Amazon no longer offers textbook rentals. We do!

Information Security Principles and Practices

by: Merkow, Mark S.; Breithaupt, James

Information Security Principles and Practices

by: Merkow, Mark S.; Breithaupt, James

ISBN 13:
9780131547292
ISBN 10:
0131547291
Edition: 1st
Format: Paperback
Copyright: 08/19/2005
Publisher: Prentice Hall
Newer Edition

Used From $110.21

Sorry, this item is currently unavailable.

List Price $150.80 Save $40.59

Used $110.21

Usually Ships in 24-48 Hours

We Buy This Book Back!

Included with your book

Free Shipping On Every Order

Add to Cart

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

Extend or Purchase Your Rental at Any Time

Need to keep your rental past your due date? At any time before your due date you can extend or purchase your rental through your account.

Summary

For an introductory course in information security covering principles and practices. This text covers the ten domains in the Information Security Common Body of Knowledge, which are Security Management Practices, Security Architecture and Models, Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP), Law, Investigations, and Ethics, Physical Security, Operations Security, Access Control Systems and Methodology, Cryptography, Telecommunications, Network, and Internet Security.

Security Series Walk-Through

xviii

Preface

xxi

About the Authors

xxv

Acknowledgments

xxvi

Quality Assurance

xxvii

Why Study Information Security?

(18)

Introduction

(1)

Growing IT Security Importance and New Career Opportunities

(2)

Increasing Demand by Government and Private Industry

(1)

Becoming an Information Security Specialist

(4)

Schools Are Responding to Demands

(1)

Multidisciplinary Approach

(1)

Contextualizing Information Security

(11)

Information Security Careers Meet the Needs of Business

(3)

Summary

(1)

Test Your Skills

(7)

Information Security Principles of Success

(20)

Introduction

(1)

Principle 1: There Is No Such Thing as Absolute Security

(1)

Principle 2: The Three Security Goals Are Confidentiality, Integrity, and Availability

(2)

Integrity Models

(1)

Availability Models

(1)

Principle 3: Defense in Depth as Strategy

(1)

Principle 4: When Left on Their Own, People Tend to Make the Worst Security Decisions

(3)

In Practice: Phishing for Dollars

(2)

Principle 5: Computer Security Depends on Two Types of Requirements: Functional and Assurance

(1)

Principle 6: Security Through Obscurity Is Not an Answer

(1)

Principle 7: Security = Risk Management

(2)

Principle 8: The Three Types of Security Controls Are Preventative, Detective, and Responsive

(1)

Principle 9: Complexity Is the Enemy of Security

(1)

Principle 10: Fear, Uncertainty, and Doubt Do Not Work in Selling Security

(1)

Principle 11: People, Process, and Technology Are All Needed to Adequately Secure a System or Facility

(2)

In Practice: How People, Process, and Technology Work in Harmony

(1)

Principle 12: Open Disclosure of Vulnerabilities Is Good for Security!

(1)

In Practice: To Disclose or Not to Disclose; That Is the Question!

(7)

Summary

(1)

Test Your Skills

(5)

Certification Programs and the Common Body of Knowledge

(20)

Introduction

(1)

Certification and Information Security

(2)

International Information Systems Security Certifications Consortium

(1)

The Information Security Common Body of Knowledge

(5)

Security Management Practices

(1)

Security Architecture and Models

(1)

Business Continuity Planning

(1)

Law, Investigations, and Ethics

(1)

Physical Security

(1)

Operations Security

(1)

Access Control Systems and Methodology

(1)

Cryptography

(1)

Telecommunications, Network, and Internet Security

(1)

Application Development Security

(1)

Other Certificate Programs in the IT Security Industry

(12)

Certified Information Systems Auditor

(1)

Certified Information Security Manager

(1)

Global Information Assurance Certifications (GIAC)

(1)

Comp TIA Security + Certification

(1)

Vendor-Specific Certification Programs

(3)

Summary

(1)

Test Your Skills

(8)

Security Management

(30)

Introduction

(1)

Security Policies Set the Stage for Success

(1)

Four Types of Policies

(5)

Programme-Level Policies

(2)

Programme-Framework Policies

(1)

Issue-Specific Policies

(1)

In Practice: An Issue-Specific Policy Scenario

(2)

System-Specific Policies

(1)

Development and Management of Security Policies

(2)

Security Objectives

(1)

Operational Security

(1)

Policy Implementation

(1)

Policy Support Documents

(1)

Regulations

(1)

In Practice: HIPAA Privacy

(3)

Standards and Baselines

(1)

Guidelines

(1)

Procedures

(1)

Suggested Standards Taxonomy

(6)

Asset Classification

(1)

Separation of Duties

(1)

Preemployment Hiring Practices

(2)

Risk Analysis and Management

(1)

Education, Training, and Awareness

(1)

Who Is Responsible for Security?

(9)

Summary

(1)

Test Your Skills

(7)

Security Architecture and Models

(34)

Introduction

(1)

Defining the Trusted Computing Base

(3)

Rings of Trust

(2)

Protection Mechanisms in a Trusted Computing Base

(3)

System Security Assurance Concepts

(1)

Goals of Security Testing

(1)

Formal Security Testing Models

(1)

Trusted Computer Security Evaluation Criteria

(4)

Division D: Minimal Protection

(1)

Division C: Discretionary Protection

(1)

Division B: Mandatory Protection

(1)

Division A: Verified Protection

100

(1)

The Trusted Network Interpretation of the TCSEC

101

(1)

Information Technology Security Evaluation Criteria

101

(3)

Comparing ITSEC and TCSEC

102

(1)

ITSEC Assurance Classes

102

(2)

Canadian Trusted Computer Product Evaluation Criteria

104

(1)

Federal Criteria for Information Technology Security

104

(1)

The Common Criteria

104

(9)

Protection Profile Organization

106

(1)

Security Functional Requirements

107

(3)

Evaluation Assurance Levels

110

(2)

The Common Evaluation Methodology

112

(1)

Confidentiality and Integrity Models

113

(10)

Bell-LaPadula Model

113

(1)

Biba Integrity Model

114

(1)

Advanced Models

114

(1)

Summary

115

(1)

Test Your Skills

116

(7)

Business Continuity Planning and Disaster Recovery Planning

123

(18)

Introduction

123

(1)

Overview of the Business Continuity Plan and Disaster Recovery Plan

124

(5)

Why the BCP Is So Important

126

(1)

Types of Disruptive Events

126

(1)

Defining the Scope of the Business Continuity Plan

127

(1)

Creating the Business Impact Analysis

128

(1)

Disaster Recovery Planning

129

(12)

Identifying Recovery Strategies

129

(1)

Shared-Site Agreements

130

(1)

Alternate Sites

130

(1)

Additional Arrangements

131

(1)

How to Test a Disaster Recovery Plan

132

(1)

Without the Walls and Within

132

(1)

Summary

133

(1)

Test Your Skills

133

(8)

Law, Investigations, and Ethics

141

(24)

Introduction

141

(1)

Types of Computer Crime

142

(2)

How Cyber Criminals Commit Crimes

144

(1)

The Computer and the Law

145

(2)

Legislative Branch of the Legal System

146

(1)

Administrative Branch of the Legal System

146

(1)

Judicial Branch of the Legal System

146

(1)

Intellectual Property Law

147

(2)

Patent Law

148

(1)

Trademarks

148

(1)

Trade Secrets

149

(1)

Privacy and the Law

149

(3)

International Privacy Issues

150

(1)

Privacy Laws in the United States

151

(1)

Computer Forensics

152

(1)

The Information Security Professional's Code of Ethics

153

(1)

Other Ethics Standards

154

(11)

Computer Ethics Institute

155

(1)

Internet Activities Board: Ethics and the Internet

155

(1)

Code of Fair Information Practices

156

(1)

Summary

156

(1)

Test Your Skills

157

(8)

Physical Security Control

165

(22)

Introduction

165

(1)

Understanding the Physical Security Domain

166

(1)

Physical Security Threats

167

(1)

Providing Physical Security

168

(19)

Educating Personnel

168

(1)

Administrative Access Controls

169

(2)

Physical Security Controls

171

(2)

Technical Controls

173

(5)

Environmental/Life-Safety Controls

178

(2)

Summary

180

(1)

Test Your Skills

180

(7)

Operations Security

187

(18)

Introduction

187

(1)

Operations Security Principles

188

(1)

Operations Security Process Controls

189

(1)

In Practice: Controlling Privileged User IDs

190

(2)

Operations Security Controls in Action

192

(13)

Software Support

192

(1)

Configuration and Change Management

193

(1)

Backups

193

(1)

Media Controls

194

(2)

Documentation

196

(1)

Maintenance

196

(1)

Interdependencies

197

(1)

Summary

198

(1)

Test Your Skills

199

(6)

Access Control Systems and Methodology

205

(24)

Introduction

205

(1)

Terms and Concepts

206

(3)

Identification

206

(1)

Authentication

206

(1)

Least Privilege (Need-to-Know)

206

(1)

Information Owner

207

(1)

Discretionary Access Control

207

(1)

Access Control Lists

207

(1)

Mandatory Access Control

208

(1)

Role-Based Access Control

208

(1)

In Practice: Classification and Clearances in Military Security

209

(1)

Principles of Authentication

210

(1)

The Problems with Passwords

210

(1)

In Practice: Password Cracking Tools

210

(3)

Multifactor Authentication

211

(2)

Biometrics

213

(1)

Single Sign-On

214

(5)

Kerberos

215

(1)

Federated Identities

215

(4)

Remote User Access and Authentication

219

(10)

Remote Access Dial-In User Service

220

(1)

Virtual Private Networks

220

(1)

Summary

220

(1)

Test Your Skills

221

(8)

Cryptography

229

(28)

Introduction

229

(1)

Applying Cryptography to Information Systems

230

(1)

Basic Terms and Concepts

231

(2)

Strength of Cryptosystems

233

(1)

In Practice: A Simple Transposition Encryption Example

234

(3)

Cryptosystems Answer the Needs of Today's E-Commerce

236

(1)

The Role of Keys in Cryptosystems

236

(1)

In Practice: A Simple Substitution Example

237

(1)

Putting the Pieces to Work

238

(6)

Digesting Data

239

(3)

Digital Certificates

242

(2)

Examining Digital Cryptography

244

(13)

Hashing Functions

244

(1)

Block Ciphers

245

(1)

Implementations of PPK Cryptography

246

(3)

Summary

249

(1)

Test Your Skills

250

(7)

Telecommunications, Network, and Internet Security

257

(38)

Introduction

257

(1)

Network and Telecommunications Security From 20,000 Feet Up

258

(1)

Network Security in Context

259

(1)

The Open Systems Interconnection (OSI) Reference Model

259

(8)

The Protocol Stack

259

(3)

The OSI Reference Model and TCP/IP

262

(3)

The OSI Model and Security

265

(2)

Data Network Types

267

(1)

Local Area Network

267

(1)

Wide Area Network

267

(1)

Internet

267

(1)

Intranet

268

(1)

Extranet

268

(1)

Protecting TCP/IP Networks

268

(1)

Basic Security Infrastructures

269

(3)

Routers

269

(1)

Packet Filtering

269

(2)

Benefits of Packet-Filtering Routers

271

(1)

Limitations of Packet-Filtering Routerst

271

(1)

Firewalls

272

(8)

Application-Level Gateway Firewall

272

(2)

Bastion Hosts

274

(1)

Benefits of Application-Level Gateways

275

(1)

Limitations of Application-Level Gateways

275

(1)

Firewall Implementation Examples

275

(4)

Choose Wisely!

279

(1)

Intrusion Detection Systems

280

(3)

What Kind of Intrusions?

280

(1)

Characteristics of Good Intrusion Detection Systems

281

(1)

False Positives, False Negatives, and Subversion Attacks

282

(1)

Virtual Private Networks

283

(12)

IPSec

283

(4)

Security Policies

287

(1)

IPSec Key Management

287

(1)

Summary

287

(1)

Test Your Skills

288

(7)

Application Development Security

295

(22)

Introduction

295

(1)

The Practice of Software Engineering

296

(1)

Software Development Life Cycles

297

(2)

Distributed Systems

299

(5)

Software Agents

301

(1)

Java

302

(1)

Java Applets

302

(1)

ActiveX Controls

302

(1)

Distributed Objects

303

(1)

Malware

304

(1)

Antivirus Software

305

(1)

Improving Security Across the SDLC

305

(12)

Education Subgroup

306

(1)

Software Process Subgroup

307

(1)

Patch Management Subgroup

308

(1)

Incentives Subgroup

309

(1)

Summary

309

(1)

Test Your Skills

310

(7)

Securing the Future

317

(16)

Introduction

317

(1)

Continuous Monitoring and Constant Vigilance

318

(1)

Operation Eligible Receiver

319

(2)

Identity Theft and the U.S. Regulatory Environment

321

(1)

Growing Threats

321

(2)

Vendors Try to Silence Security Researchers

322

(1)

Pharming Supplements Phishing Attacks

322

(1)

Trends in Security Threats

323

(1)

The Rosy Future for InfoSec Specialists

323

(10)

Demand Outpaces Security Skills

324

(1)

Summary

325

(1)

Test Your Skills

325

(8)

Appendix A: Common Body of Knowledge

333

(28)

Appendix B: Security Policy and Standards Taxonomy

361

(14)

Appendix C: Sample Policies

375

(14)

Appendix D: An Insider's Look at a Security Policy and Standards Management System

389

(8)

Appendix E: HIPAA Security Rule Standards

397

(4)

Glossary

401

(8)

References

409

(6)

Index

415

Amazon no longer offers textbook rentals. We do!

Information Security Principles and Practices

Information Security Principles and Practices

9780131547292

0131547291

Summary

Table of Contents

Supplemental Materials

Write a Review

Amazon no longer offers textbook rentals. We do!

Information Security Principles and Practices

Information Security Principles and Practices

9780131547292

0131547291

Summary

Table of Contents

Supplemental Materials

Write a Review

Related Products