Muutke küpsiste eelistusi

E-raamat: Network and Data Security for Non-Engineers

4.00/5 (2 hinnangut Goodreads-ist)
, (Ball State University, Muncie, Indiana, USA), (Ball State University, Muncie, Indiana, USA)
  • Formaat: 273 pages
  • Sari: Technology for Non-Engineers
  • Ilmumisaeg: 19-Aug-2016
  • Kirjastus: Auerbach Publishers Inc.
  • Keel: eng
  • ISBN-13: 9781315350219
Teised raamatud teemal:
  • Formaat - EPUB+DRM
  • Hind: 80,72 €*
  • * hind on lõplik, st. muud allahindlused enam ei rakendu
  • Lisa ostukorvi
  • Lisa soovinimekirja
  • See e-raamat on mõeldud ainult isiklikuks kasutamiseks. E-raamatuid ei saa tagastada.
Network and Data Security for Non-EngineersSuurem pilt
  • Formaat: 273 pages
  • Sari: Technology for Non-Engineers
  • Ilmumisaeg: 19-Aug-2016
  • Kirjastus: Auerbach Publishers Inc.
  • Keel: eng
  • ISBN-13: 9781315350219
Teised raamatud teemal:

DRM piirangud

  • Kopeerimine (copy/paste):

    ei ole lubatud

  • Printimine:

    ei ole lubatud

  • Kasutamine:

    Digitaalõiguste kaitse (DRM)
    Kirjastus on väljastanud selle e-raamatu krüpteeritud kujul, mis tähendab, et selle lugemiseks peate installeerima spetsiaalse tarkvara. Samuti peate looma endale  Adobe ID Rohkem infot siin. E-raamatut saab lugeda 1 kasutaja ning alla laadida kuni 6'de seadmesse (kõik autoriseeritud sama Adobe ID-ga).

    Vajalik tarkvara
    Mobiilsetes seadmetes (telefon või tahvelarvuti) lugemiseks peate installeerima selle tasuta rakenduse: PocketBook Reader (iOS / Android)

    PC või Mac seadmes lugemiseks peate installima Adobe Digital Editionsi (Seeon tasuta rakendus spetsiaalselt e-raamatute lugemiseks. Seda ei tohi segamini ajada Adober Reader'iga, mis tõenäoliselt on juba teie arvutisse installeeritud )

    Seda e-raamatut ei saa lugeda Amazon Kindle's. 

Learn network and data security by analyzing the Anthem breach and step-by-step how hackers gain entry, place hidden software, download information, and hide the evidence of their entry. Understand the tools, establishing persistent presence, use of sites as testbeds to determine successful variations of software that elude detection, and reaching out across trusted connections to the entire healthcare system of the nation. Examine the components of technology being diverted, starting with application code and how to protect it with isolation approaches. Dissect forms of infections including viruses, worms, bots, and Trojans; and encryption with RSA algorithm as the working example.

Preface xiii
Authors xv
1 Introduction to Security Threats 1(2)
2 The 2014-2015 Anthem Blue Cross and Blue Shield Break-In Case Study 3(18)
Step 1: Reconnaissance
4(1)
Step 2: Picking the Right Target and Spear Phishing Them
4(1)
Spear Phishing
5(1)
Waterholes
5(1)
Step 3: Initial System Entry
5(1)
Next Steps to Establish an Undetectable Anonymous Persistent Presence
6(1)
Password Decryption Process and Equipment
6(1)
Testbed
6(1)
Final Steps
6(2)
Tools Used by Hackers to Acquire Valid Entry Credentials and Tools Used by Security Personnel to Detect Activity and Malware and Protect the Stored Data
8(13)
Tool 1: Initial Spear-Phishing Entry Leading to the ScanBox Keystroke Logger
8(4)
Tool 2: Setting Up an Anonymous Path Using Tor
12(4)
Tool 3: CrowdStrike Identified Hacker Clusters, China Chopper Web-Shell Controller
16(12)
CrowdStrike's Identified Hacking Clusters
16(1)
China Chopper Web Shell Controller
17(1)
Types of Common Monitoring Software Employed
18(1)
Looking for Derusbi Parsing Software
18(1)
RSA's ECAT Scanning Software
19(1)
Yara's Operation
19(2)
3 Anonymous Persistent Threats 21(4)
Rivest-Shamir-Adleman (RSA) Identified Shell Crew
21(2)
Kaspersky Lab Has Identified a Recent Attack Group That Identifies Its Tools as Careto: The Mask
23(1)
Dark Web
24(1)
4 Creating Secure Code 25(10)
First Principle of Code Protection: Code Isolation and Confinement
25(1)
Code Isolation Techniques
26(2)
Implementation of the Four Code-Confinement Methods
28(2)
Reference Monitors
28(1)
OS Chroots
28(1)
OS Jail Routines
28(1)
FreeBSD Jail
29(1)
Linux's Ptrace Monitor and Systrace Routines
29(1)
Employing Applications Such as Ostia or NACI
30(1)
Isolation of Virtual Machines
30(1)
Computer Virtualization
31(1)
Threats to Computer Virtualization
31(4)
Subverting VM Isolation
32(1)
VM-Based Malware
32(1)
Software Fault Isolation
32(3)
5 Providing a Secure Architecture 35(6)
Providing a Secure Architecture
35(3)
Isolation and Least Privilege
35(1)
Access Control Concepts
36(1)
Operating Systems
37(1)
Browser Isolation and Least Privilege
38(1)
Hacking Attacks
38(1)
Spear Phishing and Behavioral Attacks
39(1)
Spoofing, Digital Misrepresentation, and Mobile Security
39(2)
6 The Hacker Strategy: Expanded 41(10)
Lab Analysis and Learning Vulnerabilities
41(5)
Hacker Strategies
41(5)
Reconnaissance
42(1)
Attracting the Victim
43(1)
Gain Control
43(1)
Exfiltrate Data and Conscript
43(1)
Overall: Cloak the Source
43(1)
Antivirus Protection
44(1)
Crack Passwords
44(1)
The Key
44(2)
Zero-Days
46(1)
Basic Control of Hijacking Attacks
46(1)
Platform Defenses
47(2)
Run-Time Defenses
48(1)
Advanced Hijacking Attacks: Heap Spraying
48(1)
The Final Solution to Hacking Attacks
49(2)
7 Malware, Viruses, Worms, Bugs, and Botnets 51(30)
Introduction
51(1)
Botnets: Process and Components and History
52(1)
Viruses and Worms
52(1)
A More Detailed Examination of Malware, Viruses, Trojans, and Bots/Botnets
53(5)
Worms
54(1)
Some Examples of Historical Worm Attacks
54(2)
Morris Worm
54(1)
Code Red I and Code Red II Worms
54(1)
Nimda Worm
55(1)
SQL Slammer
55(1)
Conficker Worm
55(1)
E-Mail Worms
55(1)
Love Bug Worm
55(1)
MyDoom Worm
56(1)
Storm Worm and Storm Botnet
56(1)
Viruses
56(2)
Virus Propagation
57(1)
Payload
58(1)
Detecting a Virus
58(4)
Polymorphic Code
58(1)
Metamorphic Code
59(1)
When Malware Is Detected
60(1)
Botnets
60(4)
Star-Structured Botnets
61(1)
Hierarchical Botnets
62(1)
Defending from Botnets
62(1)
Anonymity and Sneakiness
62(2)
Sneakiness and Side-Channel Attacks
64(5)
Covert Channels
65(1)
Security
65(1)
Side Channels
65(2)
Side Channels in Web Surfing
67(1)
Exploiting Side Channels for Stealth Scanning
67(1)
UI Side-Channel Snooping
68(1)
Bugs
69(1)
Detecting Attacks and Removal Systems
70(1)
Intrusion Detection Systems
70(1)
Host-Based and Network-Based Intrusion Detection Systems
70(4)
Network-Based Intrusion Detection Systems
70(1)
Host-Based Intrusion Detection Systems
71(1)
Honeypot Traps out in the Network
71(1)
Passive and Reactive Systems
72(1)
Statistical Anomaly and Signature-Based IDSs
72(1)
Comparison with Firewalls
72(1)
Detection Evasion Techniques
72(2)
Forensics
74(1)
Detecting Attacks and Attackers with Examples
74(2)
Symmetric Cryptography
74(1)
The Problem of Detecting Attacks
74(1)
Directory Traversal
74(1)
What Is Another Method to Detect This Attack?
75(1)
An Alternate Paradigm
75(1)
Detection Accuracy
75(1)
Detecting Successful Attacks
76(1)
Detection versus Blocking
76(2)
Styles of Detection
76(1)
Signature Based
76(1)
Vulnerability Signatures
77(1)
Anomaly Based
78(1)
Specification-Based Detection
78(1)
Behavioral Detection
78(1)
The Problem of Evasion
78(3)
8 Cryptography and the RSA Algorithm 81(8)
Data Encryption Standard and Advanced Encryption Standard
82(3)
Public Keys
85(1)
Modern Approaches for Breaking Encryption
85(1)
Current Cryptography Concepts
85(1)
More Cryptography, Private-Key, Public-Key Encryption, RSA Algorithm Details
86(3)
9 Browser Security and Cross-Site Scripting 89(8)
Three Web Threat Models
90(1)
Web-Page Content
91(1)
Code Isolation
91(1)
Browser Security Model
92(1)
Hypertext Transfer Protocol
92(1)
Rendering Content
93(1)
Isolation
93(1)
Security User Interface
94(1)
Cookies
94(1)
Frame Busting
95(1)
Browser Code Isolation
95(2)
Web Worker
96(1)
Sandbox
96(1)
Cross-Origin Resource Sharing
96(1)
Content Security Policy
96(1)
10 Banking Security, Zeus, and SpyEye 97(8)
Fraud Process
99(1)
Risk Management Process for Banks
99(1)
Zeus and SpyEye Attacks
100(2)
Online Fraud and the Impacts of Zeus and SpyEye Attacks
102(3)
11 Web Application Security 105(4)
Basics of SQL Injections
105(2)
More Examples of Injection-Based Attacks
107(2)
A Review of the ScanBox Software
107(2)
12 Session Management, User Authentication, and Web Application Security 109(8)
Session Management and User Authentication
109(2)
Session Management
109(1)
HTTP Cookies
110(1)
Session ID
110(1)
Storing Session IDs
111(1)
Web Application Security
111(10)
Structured Query Language Injection
112(1)
An SQL Injection Example: The CardSystems Solutions Attack
112(1)
Cross-Site Request Forgery
112(2)
Cross-Site Scripting
114(8)
Example of an XSS Attack on PayPal
114(1)
Session Management and User Authentication Conclusion
114(3)
13 Web Security, DNS Security, and the Internet 117(4)
14 Network Security and Defenses 121(12)
Network Security: Recap
122(6)
Protocols
122(1)
Address Resolution Protocol
123(1)
Internet Protocol
124(1)
Packet Sniffing
125(1)
User Datagram Protocol (UDP)
125(1)
Blind TCP Session Hijacking
125(2)
Stopping Services
127(1)
Exhausting Resources
127(1)
SYN Flooding
127(1)
Smurf DoS Attacks
127(1)
Internet Control Message Protocol
127(1)
Distributed Denial-of-Service Attacks
127(1)
Cryptographic Network Protection
128(1)
Internet Protocol Security
128(1)
Network Attacks
128(1)
Physical/Link-Layer Threats: Eavesdropping
128(1)
Physical/Link-Layer Threats: Spoofing
128(1)
Layer 3 Threats
129(1)
Layer 4 TCP and UDP Threats
129(3)
DHCP Threats
130(1)
Domain Name System Threats
131(1)
Concluding Highlights
132(1)
15 Network Security Protocols and Defensive Mechanisms 133(14)
Network Security Protocols
133(2)
IP Security (IPSec) Protocol
134(1)
Phase 1 134
134(1)
Phase 2
134(1)
Layer 2: Link-Layer Connectivity of Wireless
135(2)
TCP/IP Basic Layer 2-3 Security Problems
135(2)
Defense Mechanisms That Can Be Employed
136(1)
Virtual Private Network
136(1)
Several Different Protocols Then Apply to These Modes
136(1)
Basic Packet Formats
136(1)
Filtering Network Traffic at the IP Level
137(2)
Basic Packet Filtering
138(1)
Firewall Stateful Packet Filtering
139(1)
Other Protocols of Concern
139(1)
IP Fragmentation
139(2)
Transport Layer Security
141(1)
Proxy Firewall
141(1)
Web Traffic Scanning
142(1)
Intrusion Detection Systems
142(1)
Two Critical Infrastructure Protocols: BGP and DNS
142(1)
Infrastructure Protocols for DNS and DNSSEC
143(1)
Network Control Firewalls
144(1)
Security Principle Reference Monitors
145(2)
16 Denial-of-Service Attacks 147(4)
17 Mobile Platform Security 151(14)
Comparison of Mobile Platforms
151(2)
Apple iOS Operating System
152(1)
Core OS Layer
152(1)
Core Services Layer
152(1)
Media Layer
153(1)
Cocoa Touch Layer
153(1)
Development of iOS Applications
153(1)
Apple iOS Security
153(1)
Android Mobile Smartphone
154(1)
Android Security Model
154(1)
Security Features
155(1)
App Development Concepts
155(2)
Exploit Prevention
156(1)
Layers of Security
156(1)
Java Sandbox
157(1)
Apple iOS versus Android Operating System Comparisons
158(1)
Windows Mobile Models 7 and 8 Devices
158(2)
Windows Phone OS 7.0 Security Model
159(1)
.NET Code Access Security That Can Be Exploited on Windows Phones
160(3)
Mobile Platform Security
161(2)
Mobile Platform Security
163(1)
Attack Vectors for Mobile Devices
164(1)
18 Cellular Access Security: 4G LTE, Mobile WiMAX, 5G, and MIMOs 165(22)
First-Generation Cellular Network
165(1)
Security Issues and Drawbacks
166(1)
Second-Generation Cellular Network
166(1)
Security Issues and Drawbacks
166(1)
Third-Generation Cellular Network
167(2)
Security Issues and Drawbacks
168(1)
Information Security
169(1)
Security Analysis
169(3)
Goals and Objectives in Security
169(1)
Boundaries and Limitations in Security
169(1)
Types of Security Issues
170(1)
Types of Security Attacks
171(1)
Architecture of Security
172(1)
4G Security (LTE and WiMAX)
172(1)
WiMAX Introduction
172(1)
History of WiMAX
173(1)
Evolution of Mobile WiMAX
173(1)
Mobile WiMAX Architecture
174(1)
WiMAX Security, Threats, and Solutions
175(1)
4G LTE Introduction
176(1)
History of 4G LTE
176(1)
4G LTE Architecture
176(1)
4G LTE Security, Threats, and Solutions
177(1)
A 5G Future
178(1)
5G Security
179(4)
HetNets
180(1)
Massive MIMO
181(2)
Millimeter Wave
183(1)
Conclusion
183(4)
19 Wireless LAN Security 187(16)
Regulatory WLAN Security Standards
187(3)
802.11a
188(1)
802.11b
189(1)
802.11g
189(1)
802.11n
189(1)
802.11ac
189(1)
802.11af
189(1)
802.11i
189(1)
Wire Lined to Wireless Transition
190(1)
WNIC
190(1)
Corporate Background of Wireless Networks
190(1)
Wireless Network Security Methods
191(1)
CIA Triangle of Confidentiality, Integrity, and Availability
191(2)
Smart Cards
192(1)
Security Tokens and Software Tokens
192(1)
Wireless Security History, Standards, and Developments
193(4)
Wired Equivalent Privacy
193(1)
Wi-Fi Protected Access
194(1)
Temporal Key Integrity Protocol (TKIP)
194(1)
Extensible Authentication Protocol (EAP)
194(1)
Lightweight Extensible Authentication Protocol (LEAP)
194(1)
Protected Extensible Authentication Protocol (PEAP)
194(1)
Wireless Transport Layer Security (WTLS)
195(1)
Wi-Fi Protected Setup (WPS)
195(1)
WPA2
195(2)
Other Security Considerations
197(1)
Threats of Wireless Networks
198(3)
Confidentiality Attacks
199(1)
Access Control Attacks
199(2)
Conclusion
201(2)
20 The Stuxnet Worm and the Vulnerability of the U.S. Electric Power Grid 203(18)
More Details of the Stuxnet Worm Used for Cyber Warfare
205(3)
Attack Process
205(3)
Path 1: Via WinCC
207(1)
Path 2: Via Network Shares
207(1)
Path 3: Via the MS10-061 Print Spooler 0-Day Vulnerability
208(1)
Path 4: Via the MS08-067 SMB Vulnerability
208(1)
Path 5: Via Step? Projects
208(1)
Stuxnet Damage
208(1)
Cyber Terrorism after Stuxnet
209(1)
Stuxnet Attack Summary
209(1)
Response and Industrial Control Security
210(1)
The Vulnerable U.S. Electronic Power Grid
211(1)
Components and Operating Elements of the U.S. Electric Power Grid
212(2)
Irreplaceable Large Power Transformers and Our Smart Grid Risk
214(1)
Smart Meters
215(1)
Programmable Logic Controllers
216(1)
Advantages of PLCs
216(1)
Distribution Transformers and Controllers
216(1)
Local PLC Inner-Loop Controller
217(1)
A SCADA System
218(1)
Conclusion
219(2)
21 Cyber Warfare 221(4)
Weapons of Cyber War
223(1)
Cyber Crime as a Service
223(1)
Hacktivists
224(1)
22 Conclusion 225(2)
Bibliography 227(8)
Appendix 235(10)
Index 245
Stephan S. Jones, PhD, is the director of the Center for Information and Communication Sciences, where he is also a professor delivering core technology courses in the graduate-only program. His industry experience is as a field engineer and owner of a telecommunications company providing voice and data solutions for business/commercial systems in the Midwest. In academe, he has published or edited numerous books and texts associated with simplifying complex communication technologies for nonengineering students to comprehend. He is actively engaged in supporting broadband technology deployments to underserved and unserved regions of the country and providing technical support for non-profit organizations with student participation.





Frank Groom, PhD, is a professor in the Graduate Center for Information and Communication Science at Ball State University. His research is concentrated in the areas of high-bandwidth networking, distributed systems, and the storage of multimedia objects. Dr. Groom is the author of seven books, most recently having finished The Basics of Voice over IP Networking and The Basics of 802.11 Wireless LANs. Among his best known books are The Future of ATM and The ATM Handbook. Dr. Groom earned his PhD from the University of Wisconsin Milwaukee in information systems. He is the former senior director of information systems for Ameritech.
Lisainfo e-raamatute kohta Lisainfo e-raamatute kohta
Püsilink: https://www.kriso.ee/db/97813153502196e.html
Märksõnad: