our understanding of assurance techniques.
Part 7, "Special Topics," discusses some miscellaneous aspects of computer security. Malicious logic thwarts many mechanisms. Despite our best efforts at high assurance, systems today are replete with vulnerabilities. Why? How can a system be analyzed to detect vulnerabilities? What models might help us improve the state of the art? Given these security holes, how can we detect attackers who exploit them? A discussion of auditing flows naturally into a discussion of intrusion detection—a detection method for such attacks.
Part 8, "Practicum," presents examples of how to apply the principles discussed throughout the book. It begins with networks and proceeds to systems, users, and programs. Each chapter states a desired policy and shows how to translate that policy into a set of mechanisms and procedures that support the policy. Part 8 tries to demonstrate that the material covered elsewhere can be, and should be, used in practice.
Each chapter in this book ends with a summary, descriptions of some research issues, and some suggestions for further reading. The summary highlights the important ideas in the chapter. The research issues are current "hot topics" or are topics that may prove to be fertile ground for advancing the state of the art and science of computer security. Interested readers who wish to pursue the topics in any chapter in more depth can go to some of the suggested readings. They expand on the material in the chapter or present other interesting avenues.
Roadmap
This book is both a reference book and a textbook. Its audience is undergraduate and graduate students as well as practitioners. This section offers some suggestions on approaching the book.
Dependencies
Chapter 1 is fundamental to the rest of the book and should be read first. After that, however, the reader need not follow the chapters in order. Some of the dependencies among chapters are as follows.
Chapter 3 depends on Chapter 2 and requires a fair degree of mathematical maturity. Chapter 2, on the other hand, does not. The material in Chapter 3 is for the most part not used elsewhere (although the existence of the first section's key result, the undecidability theorem, is mentioned repeatedly). It can be safely skipped if the interests of the reader lie elsewhere.
The chapters in Part 3 build on one another. The formalisms in Chapter 5 are called on in Chapters 19 and 20, but nowhere else. Unless the reader intends to delve into the sections on theorem proving and formal mappings, the formalisms may be skipped. The material in Chapter 8 requires a degree of mathematical maturity, and this material is used sparingly elsewhere. Like Chapter 3, Chapter 8 can be skipped by the reader whose interests lie elsewhere.
Chapters 9, 10, and 11 also build on one another in order. A reader who has encountered basic cryptography will have an easier time with the material than one who has not, but the chapters do not demand the level of mathematical experience that Chapters 3 and 8 require. Chapter 12 does not require material from Chapter 10 or Chapter 11, but it does require material from Chapter 9.
Chapter 13 is required for all of Part 5. A reader who has studied operating systems at the undergraduate level will have no trouble with Chapter 15. Chapter 14 uses the material in Chapter 11; Chapter 16 builds on material in Chapters 5, 13, and 15; and Chapter 17 uses material in Chapters 4, 13, and 16.Chapter 18 relies on information in Chapter 4. Chapter 19 builds on Chapters 5, 13, 15, and 18. Chapter 20 presents highly mathematical concepts and uses material from Chapters 18 and 19. Chapter 21 is based on material in Chapters 5, 18, and 19; it does not require Chapter 20. For all of Part 5, a knowledge of software engineering is very helpful.
Chapter 22 draws on ideas and information in Chapters 5, 6, 9, 13, 15, and 17 (and for Section 22.6, the reader should read Section 3.1). Chapter 23 is self-contained, although it implicitly uses many ideas from assurance. It also assumes a good working knowledge of compilers, operating systems, and in some cases networks. Many of the flaws are drawn from versions of the UNIX operating system, or from Windows systems, and so a working knowledge of either or both systems will make some of the material easier to understand. Chapter 24 uses information from Chapter 4, and Chapter 25 uses material from Chapter 24.
The practicum chapters are self-contained and do not require any material beyond Chapter 1. However, they point out relevant material in other sections that augments the information and (we hope) the reader's understanding of that information.
Background
The material in this book is at the advanced undergraduate level. Throughout, we assume that the reader is familiar with the basics of compilers and computer architecture (such as the use of the program stack) and operating systems. The reader should also be comfortable with modular arithmetic (for the material on cryptography). Some material, such as that on formal methods (Chapter 20) and the mathematical theory of computer security (Chapter 3 and the formal presentation of policy models), requires considerable mathematical maturity. Other specific recommended background is presented in the preceding section. Part 9, "End Matter," contains material that will be helpful to readers with backgrounds that lack some of the recommended material.
Examples are drawn from many systems. Many come from the UNIX operating system or variations of it (such as Linux). Others come from the Windows family of systems. Familiarity with these systems will help the reader understand many examples easily and quickly.
Undergraduate Level
An undergraduate class typically focuses on applications of theory and how students can use the material. The specific arrangement and selection of material depends on the focus of the class, but all classes should cover some basic material—notably that in Chapters 1, 9, and 13, as well as the notion of an access control matrix, which is discussed in Sections 2.1 and 2.2.
Presentation of real problems and solutions often engages undergraduate students more effecively than presentation of abstractions. The special topics and the practicum provide a wealth of practical problems and ways to deal with them. This leads naturally to the deeper issues of policy, cryptography, noncryptographic mechanisms, and assurance. The following are sections appropriate for nonmathematical undergraduate courses in these topics.
Graduate Level
A typical introductory graduate class can focus more deeply on the subject than can an undergraduate class. Like an undergraduate class, a graduate class should cover Chapters 1, 9, and 13. Also important are the undecidability results in Sections 3.1 and 3.2, which require that Chapter 2 be covered. Beyond that, the instructor can choose from a variety of topics and present them to whatever depth is appropriate. The following are sections suitable for graduate study.
Practitioners
Practitioners in the field of computer security will find much to interest them. The table of contents and the index will help them locate specific topics. A more general approach is to start with Chapter 1 and then proceed to Part 8, the practicum. Each chapter has references to other sections of the text that explain the underpinnings of the material. This will lead the reader to a deeper understanding of the reasons for the poli settings, configurations, and advice in the practicum. This approach also allows readers to focus on those topics that are of most interest to them.
Special Acknowledgment
Elisabeth Sullivan contributed the assurance part of this book. She wrote several drafts, all of which reflect her extensive knowledge and experience in that aspect of computer security. I am particularly grateful to her for contributing her real-world knowledge of how assurance is managed. Too often, books recount the mathematics of assurance without recognizing that other aspects are equally important and more widely used. These other aspects shine through in the assurance section, thanks to Liz. As if that were not enough, she made several suggestions that improved the policy part of this book. I will always be grateful for her contribution, her humor, and especially her friendship.