Principles of computer security 4th edition mcgraw hill

Any Information Security Topic From Our Textbook --- Principles Of Computer Security, Conklin And White, 4th Edition, McGrawHill Companies, 2016; ISBN: 978-0-07-183597-8.

TERMS OF USE

This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Education’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with these terms.

THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF

MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.

About the Authors Dr. Wm. Arthur Conklin is an associate professor and Director of the Center for Information Security Research and Education in the College of Technology at the University of Houston. He holds two terminal degrees, a Ph.D. in Business Administration (specializing in Information Security) from The University of Texas at San Antonio (UTSA) and the degree Electrical Engineer (specializing in Space Systems Engineering) from the Naval Postgraduate School in Monterey, CA. He holds CompTIA Security+, CISSP, CSSLP, CRISC, DFCP, GICSP, and CASP certifications. An ISSA Fellow, he is also a senior member of ASQ and a member of IEEE and ACM. His research interests include the use of systems theory to explore information security, specifically in cyber- physical systems. He has coauthored six security books and numerous academic articles associated with information security. He is active in the DHS-sponsored Industrial Control Systems Joint Working Group (ICSJWG) efforts associated with workforce development and cybersecurity aspects of industrial control systems. He has an extensive background in secure coding and is a former co-chair of the DHS/DoD Software Assurance Forum working group for workforce education, training, and development.

Dr. Gregory White has been involved in computer and network security since 1986. He spent 19 years on active duty with the U.S. Air Force and is currently in the Air Force Reserves assigned to the Pentagon. He obtained his Ph.D. in Computer Science from Texas A&M University in 1995. His dissertation topic was in the area of computer network intrusion detection, and he continues to conduct research in this area today. He is currently the Director for the Center for Infrastructure Assurance and Security and is an associate professor of computer science at The University of Texas at San Antonio. Dr. White has written and presented numerous articles and conference papers on security. He is also the coauthor for five textbooks on computer and network security and has written chapters for two other security books. Dr. White continues to be active in security research. His

current research initiatives include efforts in high-speed intrusion detection, community infrastructure protection, and visualization of community and organization security postures.

Dwayne Williams is Associate Director, Special Projects for the Center for Infrastructure Assurance and Security (CIAS) at the University of Texas at San Antonio and has more than 22 years of experience in information systems and network security. Mr. Williams’s experience includes six years of commissioned military service as a Communications- Computer Information Systems Officer in the U.S. Air Force, specializing in network security, corporate information protection, intrusion detection systems, incident response, and VPN technology. Prior to joining the CIAS, he served as Director of Consulting for SecureLogix Corporation, where he directed and provided security assessment and integration services to Fortune 100, government, public utility, oil and gas, financial, and technology clients. Mr. Williams graduated in 1993 from Baylor University with a Bachelor of Arts in Computer Science. Mr. Williams is a Certified Information Systems Security Professional (CISSP), CompTIA Advanced Security Practitioner (CASP), and coauthor of McGraw-Hill’s Voice and Data Security, CompTIA Security+ All-in-One Exam Guide, and CASP CompTIA Advanced Security Practitioner Certification Study Guide.

Roger L. Davis, CISSP, CISM, CISA, is an Account Manager for Microsoft. He has served as president of the Utah chapter of the Information Systems Security Association (ISSA) and various board positions for the Utah chapter of the Information Systems Audit and Control Association (ISACA). He is a retired Air Force lieutenant colonel with 35 years of military and information systems/security experience. Mr. Davis served on the faculty of Brigham Young University and the Air Force Institute of Technology. He coauthored McGraw-Hill’s CompTIA Security+ All-in-One Exam Guide and Voice and Data Security. He holds a Master’s degree in Computer Science from George Washington University, a Bachelor’s degree in Computer Science from Brigham

Young University, and performed post-graduate studies in electrical engineering and computer science at the University of Colorado.

Chuck Cothren, CISSP, is a Principal Solutions Specialist at Symantec Corporation applying a wide array of network security experience, including performing controlled penetration testing, incident response, and security management to assist a wide variety of clients in the protection of their critical data. He has also analyzed security methodologies for Voice over Internet Protocol (VoIP) systems and supervisory control and data acquisition (SCADA) systems. He is coauthor of the books Voice and Data Security, and CompTIA Security+ All-in-One Exam Guide.

About the Technical Editor Bobby E. Rogers is an Information Security Engineer working as a contractor for Department of Defense agencies, helping to secure, certify, and accredit their information systems. His duties include information system security engineering, risk management, and certification and accreditation efforts. He retired after 21 years in the United States Air Force, serving as a network security engineer and instructor, and has secured networks all over the world. Bobby has a Master’s degree in Information Assurance (IA), and is pursuing a doctoral degree in Cybersecurity from Capitol Technology University, Maryland. His many certifications include CRISC, CISSP-ISSEP, C|EH, and MCSE: Security as well as the CompTIA A+, Network+, Security+, and Mobility+ certifications.

Acknowledgments This book is dedicated to the many security professionals who daily

work to ensure the safety of our nation’s critical infrastructures. We want to recognize the thousands of dedicated individuals who strive to protect

our national assets but who seldom receive praise and often are only noticed when an incident occurs. To you, we say thank you for a job well

done!

We, the authors of Principles of Computer Security, Fourth Edition, have many individuals who we need to acknowledge—individuals without whom this effort would not have been successful. This edition would not have been possible without Tim Green, whose support and faith in the authors made this edition possible. He brought together an all-star production team that made this book more than just a new edition, but a complete learning system. The list needs to start with those folks at McGraw-Hill Education who

worked tirelessly with the project’s multiple authors and contributors and led us successfully through the minefield that is a book schedule and who took our rough chapters and drawings and turned them into a final, professional product we can be proud of. We thank all the good people from the Acquisitions team, Tim Green and Amy Stonebraker; from the Editorial Services team, Jody McKenzie and Howie Severson; from the Illustration and Production teams, James Kussow and Amarjeet Kumar and the composition team at Cenveo Publisher Services. We also thank the technical editor, Bobby Rogers; the copy editor, Bill McManus; the proofreader, Paul Tyler; and the indexer, Jack Lewis; for all their attention to detail that made this a finer work after they finished with it. We also need to acknowledge our current employers who, to our great

delight, have seen fit to pay us to work in a career field that we all find exciting and rewarding. There is never a dull moment in security, because it is constantly changing. We would like to thank Art Conklin for herding the cats on this one.

Finally, we would each like to individually thank those people who—on a personal basis—have provided the core support for us individually. Without these special people in our lives, none of us could have put this work together.

—The Author Team

To Susan, your love and support is what enables me to do all the things I do.

—Art Conklin, Ph.D. I would like to thank my wife, Charlan, for the tremendous support she has always given me. It doesn’t matter how many times I have sworn that I’ll never get involved with another book project only to return within months to yet another one; through it all, she has remained supportive. I would also like to publicly thank the United States Air Force, which

provided me numerous opportunities since 1986 to learn more about security than I ever knew existed. To whoever it was who decided to send me as a young captain—fresh from completing my master’s degree in artificial intelligence—to my first assignment in computer security: thank you, it has been a great adventure!

—Gregory B. White, Ph.D. Josie, thank you for all the love and support. Macon, John, this is for you.

—Chuck Cothren Geena, thanks for being my best friend and my greatest support. Anything I am is because of you. Love to my kids and grandkids!

—Roger L. Davis To my wife and best friend, Leah, for your love, energy, and support— thank you for always being there. Here’s to many more years together.

—Dwayne Williams

ABOUT THIS BOOK

Important Technology Skills Information technology (IT) offers many career paths, and information security is one of the fastest-growing tracks for IT professionals. This book provides coverage of the materials you need to begin your exploration of information security. In addition to covering all of the CompTIA Security+ exam objectives, additional material is included to help you build a solid introductory knowledge of information security.

Proven Learning Method Keeps You on Track Designed for classroom use and written by instructors for use in their own classes, Principles of Computer Security is structured to give you comprehensive knowledge of information security. The textbook’s active learning methodology guides you beyond mere recall and— through thought-provoking activities, labs, and sidebars—helps you develop critical-thinking, diagnostic, and communication skills.

Effective Learning Tools This feature-rich textbook is designed to make learning easy and enjoyable and to help you develop the skills and critical-thinking abilities that will enable you to adapt to different job situations and to troubleshoot problems. Written by instructors with decades of combined information security experience, this book conveys even the most complex issues in an accessible, easy-to understand format.

Each chapter includes

Learning Objectives that set measurable goals for chapter-by- chapter progress

Illustrations that give you a clear picture of the concepts and technologies

Try This!, Cross Check, and Tech Tip sidebars that encourage you to practice and apply concepts in real-world settings

Notes, Tips, and Warnings that guide you, and Exam Tips that give you advice or provide information specifically related to preparing for the exam

Chapter Summaries and Key Terms Lists that provide you with an easy way to review important concepts and vocabulary

Challenging End-of-Chapter Tests that include vocabulary- building exercises, multiple-choice questions, essay questions, and on-the-job lab projects

CompTIA APPROVED QUALITY CONTENT

It Pays to Get Certified In a digital world, digital literacy is an essential survival skill. Certification demonstrates that you have the knowledge and skill to solve technical or business problems in virtually any business environment. CompTIA certifications are highly valued credentials that qualify you for jobs, increased compensation, and promotion.

CompTIA Security+ Certification Helps Your

Career

Security is one of the highest demand job categories, growing in importance as the frequency and severity of security threats continues to be a major concern for organizations around the world.

Jobs for security administrators are expected to increase by 18% —the skill set required for these types of jobs maps to the CompTIA Security+ certification.

Network Security Administrators can earn as much as $106,000 per year.

CompTIA Security+ is the first step in starting your career as a Network Security Administrator or Systems Security Administrator.

More than 250,000 individuals worldwide are CompTIA Security+ certified.

CompTIA Security+ is regularly used in organizations such as Hitachi Systems, Fuji Xerox, HP, Dell, and a variety of major U.S. government contractors.

Approved by the U.S. Department of Defense (DoD) as one of the required certification options in the DoD 8570.01-M directive, for Information Assurance Technical Level II and Management Level I job roles.

Steps to Getting Certified and Staying Certified 1. Review the exam objectives. Review the certification objectives to

make sure you know what is covered in the exam: http://certification.comptia.org/examobjectives.aspx

2. Practice for the exam. After you have studied for the certification exam, review and answer sample questions to get an idea of what type of questions might be on the exam: http://certification.comptia.org/samplequestions.aspx

3. Purchase an exam voucher. You can purchase exam vouchers on the CompTIA Marketplace, www.comptiastore.com.

4. Take the test! Go to the Pearson VUE website, www.pearsonvue.com/comptia/, and schedule a time to take your exam.

5. Stay certified! Effective January 1, 2011, new CompTIA Security+ certifications are valid for three years from the date of certification. There are a number of ways the certification can be renewed. For more information go to http://certification.comptia.org/ce.

For More Information Visit CompTIA online Go to http://certification.comptia.org/home.aspx to learn more about getting CompTIA certified.

Contact CompTIA Please call 866-835-8020 and choose Option 2, or e-mail questions@comptia.org.

Connect with CompTIA Find CompTIA on Facebook, LinkedIn, Twitter, and YouTube.

http://certification.comptia.org/examobjectives.aspx
http://certification.comptia.org/samplequestions.aspx
http://www.comptiastore.com
http://www.pearsonvue.com/comptia/
http://certification.comptia.org/ce
http://certification.comptia.org/home.aspx
mailto:questions@comptia.org
Content Seal of Quality This courseware bears the seal of CompTIA Approved Quality Content. This seal signifies this content covers 100 percent of the exam objectives and implements important instructional design principles. CompTIA recommends multiple learning tools to help increase coverage of the learning objectives.

CAQC Disclaimer The logo of the CompTIA Approved Quality Content (CAQC) program and the status of this or other training material as “Approved” under the CompTIA Approved Quality Content program signifies that, in CompTIA’s opinion, such training material covers the content of CompTIA’s related certification exam. The contents of this training material were created for the CompTIA

Security+ exam covering CompTIA certification objectives that were current as of the date of publication. CompTIA has not reviewed or approved the accuracy of the contents of

this training material and specifically disclaims any warranties of merchantability or fitness for a particular purpose. CompTIA makes no guarantee concerning the success of persons using any such “Approved” or other training material in order to prepare for any CompTIA certification exam.

CONTENTS AT A GLANCE

Chapter 1 Introduction and Security Trends

Chapter 2 General Security Concepts

Chapter 3 Operational and Organizational Security

Chapter 4 The Role of People in Security

Chapter 5 Cryptography

Chapter 6 Public Key Infrastructure

Chapter 7 PKI Standards and Protocols

Chapter 8 Physical Security

Chapter 9 Network Fundamentals

Chapter 10 Infrastructure Security

Chapter 11 Authentication and Remote Access

Chapter 12 Wireless Security and Mobile Devices

Chapter 13 Intrusion Detection Systems and Network Security

Chapter 14 System Hardening and Baselines

Chapter 15 Types of Attacks and Malicious Software

Chapter 16 E-Mail and Instant Messaging

Chapter 17 Web Components

Chapter 18 Secure Software Development

Chapter 19 Business Continuity and Disaster Recovery, and Organizational Policies

Chapter 20 Risk Management

Chapter 21 Change Management

Chapter 22 Incident Response

Chapter 23 Computer Forensics

Chapter 24 Legal Issues and Ethics

Chapter 25 Privacy

Appendix A CompTIA Security+ Exam Objectives: SY0-401

Appendix B About the Download

Glossary

Index

CONTENTS

Foreword Preface Introduction Instructor Web Site

Chapter 1 Introduction and Security Trends The Computer Security Problem

Definition of Computer Security Historical Security Incidents The Current Threat Environment Threats to Security Security Trends

Targets and Attacks Specific Target Opportunistic Target Minimizing Possible Avenues of Attack

Approaches to Computer Security Ethics Additional References Chapter 1 Review

Chapter 2 General Security Concepts Basic Security Terminology

Security Basics

Security Tenets Security Approaches Security Principles Access Control Authentication Mechanisms Authentication and Access Control Policies

Security Models Confidentiality Models Integrity Models

Chapter 2 Review

Chapter 3 Operational and Organizational Security Policies, Procedures, Standards, and Guidelines

Security Policies Change Management Policy Data Policies Human Resources Policies Due Care and Due Diligence Due Process Incident Response Policies and Procedures

Security Awareness and Training Security Policy Training and Procedures Role-Based Training Compliance with Laws, Best Practices, and Standards User Habits New Threats and Security Trends/Alerts Training Metrics and Compliance

Interoperability Agreements Service Level Agreements Business Partnership Agreement

Memorandum of Understanding Interconnection Security Agreement

The Security Perimeter Physical Security

Physical Access Controls Physical Barriers

Environmental Issues Fire Suppression

Wireless Electromagnetic Eavesdropping

Modern Eavesdropping Chapter 3 Review

Chapter 4 The Role of People in Security People—A Security Problem

Social Engineering Poor Security Practices

People as a Security Tool Security Awareness Security Policy Training and Procedures

Chapter 4 Review

Chapter 5 Cryptography Cryptography in Practice

Fundamental Methods Comparative Strengths and Performance of Algorithms

Historical Perspectives Substitution Ciphers One-Time Pads

Algorithms Key Management Random Numbers

Hashing Functions SHA RIPEMD Message Digest Hashing Summary

Symmetric Encryption DES 3DES AES CAST RC Blowfish Twofish IDEA Block vs. Stream Symmetric Encryption Summary

Asymmetric Encryption Diffie-Hellman RSA ElGamal ECC Asymmetric Encryption Summary Symmetric vs. Asymmetric

Quantum Cryptography Steganography Cryptography Algorithm Use

Confidentiality Integrity

Authentication Nonrepudiation Cipher Suites Key Exchange Key Escrow Session Keys Ephemeral Keys Key Stretching Secrecy Principles Transport Encryption Digital Signatures Digital Rights Management Cryptographic Applications Use of Proven Technologies

Chapter 5 Review

Chapter 6 Public Key Infrastructure The Basics of Public Key Infrastructures Certificate Authorities Registration Authorities

Local Registration Authorities Digital Certificates

Certificate Extensions Certificate Attributes

Certificate Lifecycles Registration and Generation CSR Renewal Suspension Revocation

Key Destruction Certificate Repositories Trust and Certificate Verification Centralized and Decentralized Infrastructures

Hardware Security Modules Private Key Protection Key Recovery Key Escrow

Public Certificate Authorities In-House Certificate Authorities

Choosing Between a Public CA and an In-House CA Outsourced Certificate Authorities Tying Different PKIs Together Trust Models

Certificate-Based Threats Stolen Certificates

Chapter 6 Review

Chapter 7 PKI Standards and Protocols PKIX and PKCS

PKIX Standards PKCS Why You Need to Know the PKIX and PKCS Standards

X.509 SSL/TLS Cipher Suites ISAKMP CMP XKMS S/MIME

IETF S/MIME History IETF S/MIME v3 Specifications

PGP How PGP Works

HTTPS IPsec CEP Other Standards

FIPS Common Criteria WTLS ISO/IEC 27002 (Formerly ISO 17799) SAML

Chapter 7 Review

Chapter 8 Physical Security The Security Problem Physical Security Safeguards

Walls and Guards Physical Access Controls and Monitoring Convergence Policies and Procedures Environmental Controls

Fire Suppression Water-Based Fire Suppression Systems Halon-Based Fire Suppression Systems Clean-Agent Fire Suppression Systems Handheld Fire Extinguishers Fire Detection Devices

Power Protection

UPS Backup Power and Cable Shielding Electromagnetic Interference

Electronic Access Control Systems Access Tokens

Chapter 8 Review

Chapter 9 Network Fundamentals Network Architectures Network Topology Network Protocols

Protocols Packets

Internet Protocol IP Packets TCP vs. UDP ICMP

IPv4 vs. IPv6 Packet Delivery

Ethernet Local Packet Delivery Remote Packet Delivery IP Addresses and Subnetting Network Address Translation

Security Zones DMZ Internet Intranet Extranet Flat Networks

Enclaves VLANs Zones and Conduits

Tunneling Storage Area Networks

iSCSI Fibre Channel FCoE

Chapter 9 Review

Chapter 10 Infrastructure Security Devices

Workstations Servers Virtualization Mobile Devices Device Security, Common Concerns Network Attached Storage Removable Storage

Networking Network Interface Cards Hubs Bridges Switches Routers Firewalls How Do Firewalls Work? Next-Generation Firewalls Web Application Firewalls vs. Network Firewalls Concentrators

Wireless Devices Modems Telephony VPN Concentrator

Security Devices Intrusion Detection Systems Network Access Control Network