Computer security: art and science
Saved in:
| Main Author: | |
|---|---|
| Other Authors: | , |
| Format: | Book |
| Language: | English |
| Published: |
Boston
Addison-Wesley
[2019]
|
| Edition: | Second edition |
| Subjects: | |
| Online Access: | Inhaltsverzeichnis |
| Physical Description: | xlix, 1383 Seiten Illustrationen |
| ISBN: | 9780321712332 0321712331 |
Staff View
MARC
| LEADER | 00000nam a2200000zc 4500 | ||
|---|---|---|---|
| 001 | BV040338702 | ||
| 003 | DE-604 | ||
| 005 | 20220525 | ||
| 007 | t | ||
| 008 | 120727s2019 xxua||| |||| 00||| eng d | ||
| 020 | |a 9780321712332 |9 978-0-321-71233-2 | ||
| 020 | |a 0321712331 |9 0-321-71233-1 | ||
| 035 | |a (OCoLC)802789160 | ||
| 035 | |a (DE-599)BVBBV040338702 | ||
| 040 | |a DE-604 |b ger |e rda | ||
| 041 | 0 | |a eng | |
| 044 | |a xxu |c US | ||
| 049 | |a DE-91G |a DE-706 |a DE-739 |a DE-355 |a DE-573 |a DE-1050 |a DE-898 |a DE-523 |a DE-20 |a DE-522 |a DE-188 | ||
| 084 | |a ST 273 |0 (DE-625)143640: |2 rvk | ||
| 084 | |a ST 277 |0 (DE-625)143643: |2 rvk | ||
| 084 | |a ST 276 |0 (DE-625)143642: |2 rvk | ||
| 084 | |a DAT 460f |2 stub | ||
| 084 | |a DAT 050f |2 stub | ||
| 100 | 1 | |a Bishop, Matt |e Verfasser |0 (DE-588)129811564 |4 aut | |
| 245 | 1 | 0 | |a Computer security |b art and science |c Matt Bishop with contributions from Elisabeth Sullivan and Michelle Ruppel |
| 250 | |a Second edition | ||
| 264 | 1 | |a Boston |b Addison-Wesley |c [2019] | |
| 300 | |a xlix, 1383 Seiten |b Illustrationen | ||
| 336 | |b txt |2 rdacontent | ||
| 337 | |b n |2 rdamedia | ||
| 338 | |b nc |2 rdacarrier | ||
| 650 | 0 | 7 | |a Datensicherung |0 (DE-588)4011144-1 |2 gnd |9 rswk-swf |
| 650 | 0 | 7 | |a Computersicherheit |0 (DE-588)4274324-2 |2 gnd |9 rswk-swf |
| 689 | 0 | 0 | |a Computersicherheit |0 (DE-588)4274324-2 |D s |
| 689 | 0 | |5 DE-604 | |
| 689 | 1 | 0 | |a Datensicherung |0 (DE-588)4011144-1 |D s |
| 689 | 1 | |8 1\p |5 DE-604 | |
| 700 | 1 | |a Sullivan, Elisabeth |4 ctb | |
| 700 | 1 | |a Ruppel, Michelle |4 ctb | |
| 856 | 4 | 2 | |m Digitalisierung UB Passau - ADAM Catalogue Enrichment |q application/pdf |u http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=025192998&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA |3 Inhaltsverzeichnis |
| 999 | |a oai:aleph.bib-bvb.de:BVB01-025192998 | ||
| 883 | 1 | |8 1\p |a cgwrk |d 20201028 |q DE-101 |u https://d-nb.info/provenance/plan#cgwrk | |
Record in the Search Index
| _version_ | 1804149370978828288 |
|---|---|
| adam_text | Contents Preface.......................................................................................................................xxix Acknowledgments......................................................................................................xlv About the Author.................................................................................................... xlix PART I : INTRODUCTION Chapter 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1 An Overview of Computer Security................................................... 3 The Basic Components ............................................................................... 3 1.1.1 Confidentiality............................................................................... 4 1.1.2 Integrity ..........................................................................................5 1.1.3 Availability..................................................................................... 6 Threats.......................................................................................................... 6 Policy and Mechanism................................................................................. 9 1.3.1 Goals of Security....................................................................... 10 Assumptions and Trust ........................................................................... 11 Assurance.................................................................................................. 12 1.5.1
Specification............................................................................... 14 1.5.2 Design......................................................................................... 14 1.5.3 Implementation ......................................................................... 15 Operational Issues................................................................................... 16 1.6.1 Cost-Benefit Analysis................................................................ 16 1.6.2 Risk Analysis............................................................................. 17 1.6.3 Laws and Customs..................................................................... 19 Human Issues..............................................................................................20 1.7.1 Organizational Problems.............................................................20 1.7.2 People Problems........................................................................... 21 Tying It All Together................................................................................. 22 Summary ....................................................................................................24 Research Issues............................................................................................24 Further Reading..........................................................................................25 Exercises...................................................................................................... 25 vii
viii Contents PART II : FOUNDATIONS Chapter 2 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 3.4 3.5 3.6 Access Control Matrix ...................................................................... 31 Protection State.......................................................................................... 31 Access Control Matrix Model................................................................... 32 2.2.1 Access Control by Boolean Expression Evaluation................... 35 2.2.2 Access Controlled by History.......................................................36 Protection State Transitions....................................................................... 37 2.3.1 Conditional Commands...............................................................40 Copying, Owning, and the Attenuationof Privilege.................................42 2.4.1 Copy Right................................................................................... 42 2.4.2 Own Right....................................................................................42 2.4.3 Principle of Attenuation of Privilege.......................................... 43 Summary.................................................................................................... 44 Research Issues............................................................................................44 Further Reading..........................................................................................44 Exercises...................................................................................................... 45 Chapter 3 3.1 3.2 3.3
29 Foundational Results........................................................................ 49 The General Question............................................................................... 49 Basic Results .............................................................................................. 51 The Take-Grant Protection Model ...........................................................56 3.3.1 Sharing of Rights......................................................................... 57 3.3.2 Interpretation of the Model.........................................................61 3.3.3 Theft in the Take-Grant Protection Model................................62 3.3.4 Conspiracy....................................................................................66 3.3.5 Summary ......................................................................................68 Closing the Gap: The Schematic Protection Model ................................68 3.4.1 Link Predicate................................................................................69 3.4.2 Filter Function..............................................................................70 3.4.3 Putting It All Together................................................................. 71 3.4.4 Demand and Create Operations.................................................. 72 3.4.5 Safety Analysis............................................................................. 75 Expressive Power and the Models.............................................................81 3.5.1 Brief Comparison of HRU and SPM
........................................82 3.5.2 Extending SPM ........................................................................... 83 3.5.3 Simulation and Expressiveness.....................................................88 3.5.4 Typed Access Matrix Model.........................................................92 Comparing Security Properties of Models.............................................. 94 3.6.1 Comparing Schemes and Security Properties ........................... 95 3.6.2 Augmented Typed Access Matrix Model....................................99
Contents 3.7 3.8 3.9 3.10 Summary................................................................................................ Research Issues....................................................................................... Further Reading..................................................................................... Exercises.................................................................................................. PART III : POLICY Chapter 4 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10 4.11 5.1 5.2 5.3 5.4 5.5 5.6 5.7 5.8 101 102 102 103 107 Security Policies.......................................................................... 109 The Nature of Security Policies............................................................ Types of Security Policies....................................................................... The Role of Trust................................................................................... Types of Access Control ....................................................................... Policy Languages................................................................................... 4.5.1 High-Level Policy Languages.................................................. 4.5.2 Low-Level Policy Languages.................................................. Example: Academic Computer Security Policy................................... 4.6.1 General University Electronic Communications Policy ....................................................................................... 4.6.2 Implementation at UC
Davis.................................................. Security and Precision........................................................................... Summary................................................................................................ Research Issues....................................................................................... Further Reading..................................................................................... Exercises.................................................................................................. Chapters IX 109 113 115 117 118 119 125 126 127 130 131 136 136 137 138 Confidentiality Policies................................................................ 141 Goals of Confidentiality Policies.......................................................... 141 The Bell-LaPadula Model..................................................................... 142 5.2.1 Informal Description.............................................................. 142 5.2.2 Example: Trusted Solaris........................................................ 146 5.2.3 Formal Model........................................................................... 151 5.2.4 Example Model Instantiation: Multics................................. 158 Tranquility.............................................................................................. 161 5.3.1 Declassification Principles...................................................... 163 The Controversy over the Bell-LaPadula Model................................. 164 5.4.1 McLean’s f-Property
and the Basic Security Theorem........ 164 5.4.2 McLean’s System Z and More Questions............................... 166 Summary................................................................................................ 169 Research Issues....................................................................................... 169 Further Reading..................................................................................... 170 Exercises.................................................................................................. 171
x Contents Chapter 6 6.1 6.2 6.3 6.4 6.5 6.6 6.7 6.8 6.9 Goals ...................................................................................................... The Biba Model..................................................................................... 6.2.1 Low-Water-Mark Policy.......................................................... 6.2.2 Ring Policy............................................................................... 6.2.3 Biba’s Model (Strict Integrity Policy)...................................... Lipner’s Integrity Matrix Model.......................................................... 6.3.1 Lipner’s Use of the Bell-LaPadula Model............................. 6.3.2 Lipner’s Full Model................................................................. 6.3.3 Comparison with Biba............................................................ Clark-Wilson Integrity Model............................................................... 6.4.1 The Model............................................................................... 6.4.2 Comparison with the Requirements........................................ 6.4.3 Comparison with Other Models.............................................. Trust Models .......................................................................................... 6.5.1 Policy-Based Trust Management............................................ 6.5.2 Reputation-Based Trust Management................................... Summary................................................................................................ Research
Issues....................................................................................... Further Reading..................................................................................... Exercises.................................................................................................. Chapter 7 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 173 175 176 177 177 178 178 181 182 183 184 187 188 189 191 194 196 196 197 198 Availability Policies........................................................................... 201 Goals of Availability Policies................................................................... 201 Deadlock.................................................................................................. 202 Denial of Service Models......................................................................... 203 7.3.1 Constraint-Based Model ...........................................................204 7.3.2 State-Based Modes..................................................................... 210 Example: Availability and Network Flooding........................................ 215 7.4.1 Analysis ......................................................................................216 7.4.2 Intermediate Systems................................................................. 216 7.4.3 TCP State and Memory Allocations........................................ 218 7.4.4 Other Flooding Attacks.............................................................221 Summary..................................................................................................
222 Research Issues.......................................................................................... 222 Further Reading........................................................................................223 Exercises.................................................................................................... 224 Chapter 8 8.1 Integrity Policies............................................................................... 173 Hybrid Policies ................................................................................. 227 Chinese Wall Model.................................................................................. 227 8.1.1 Informal Description................................................................. 228 8.1.2 Formal Model............................................................................. 230
Contents 8.2 8.3 8.4 8.5 8.6 8.7 8.8 8.9 8.1.3 Aggressive Chinese Wall Model................................................ 233 8.1.4 Bell-LaPadula and Chinese WallModels...................................234 8.1.5 Clark-Wilson and Chinese Wall Models..................................236 Clinical Information Systems SecurityPolicy.........................................236 8.2.1 Bell-LaPadula and Clark-Wilson Models............................... 239 Originator Controlled Access Control.................................................... 239 8.3.1 Digital Rights Management...................................................... 241 Role-Based Access Control .....................................................................244 Break-the-Glass Policies........................................................................ 249 Summary.................................................................................................. 250 Research Issues..........................................................................................250 Further Reading........................................................................................251 Exercises.................................................................................................... 252 Chapter 9 9.1 9.2 9.3 9.4 9.5 9.6 9.7 9.8 9.9 9.10 Noninterference and Policy Composition.................................... 255 The Problem..............................................................................................255 9.1.1 Composition of Bell-LaPadula Models....................................256
Deterministic Noninterference.................................................................259 9.2.1 Unwinding Theorem .................................................................263 9.2.2 Access Control Matrix Interpretation......................................266 9.2.3 Security Policies That ChangeoverTime....................................268 9.2.4 Composition of Deterministic Noninterference-Secure Systems........................................................................................270 Nondeducibility........................................................................................271 9.3.1 Composition of Deducibly Secure Systems............................. 273 Generalized Noninterference...................................................................274 9.4.1 Composition of Generalized Noninterference Systems........ 275 Restrictiveness..........................................................................................277 9.5.1 State Machine Model.................................................................277 9.5.2 Composition of Restrictive Systems ........................................279 Side Channels and Deducibility...............................................................280 Summary.................................................................................................. 282 Research Issues..........................................................................................283 Further Reading........................................................................................283
Exercises.................................................................................................... 285 PART IV : IMPLEMENTATION I: CRYPTOGRAPHY Chapter 10 10.1 XI 287 Basic Cryptography...................................................................... 289 Cryptography............................................................................................ 289 10.1.1 Overview of Cryptanalysis.........................................................290
xii Contents 10.2 Symmetric Cryptosystems....................................................................... 291 10.2.1 Transposition Ciphers ...............................................................291 10.2.2 Substitution Ciphers................................................................... 292 10.2.3 Data Encryption Standard.........................................................299 10.2.4 Other Modern Symmetric Ciphers............................................ 302 10.2.5 Advanced Encryption Standard................................................ 303 Public Key Cryptography......................................................................... 306 10.3.1 El Gamal......................................................................................307 10.3.2 RSA .......................................................................................... 309 10.3.3 Elliptic Curve Ciphers............................................................... 312 Cryptographic Checksums....................................................................... 315 10.4.1 HMAC........................................................................................317 Digital Signatures......................................................................................318 10.5.1 Symmetric Key Signatures.........................................................319 10.5.2 Public Key Signatures................................................................. 319 Summary.................................................................................................. 323
Research Issues.......................................................................................... 324 Further Reading........................................................................................ 325 Exercises.................................................................................................. 326 10.3 10.4 10.5 10.6 10.7 10.8 10.9 Chapter 11 11.1 11.2 11.3 11.4 11.5 11.6 11.7 11.8 11.9 Key Management............................................................................. 331 Session and Interchange Keys................................................................. 332 Key Exchange............................................................................................ 332 11.2.1 Symmetric Cryptographic Key Exchange................................333 11.2.2 Kerberos......................................................................................337 11.2.3 Public Key Cryptographic Key Exchange and Authentication........................................................................... 338 Key Generation........................................................................................ 341 Cryptographic Key Infrastructures..........................................................343 11.4.1 Merkle’s Tree Authentication Scheme...................................... 344 . 11.4.2 Certificate Signature Chains........................................................346 11.4.3 Public Key Infrastructures.........................................................350 Storing and Revoking
Keys..................................................................... 353 11.5.1 Key Storage ................................................................................353 11.5.2 Key Revocation ......................................................................... 358 Summary.................................................................................................. 359 Research Issues....................................................................................... 360 Further Reading........................................................................................361 Exercises.................................................................................................... 362
Contents Chapter 12 12.1 12.2 12.3 12.4 12.5 12.6 12.7 12.8 12.9 13.4 Cipher Techniques........................................................................ 367 Problems........................... 367 12.1.1 Precomputing the Possible Messages........................................367 12.1.2 Misordered Blocks.................................................................. 368 12.1.3 Statistical Regularities ...............................................................368 12.1.4 Type Flaw Attacks..................................................................... 369 12.1.5 Summary ....................................................................................370 Stream and Block Ciphers....................................................................... 370 12.2.1 Stream Ciphers........................................................................ 371 12.2.2 Block Ciphers............................................................................. 374 Authenticated Encryption..................................................................... 377 12.3.1 Counter with CBC-MAC Mode................................................ 377 12.3.2 Galois Counter Mode.................................................................379 Networks and Cryptography...................................................................381 Example Protocols....................................................................................384 12.5.1 Secure Electronic Mail: PEM and OpenPGP................................................................................... 384
12.5.2 Instant Messaging....................................................................... 389 12.5.3 Security at the Transport Layer: TLS and SSL....................... 393 12.5.4 Security at the Network Layer: IPsec........................................402 12.5.5 Conclusion................................................................................. 410 Summary.................................................................................................. 410 Research Issues..........................................................................................411 Further Reading....................................................................................... 411 Exercises.................................................................................................... 413 Chapter 13 13.1 13.2 13.3 xiii Authentication................................................................................. 415 Authentication Basics............................................................................... 415 Passwords.................................................................................................. 416 Password Selection................................................................................... 418 13.3.1 Random Selection of Passwords..............................................418 13.3.2 Pronounceable and Other Computer-Generated Passwords................................................................................... 420 13.3.3 User Selection of Passwords...................................................... 421 13.3.4
Graphical Passwords .................................................................425 Attacking Passwords ............................................................................... 426 13.4.1 Off-Line Dictionary Attacks .................................................... 428 13.4.2 On-Line Dictionary Attacks .................................................... 430 13.4.3 Password Strength .....................................................................432
xiv Contents 13.5 Password Aging........................................................................................434 13.5.1 One-Time Passwords ................................................................. 436 Challenge-Response..................................................................................438 13.6.1 Pass Algorithms......................................................................... 438 13.6.2 Hardware-Supported Challenge-Response Procedures........ 439 13.6.3 Challenge-Response and Dictionary Attacks ......................... 439 Biometrics ................................................................................................ 441 13.7.1 Fingerprints............................................................................... 442 13.7.2 Voices..........................................................................................443 13.7.3 Eyes.............................................................................................. 443 13.7.4 Faces............................................................................................ 444 13.7.5 Keystrokes ..................................................................................444 13.7.6 Combinations............................................................................. 445 Location.................................................................................................... 445 Multifactor Authentication..................................................................... 446
Summary.................................................................................................. 448 Research Issues..........................................................................................449 Further Reading........................................................................................450 Exercises.................................................................................................... 451 13.6 13.7 13.8 13.9 13.10 13.11 13.12 13.13 PART V : IMPLEMENTATION II: SYSTEMS Chapter 14 14.1 14.2 14.3 14.4 14.5 14.6 Design Principles ........................................................................... 455 Underlying Ideas......................................................................................455 Principles of Secure Design..................................................................... 457 14.2.1 Principle of Least Privilege ...................................................... 457 14.2.2 Principle of Fail-Safe Defaults.................................................. 458 14.2.3 Principle of Economy of Mechanism ......................................459 14.2.4 Principle of Complete Mediation.............................................. 460 14.2.5 Principle of Open Design...........................................................461 14.2.6 Principle of Separation of Privilege.......................................... 463 14.2.7 Principle of Least Common Mechanism..................................463 14.2.8 Principle of Least Astonishment.............................................. 464 Summary
.................................................................................................. 466 Research Issues..........................................................................................466 Further Reading........................................................................................467 Exercises.................................................................................................... 468 Chapter 15 15.1 15.2 15.3 453 Representing Identity.................................................................... 471 What Is Identity?......................................................................................471 Files and Objects......................................................................................472 Users.......................................................................................................... 473
Contents XV 15.4 15.5 Groups and Roles......................................................................................475 Naming and Certificates ......................................................................... 476 15.5.1 Conflicts......................................................................................479 15.5.2 The Meaning of the Identity.................................................... 481 15.5.3 Trust............................................................................................482 15.6 Identity on the Web................................................................................. 484 15.6.1 Host Identity ............................................................................. 484 15.6.2 State and Cookies.......................................................................488 15.7 Anonymity on the Web ........................................................................... 490 15.7.1 Email Anonymizers...................................................................491 15.7.2 Onion Routing........................................................................... 495 15.8 Summary.................................................................................................. 501 15.9 Research Issues..........................................................................................502 15.10 Further Reading........................................................................................503 15.11
Exercises.................................................................................................... 504 Chapter 16 16.1 16.2 16.3 16.4 16.5 16.6 16.7 16.8 16.9 Access Control Lists................................................................................. 507 16.1.1 Abbreviations of Access Control Lists......................................508 16.1.2 Creation and Maintenance of Access Control Lists............... 511 16.1.3 Revocation of Rights.................................................................514 16.1.4 Example: NTFS and Access Control Lists ............................. 515 Capabilities.............................................................................................. 518 16.2.1 Implementation of Capabilities................................................ 519 16.2.2 Copying and Amplifying Capabilities......................................520 16.2.3 Revocation of Rights.................................................................522 16.2.4 Limits of Capabilities.................................................................522 16.2.5 Comparison with Access Control Lists....................................523 16.2.6 Privileges................................................................................... 524 Locks and Keys..................................................................................... 526 16.3.1 Type Checking........................................................................... 528 16.3.2 Sharing Secrets........................................................................... 529 Ring-Based
Access Control.................................................................. 531 Propagated Access Control Lists.............................................................533 Summary.................................................................................................. 535 Research Issues..........................................................................................535 Further Reading..................................................................................... 536 Exercises.................................................................................................... 536 Chapter 17 17.1 Access Control Mechanisms....................................................... 507 Information Flow............................................................................ 539 Basics and Background............................................................................ 539 17.1.1 Entropy-Based Analysis.............................................................540 17.1.2 Information Flow Models and Mechanisms........................... 541
xvi Contents 17.2 Nonlattice Information Flow Policies.....................................................542 17.2.1 Confinement Flow Model .........................................................543 17.2.2 Transitive Nonlattice Information Flow Policies..................... 544 17.2.3 Nontransitive Information Flow Policies..................................545 17.3 Static Mechanisms....................................................................................548 17.3.1 Declarations................................................................................549 17.3.2 Program Statements................................................................... 550 17.3.3 Exceptions and Infinite Loops...................................................557 17.3.4 Concurrency................................................................................558 17.3.5 Soundness....................................................................................561 17.4 Dynamic Mechanisms..............................................................................562 17.4.1 Fenton’s Data Mark Machine.................................................. 562 17.4.2 Variable Classes......................................................................... 565 17.5 Integrity Mechanisms ..............................................................................566 17.6 Example Information Flow Controls.......................................................567 17.6.1 Privacy and Android Cell Phones ............................................ 568 17.6.2
Firewalls...................................................................................... 570 17.7 Summary.................................................................................................. 574 17.8 Research Issues.......................................................................................... 574 17.9 Further Reading........................................................................................ 575 17.10 Exercises.................................................................................................. 576 Chapter 18 18.1 18.2 18.3 18.4 18.5 18.6 18.7 Confinement Problem.................................................................... 579 The Confinement Problem....................................................................... 579 Isolation.................................................................................................. 582 18.2.1 Controlled Environment............................................................. 582 18.2.2 Program Modification............................................................... 590 Covert Channels........................................................................................ 594 18.3.1 Detection of Covert Channels...................................................596 18.3.2 Analysis of Covert Channels.....................................................610 18.3.3 Mitigation of Covert Channels ................................................ 616 Summary.................................................................................................. 619 Research
Issues.......................................................................................... 620 Further Reading........................................................................................620 Exercises.................................................................................................... 622 PART VI : ASSURANCE 625 Contributed by Elisabeth Sullivan and Michelle Ruppel Chapter 19 19.1 Introduction to Assurance............................................................ 627 Assurance and Trust.................................................................................. 627 19.1.1 The Need for Assurance............................................................. 629
Contents 19.2 19.3 19.4 19.5 19.6 19.1.2 The Role of Requirements in Assurance................................. 63! 19.1.3 Assurance throughout the Life Cycle........................................632 Building Secure and Trusted Systems .................................................... 634 19.2.1 Life Cycle....................................................................................634 19.2.2 The Waterfall Life Cycle Model................................................ 639 19.2.3 Agile Software Development.................................................... 641 19.2.4 Other Models of Software Development..................................644 Summary.................................................................................................. 645 Research Issues..........................................................................................645 Further Reading........................................................................................646 Exercises.................................................................................................... 647 Chapter 20 20.1 20.2 20.3 20.4 20.5 20.6 20.7 20.8 xvii Building Systems with Assurance............................................... 649 Assurance in Requirements Definition and Analysis.............................. 649 20.1.1 Threats and Security Objectives.................................................650 20.1.2 Architectural Considerations.................................................... 651 20.1.3 Policy Definition and Requirements Specification................... 657 20.1.4
Justifying Requirements.............................................................660 Assurance during System and Software Design ....................................662 20.2.1 Design Techniques That Support Assurance........................... 662 20.2.2 Design Document Contents...................................................... 665 20.2.3 Building Documentation and Specification............................. 675 20.2.4 Justifying That Design Meets Requirements........................... 677 Assurance in Implementation and Integration......................................685 20.3.1 Implementation Considerations That Support Assurance....................................................................................685 20.3.2 Assurance through Implementation Management................... 686 20.3.3 Justifying That the Implementation Meets the Design................................................................................... 687 Assurance during Operation and Maintenance......................................695 Summary .................................................................................................. 696 Research Issues..........................................................................................696 Further Reading........................................................................................697 Exercises.................................................................................................... 698 Chapter 21 Formal Methods............................................................................... 699 21.1 Formal
Verification Techniques................................................................699 21.2 Formal Specification ............................................................................... 702 21.3 Early Formal Verification Techniques.................................................... 705 21.3.1 The Hierarchical Development Methodology......................... 705 21.3.2 Enhanced HDM......................................................................... 710 21.3.3 The Gypsy Verification Environment........................................711
xviii Contents 21.4 Current Verification Systems................................................................... 713 21.4.1 The Prototype Verification System............................................ 713 21.4.2 The Symbolic Model Verifier.....................................................716 21.4.3 The Naval Research Laboratory Protocol Analyzer............... 720 21.5 Functional Programming Languages.......................................................721 21.6 Formally Verified Products ..................................................................... 722 21.7 Summary.................................................................................................. 723 21.8 Research Issues.......................................................................................... 724 21.9 Further Reading........................................................................................725 21.10 Exercises.................................................................................................. 725 Chapter 22 22.1 22.2 22.3 22.4 22.5 22.6 22.7 22.8 Evaluating Systems ...................................................................... 727 Goals of Formal Evaluation................................................................... 727 22.1.1 Deciding to Evaluate................................................................. 728 22.1.2 Historical Perspective of Evaluation Methodologies...............729 TCSEC: 1983-1999 ............................................................................... 730 22.2.1 TCSEC Requirements
............................................................... 731 22.2.2 The TCSEC Evaluation Classes................................................ 733 22.2.3 The TCSEC Evaluation Process................................................ 734 22.2.4 Impacts........................................................................................735 International Efforts and the ITSEC:1991-2001 ................................. 737 22.3.1 ITSEC Assurance Requirements.............................................. 739 22.3.2 The ITSEC Evaluation Levels...................................................740 22.3.3 The ITSEC Evaluation Process................................................ 741 22.3.4 Impacts........................................................................................741 Commercial International Security Requirements: 1991 ..................... 742 22.4.1 CISR Requirements................................................................... 743 22.4.2 Impacts........................................................................................743 Other Commercial Efforts: Early 1990s.................................................. 744 The Federal Criteria: 1992 ..................................................................... 744 22.6.1 FC Requirements....................................................................... 745 22.6.2 Impacts........................................................................................ 745 FIPS 140: 1994-Present............................................................................746 22.7.1 FIPS 140
Requirements.............................................................746 22.7.2 FIPS 140-2 Security Levels.........................................................747 22.7.3 Additional FIPS 140-2 Documentation.................................... 748 22.7.4 Impact.......................................................................................... 748 22.7.5 Future.......................................................................................... 749 The Common Criteria: 1998-Present .....................................................749 22.8.1 Overview of the Methodology...................................................751 22.8.2 CC Requirements....................................................................... 756 22.8.3 CC Security Functional Requirements...................................... 756
Contents 22.9 22.10 22.11 22.12 22.13 22.8.4 Assurance Requirements...........................................................759 22.8.5 Evaluation Assurance Levels.................................................... 759 22.8.6 Evaluation Process.....................................................................761 22.8.7 Other International Organizations............................................762 22.8.8 Impacts..................................................................................... 763 22.8.9 Future of the Common Criteria................................................ 764 SSE-CMM: 1997-Present ..................................................................... 765 22.9.1 The SSE-CMM Model...............................................................765 22.9.2 Using the SSE-CMM.................................................................767 Summary.................................................................................................. 768 Research Issues....................................................................................... 769 Further Reading........................................................................................769 Exercises.................................................................................................... 770 PART VII : SPECIAL TOPICS Chapter 23 23.1 23.2 23.3 23.4 23.5 23.6 23.7 23.8 23.9 XIX 773 Malware........................................................................................... 775
Introduction..............................................................................................775 Trojan Horses............................................................................................776 23.2.1 Rootkits ......................................................................................Ill 23.2.2 Propagating Trojan Horses........................................................ 779 Computer Viruses ................................................................................... 780 23.3.1 Infection Vectors ....................................................................... 782 23.3.2 Concealment............................................................................... 785 23.3.3 Summary ................................................................................... 790 Computer Worms......................................................................................790 Bots and Botnets......................................................................................793 Other Malware..........................................................................................796 23.6.1 Rabbits and Bacteria .................................................................796 23.6.2 Logic Bombs............................................................................. 797 23.6.3 Adware........................................................................................797 23.6.4 Spyware ................................................................................... 799 23.6.5
Ransomware............................................................................... 800 23.6.6 Phishing................................................................................... 802 Combinations............................................................................................803 Theory of ComputerViruses.................................................................... 803 Defenses.................................................................................................... 808 23.9.1 Scanning Defenses.....................................................................808 23.9.2 Data and Instructions.................................................................811 23.9.3 Containment............................................................................... 812 23.9.4 Specifications as Restrictions.................................................... 817
xx 23.10 23.11 23.12 23.13 Contents 23.9.5 Limiting Sharing......................................................................... 817 23.9.6 Statistical Analysis..................................................................... 819 23.9.7 The Notion of Trust................................................................... 819 Summary................................................................................................ 820 Research Issues........................................................................................ 820 Further Reading..................................................................................... 821 Exercises.................................................................................................. 822 Chapter 24 24.1 24.2 Vulnerability Analysis.................................................................... 825 Introduction............................................................................................ 825 Penetration Studies ..................................................................................827 24.2.1 Goals .......................................................................................... 827 24.2.2 Layering of Tests....................................................................... 828 24.2.3 Methodology at Each Layer.......................................................829 24.2.4 Flaw Hypothesis Methodology................................................ 830 24.2.5 Versions ......................................................................................833 24.2.6
Example: Penetration of the Michigan Terminal System.......................................................................................... 837 24.2.7 Example: Compromise of a Burroughs System....................... 839 24.2.8 Example: Penetration of a Corporate Computer System . . . 840 24.2.9 Example: Penetrating a UNIX System...................................... 841 24.2.10 Example: Penetrating a Windows System................................843 24.2.11 Debate.......................................................................................... 844 24.2.12 Conclusion..................................................................................845 24.3 Vulnerability Classification..................................................................... 845 24.3.1 Two Security Flaws..................................................................... 846 24.4 Frameworks.............................................................................................. 849 24.4.1 The RISOS Study....................................................................... 849 24.4.2 Protection Analysis Model.........................................................851 24.4.3 The NRL Taxonomy................................................................. 857 24.4.4 Aslam’s Model........................................................................... 859 24.4.5 Comparison and Analysis .........................................................860 24.5 Standards.................................................................................................. 864 24.5.1 Common
Vulnerabilities and Exposures (CVE) ..................... 864 24.5.2 Common Weaknesses and Exposures (CWE)..........................866 24.6 Gupta and Gligor’s Theory of Penetration Analysis..............................868 24.6.1 The Flow-Based Model of Penetration Analysis..................... 869 24.6.2 The Automated Penetration Analysis Tool..............................872 24.6.3 Discussion....................................................................................873 24.7 Summary.................................................................................................. 873 24.8 Research Issues.......................................................................................... 874 24.9 Further Reading........................................................................................ 875 24.10 Exercises.................................................................................................. 876
Contents Chapter 25 XXI Auditing........................................................................................... 879 25.1 25.2 Definition.................................................................................................. 879 Anatomy of an Auditing System.............................................................880 25.2.1 Logger..........................................................................................881 25.2.2 Analyzer................................................................................... 883 25.2.3 Notifier........................................................................................883 25.3 Designing an Auditing System.................................................................884 25.3.1 Implementation Considerations................................................ 886 25.3.2 Syntactic Issues........................................................................ 887 25.3.3 Log Sanitization......................................................................... 888 25.3.4 Application and System Logging.............................................. 891 25.4 A Posteriori Design ................................................................................. 893 25.4.1 Auditing to Detect Violations of a Known Policy................... 893 25.4.2 Auditing to Detect Known Violations of a Policy................... 895 25.5 Auditing Mechanisms ............................................................................. 897 25.5.1 Secure
Systems......................................................................... 897 25.5.2 Nonsecure Systems.....................................................................899 25.6 Examples: Auditing File Systems.............................................................900 25.6.1 Audit Analysis of the NFS Version 2 Protocol....................... 900 25.6.2 The Logging and Auditing File System (LAFS)..................... 905 25.6.3 Comparison ............................................................................... 907 25.6.4 Audit Browsing........................................................................... 908 25.7 Summary.................................................................................................. 910 25.8 Research Issues..........................................................................................911 25.9 Further Reading........................................................................................912 25.10 Exercises.................................................................................................... 913 Chapter 26 26.1 26.2 26.3 26.4 26.5 Intrusion Detection........................................................................ 917 Principles..................................................................................................917 Basic Intrusion Detection .......................................................................918 Models...................................................................................................... 920 26.3.1 Anomaly Modeling
...................................................................920 26.3.2 Misuse Modeling....................................................................... 932 26.3.3 Specification Modeling...............................................................938 26.3.4 Summary ................................................................................... 941 Architecture..............................................................................................942 26.4.1 Agent ..........................................................................................943 26.4.2 Director ......................................................................................945 26.4.3 Notifier........................................................................................946 Organization of Intrusion Detection Systems........................................948 26.5.1 Monitoring Network Traffic for Intrusions: NSM................... 948 26.5.2 Combining Host and Network Monitoring: DIDS................. 949 26.5.3 Autonomous Agents: AAFID.................................................. 952
xxii 26.6 26.7 26.8 26.9 Contents Summary.................................................................................................. 954 Research Issues..........................................................................................954 Further Reading........................................................................................955 Exercises.................................................................................................... 956 Chapter 27 27.1 27.2 27.3 27.4 27.5 27.6 27.7 27.8 Attacks and Responses................................................................ 959 Attacks...................................................................................................... 959 Representing Attacks................................................................................960 27.2.1 Attack Trees................................................................................961 27.2.2 The Requires/Provides Model .................................................. 965 27.2.3 Attack Graphs........................................................................... 969 Intrusion Response ..................................................................................971 27.3.1 Incident Prevention ................................................................... 971 27.3.2 Intrusion Handling..................................................................... 975 Digital Forensics ......................................................................................987 27.4.1 Principles
....................................................................................987 27.4.2 Practice........................................................................................990 27.4.3 Anti-Forensics ........................................................................... 994 Summary.................................................................................................. 996 Research Issues.......................................................................................... 997 Further Reading........................................................................................998 Exercises.................................................................................................... 999 PART VIII : PRACTICUM Chapter 28 28.1 28.2 28.3 28.4 1003 Network Security........................................................................... 1005 Introduction.......................................................................................... Policy Development............................................................................. 28.2.1 Data Classes........................................................................... 28.2.2 User Classes........................................................................... 28.2.3 Availability............................................................................. 28.2.4 Consistency Check................................................................. Network Organization......................................................................... 28.3.1 Analysis of the Network
Infrastructure................................ 28.3.2 In the DMZ........................................................................... 28.3.3 In the Internal Network........................................................ 28.3.4 General Comment onAssurance........................................... Availability............................................................................................ 1005 1006 1007 1008 1010 1010 1011 1013 1017 1021 1025 1026
Contents 28.5 28.6 28.7 28.8 28.9 Anticipating Attacks........................................................................... Summary.............................................................................................. Research Issues..................................................................................... Further Reading................................................................................... Exercises................................................................................................ Chapter 29 29.1 29.2 xxiii 1027 1028 1028 1029 1030 System Security .......................................................................... 1035 Introduction......................................................................................... Policy.................................................................................................... 29.2.1 The WWW Server System in the DMZ................................ 29.2.2 The Development System...................................................... 29.2.3 Comparison........................................................................... 29.2.4 Conclusion............................................................................. 29.3 Networks.............................................................................................. 29.3.1 The WWW Server System in the DMZ................................ 29.3.2 The Development System...................................................... 29.3.3 Comparison........................................................................... 29.4
Users...................................................................................................... 29.4.1 The WWW Server System in the DMZ................................ 29.4.2 The Development System...................................................... 29.4.3 Comparison ........................................................................... 29.5 Authentication..................................................................................... 29.5.1 The WWW Server System in the DMZ................................ 29.5.2 Development Network System.............................................. 29.5.3 Comparison ........................................................................... 29.6 Processes................................................................................................ 29.6.1 The WWW Server System in the DMZ................................ 29.6.2 The Development System...................................................... 29.6.3 Comparison........................................................................... 29.7 Files...................................................................................................... 29.7.1 The WWW Server System in the DMZ................................ 29.7.2 The Development System...................................................... 29.7.3 Comparison........................................................................... 29.8 Retrospective....................................................................................... 29.8.1 The WWW Server System in the
DMZ................................ 29.8.2 The Development System...................................................... 29.9 Summary.............................................................................................. 29.10 Research Issues..................................................................................... 29.11 Further Reading................................................................................... 29.12 Exercises................................................................................................ 1035 1036 1036 1037 1041 1041 1042 1042 1045 1047 1048 1048 1050 1052 1053 1053 1054 1055 1055 1055 1059 1060 1061 1061 1063 1065 1066 1066 1067 1068 1068 1069 1070
XXIV Contents Chapter 30 30.1 30.2 30.3 30.4 30.5 30.6 30.7 30.8 30.9 Policy.................................................................................................... Access.................................................................................................... 30.2.1 Passwords............................................................................... 30.2.2 The Login Procedure............................................................. 30.2.3 Leaving the System................................................................. Files and Devices................................................................................. 30.3.1 Files ........................................................................................ 30.3.2 Devices................................................................................... Processes................................................................................................ 30.4.1 Copying and Moving Files.................................................... 30.4.2 Accidentally Overwriting Files.............................................. 30.4.3 Encryption, Cryptographic Keys, and Passwords............... 30.4.4 Startup Settings..................................................................... 30.4.5 Limiting Privileges................................................................. 30.4.6 Malicious Logic..................................................................... Electronic Communications................................................................. 30.5.1 Automated Electronic Mail
Processing............................... 30.5.2 Failure to Check Certificates................................................ 30.5.3 Sending Unexpected Content................................................ Summary.............................................................................................. Research Issues..................................................................................... Further Reading................................................................................... Exercises................................................................................................ Chapter 31 31.1 31.2 31.3 31.4 31.5 User Security................................................................................. 1073 1073 1074 1074 1076 1079 1080 1080 1084 1087 1087 1088 1089 1090 1091 1091 1092 1092 1093 1094 1094 1095 1095 1096 Program Security ........................................................................ 1099 Problem ................................................................................................ Requirements and Policy..................................................................... 31.2.1 Requirements......................................................................... 31.2.2 Threats................................................................................... Design .................................................................................................. 31.3.1 Framework............................................................................. 31.3.2 Access to Roles and
Commands............................................ Refinement and Implementation........................................................ 31.4.1 First-Level Refinement.......................................................... 31.4.2 Second-Level Refinement...................................................... 31.4.3 Functions............................................................................... 31.4.4 Summary ............................................................................... Common Security-Related Programming Problems......................... 31.5.1 Improper Choice of Initial Protection Domain................... 31.5.2 Improper Isolation of Implementation Detail..................... 1099 1100 1100 1102 1104 1104 1106 1111 1111 1112 1114 1117 1117 1118 1123
Contents 31.5.3 Improper Change................................................................... 31.5.4 Improper Naming.................................................................. 31.5.5 Improper Deallocation or Deletion..................................... 31.5.6 Improper Validation.............................................................. 31.5.7 Improper Indivisibility.......................................................... 31.5.8 Improper Choice of Operand or Operation......................... 31.5.9 Summary ............................................................................... 31.6 Testing, Maintenance,and Operation................................................. 31.6.1 Testing ................................................................................... 31.6.2 Testing Composed Modules.................................................. 31.6.3 Testing the Program.............................................................. 31.7 Distribution......................................................................................... 31.8 Summary.............................................................................................. 31.9 Research Issues..................................................................................... 31.10 Further Reading................................................................................... 31.11 Exercises................................................................................................ PART IX : APPENDICES Appendix A xxv 1125 1129 1131 1132 1138 1139 1141 1141 1142 1145 1145
1146 1147 1147 1148 1148 1151 Lattices........................................................................................ 1153 A.l Basics..................................................................................................... 1153 A.2 Lattices................................................................................................... 1154 A. 3 Exercises................................................................................................. 1155 AppendixB B. I B.2 B.3 B.4 B. 5 The Euclidean Algorithm ................................................................... The Extended Euclidean Algorithm .................................................. Solving ax mod n = 1............................................................................ Solving ax mod n — b............................................................................ Exercises................................................................................................. Appendixe C. 1 C.2 C.3 C.4 The Extended Euclidean Algorithm....................................... 1157 1157 1158 1160 1161 1161 Entropy and Uncertainty........................................................... 1163 Conditional and JointProbability........................................................ Entropy and Uncertainty...................................................................... Joint and Conditional Entropy........................................................... C.3.1 Joint Entropy......................................................................... C.3.2 Conditional Entropy
............................................................. C.3.3 Perfect Secrecy....................................................................... Exercises................................................................................................ 1163 1165 1166 1166 1167 1168 1169
XXVI Contents Appendix D Virtual Machines ........................................................................ D.l D.2 Virtual Machine Structure................................................................... Virtual Machine Monitor .................................................................... D.2.1 Privilege and Virtual Machines............................................ D.2.2 Physical Resources and Virtual Machines............................ D.2.3 Paging and Virtual Machines................................................. D. 3 Exercises................................................................................................. Appendix E G. 1 1179 1180 1180 1181 1182 1182 1183 1184 1185 1186 1186 1186 1188 The Encryption Standards.......................................................... 1191 F. l Data Encryption Standard.................................................................... F.1.1 Main DES Algorithm............................................................. F.1.2 Round Key Generation ......................................................... F.2 Advanced Encryption Standard........................................................... F.2.1 Background ............................................................................ F.2.2 AES Encryption..................................................................... F.2.3 Encryption.............................................................................. F.2.4 Round Key Generation ......................................................... F.2.5 Equivalent Inverse Cipher
Implementation.......................... F. 3 Exercises................................................................................................. Appendix G 1171 1171 1172 1175 1175 1176 Symbolic Logic............................................................................. 1179 E. l Propositional Logic.............................................................................. E.1.1 Natural Deduction in Propositional Logic .......................... E.l.2 Rules........................................................................................ E.1.3 Derived Rules.......................................................................... E. 1.4 Well-Formed Formulas........................................................... E.l.5 Truth Tables............................................................................ E.l.6 Mathematical Induction......................................................... E.2 Predicate Logic...................................................................................... E.2.1 Natural Deduction in Predicate Logic.................................. E.3 Temporal Logic Systems...................................................................... E.3.1 Syntax of CTL........................................................................ E.3.2 Semantics of CTL ................................................................. E. 4 Exercises................................................................................................. Appendix F 1171 1191 1191 1195 1196 1196 1197 1199 1201 1203 1205 Example Academic Security
Policy......................................... 1207 Acceptable Use Policy.......................................................................... G.l.l Introduction............................................................................ G.1.2 Rights and Responsibilities................................................... G.1.3 Privacy.................................................................................... 1207 1208 1208 1208
Contents G. 1.4 Enforcement of Laws and University Policies...................... G.1.5 Unacceptable Conduct........................................................... G.1.6 Further Information............................................................... G.2 University of California Electronic Communications Policy............ G.2.1 Introduction............................................................................ G.2.2 General Provisions................................................................. G.2.3 Allowable Use......................................................................... G.2.4 Privacy and Confidentiality.................................................. G.2.5 Security.................................................................................... G.2.6 Retention and Disposition..................................................... G.2.7 Appendix A: Definitions ...................................................... G.2.8 Appendix B: References......................................................... G.2.9 Appendix C: Policies Relating to Access Without Consent................................................................................... G.3 User Advisories.................................................................................... G.3.1 Introduction............................................................................ G.3.2 User Responsibilities............................................................. G.3.3 Privacy Expectations ............................................................. G.3.4 Privacy
Protections................................................................. G.3.5 Privacy Limits......................................................................... G.3.6 Security Considerations......................................................... G. 4 Electronic Communications—Allowable Use.................................... G.4.1 Purpose.................................................................................... G.4.2 Definitions .............................................................................. G.4.3 Policy ...................................................................................... G.4.4 Allowable Users..................................................................... G.4.5 Allowable Uses....................................................................... G.4.6 Restrictions on Use................................................................. G.4.7 References and Related Policies............................................ xxvii 1209 1209 t212 1212 1212 1213 1216 1220 1225 1227 1227 1230 1232 1234 1234 1234 1235 1236 1237 1239 1241 1241 1242 1242 1242 1243 1245 1246 Appendix H Programming Rules................................................................. 1247 H. l Implementation Rules .......................................................................... 1247 H.2 Management Rules................................................................................ 1249 References...................................................................................................... 1251
Index................................................................................................................. 1341
|
| any_adam_object | 1 |
| author | Bishop, Matt |
| author2 | Sullivan, Elisabeth Ruppel, Michelle |
| author2_role | ctb ctb |
| author2_variant | e s es m r mr |
| author_GND | (DE-588)129811564 |
| author_facet | Bishop, Matt Sullivan, Elisabeth Ruppel, Michelle |
| author_role | aut |
| author_sort | Bishop, Matt |
| author_variant | m b mb |
| building | Verbundindex |
| bvnumber | BV040338702 |
| classification_rvk | ST 273 ST 277 ST 276 |
| classification_tum | DAT 460f DAT 050f |
| ctrlnum | (OCoLC)802789160 (DE-599)BVBBV040338702 |
| discipline | Informatik |
| edition | Second edition |
| format | Book |
| fullrecord | <?xml version="1.0" encoding="UTF-8"?><collection xmlns="http://www.loc.gov/MARC21/slim"><record><leader>01908nam a2200469zc 4500</leader><controlfield tag="001">BV040338702</controlfield><controlfield tag="003">DE-604</controlfield><controlfield tag="005">20220525 </controlfield><controlfield tag="007">t</controlfield><controlfield tag="008">120727s2019 xxua||| |||| 00||| eng d</controlfield><datafield tag="020" ind1=" " ind2=" "><subfield code="a">9780321712332</subfield><subfield code="9">978-0-321-71233-2</subfield></datafield><datafield tag="020" ind1=" " ind2=" "><subfield code="a">0321712331</subfield><subfield code="9">0-321-71233-1</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(OCoLC)802789160</subfield></datafield><datafield tag="035" ind1=" " ind2=" "><subfield code="a">(DE-599)BVBBV040338702</subfield></datafield><datafield tag="040" ind1=" " ind2=" "><subfield code="a">DE-604</subfield><subfield code="b">ger</subfield><subfield code="e">rda</subfield></datafield><datafield tag="041" ind1="0" ind2=" "><subfield code="a">eng</subfield></datafield><datafield tag="044" ind1=" " ind2=" "><subfield code="a">xxu</subfield><subfield code="c">US</subfield></datafield><datafield tag="049" ind1=" " ind2=" "><subfield code="a">DE-91G</subfield><subfield code="a">DE-706</subfield><subfield code="a">DE-739</subfield><subfield code="a">DE-355</subfield><subfield code="a">DE-573</subfield><subfield code="a">DE-1050</subfield><subfield code="a">DE-898</subfield><subfield code="a">DE-523</subfield><subfield code="a">DE-20</subfield><subfield code="a">DE-522</subfield><subfield code="a">DE-188</subfield></datafield><datafield tag="084" ind1=" " ind2=" "><subfield code="a">ST 273</subfield><subfield code="0">(DE-625)143640:</subfield><subfield code="2">rvk</subfield></datafield><datafield tag="084" ind1=" " ind2=" "><subfield code="a">ST 277</subfield><subfield code="0">(DE-625)143643:</subfield><subfield code="2">rvk</subfield></datafield><datafield tag="084" ind1=" " ind2=" "><subfield code="a">ST 276</subfield><subfield code="0">(DE-625)143642:</subfield><subfield code="2">rvk</subfield></datafield><datafield tag="084" ind1=" " ind2=" "><subfield code="a">DAT 460f</subfield><subfield code="2">stub</subfield></datafield><datafield tag="084" ind1=" " ind2=" "><subfield code="a">DAT 050f</subfield><subfield code="2">stub</subfield></datafield><datafield tag="100" ind1="1" ind2=" "><subfield code="a">Bishop, Matt</subfield><subfield code="e">Verfasser</subfield><subfield code="0">(DE-588)129811564</subfield><subfield code="4">aut</subfield></datafield><datafield tag="245" ind1="1" ind2="0"><subfield code="a">Computer security</subfield><subfield code="b">art and science</subfield><subfield code="c">Matt Bishop with contributions from Elisabeth Sullivan and Michelle Ruppel</subfield></datafield><datafield tag="250" ind1=" " ind2=" "><subfield code="a">Second edition</subfield></datafield><datafield tag="264" ind1=" " ind2="1"><subfield code="a">Boston</subfield><subfield code="b">Addison-Wesley</subfield><subfield code="c">[2019]</subfield></datafield><datafield tag="300" ind1=" " ind2=" "><subfield code="a">xlix, 1383 Seiten</subfield><subfield code="b">Illustrationen</subfield></datafield><datafield tag="336" ind1=" " ind2=" "><subfield code="b">txt</subfield><subfield code="2">rdacontent</subfield></datafield><datafield tag="337" ind1=" " ind2=" "><subfield code="b">n</subfield><subfield code="2">rdamedia</subfield></datafield><datafield tag="338" ind1=" " ind2=" "><subfield code="b">nc</subfield><subfield code="2">rdacarrier</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Datensicherung</subfield><subfield code="0">(DE-588)4011144-1</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="650" ind1="0" ind2="7"><subfield code="a">Computersicherheit</subfield><subfield code="0">(DE-588)4274324-2</subfield><subfield code="2">gnd</subfield><subfield code="9">rswk-swf</subfield></datafield><datafield tag="689" ind1="0" ind2="0"><subfield code="a">Computersicherheit</subfield><subfield code="0">(DE-588)4274324-2</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="0" ind2=" "><subfield code="5">DE-604</subfield></datafield><datafield tag="689" ind1="1" ind2="0"><subfield code="a">Datensicherung</subfield><subfield code="0">(DE-588)4011144-1</subfield><subfield code="D">s</subfield></datafield><datafield tag="689" ind1="1" ind2=" "><subfield code="8">1\p</subfield><subfield code="5">DE-604</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Sullivan, Elisabeth</subfield><subfield code="4">ctb</subfield></datafield><datafield tag="700" ind1="1" ind2=" "><subfield code="a">Ruppel, Michelle</subfield><subfield code="4">ctb</subfield></datafield><datafield tag="856" ind1="4" ind2="2"><subfield code="m">Digitalisierung UB Passau - ADAM Catalogue Enrichment</subfield><subfield code="q">application/pdf</subfield><subfield code="u">http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=025192998&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA</subfield><subfield code="3">Inhaltsverzeichnis</subfield></datafield><datafield tag="999" ind1=" " ind2=" "><subfield code="a">oai:aleph.bib-bvb.de:BVB01-025192998</subfield></datafield><datafield tag="883" ind1="1" ind2=" "><subfield code="8">1\p</subfield><subfield code="a">cgwrk</subfield><subfield code="d">20201028</subfield><subfield code="q">DE-101</subfield><subfield code="u">https://d-nb.info/provenance/plan#cgwrk</subfield></datafield></record></collection> |
| id | DE-604.BV040338702 |
| illustrated | Illustrated |
| indexdate | 2024-07-10T00:21:58Z |
| institution | BVB |
| isbn | 9780321712332 0321712331 |
| language | English |
| oai_aleph_id | oai:aleph.bib-bvb.de:BVB01-025192998 |
| oclc_num | 802789160 |
| open_access_boolean | |
| owner | DE-91G DE-BY-TUM DE-706 DE-739 DE-355 DE-BY-UBR DE-573 DE-1050 DE-898 DE-BY-UBR DE-523 DE-20 DE-522 DE-188 |
| owner_facet | DE-91G DE-BY-TUM DE-706 DE-739 DE-355 DE-BY-UBR DE-573 DE-1050 DE-898 DE-BY-UBR DE-523 DE-20 DE-522 DE-188 |
| physical | xlix, 1383 Seiten Illustrationen |
| publishDate | 2019 |
| publishDateSearch | 2019 |
| publishDateSort | 2019 |
| publisher | Addison-Wesley |
| record_format | marc |
| spelling | Bishop, Matt Verfasser (DE-588)129811564 aut Computer security art and science Matt Bishop with contributions from Elisabeth Sullivan and Michelle Ruppel Second edition Boston Addison-Wesley [2019] xlix, 1383 Seiten Illustrationen txt rdacontent n rdamedia nc rdacarrier Datensicherung (DE-588)4011144-1 gnd rswk-swf Computersicherheit (DE-588)4274324-2 gnd rswk-swf Computersicherheit (DE-588)4274324-2 s DE-604 Datensicherung (DE-588)4011144-1 s 1\p DE-604 Sullivan, Elisabeth ctb Ruppel, Michelle ctb Digitalisierung UB Passau - ADAM Catalogue Enrichment application/pdf http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=025192998&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA Inhaltsverzeichnis 1\p cgwrk 20201028 DE-101 https://d-nb.info/provenance/plan#cgwrk |
| spellingShingle | Bishop, Matt Computer security art and science Datensicherung (DE-588)4011144-1 gnd Computersicherheit (DE-588)4274324-2 gnd |
| subject_GND | (DE-588)4011144-1 (DE-588)4274324-2 |
| title | Computer security art and science |
| title_auth | Computer security art and science |
| title_exact_search | Computer security art and science |
| title_full | Computer security art and science Matt Bishop with contributions from Elisabeth Sullivan and Michelle Ruppel |
| title_fullStr | Computer security art and science Matt Bishop with contributions from Elisabeth Sullivan and Michelle Ruppel |
| title_full_unstemmed | Computer security art and science Matt Bishop with contributions from Elisabeth Sullivan and Michelle Ruppel |
| title_short | Computer security |
| title_sort | computer security art and science |
| title_sub | art and science |
| topic | Datensicherung (DE-588)4011144-1 gnd Computersicherheit (DE-588)4274324-2 gnd |
| topic_facet | Datensicherung Computersicherheit |
| url | http://bvbr.bib-bvb.de:8991/F?func=service&doc_library=BVB01&local_base=BVB01&doc_number=025192998&sequence=000001&line_number=0001&func_code=DB_RECORDS&service_type=MEDIA |
| work_keys_str_mv | AT bishopmatt computersecurityartandscience AT sullivanelisabeth computersecurityartandscience AT ruppelmichelle computersecurityartandscience |