Freeftpd error the specified address is already in use

Information System Security

eBook conversion by codeMantra Version 1.0

All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.

McGraw-Hill Education eBooks are available at special quantity discounts to use as premiums and sales promotions or for use in corporate training programs. To contact a representative, please visit the Contact Us page at www.mhprofessional.com.

SANS Institute IT Code of Ethics reproduced with permission, © SANS Institute.

Information has been obtained by McGraw-Hill Education from sources believed to be reliable. However, because of the possibility of human or mechanical error by our sources, McGraw-Hill Education, or others,

http://www.mhprofessional.com
McGraw-Hill Education does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such information.

McGraw-Hill Education is an independent entity from CompTIA®. This publication and digital content may be used in assisting students to prepare for the CompTIA Security+ exam. Neither CompTIA nor McGraw-Hill Education warrants that use of this publication and digital content will ensure passing any exam. CompTIA and CompTIA Security+ are trademarks or registered trademarks of CompTIA in the United States and/or other countries. All other trademarks are trademarks of their respective owners.

TERMS OF USE

This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Education’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with these terms.

THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF

MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.

About the Authors Dr. Wm. Arthur Conklin is an associate professor and Director of the Center for Information Security Research and Education in the College of Technology at the University of Houston. He holds two terminal degrees, a Ph.D. in Business Administration (specializing in Information Security) from The University of Texas at San Antonio (UTSA) and the degree Electrical Engineer (specializing in Space Systems Engineering) from the Naval Postgraduate School in Monterey, CA. He holds CompTIA Security+, CISSP, CSSLP, CRISC, DFCP, GICSP, and CASP certifications. An ISSA Fellow, he is also a senior member of ASQ and a member of IEEE and ACM. His research interests include the use of systems theory to explore information security, specifically in cyber- physical systems. He has coauthored six security books and numerous academic articles associated with information security. He is active in the DHS-sponsored Industrial Control Systems Joint Working Group (ICSJWG) efforts associated with workforce development and cybersecurity aspects of industrial control systems. He has an extensive background in secure coding and is a former co-chair of the DHS/DoD Software Assurance Forum working group for workforce education, training, and development.

Dr. Gregory White has been involved in computer and network security since 1986. He spent 19 years on active duty with the U.S. Air Force and is currently in the Air Force Reserves assigned to the Pentagon. He obtained his Ph.D. in Computer Science from Texas A&M University in 1995. His dissertation topic was in the area of computer network intrusion detection, and he continues to conduct research in this area today. He is currently the Director for the Center for Infrastructure Assurance and Security and is an associate professor of computer science at The University of Texas at San Antonio. Dr. White has written and presented numerous articles and conference papers on security. He is also the coauthor for five textbooks on computer and network security and has written chapters for two other security books. Dr. White continues to be active in security research. His

current research initiatives include efforts in high-speed intrusion detection, community infrastructure protection, and visualization of community and organization security postures.

Dwayne Williams is Associate Director, Special Projects for the Center for Infrastructure Assurance and Security (CIAS) at the University of Texas at San Antonio and has more than 22 years of experience in information systems and network security. Mr. Williams’s experience includes six years of commissioned military service as a Communications- Computer Information Systems Officer in the U.S. Air Force, specializing in network security, corporate information protection, intrusion detection systems, incident response, and VPN technology. Prior to joining the CIAS, he served as Director of Consulting for SecureLogix Corporation, where he directed and provided security assessment and integration services to Fortune 100, government, public utility, oil and gas, financial, and technology clients. Mr. Williams graduated in 1993 from Baylor University with a Bachelor of Arts in Computer Science. Mr. Williams is a Certified Information Systems Security Professional (CISSP), CompTIA Advanced Security Practitioner (CASP), and coauthor of McGraw-Hill’s Voice and Data Security, CompTIA Security+ All-in-One Exam Guide, and CASP CompTIA Advanced Security Practitioner Certification Study Guide.

Roger L. Davis, CISSP, CISM, CISA, is an Account Manager for Microsoft. He has served as president of the Utah chapter of the Information Systems Security Association (ISSA) and various board positions for the Utah chapter of the Information Systems Audit and Control Association (ISACA). He is a retired Air Force lieutenant colonel with 35 years of military and information systems/security experience. Mr. Davis served on the faculty of Brigham Young University and the Air Force Institute of Technology. He coauthored McGraw-Hill’s CompTIA Security+ All-in-One Exam Guide and Voice and Data Security. He holds a Master’s degree in Computer Science from George Washington University, a Bachelor’s degree in Computer Science from Brigham

Young University, and performed post-graduate studies in electrical engineering and computer science at the University of Colorado.

Chuck Cothren, CISSP, is a Principal Solutions Specialist at Symantec Corporation applying a wide array of network security experience, including performing controlled penetration testing, incident response, and security management to assist a wide variety of clients in the protection of their critical data. He has also analyzed security methodologies for Voice over Internet Protocol (VoIP) systems and supervisory control and data acquisition (SCADA) systems. He is coauthor of the books Voice and Data Security, and CompTIA Security+ All-in-One Exam Guide.

About the Technical Editor Bobby E. Rogers is an Information Security Engineer working as a contractor for Department of Defense agencies, helping to secure, certify, and accredit their information systems. His duties include information system security engineering, risk management, and certification and accreditation efforts. He retired after 21 years in the United States Air Force, serving as a network security engineer and instructor, and has secured networks all over the world. Bobby has a Master’s degree in Information Assurance (IA), and is pursuing a doctoral degree in Cybersecurity from Capitol Technology University, Maryland. His many certifications include CRISC, CISSP-ISSEP, C|EH, and MCSE: Security as well as the CompTIA A+, Network+, Security+, and Mobility+ certifications.

Acknowledgments This book is dedicated to the many security professionals who daily

work to ensure the safety of our nation’s critical infrastructures. We want to recognize the thousands of dedicated individuals who strive to protect

our national assets but who seldom receive praise and often are only noticed when an incident occurs. To you, we say thank you for a job well

done!

We, the authors of Principles of Computer Security, Fourth Edition, have many individuals who we need to acknowledge—individuals without whom this effort would not have been successful. This edition would not have been possible without Tim Green, whose support and faith in the authors made this edition possible. He brought together an all-star production team that made this book more than just a new edition, but a complete learning system. The list needs to start with those folks at McGraw-Hill Education who

worked tirelessly with the project’s multiple authors and contributors and led us successfully through the minefield that is a book schedule and who took our rough chapters and drawings and turned them into a final, professional product we can be proud of. We thank all the good people from the Acquisitions team, Tim Green and Amy Stonebraker; from the Editorial Services team, Jody McKenzie and Howie Severson; from the Illustration and Production teams, James Kussow and Amarjeet Kumar and the composition team at Cenveo Publisher Services. We also thank the technical editor, Bobby Rogers; the copy editor, Bill McManus; the proofreader, Paul Tyler; and the indexer, Jack Lewis; for all their attention to detail that made this a finer work after they finished with it. We also need to acknowledge our current employers who, to our great

delight, have seen fit to pay us to work in a career field that we all find exciting and rewarding. There is never a dull moment in security, because it is constantly changing. We would like to thank Art Conklin for herding the cats on this one.

Finally, we would each like to individually thank those people who—on a personal basis—have provided the core support for us individually. Without these special people in our lives, none of us could have put this work together.

—The Author Team

To Susan, your love and support is what enables me to do all the things I do.

—Art Conklin, Ph.D. I would like to thank my wife, Charlan, for the tremendous support she has always given me. It doesn’t matter how many times I have sworn that I’ll never get involved with another book project only to return within months to yet another one; through it all, she has remained supportive. I would also like to publicly thank the United States Air Force, which

provided me numerous opportunities since 1986 to learn more about security than I ever knew existed. To whoever it was who decided to send me as a young captain—fresh from completing my master’s degree in artificial intelligence—to my first assignment in computer security: thank you, it has been a great adventure!

—Gregory B. White, Ph.D. Josie, thank you for all the love and support. Macon, John, this is for you.

—Chuck Cothren Geena, thanks for being my best friend and my greatest support. Anything I am is because of you. Love to my kids and grandkids!

—Roger L. Davis To my wife and best friend, Leah, for your love, energy, and support— thank you for always being there. Here’s to many more years together.

—Dwayne Williams

ABOUT THIS BOOK

Important Technology Skills Information technology (IT) offers many career paths, and information security is one of the fastest-growing tracks for IT professionals. This book provides coverage of the materials you need to begin your exploration of information security. In addition to covering all of the CompTIA Security+ exam objectives, additional material is included to help you build a solid introductory knowledge of information security.

Proven Learning Method Keeps You on Track Designed for classroom use and written by instructors for use in their own classes, Principles of Computer Security is structured to give you comprehensive knowledge of information security. The textbook’s active learning methodology guides you beyond mere recall and— through thought-provoking activities, labs, and sidebars—helps you develop critical-thinking, diagnostic, and communication skills.

Effective Learning Tools This feature-rich textbook is designed to make learning easy and enjoyable and to help you develop the skills and critical-thinking abilities that will enable you to adapt to different job situations and to troubleshoot problems. Written by instructors with decades of combined information security experience, this book conveys even the most complex issues in an accessible, easy-to understand format.

Each chapter includes

Learning Objectives that set measurable goals for chapter-by- chapter progress

Illustrations that give you a clear picture of the concepts and technologies

Try This!, Cross Check, and Tech Tip sidebars that encourage you to practice and apply concepts in real-world settings

Notes, Tips, and Warnings that guide you, and Exam Tips that give you advice or provide information specifically related to preparing for the exam

Chapter Summaries and Key Terms Lists that provide you with an easy way to review important concepts and vocabulary

Challenging End-of-Chapter Tests that include vocabulary- building exercises, multiple-choice questions, essay questions, and on-the-job lab projects

CompTIA APPROVED QUALITY CONTENT

It Pays to Get Certified In a digital world, digital literacy is an essential survival skill. Certification demonstrates that you have the knowledge and skill to solve technical or business problems in virtually any business environment. CompTIA certifications are highly valued credentials that qualify you for jobs, increased compensation, and promotion.

CompTIA Security+ Certification Helps Your

Career

Security is one of the highest demand job categories, growing in importance as the frequency and severity of security threats continues to be a major concern for organizations around the world.

Jobs for security administrators are expected to increase by 18% —the skill set required for these types of jobs maps to the CompTIA Security+ certification.

Network Security Administrators can earn as much as $106,000 per year.

CompTIA Security+ is the first step in starting your career as a Network Security Administrator or Systems Security Administrator.

More than 250,000 individuals worldwide are CompTIA Security+ certified.

CompTIA Security+ is regularly used in organizations such as Hitachi Systems, Fuji Xerox, HP, Dell, and a variety of major U.S. government contractors.

Approved by the U.S. Department of Defense (DoD) as one of the required certification options in the DoD 8570.01-M directive, for Information Assurance Technical Level II and Management Level I job roles.

Steps to Getting Certified and Staying Certified 1. Review the exam objectives. Review the certification objectives to

make sure you know what is covered in the exam: http://certification.comptia.org/examobjectives.aspx

2. Practice for the exam. After you have studied for the certification exam, review and answer sample questions to get an idea of what type of questions might be on the exam: http://certification.comptia.org/samplequestions.aspx

3. Purchase an exam voucher. You can purchase exam vouchers on the CompTIA Marketplace, www.comptiastore.com.

4. Take the test! Go to the Pearson VUE website, www.pearsonvue.com/comptia/, and schedule a time to take your exam.

5. Stay certified! Effective January 1, 2011, new CompTIA Security+ certifications are valid for three years from the date of certification. There are a number of ways the certification can be renewed. For more information go to http://certification.comptia.org/ce.

For More Information Visit CompTIA online Go to http://certification.comptia.org/home.aspx to learn more about getting CompTIA certified.

Contact CompTIA Please call 866-835-8020 and choose Option 2, or e-mail questions@comptia.org.

Connect with CompTIA Find CompTIA on Facebook, LinkedIn, Twitter, and YouTube.

http://certification.comptia.org/examobjectives.aspx
http://certification.comptia.org/samplequestions.aspx
http://www.comptiastore.com
http://www.pearsonvue.com/comptia/
http://certification.comptia.org/ce
http://certification.comptia.org/home.aspx
mailto:questions@comptia.org
Content Seal of Quality This courseware bears the seal of CompTIA Approved Quality Content. This seal signifies this content covers 100 percent of the exam objectives and implements important instructional design principles. CompTIA recommends multiple learning tools to help increase coverage of the learning objectives.

CAQC Disclaimer The logo of the CompTIA Approved Quality Content (CAQC) program and the status of this or other training material as “Approved” under the CompTIA Approved Quality Content program signifies that, in CompTIA’s opinion, such training material covers the content of CompTIA’s related certification exam. The contents of this training material were created for the CompTIA

Security+ exam covering CompTIA certification objectives that were current as of the date of publication. CompTIA has not reviewed or approved the accuracy of the contents of

this training material and specifically disclaims any warranties of merchantability or fitness for a particular purpose. CompTIA makes no guarantee concerning the success of persons using any such “Approved” or other training material in order to prepare for any CompTIA certification exam.

CONTENTS AT A GLANCE

Chapter 1 Introduction and Security Trends

Chapter 2 General Security Concepts

Chapter 3 Operational and Organizational Security

Chapter 4 The Role of People in Security

Chapter 5 Cryptography

Chapter 6 Public Key Infrastructure

Chapter 7 PKI Standards and Protocols

Chapter 8 Physical Security

Chapter 9 Network Fundamentals

Chapter 10 Infrastructure Security

Chapter 11 Authentication and Remote Access

Chapter 12 Wireless Security and Mobile Devices

Chapter 13 Intrusion Detection Systems and Network Security

Chapter 14 System Hardening and Baselines

Chapter 15 Types of Attacks and Malicious Software

Chapter 16 E-Mail and Instant Messaging

Chapter 17 Web Components

Chapter 18 Secure Software Development

Chapter 19 Business Continuity and Disaster Recovery, and Organizational Policies

Chapter 20 Risk Management

Chapter 21 Change Management

Chapter 22 Incident Response

Chapter 23 Computer Forensics

Chapter 24 Legal Issues and Ethics

Chapter 25 Privacy

Appendix A CompTIA Security+ Exam Objectives: SY0-401

Appendix B About the Download

Glossary

Index

CONTENTS

Foreword Preface Introduction Instructor Web Site

Chapter 1 Introduction and Security Trends The Computer Security Problem

Definition of Computer Security Historical Security Incidents The Current Threat Environment Threats to Security Security Trends

Targets and Attacks Specific Target Opportunistic Target Minimizing Possible Avenues of Attack

Approaches to Computer Security Ethics Additional References Chapter 1 Review

Chapter 2 General Security Concepts Basic Security Terminology

Security Basics

Security Tenets Security Approaches Security Principles Access Control Authentication Mechanisms Authentication and Access Control Policies

Security Models Confidentiality Models Integrity Models

Chapter 2 Review

Chapter 3 Operational and Organizational Security Policies, Procedures, Standards, and Guidelines

Security Policies Change Management Policy Data Policies Human Resources Policies Due Care and Due Diligence Due Process Incident Response Policies and Procedures

Security Awareness and Training Security Policy Training and Procedures Role-Based Training Compliance with Laws, Best Practices, and Standards User Habits New Threats and Security Trends/Alerts Training Metrics and Compliance

Interoperability Agreements Service Level Agreements Business Partnership Agreement

Memorandum of Understanding Interconnection Security Agreement

The Security Perimeter Physical Security

Physical Access Controls Physical Barriers

Environmental Issues Fire Suppression

Wireless Electromagnetic Eavesdropping

Modern Eavesdropping Chapter 3 Review

Chapter 4 The Role of People in Security People—A Security Problem

Social Engineering Poor Security Practices

People as a Security Tool Security Awareness Security Policy Training and Procedures

Chapter 4 Review

Chapter 5 Cryptography Cryptography in Practice

Fundamental Methods Comparative Strengths and Performance of Algorithms

Historical Perspectives Substitution Ciphers One-Time Pads

Algorithms Key Management Random Numbers

Hashing Functions SHA RIPEMD Message Digest Hashing Summary

Symmetric Encryption DES 3DES AES CAST RC Blowfish Twofish IDEA Block vs. Stream Symmetric Encryption Summary

Asymmetric Encryption Diffie-Hellman RSA ElGamal ECC Asymmetric Encryption Summary Symmetric vs. Asymmetric

Quantum Cryptography Steganography Cryptography Algorithm Use

Confidentiality Integrity

Authentication Nonrepudiation Cipher Suites Key Exchange Key Escrow Session Keys Ephemeral Keys Key Stretching Secrecy Principles Transport Encryption Digital Signatures Digital Rights Management Cryptographic Applications Use of Proven Technologies

Chapter 5 Review

Chapter 6 Public Key Infrastructure The Basics of Public Key Infrastructures Certificate Authorities Registration Authorities

Local Registration Authorities Digital Certificates

Certificate Extensions Certificate Attributes

Certificate Lifecycles Registration and Generation CSR Renewal Suspension Revocation

Key Destruction Certificate Repositories Trust and Certificate Verification Centralized and Decentralized Infrastructures

Hardware Security Modules Private Key Protection Key Recovery Key Escrow

Public Certificate Authorities In-House Certificate Authorities

Choosing Between a Public CA and an In-House CA Outsourced Certificate Authorities Tying Different PKIs Together Trust Models

Certificate-Based Threats Stolen Certificates

Chapter 6 Review

Chapter 7 PKI Standards and Protocols PKIX and PKCS

PKIX Standards PKCS Why You Need to Know the PKIX and PKCS Standards

X.509 SSL/TLS Cipher Suites ISAKMP CMP XKMS S/MIME

IETF S/MIME History IETF S/MIME v3 Specifications

PGP How PGP Works

HTTPS IPsec CEP Other Standards

FIPS Common Criteria WTLS ISO/IEC 27002 (Formerly ISO 17799) SAML

Chapter 7 Review

Chapter 8 Physical Security The Security Problem Physical Security Safeguards

Walls and Guards Physical Access Controls and Monitoring Convergence Policies and Procedures Environmental Controls

Fire Suppression Water-Based Fire Suppression Systems Halon-Based Fire Suppression Systems Clean-Agent Fire Suppression Systems Handheld Fire Extinguishers Fire Detection Devices

Power Protection

UPS Backup Power and Cable Shielding Electromagnetic Interference

Electronic Access Control Systems Access Tokens

Chapter 8 Review

Chapter 9 Network Fundamentals Network Architectures Network Topology Network Protocols

Protocols Packets

Internet Protocol IP Packets TCP vs. UDP ICMP

IPv4 vs. IPv6 Packet Delivery

Ethernet Local Packet Delivery Remote Packet Delivery IP Addresses and Subnetting Network Address Translation

Security Zones DMZ Internet Intranet Extranet Flat Networks

Enclaves VLANs Zones and Conduits

Tunneling Storage Area Networks

iSCSI Fibre Channel FCoE

Chapter 9 Review

Chapter 10 Infrastructure Security Devices

Workstations Servers Virtualization Mobile Devices Device Security, Common Concerns Network Attached Storage Removable Storage

Networking Network Interface Cards Hubs Bridges Switches Routers Firewalls How Do Firewalls Work? Next-Generation Firewalls Web Application Firewalls vs. Network Firewalls Concentrators

Wireless Devices Modems Telephony VPN Concentrator

Security Devices Intrusion Detection Systems Network Access Control Network Monitoring/Diagnostic Load Balancers Proxies Web Security Gateways Internet Content Filters Data Loss Prevention Unified Threat Management

Media Coaxial Cable UTP/STP Fiber Unguided Media

Removable Media Magnetic Media Optical Media Electronic Media

Security Concerns for Transmission Media Physical Security Concerns Cloud Computing

Private Public Hybrid Community Software as a Service

Platform as a Service Infrastructure as a Service

Chapter 10 Review

Chapter 11 Authentication and Remote Access User, Group, and Role Management

User Group Role

Password Policies Domain Password Policy

Single Sign-On Time of Day Restrictions Tokens Account and Password Expiration

Security Controls and Permissions Access Control Lists Mandatory Access Control (MAC) Discretionary Access Control (DAC) Role-Based Access Control (RBAC) Rule-Based Access Control Attribute Based Access Control (ABAC) Account Expiration

Preventing Data Loss or Theft The Remote Access Process

Identification Authentication Authorization Access Control

Remote Access Methods

IEEE 802.1X RADIUS TACACS+ Authentication Protocols FTP/FTPS/SFTP VPNs IPsec Vulnerabilities of Remote Access Methods

Connection Summary Chapter 11 Review

Chapter 12 Wireless Security and Mobile Devices Introduction to Wireless Networking Mobile Phones

Wireless Application Protocol 3G Mobile Networks 4G Mobile Networks

Bluetooth Bluetooth Attacks

Near Field Communication IEEE 802.11 Series

802.11: Individual Standards Attacking 802.11 Current Security Methods

Wireless Systems Configuration Antenna Types Antenna Placement Power Level Controls Site Surveys Captive Portals

Securing Public Wi-Fi Mobile Devices

Mobile Device Security BYOD Concerns Location Services Mobile Application Security

Chapter 12 Review

Chapter 13 Intrusion Detection Systems and Network Security History of Intrusion Detection Systems IDS Overview

IDS Models Signatures False Positives and False Negatives

Network-Based IDSs Advantages of a NIDS Disadvantages of a NIDS Active vs. Passive NIDSs NIDS Tools

Host-Based IDSs Advantages of HIDSs Disadvantages of HIDSs Active vs. Passive HIDSs Resurgence and Advancement of HIDSs

Intrusion Prevention Systems Honeypots and Honeynets Tools

Protocol Analyzer Switched Port Analyzer Port Scanner

Passive vs. Active Tools Banner Grabbing

Chapter 13 Review

Chapter 14 System Hardening and Baselines Overview of Baselines Operating System and Network Operating System Hardening

OS Security Host Security

Machine Hardening Operating System Security and Settings OS Hardening Hardening Microsoft Operating Systems Hardening UNIX- or Linux-Based Operating Systems Updates (a.k.a. Hotfixes, Service Packs, and Patches) Antimalware White Listing vs. Black Listing Applications Trusted OS Host-based Firewalls Hardware Security Host Software Baselining

Host-Based Security Controls Hardware-Based Encryption Devices Data Encryption Data Security Handling Big Data Cloud Storage Storage Area Network Permissions/ACL

Network Hardening

Software Updates Device Configuration Securing Management Interfaces VLAN Management IPv4 vs. IPv6

Application Hardening Application Configuration Baseline Application Patches Patch Management Host Software Baselining

Group Policies Security Templates Alternative Environments

SCADA Embedded Systems Phones and Mobile Devices Mainframe Game Consoles In-Vehicle Computing Systems Alternative Environment Methods Network Segmentation Security Layers Application Firewalls Manual Updates Firmware Version Control Wrappers Control Redundancy and Diversity

Chapter 14 Review

Chapter 15 Types of Attacks and Malicious Software

Avenues of Attack Minimizing Possible Avenues of Attack

Malicious Code Viruses Worms Polymorphic Malware Trojan Horses Rootkits Logic Bombs Spyware Adware Botnets Backdoors and Trapdoors Ransomware Malware Defenses

Attacking Computer Systems and Networks Denial-of-Service Attacks Social Engineering Null Sessions Sniffing Spoofing TCP/IP Hijacking Man-in-the-Middle Attacks Replay Attacks Transitive Access Spam Spim Phishing Spear Phishing Vishing Pharming

Scanning Attacks Attacks on Encryption Address System Attacks Cache Poisoning Password Guessing Pass-the-Hash Attacks Software Exploitation Client-Side Attacks

Advanced Persistent Threat Remote Access Trojans

Tools Metasploit BackTrack/Kali Social-Engineering Toolkit Cobalt Strike Core Impact Burp Suite

Auditing Perform Routine Audits

Chapter 15 Review

Chapter 16 E-Mail and Instant Messaging How E-Mail Works

E-Mail Structure MIME

Security of E-Mail Malicious Code Hoax E-Mails Unsolicited Commercial E-Mail (Spam) Sender ID Framework

DomainKeys Identified Mail Mail Encryption

S/MIME PGP

Instant Messaging Modern Instant Messaging Systems

Chapter 16 Review

Chapter 17 Web Components Current Web Components and Concerns Web Protocols

Encryption (SSL and TLS) The Web (HTTP and HTTPS) HTTPS Everywhere HTTP Strict Transport Security Directory Services (DAP and LDAP) File Transfer (FTP and SFTP) Vulnerabilities

Code-Based Vulnerabilities Buffer Overflows Java JavaScript ActiveX Securing the Browser CGI Server-Side Scripts Cookies Browser Plug-ins Malicious Add-ons Signed Applets

Application-Based Weaknesses Session Hijacking Client-Side Attacks Web 2.0 and Security

Chapter 17 Review

Chapter 18 Secure Software Development The Software Engineering Process

Process Models Secure Development Lifecycle

Secure Coding Concepts Error and Exception Handling Input and Output Validation Fuzzing Bug Tracking

Application Attacks Cross-Site Scripting Injections Directory Traversal/Command Injection Buffer Overflow Integer Overflow Cross-Site Request Forgery Zero-Day Attachments Locally Shared Objects Client-Side Attacks Arbitrary/Remote Code Execution Open Vulnerability and Assessment Language

Application Hardening Application Configuration Baseline

Application Patch Management NoSQL Databases vs. SQL Databases Server-Side vs. Client-Side Validation

Chapter 18 Review

Chapter 19 Business Continuity and Disaster Recovery, and Organizational Policies

Business Continuity Business Continuity Plans Business Impact Analysis Identification of Critical Systems and Components Removing Single Points of Failure Risk Assessment Succession Planning Continuity of Operations

Disaster Recovery Disaster Recovery Plans/Process Categories of Business Functions IT Contingency Planning Test, Exercise, and Rehearse Recovery Time Objective and Recovery Point Objective Backups Alternative Sites Utilities Secure Recovery Cloud Computing High Availability and Fault Tolerance Failure and Recovery Timing

Chapter 19 Review

Chapter 20 Risk Management An Overview of Risk Management

Example of Risk Management at the International Banking Level Risk Management Vocabulary

What Is Risk Management? Risk Management Culture

Business Risks Examples of Business Risks Examples of Technology Risks

Risk Mitigation Strategies Change Management Incident Management User Rights and Permissions Reviews Data Loss or Theft

Risk Management Models General Risk Management Model Software Engineering Institute Model NIST Risk Models Model Application

Qualitatively Assessing Risk Quantitatively Assessing Risk

Adding Objectivity to a Qualitative Assessment Risk Calculation

Qualitative vs. Quantitative Risk Assessment Tools

Cost-Effectiveness Modeling Risk Management Best Practices

System Vulnerabilities Threat Vectors Probability/Threat Likelihood

Risk-Avoidance, Transference, Acceptance, Mitigation, Deterrence Risks Associated with Cloud Computing and Virtualization

Chapter 20 Review

Chapter 21 Change Management Why Change Management? The Key Concept: Separation of Duties Elements of Change Management Implementing Change Management

Back-out Plan The Purpose of a Change Control Board

Code Integrity The Capability Maturity Model Integration Chapter 21 Review

Chapter 22 Incident Response Foundations of Incident Response

Incident Management Anatomy of an Attack Goals of Incident Response

Incident Response Process Preparation Security Measure Implementation Incident Identification/Detection Initial Response Incident Isolation Strategy Formulation Investigation Recovery/Reconstitution Procedures

Reporting Follow-up/Lessons Learned

Standards and Best Practices State of Compromise NIST Department of Justice Indicators of Compromise Cyber Kill Chain Making Security Measurable

Chapter 22 Review

Chapter 23 Computer Forensics Evidence

Types of Evidence Standards for Evidence Three Rules Regarding Evidence

Forensic Process Acquiring Evidence Identifying Evidence Protecting Evidence Transporting Evidence Storing Evidence Conducting the Investigation

Analysis Chain of Custody Message Digest and Hash Host Forensics

File Systems  Windows Metadata Linux Metadata

Device Forensics Network Forensics E-Discovery

Reference Model Big Data Cloud

Chapter 23 Review

Chapter 24 Legal Issues and Ethics Cybercrime

Common Internet Crime Schemes Sources of Laws Computer Trespass Significant U.S. Laws Payment Card Industry Data Security Standard (PCI DSS) Import/Export Encryption Restrictions Non-U.S. Laws Digital Signature Laws Digital Rights Management

Ethics Chapter 24 Review

Chapter 25 Privacy Personally Identifiable Information (PII)

Sensitive PII Notice, Choice, and Consent

U.S. Privacy Laws Privacy Act of 1974 Freedom of Information Act (FOIA)

Family Education Records and Privacy Act (FERPA) U.S. Computer Fraud and Abuse Act (CFAA) U.S. Children’s Online Privacy Protection Act (COPPA) Video Privacy Protection Act (VPPA) Health Insurance Portability & Accountability Act (HIPAA) Gramm-Leach-Bliley Act (GLBA) California Senate Bill 1386 (SB 1386) U.S. Banking Rules and Regulations Payment Card Industry Data Security Standard (PCI DSS) Fair Credit Reporting Act (FCRA) Fair and Accurate Credit Transactions Act (FACTA)

Non-Federal Privacy Concerns in the United States International Privacy Laws

OECD Fair Information Practices European Laws Canadian Laws Asian Laws

Privacy-Enhancing Technologies Privacy Policies

Privacy Impact Assessment Web Privacy Issues

Cookies Privacy in Practice

User Actions Data Breaches

Chapter 25 Review

Appendix A CompTIA Security+ Exam Objectives: SY0-401

Appendix B

About the Download System Requirements Downloading Total Tester Premium Practice Exam Software Total Tester Premium Practice Exam Software

Installing and Running Total Tester Technical Support

Total Seminars Technical Support McGraw-Hill Education Content Support

Glossary

Index

FOREWORD

Selecting a book is tricky for me. If it is for personal reading, will I like reading it? If it is for my professional development, will it meet the need? If it is for my students, will it be clear and concise? This new edition of Principles of Computer Security passes all three tests with flying colors. I enjoyed reading it. If I needed to pass the CompTIA Security+ or other practitioner examination, it would prepare me. And finally, based on personal experience, students will like this book and find it to be valuable reading and study material. It even has practice exams for certification for my convenience. For more than 40 years I have worked in some variety of computer

security. When people ask me what defines my job, I respond with “I don’t know until I read the morning newspaper because the security environment changes rapidly.” If you want to get into the computer security industry, reading and understanding this book is a great introduction. Now in its fourth edition, the 25 chapters of Principles of Computer Security focus on a broad spectrum of important topics to prepare the reader to be a certified computer security practitioner. The real deal maker for me is the further endorsement of the contents: the book is based on CompTIA Approved Quality Content (CAQC) and serves as both an exam preparation guide and a useful reference. Dr. Conklin and his team of coauthors ease the reader into the meat of

the topic by reviewing both security trends and concepts. They then address security from two different perspectives. First they focus on the organization’s need for security, and then focus on the important role of people. These two perspectives are intertwined; it is essential for a security practitioner to understand the security environment and how the people make it work. Every practitioner needs to understand the underlying technology and

tools of computer security. Some individuals have an idea about security topics but do not have the essential knowledge needed to address them in depth. The authors have provided nine masterful chapters introducing these key concepts. For example, in a single chapter they provide the basis for the reader to deal with security of networks. This chapter supports everything the reader needs to know to address standards and protocols, infrastructure security, remote access and authentication, as well as wireless. The authors integrate these concepts to support public key infrastructure (PKI) and intrusion detection systems for network security without forgetting the importance of physical security in protecting the information system as well as infrastructure. One of the most debated topics in security is the importance of

cryptography. Some would assert that almost all digital security can be accomplished with cryptography, that security and cryptography are inseparable, with cryptography being the cornerstone of securing data in both transmission and storage. However, if computer security were as easy as “encrypt everything,” this would be a very short book. While cryptography is very important and a very complex security measure, it is not a panacea—but it does provide for lively discussions. The authors bring all these components together with a comprehensive chapter on intrusion detection and prevention. Once the reader has mastered the basics, the authors address e-mail,

malicious software, instant messaging, and web components in such a way that the reader can apply his or her knowledge of networks and security fundamentals. The reader will then be provided with an overview of secure software development. In 2015, both the U.S. Department of Homeland Security and CSO magazine concluded that poorly developed software is one of the biggest cyber threats—perhaps 90 percent of the threats come through poor software design. In the final analysis, security is really all about risk management. What

is your organization’s appetite for risk and how is that risk managed? The chapters covering risk management lead the reader through these less technical issues to gain an understanding how these impact the

organization. Baselines and change management are essential to understanding what assets are being secured and how they are being changed. A reader who learns these skills well will be able to work in incident response, disaster recovery, and business continuity. Understanding these processes and how they work with technical issues expands career opportunities. The authors conclude their review of the principles of computer security

with an examination of privacy, legal issues, and ethics. Although these topics appear at the end of the book, they are crucial issues in the modern world. Remember, as a computer security practitioner, you will have legal access to more data and information than any else in the organization. Although not the last chapter in the book, I have decided to comment on

forensics last. The authors have done a wonderful job of addressing this complex topic. But why mention it last? Because many times forensics is what one does after computer security fails. It makes a good epitaph for a wonderful book. Tonight it is 15 degrees and snowing outside while I sit in my study—

warm, dry, and comfortable; my home is my castle. Not bad for mid- winter in Idaho; however, I should not forget that one reason I am comfortable is because certified computer security practitioners are protecting my information and privacy as well as the critical infrastructure that supports it.

For Instructors I have taught from prior editions of this book and have used its companion laboratory manual for several years. Both Principles of Computer Security, Fourth Edition and Principles of Computer Security Lab Manual, Fourth Edition have instructor materials on a companion Web site available to adopting instructors. Instructor manuals, including the answers to the end- of-chapter questions, PowerPoint slides, and the test bank of questions for use as quizzes or exams, make preparation a snap.

Corey D. Schou, PhD Series Editor

University Professor of Informatics Professor of Computer Science

Director of the National Information Assurance Training and Education Center

Idaho State University

PREFACE

Information and computer security has moved from the confines of academia to mainstream America in the 21st century. Data breaches, information disclosures, and high-profile hacks involving the theft of information and intellectual property seem to be a regular staple of the news. It has become increasingly obvious to everybody that something needs to be done to secure not only our nation’s critical infrastructure but also the businesses we deal with on a daily basis. The question is, “Where do we begin?” What can the average information technology professional do to secure the systems that he or she is hired to maintain? One immediate answer is education and training. If we want to secure our computer systems and networks, we need to know how to do this and what security entails. Our way of life, from commerce to messaging to business

communications and even social media, depends on the proper functioning of our worldwide infrastructure. A common thread throughout all of these, however, is technology—especially technology related to computers and communication. Thus, an individual, organization, or nation who wanted to cause damage to this nation could attack it not just with traditional weapons but with computers through the Internet. Complacency is not an option in today’s hostile network environment. The protection of our networks and systems is not the sole domain of the information security professional, but rather the responsibility of all who are involved in the design, development, deployment, and operation of the systems that are nearly ubiquitous in our daily lives. With virtually every system we depend upon daily at risk, the attack surface and corresponding risk profile is extremely large. Information security has matured from a series of technical issues to a comprehensive risk management problem, and this book provides the foundational material to engage in the field in a

professional manner. So, where do you, the IT professional seeking more knowledge on

security, start your studies? This book offers a comprehensive review of the underlying foundations and technologies associated with securing our systems and networks. The IT world is overflowing with certifications that can be obtained by those attempting to learn more about their chosen profession. The information security sector is no different, and the CompTIA Security+ exam offers a basic level of certification for security. In the pages of this book you will find not only material that can help you prepare for taking the CompTIA Security+ exam but also the basic information that you will need in order to understand the issues involved in securing your computer systems and networks today. In no way is this book the final source for learning all about protecting your organization’s systems, but it serves as a point from which to launch your security studies and career. One thing is certainly true about this field of study—it never gets

boring. It constantly changes as technology itself advances. Something else you will find as you progress in your security studies is that no matter how much technology advances and no matter how many new security devices are developed, at its most basic level, the human is still the weak link in the security chain. If you are looking for an exciting area to delve into, then you have certainly chosen wisely. Security offers a challenging blend of technology and people issues. And securing the systems of tomorrow will require everyone to work together, not just security, but developers, operators, and users alike. We, the authors of this book, wish you luck as you embark on an exciting and challenging career path.

Wm. Arthur Conklin, Ph.D. Gregory B. White, Ph.D.

INTRODUCTION

Computer security is becoming increasingly important today as the number of security incidents steadily climbs. Many corporations are now spending significant portions of their budgets on security hardware, software, services, and personnel. They are spending this money not because it increases sales or enhances the product they provide, but because of the possible consequences should they not take protective actions. Security has become a comprehensive risk management exercise in firms that take the risks seriously.

Why Focus on Security? Security is not something that we want to have to pay for; it would be nice if we didn’t have to worry about protecting our data from disclosure, modification, or destruction from unauthorized individuals, but that is not the environment we find ourselves in today. Instead, we have seen the cost of recovering from security incidents steadily rise along with the rise in the number of incidents themselves. Since hackers have learned how to monetize hacks, the playing field has become significantly more dangerous. There are now incentives for a professional class of hacker with the intent of reaping benefits both long and short term. With the advent of advanced persistent threats, the rise of nation-state hacking, and the increase in criminal activity from botnets to ransomware, the IT playing field is now viewed as a contested environment, one where hacking can result in gains. Law enforcement is too overwhelmed and under-resourced to make a dent in the problem, and the result is a need for trained security practitioners in all business segments—and a further need for security-aware IT personnel in regular IT positions. Security has become a mainstream topic.

A Growing Need for Security Specialists To protect our computer systems and networks, we will need a significant number of new security professionals trained in the many aspects of computer and network security. This is not an easy task, as the systems connected to the Internet become increasingly complex, with software whose lines of code number in the millions. Understanding why this is such a difficult problem to solve is not hard if you consider how many errors might be present in a piece of software that is several million lines long. When you add the additional factor of how fast software is being developed—from necessity as the market is constantly moving— understanding how errors occur is easy. Not every “bug” in the software will result in a security hole, but it

doesn’t take many to affect the Internet community drastically. We can’t just blame the vendors for this situation, because they are reacting to the demands of government and industry. Most vendors are fairly adept at developing patches for flaws found in their software, and patches are constantly issued to protect systems from bugs that may introduce security problems. This introduces a whole new problem for managers and administrators—patch management. How important this has become is easily illustrated by how many of the most recent security events have occurred as a result of a security bug for which a patch was available months prior to the security incident; members of the community had not correctly installed the patch, however, thus making the incident possible. One of the reasons this happens is that many of the individuals responsible for installing the patches are not trained to understand the security implications surrounding the hole or the ramifications of not installing the patch. Many of these individuals simply lack the necessary training. Because of the need for an increasing number of security professionals

who are trained to some minimum level of understanding, certifications such as the CompTIA Security+ have been developed. Prospective employers want to know that the individual they are considering hiring knows what to do in terms of security. The prospective employee, in turn, wants to have a way to demonstrate his or her level of understanding,

which can enhance the candidate’s chances of being hired. The community as a whole simply wants more trained security professionals.

Preparing Yourself for the CompTIA Security+ Exam Principles of Computer Security, Fourth Edition is designed to help prepare you to take the CompTIA Security+ certification exam. When you pass it, you will demonstrate you have that basic understanding of security that employers are looking for. Passing this certification exam will not be an easy task, for you will need to learn many things to acquire that basic understanding of computer and network security.

How This Book Is Organized The book is divided into chapters to correspond with the objectives of the exam itself. Some of the chapters are more technical than others— reflecting the nature of the security environment where you will be forced to deal with not only technical details but also other issues such as security policies and procedures as well as training and education. Although many individuals involved in computer and network security have advanced degrees in math, computer science, information systems, or computer or electrical engineering, you do not need this technical background to address security effectively in your organization. You do not need to develop your own cryptographic algorithm, for example; you simply need to be able to understand how cryptography is used, along with its strengths and weaknesses. As you progress in your studies, you will learn that many security problems are caused by the human element. The best technology in the world still ends up being placed in an environment where humans have the opportunity to foul things up—and all too often do.

Onward and Upward

At this point, we hope that you are now excited about the topic of security, even if you weren’t in the first place. We wish you luck in your endeavors and welcome you to the exciting field of computer and network security.

INSTRUCTOR WEB SITE

For instructor resources, visit www.mhprofessional.com/PrinciplesSecurity4e. Adopting teachers can access the support materials identified below. Contact your McGraw-Hill Education sales representative for details on how to access the materials.

Instructor Materials The Principles of Computer Security companion Web site (www.mhprofessional.com/PrinciplesSecurity4e) provides many resources for instructors:

Answer keys to the end-of-chapter activities in the textbook

Answer keys to the lab manual activities (lab manual available separately)

Engaging PowerPoint slides on the lecture topics (including full-color artwork from the book)

An Instructor Manual

Access to test bank files and software that allows you to generate a wide array of paper- or network-based tests, and that features automatic grading

Hundreds of practice questions and a wide variety of question types and difficulty levels, enabling you to customize each test to maximize student progress

Blackboard cartridges and other formats may also be available upon request; contact your sales representative

http://www.mhprofessional.com/PrinciplesSecurity4e
http://www.mhprofessional.com/PrinciplesSecurity4e
chapter 1 Introduction and Security Trends

Security is mostly a superstition. It does not exist in nature, nor do the children of men as a whole experience it. Avoiding danger is no safer in the long run than outright exposure. Life is

W

either a daring adventure or nothing.

—HELEN KELLER

In this chapter, you will learn how to

Define computer security

Discuss common threats and recent computer crimes that have been committed

List and discuss recent trends in computer security

Describe common avenues of attacks

Describe approaches to computer security

Discuss the relevant ethical issues associated with computer security

hy should we be concerned about computer and network security? All you have to do is turn on the television or read the newspaper to find out about a variety of security problems that affect our nation

and the world today. The danger to computers and networks may seem to pale in comparison to the threat of terrorist strikes, but in fact the average citizen is much more likely to be the target of an attack on their own personal computer, or a computer they use at their place of work, than they are to be the direct victim of a terrorist attack. This chapter will introduce you to a number of issues involved in securing your computers and networks from a variety of threats that may utilize any of a number of different attacks.

The Computer Security Problem Fifty years ago companies did not conduct business across the Internet. Online banking and shopping were only dreams in science fiction stories. Today, however, millions of people perform online transactions every day. Companies rely on the Internet to operate and conduct business. Vast amounts of money are transferred via networks, in the form of either bank transactions or simple credit card purchases. Wherever there are vast

amounts of money, there are those who will try to take advantage of the environment to conduct fraud or theft. There are many different ways to attack computers and networks to take advantage of what has made shopping, banking, investment, and leisure pursuits a simple matter of “dragging and clicking” (or tapping) for many people. Identity theft is so common today that most everyone knows somebody who’s been a victim of such a crime, if they haven’t been a victim themselves. This is just one type of criminal activity that can be conducted using the Internet. There are many others and all are on the rise.

Definition of Computer Security Computer security is not a simple concept to define, and has numerous complexities associated with it. If one is referring to a computer, then it can be considered secure when the computer does what it is supposed to do and only what it is supposed to do. But as was noted earlier, the security emphasis has shifted from the computer to the information being processed. Information security is defined by the information being protected from unauthorized access or alteration and yet is available to authorized individuals when required. When one begins considering the aspects of information, it is important to realize that information is stored, processed, and transferred between machines, and all of these different states require appropriate protection schemes. Information assurance is a term used to describe not just the protection of information, but a means of knowing the level of protection that has been accomplished.

Tech Tip

Historical Computer Security Computer security is an ever-changing issue. Fifty years ago, computer security was mainly concerned with the physical devices that made up the computer. At the time, computers were the high-value items that organizations could not afford to lose. Today, computer equipment is inexpensive compared to the value of the data processed by the computer. Now the high-value

item is not the machine, but the information that it stores and processes. This has fundamentally changed the focus of computer security from what it was in the early years. Today the data stored and processed by computers is almost always more valuable than the hardware.

Computer security and information security both refer to a state where the hardware and software perform only desired actions and the information is protected from unauthorized access or alteration and is available to authorized users when required.

Historical Security Incidents By examining some of the computer-related crimes that have been committed over the last 30 or so years, we can better understand the threats and security issues that surround our computer systems and networks. Electronic crime can take a number of different forms, but the ones we will examine here fall into two basic categories: crimes in which the computer was the target, and incidents in which a computer was used to perpetrate the act (for example, there are many different ways to conduct bank fraud, one of which uses computers to access the records that banks process and maintain). We will start our tour of computer crimes with the 1988 Internet worm

(Morris worm), one of the first real Internet crime cases. Prior to 1988, criminal activity was chiefly centered on unauthorized access to computer systems and networks owned by the telephone company and companies that provided dial-up access for authorized users. Virus activity also existed prior to 1988, having started in the early 1980s.

The Morris Worm (November 1988) Robert Morris, then a graduate student at Cornell University, released what has become known as the Internet worm (or the Morris worm). The worm infected roughly 10 percent of the machines then connected to the Internet

(which amounted to approximately 6000 infected machines). The worm carried no malicious payload, the program being obviously a “work in progress,” but it did wreak havoc because it continually re-infected computer systems until they could no longer run any programs.

Citibank and Vladimir Levin (June–October 1994) Starting about June of 1994 and continuing until at least October of the same year, a number of bank transfers were made by Vladimir Levin of St. Petersburg, Russia. By the time he and his accomplices were caught, they had transferred an estimated $10 million. Eventually all but about $400,000 was recovered. Levin reportedly accomplished the break-ins by dialing into Citibank’s cash management system. This system allowed clients to initiate their own fund transfers to other banks.

Kevin Mitnick (February 1995) Kevin Mitnick’s computer activities occurred over a number of years during the 1980s and 1990s. Arrested in 1995, he eventually pled guilty to four counts of wire fraud, two counts of computer fraud, and one count of illegally intercepting a wire communication and was sentenced to 46 months in jail. In the plea agreement, Mitnick admitted to having gained unauthorized access to a number of different computer systems belonging to companies such as Motorola, Novell, Fujitsu, and Sun Microsystems. He described using a number of different “tools” and techniques, including social engineering, sniffers, and cloned cellular telephones.