Atjaunināt sīkdatņu piekrišanu

Guide to Network Security New edition [Mīkstie vāki]

3.20/5 (18 ratings by Goodreads)
(Michael J. Coles College of Business, Kennesaw State University), (Institute for Cybersecurity Workforce Development, Kennesaw State U), (University of Colorado Boulder), (Michael J. Coles College of Business, Kennesaw State University)
  • Formāts: Paperback / softback, 512 pages, height x width x depth: 233x189x28 mm, weight: 816 g
  • Izdošanas datums: 20-Sep-2012
  • Izdevniecība: Course Technology Inc
  • ISBN-10: 0840024223
  • ISBN-13: 9780840024220
Citas grāmatas par šo tēmu:
  • Mīkstie vāki
  • Cena: 65,54 €*
  • * Šī grāmata vairs netiek publicēta. Jums tiks paziņota lietotas grāmatas cena
  • Šī grāmata vairs netiek publicēta. Jums tiks paziņota lietotas grāmatas cena.
  • Daudzums:
  • Ielikt grozā
  • Pievienot vēlmju sarakstam
  • Formāts: Paperback / softback, 512 pages, height x width x depth: 233x189x28 mm, weight: 816 g
  • Izdošanas datums: 20-Sep-2012
  • Izdevniecība: Course Technology Inc
  • ISBN-10: 0840024223
  • ISBN-13: 9780840024220
Citas grāmatas par šo tēmu:
GUIDE TO NETWORK SECURITY is a wide-ranging new text that provides a detailed review of the network security field, including essential terminology, the history of the discipline, and practical techniques to manage implementation of network security solutions. It begins with an overview of information, network, and web security, emphasizing the role of data communications and encryption. The authors then explore network perimeter defense technologies and methods, including access controls, firewalls, VPNs, and intrusion detection systems, as well as applied cryptography in public key infrastructure, wireless security, and web commerce. The final section covers additional topics relevant for information security practitioners, such as assessing network security, professional careers in the field, and contingency planning. Perfect for both aspiring and active IT professionals, GUIDE TO NETWORK SECURITY is an ideal resource for readers who want to help organizations protect critical information assets and secure their systems and networks, both by recognizing current threats and vulnerabilities, and by designing and developing the secure systems of the future.
Introduction xv
Chapter 1 Introduction to Information Security
1(36)
Introduction
2(1)
What Is Information Security?
3(1)
Information Security Terminology
3(3)
Critical Characteristics of Information
6(1)
Security Models
7(1)
Balancing Information Security and Access
8(1)
Business Needs First
9(1)
Threats to Information Security
10(1)
Common Threats
11(1)
Attacks on Information Security
12(1)
Malicious Code
12(1)
Password Attacks
13(1)
Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Attacks
14(1)
Spoofing
15(1)
Man-in-the-Middle Attacks
15(1)
E-Mail Attacks
16(1)
Sniffers
17(1)
Social Engineering
17(1)
Buffer Overflow
17(1)
Timing Attacks?
18(1)
Security Professionals and the Organization
18(1)
Executive Management
18(1)
Information Security Project Team
19(1)
Information Security Policy, Standards, and Practices
19(2)
Enterprise Information Security Policy (EISP)
21(1)
Issue-Specific Security Policy (ISSP)
22(2)
Systems-Specific Policy (SysSP)
24(1)
Frameworks and Industry Standards in Information Security
24(1)
The ISO 27000 Series
25(2)
NIST Security Models
27(1)
IETF Security Architecture
28(1)
Benchmarking and Best Business Practices
28(9)
Chapter Summary
31(2)
Review Questions
33(1)
Real-World Exercises
34(1)
Hands-On Projects
34(1)
Endnotes
35(2)
Chapter 2 Introduction To Networking
37(50)
Introduction
38(1)
Networking Fundamentals
39(1)
Reasons to Network
39(1)
Getting the Message Across
40(4)
Combining Multiple Signals
44(1)
Impedance to Communications
45(1)
Types of Networks
45(2)
Networks Categorized by Components
47(1)
Networks Categorized by Size
47(1)
Networks Categorized by Topology
48(1)
Networks Categorized by Media
48(1)
Standards Organizations
48(1)
The Internet Society (ISOC)
49(1)
Internet Assigned Numbers Authority (IANA)
49(1)
American National Standards Institute (ANSI)
49(1)
International Telecommunications Union (ITU)
49(1)
Institute of Electrical and Electronics Engineers (IEEE)
50(1)
Telecommunications Industry Association (TIA)
50(1)
International Organization for Standardization (ISO)
50(1)
OSI Reference Model
50(2)
Physical Layer
52(6)
Data Link Layer
58(5)
Network Layer
63(5)
Transport Layer
68(5)
Session Layer
73(1)
Presentation Layer
74(1)
Application Layer
75(3)
The Internet, WWW, and TCP/IP
78(1)
The World Wide Web
79(1)
TCP/IP
80(7)
Chapter Summary
83(1)
Review Questions
83(1)
Real-World Exercises
84(1)
Hands-On Projects
85(1)
Endnotes
85(2)
Chapter 3 Cryptography
87(46)
Introduction
88(1)
Terminology
89(1)
History of Cryptology
90(2)
Cipher Methods
92(1)
Substitution Cipher
92(3)
Transposition Cipher
95(2)
Exclusive OR Operation
97(1)
Vernam Cipher
98(1)
Book or Running Key Cipher
99(1)
Hash Functions
99(2)
Cryptographic Algorithms
101(1)
Cryptographic Notation
101(1)
Symmetric Encryption
102(2)
Asymmetric Encryption
104(3)
Hybrid Cryptography Systems
107(1)
Encryption Key Size
108(2)
Multiple Encryption Methods
110(1)
Encrypted Communications
110(1)
Securing Network Communications with IPSec and SSH
111(2)
Securing Web Communications with SSI and S-HTTP
113(1)
Securing E-Mail with S/MIME and PGP
114(3)
Securing Wireless Networks with WEP and WPA
117(1)
Next-Generation Wireless Protocols
118(1)
Cryptographic Tools
119(1)
Public Key Infrastructure (PKI)
119(1)
Digital Signatures
120(2)
Digital Certificates
122(1)
Steganography
122(2)
Attacks on Cryptosystems
124(1)
Man-in-the-Middle Attack
125(1)
Correlation Attacks
125(1)
Dictionary Attacks
125(1)
Timing Attacks
125(1)
Defending Against Attacks
126(7)
Chapter Summary
126(1)
Review Questions
127(1)
Real-World Exercises
128(1)
Hands-On Projects
128(3)
Endnotes
131(2)
Chapter 4 Firewall Technologies and Administration
133(38)
Introduction
134(1)
Firewall Overview
135(1)
Firewall Uses
136(1)
Protecting a System
136(1)
Restricting Access to the Network
137(1)
Extending the Network
138(1)
Preventing Malicious Traffic from Leaving the Network
138(2)
Protecting Critical Resources
140(1)
Enabling an Audit Trail
140(1)
Providing for Authentication
140(1)
How Do Firewalls Work?
140(1)
Protocols
141(1)
Ports
142(1)
Packet-Filtering Firewalls
142(6)
Application-Level Gateways
148(2)
Multi-Layer Filtering
150(1)
Circuit-Level Gateways
151(1)
Firewall Form Factors
152(1)
Firewall Appliances
152(7)
Firewall Architectures
159(1)
Packet-Filtering Routers
159(1)
Screened Host Firewalls
160(1)
Dual-Homed Host Firewalls
160(1)
Screened Subnet Firewalls (with DMZ)
161(1)
Limitations of Firewalls
162(9)
Chapter Summary
165(1)
Review Questions
165(1)
Real-World Exercises
166(1)
Hands-On Project
166(3)
Endnotes
169(2)
Chapter 5 Network Authentication and Remote Access Using VPN
171(42)
Introduction
172(1)
Access Control
173(1)
Categories of Access Control
174(4)
Identification
178(1)
Authentication
179(1)
Password Security Issues
180(2)
Implementing Authentication
182(7)
Virtual Private Networks
189(1)
Extranets and Intranets
190(1)
VPN Components and Operations
191(2)
Essential Activities of VPNs
193(4)
Types of VPNs
197(1)
VPN Appliances
197(2)
VPN Architectures
199(2)
Tunneling Protocols Used with VPNs
201(2)
VPN Best Practices
203(1)
Benefits and Drawbacks of VPNs
204(9)
Chapter Summary
207(2)
Review Questions
209(1)
Real-World Exercises
210(1)
Hands-On Project
211(1)
Endnotes
212(1)
Chapter 6 Network Monitoring and Intrusion Detection and Prevention Systems
213(52)
Introduction
214(1)
Network-Monitoring Software: Packet Sniffers
215(1)
Capturing Network Traffic
215(1)
Packet Analysis
215(2)
Tcpdump
217(3)
Intrusion Detection and Prevention Systems
220(1)
IDPS Terminology
221(1)
Why Use an IDPS?
222(2)
Types of IDPSs
224(8)
IDPS Detection Methods
232(2)
IDPS Response Behavior
234(3)
Selecting IDPS Approaches and Products
237(3)
IDPS Product Features and Quality
240(2)
Strengths and Limitations of IDPSs
242(1)
Deployment and Implementation of an IDPS
243(8)
Honeypots and Honeynets
251(1)
Trap-and-Trace Systems
252(1)
Active Intrusion Prevention
253(12)
Chapter Summary
253(1)
Review Questions
254(1)
Real-World Exercises
255(1)
Hands-On Project
255(5)
Endnotes
260(5)
Chapter 7 Wireless Network Security
265(38)
Introduction
266(2)
Wireless Technologies and Standards
268(1)
Wireless Modulation Technologies
268(1)
IEEE 802.11 Standards
269(2)
Wi-Fi Alliance Certifications
271(1)
Other Wireless Standards
271(2)
Wireless Architectures and Topologies
273(1)
Wireless Architectures
273(1)
Wireless Topologies
274(4)
Wireless Architectures
278(3)
Wireless Security Protocols
281(1)
Wired Equivalent Privacy (WEP)
281(1)
Wi-Fi Protected Access (WPA and WPA2)
282(1)
WPA2
283(3)
WLAN Security Concerns
286(1)
WLAN Security Solutions
287(1)
WLAN Security Myths
288(1)
Bluetooth
288(1)
Bluetooth Security Concerns
289(1)
Bluetooth Security Solutions
290(13)
Chapter Summary
292(2)
Review Questions
294(1)
Real-World Exercises
294(1)
Hands-On Project
295(5)
Endnotes
300(3)
Chapter 8 Security of Web Applications
303(44)
Introduction
304(1)
Internet Services
304(1)
SMTP, POP, and IMAP
305(2)
FTP
307(3)
Telnet
310(2)
SNMP
312(1)
LDAP
313(1)
NNTP
314(1)
DNS
315(4)
Web Overview
319(1)
Web Client/Server Architecture
319(2)
Web Programming Languages
321(6)
Threats and Vulnerabilities in Web Applications
327(1)
Injection
328(1)
Cross-Site Scripting (XSS)
329(1)
Broken Authentication and Session Management
330(1)
Insecure Direct Object References
331(1)
Cross-Site Request Forgery (CSRF)
332(1)
Security Misconfiguration
333(1)
Insecure Cryptographic Storage
333(1)
Failure to Restrict URL Access
334(1)
Insufficient Transport Layer Protection
334(1)
Unvalidated Redirects and Forwards
334(1)
Securing a Web Server
335(12)
Chapter Summary
335(2)
Review Questions
337(1)
Real-World Exercises
338(1)
Hands-On Project
338(5)
Endnotes
343(4)
Chapter 9 Network Vulnerability Assessment
347(48)
Introduction
348(1)
Common Vulnerabilities
348(1)
Defects in Software or Firmware
349(5)
Errors in Configuration or Implementation
354(1)
Weaknesses in Processes and Procedures
355(1)
Finding Vulnerabilities on the Network
356(1)
Scanning and Analysis Tools
356(16)
Penetration Testing
372(2)
Recommended Vulnerability Assessment Methodology
374(2)
Addressing Vulnerabilities
376(1)
Vulnerability Disclosure
377(7)
Vulnerability Risk Assessment
384(11)
Chapter Summary
386(1)
Review Questions
387(1)
Real-World Exercises
388(1)
Hands-On Project
389(3)
Endnotes
392(3)
Chapter 10 Auditing, Monitoring, and Logging
395(46)
Introduction
396(1)
Monitoring Network Systems
397(1)
What to Audit?
398(6)
Log Management Policy
404(1)
Standard OS Logs
405(8)
Log Management Technology
413(2)
Configuration and Change Management (CCM)
415(1)
Configuration Management
415(2)
Change Management
417(2)
Auditing (Formal Review)
419(1)
IT Auditing
419(3)
Systems Certification, Accreditation, and Authorization
422(1)
Auditing for Government and Classified Information Systems
422(3)
Auditing and the ISO 27000 Series
425(3)
Auditing and COBIT
428(13)
Chapter Summary
430(2)
Review Questions
432(1)
Real-World Exercises
432(1)
Hands-On Project
433(5)
Endnotes
438(3)
Chapter 11 Contingency Planning and Networking Incident Response
441(50)
Introduction
442(1)
What Is Contingency Planning?
443(2)
Stages and Components of Contingency Planning
445(6)
Data and Application Resumption
451(1)
Disk-to-Disk-to-Tape
451(1)
Backup Strategies
451(3)
Threats to Stored Information
454(2)
Database Backups
456(1)
Application Backups
457(4)
Network-Attached Storage and Storage Area Networks
461(1)
Service Level Agreements (SLAs)
462(1)
Incident Response Plan
463(1)
Form IR Planning Team
464(1)
Develop IR Planning Policy
465(1)
Integrate the Business Impact Analysis (BIA)
465(1)
Identify Preventive Controls Unique to IR
466(1)
Organize the Computer Security Incident Response Team (CSIRT)
466(1)
Create IR Contingency Strategies
466(1)
Develop the Incident Response (IR) Plan
467(12)
Ensure Plan Testing, Training, and Exercises
479(2)
IR Plan Maintenance
481(10)
Chapter Summary
481(1)
Review Questions
482(1)
Real-World Exercises
483(1)
Hands-On Project
484(5)
Endnotes
489(2)
Chapter 12 Digital Forensics
491(36)
Introduction
492(1)
Legal Matters
493(1)
Search and Seizure
493(1)
Interacting with Law Enforcement
494(1)
Adversarial Legal System
495(1)
Digital Forensics Team
496(1)
First Response Team
496(1)
Analysis Team
497(1)
Dedicated Team or Outsource?
498(1)
Forensic Field Kit
499(1)
Digital Forensics Methodology
500(1)
Assessing the Scene
501(2)
Acquiring the Evidence
503(14)
Analyzing Evidence
517(1)
Searching for Evidence
518(1)
Reporting the Findings
519(1)
Encryption Concerns
520(7)
Chapter Summary
521(1)
Review Questions
521(1)
Real-World Exercises
522(1)
Hands-On Project
523(2)
Endnotes
525(2)
Glossary 527(14)
Index 541
Herbert Mattord, Ph.D., C.I.S.M., C.I.S.S.P., completed 24 years of IT industry experience as an application developer, database administrator, project manager and information security practitioner before joining the faculty at Kennesaw State University, where he serves as a professor of information security and assurance and cybersecurity. Dr. Mattord currently teaches graduate and undergraduate courses. He is also a senior editor of the Journal of Cybersecurity Education, Research and Practice. He and Dr. Michael Whitman have authored PRINCIPLES OF INFORMATION SECURITY; PRINCIPLES OF INCIDENT RESPONSE AND DISASTER RECOVERY; MANAGEMENT OF INFORMATION SECURITY; READINGS AND CASES IN THE MANAGEMENT OF INFORMATION SECURITY; THE GUIDE TO NETWORK SECURITY and THE HANDS-ON INFORMATION SECURITY LAB MANUAL. Dr. Mattord is an active researcher, author and consultant in information security management and related topics. He has published articles in the Information Resources Management Journal, Journal of Information Security Education, the Journal of Executive Education and the International Journal of Interdisciplinary Telecommunications and Networking. Dr. Mattord is a member of the Information Systems Security Association, ISACA, and the Association for Information Systems. During his career as an IT practitioner, Dr. Mattord was an adjunct professor at Kennesaw State University, Southern Polytechnic State University, Austin Community College and Texas State University: San Marcos. He was formerly the manager of corporate information technology security at Georgia-Pacific Corporation, where he acquired much of the practical knowledge found in this and his other textbooks. David Mackey, CISSP, is director of security operations consulting at ArcSight and an adjunct faculty member at the University of Colorado Boulder, where he teaches graduate courses in information security. Mr. Mackey has over 15 years of IT and information security experience and currently leads a group that helps customers build or improve their security intelligence capabilities. Prior to his IT career, Mr. Mackey served as an intelligence specialist in the U.S. Army. He has written a textbook on web security and contributed to a number of additional books and papers. Andrew Green, M.S.I.S., is a lecturer of information security and assurance in the CSIS department at Kennesaw State University and a research associate with the KSU Center for Information Security Education and Awareness. He was also one of the principal designers of the Southeast Collegiate Cyberdefense Competition, hosted annually by KSU. Before entering academia full-time, Green worked for 10 years as an information security professional, primarily as a consultant to small and medium-sized businesses, as well as a healthcare IT specialist. In the latter role, he developed and supported transcription interfaces for medical facilities throughout the United States. Green is also a full-time Ph.D. student at Nova Southeastern University, where he is studying information systems with a concentration in information security, as well as the co-author of multiple books published by Course Technology. Michael E. Whitman, Ph.D., C.I.S.M., C.I.S.S.P., is the executive director of the Institute for Cybersecurity Workforce Development and a professor of information security at Kennesaw State University. In 2004, 2007, 2012 and 2015, under Dr. Whitman's direction the Center for Information Security Education spearheaded K.S.U.s successful bid for the prestigious National Center of Academic Excellence recognitions (CAE/IAE and CAE/CDE), awarded jointly by the Department of Homeland Security and the National Security Agency. Dr. Whitman is also the editor-in-chief of the Journal of Cybersecurity Education and Research and Practice and director of the Southeast Collegiate Cyber Defense Competition. Dr. Whitman is an active researcher and author in information security policy, threats, curriculum development and ethical computing. He currently teaches graduate and undergraduate courses in information security. Dr. Whitman has several information security textbooks currently in print, including PRINCIPLES OF INFORMATION SECURITY; PRINCIPLES OF INCIDENT RESPONSE AND DISASTER RECOVERY; MANAGEMENT OF INFORMATION SECURITY; READINGS AND CASES IN THE MANAGEMENT OF INFORMATION SECURITY, VOLUMES I AND II; THE HANDS-ON INFORMATION SECURITY LAB MANUAL; THE GUIDE TO NETWORK SECURITY and THE GUIDE TO FIREWALLS AND NETWORK SECURITY. He has published articles in Information Systems Research, the Communications of the ACM, the Journal of International Business Studies, Information and Management and the Journal of Computer Information Systems. Dr. Whitman is a member of the Information Systems Security Association, ISACA and the Association for Information Systems. Previously, Dr. Whitman served the U.S. Army as an armored cavalry officer with additional duties as the automated data processing system security officer (ADPSSO).