Acknowledgments |
|
xvii | |
Introduction |
|
xix | |
|
Who Should Read This Book? |
|
|
xx | |
|
|
xx | |
1 What Is Information Security? |
|
1 | (22) |
|
Defining Information Security |
|
|
2 | (1) |
|
|
2 | (2) |
|
Models for Discussing Security Issues |
|
|
4 | (4) |
|
The Confidentiality, Integrity, and Availability Triad |
|
|
4 | (2) |
|
|
6 | (2) |
|
|
8 | (9) |
|
|
8 | (2) |
|
Threats, Vulnerabilities, and Risk |
|
|
10 | (1) |
|
|
11 | (4) |
|
|
15 | (2) |
|
|
17 | (3) |
|
|
20 | (1) |
|
|
21 | (2) |
2 Identification And Authentication |
|
23 | (12) |
|
|
24 | (1) |
|
|
24 | (1) |
|
|
24 | (1) |
|
Falsifying Identification |
|
|
25 | (1) |
|
|
25 | (3) |
|
|
26 | (1) |
|
Multifactor Authentication |
|
|
27 | (1) |
|
|
27 | (1) |
|
Common Identification and Authentication Methods |
|
|
28 | (5) |
|
|
28 | (1) |
|
|
29 | (3) |
|
|
32 | (1) |
|
|
33 | (1) |
|
|
33 | (2) |
3 Authorization And Access Controls |
|
35 | (16) |
|
What Are Access Controls? |
|
|
36 | (1) |
|
Implementing Access Controls |
|
|
37 | (6) |
|
|
38 | (4) |
|
|
42 | (1) |
|
|
43 | (5) |
|
Discretionary Access Control |
|
|
43 | (1) |
|
|
43 | (1) |
|
Rule-Based Access Control |
|
|
44 | (1) |
|
Role-Based Access Control |
|
|
44 | (1) |
|
Attribute-Based Access Control |
|
|
45 | (1) |
|
Multilevel Access Control |
|
|
45 | (3) |
|
|
48 | (2) |
|
|
50 | (1) |
|
|
50 | (1) |
4 Auditing And Accountability |
|
51 | (10) |
|
|
52 | (1) |
|
Security Benefits of Accountability |
|
|
53 | (2) |
|
|
54 | (1) |
|
|
54 | (1) |
|
Intrusion Detection and Prevention |
|
|
54 | (1) |
|
|
55 | (1) |
|
|
55 | (4) |
|
|
56 | (1) |
|
|
56 | (1) |
|
|
57 | (1) |
|
Auditing with Assessments |
|
|
57 | (2) |
|
|
59 | (1) |
|
|
59 | (2) |
5 Cryptography |
|
61 | (18) |
|
The History of Cryptography |
|
|
62 | (4) |
|
|
62 | (1) |
|
|
62 | (4) |
|
|
66 | (1) |
|
Modern Cryptographic Tools |
|
|
66 | (8) |
|
Keyword Ciphers and One-Time Pads |
|
|
67 | (1) |
|
Symmetric and Asymmetric Cryptography |
|
|
68 | (3) |
|
|
71 | (1) |
|
|
72 | (1) |
|
|
73 | (1) |
|
Protecting Data at Rest, in Motion, and in Use |
|
|
74 | (3) |
|
|
74 | (1) |
|
Protecting Data in Motion |
|
|
75 | (1) |
|
|
76 | (1) |
|
|
77 | (1) |
|
|
77 | (2) |
6 Compliance, Laws, And Regulations |
|
79 | (16) |
|
|
79 | (2) |
|
|
80 | (1) |
|
Consequences of Noncompliance |
|
|
81 | (1) |
|
Achieving Compliance with Controls |
|
|
81 | (1) |
|
|
81 | (1) |
|
Key vs. Compensating Controls |
|
|
82 | (1) |
|
|
82 | (1) |
|
Laws and Information Security |
|
|
83 | (4) |
|
Government-Related Regulatory Compliance |
|
|
84 | (1) |
|
Industry-Specific Regulatory Compliance |
|
|
85 | (2) |
|
Laws Outside of the United States |
|
|
87 | (1) |
|
Adopting Frameworks for Compliance |
|
|
87 | (2) |
|
International Organization for Standardization |
|
|
88 | (1) |
|
National Institute of Standards and Technology |
|
|
88 | (1) |
|
|
89 | (1) |
|
Compliance amid Technological Changes |
|
|
89 | (3) |
|
|
89 | (2) |
|
Compliance with Blockchain |
|
|
91 | (1) |
|
Compliance with Cryptocurrencies |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
93 | (2) |
7 Operations Security |
|
95 | (12) |
|
The Operations Security Process |
|
|
96 | (3) |
|
Identification of Critical Information |
|
|
96 | (1) |
|
|
97 | (1) |
|
Analysis of Vulnerabilities |
|
|
97 | (1) |
|
|
98 | (1) |
|
Application of Countermeasures |
|
|
98 | (1) |
|
Laws of Operations Security |
|
|
99 | (1) |
|
First Law: Know the Threats |
|
|
99 | (1) |
|
Second Law: Know What to Protect |
|
|
99 | (1) |
|
Third Law: Protect the Information |
|
|
99 | (1) |
|
Operations Security in Our Personal Lives |
|
|
100 | (1) |
|
Origins of Operations Security |
|
|
101 | (3) |
|
|
102 | (1) |
|
|
102 | (1) |
|
|
103 | (1) |
|
|
103 | (1) |
|
Interagency OPSEC Support Staff |
|
|
103 | (1) |
|
|
104 | (1) |
|
|
105 | (2) |
8 Human Element Security |
|
107 | (14) |
|
Gathering Information for Social Engineering Attacks |
|
|
108 | (6) |
|
|
108 | (1) |
|
|
108 | (5) |
|
Other Kinds of Intelligence |
|
|
113 | (1) |
|
Types of Social Engineering Attacks |
|
|
114 | (2) |
|
|
114 | (1) |
|
|
114 | (2) |
|
|
116 | (1) |
|
Building Security Awareness with Security Training Programs |
|
|
116 | (3) |
|
|
116 | (1) |
|
Social Engineering Training |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
|
119 | (1) |
|
Familiarity with Policy and Regulatory Knowledge |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
120 | (1) |
9 Physical Security |
|
121 | (12) |
|
Identifying Physical Threats |
|
|
122 | (1) |
|
Physical Security Controls |
|
|
122 | (3) |
|
|
123 | (1) |
|
|
123 | (1) |
|
|
124 | (1) |
|
Using Physical Access Controls |
|
|
124 | (1) |
|
|
125 | (2) |
|
Physical Concerns for People |
|
|
125 | (1) |
|
|
126 | (1) |
|
|
126 | (1) |
|
|
127 | (1) |
|
|
127 | (2) |
|
Physical Concerns for Data |
|
|
127 | (1) |
|
|
128 | (1) |
|
|
129 | (1) |
|
|
129 | (3) |
|
Physical Concerns for Equipment |
|
|
129 | (1) |
|
|
130 | (1) |
|
|
131 | (1) |
|
|
131 | (1) |
|
|
132 | (1) |
|
|
132 | (1) |
10 Network Security |
|
133 | (12) |
|
|
134 | (4) |
|
Designing Secure Networks |
|
|
134 | (1) |
|
|
135 | (3) |
|
Implementing Network Intrusion Detection Systems |
|
|
138 | (1) |
|
Protecting Network Traffic |
|
|
138 | (2) |
|
Using Virtual Private Networks |
|
|
139 | (1) |
|
Protecting Data over Wireless Networks |
|
|
139 | (1) |
|
|
140 | (1) |
|
|
140 | (4) |
|
Wireless Protection Tools |
|
|
141 | (1) |
|
|
141 | (1) |
|
|
142 | (1) |
|
|
143 | (1) |
|
|
143 | (1) |
|
|
144 | (1) |
|
|
144 | (1) |
11 Operating System Security |
|
145 | (14) |
|
Operating System Hardening |
|
|
146 | (5) |
|
Remove All Unnecessary Software |
|
|
146 | (1) |
|
Remove All Unessential Services |
|
|
147 | (1) |
|
|
148 | (1) |
|
Apply the Principle of Least Privilege |
|
|
149 | (1) |
|
|
150 | (1) |
|
Turn On Logging and Auditing |
|
|
150 | (1) |
|
Protecting Against Malware |
|
|
151 | (2) |
|
|
151 | (1) |
|
Executable Space Protection |
|
|
151 | (1) |
|
Software Firewalls and Host Intrusion Detection |
|
|
152 | (1) |
|
Operating System Security Tools |
|
|
153 | (4) |
|
|
153 | (2) |
|
Vulnerability Assessment Tools |
|
|
155 | (1) |
|
|
156 | (1) |
|
|
157 | (1) |
|
|
157 | (2) |
12 Mobile, Embedded, And Internet Of Things Security |
|
159 | (14) |
|
|
160 | (4) |
|
Protecting Mobile Devices |
|
|
160 | (2) |
|
|
162 | (2) |
|
|
164 | (3) |
|
Where Embedded Devices Are Used |
|
|
164 | (2) |
|
Embedded Device Security Issues |
|
|
166 | (1) |
|
Internet of Things Security |
|
|
167 | (4) |
|
|
167 | (2) |
|
|
169 | (2) |
|
|
171 | (1) |
|
|
171 | (2) |
13 Application Security |
|
173 | (18) |
|
Software Development Vulnerabilities |
|
|
174 | (4) |
|
|
175 | (1) |
|
|
175 | (1) |
|
|
176 | (1) |
|
|
177 | (1) |
|
|
177 | (1) |
|
|
178 | (1) |
|
|
178 | (3) |
|
|
178 | (1) |
|
|
179 | (2) |
|
|
181 | (3) |
|
|
182 | (1) |
|
|
183 | (1) |
|
|
183 | (1) |
|
|
183 | (1) |
|
Application Security Tools |
|
|
184 | (4) |
|
|
184 | (2) |
|
Web Application Analysis Tools |
|
|
186 | (2) |
|
|
188 | (1) |
|
|
188 | (1) |
|
|
189 | (2) |
14 Assessing Security |
|
191 | (16) |
|
|
191 | (4) |
|
|
192 | (1) |
|
|
193 | (1) |
|
Technological Challenges for Vulnerability Assessment |
|
|
194 | (1) |
|
|
195 | (7) |
|
The Penetration Testing Process |
|
|
196 | (1) |
|
Classifying Penetration Tests |
|
|
197 | (1) |
|
Targets of Penetration Tests |
|
|
198 | (2) |
|
|
200 | (1) |
|
Technological Challenges for Penetration Testing |
|
|
201 | (1) |
|
Does This Really Mean You're Secure? |
|
|
202 | (3) |
|
|
202 | (1) |
|
Can You Detect Your Own Attacks? |
|
|
203 | (1) |
|
Secure Today Doesn't Mean Secure Tomorrow |
|
|
204 | (1) |
|
Fixing Security Holes Is Expensive |
|
|
205 | (1) |
|
|
205 | (1) |
|
|
206 | (1) |
Notes |
|
207 | (8) |
Index |
|
215 | |