Computer Security - Dieter Gollmann

. .

Résumé :
Preface xvii

CHAPTER 1 - History of Computer Security 1

1.1 The Dawn of Computer Security 2

1.2 1970s - Mainframes 3

1.3 1980s - Personal Computers 4

1.4 1990s - Internet 6

1.5 2000s - The Web 8

1.6 Conclusions - The Benefits of Hindsight 10

1.7 Exercises 11

CHAPTER 2 - Managing Security 13

2.1 Attacks and Attackers 14

2.2 Security Management 15

2.3 Risk and Threat Analysis 21

2.4 Further Reading 29

2.5 Exercises 29

CHAPTER 3 - Foundations of Computer Security 31

3.1 Definitions 32

3.2 The Fundamental Dilemma of Computer Security 40

3.3 Data vs Information 40

3.4 Principles of Computer Security 41

3.5 The Layer Below 45

3.6 The Layer Above 47

3.7 Further Reading 47

3.8 Exercises 48

CHAPTER 4 - Identification and Authentication 49

4.1 Username and Password 50

4.2 Bootstrapping Password Protection 51

4.3 Guessing Passwords 52

4.4 Phishing, Spoofing, and Social Engineering 54

4.5 Protecting the Password File 56

4.6 Single Sign-on 58

4.7 Alternative Approaches 59

4.8 Further Reading 63

4.9 Exercises 63

CHAPTER 5 - Access Control 65

5.1 Background 66

5.2 Authentication and Authorization 66

5.3 Access Operations 68

5.4 Access Control Structures 71

5.5 Ownership 73

5.6 Intermediate Controls 74

5.7 Policy Instantiation 79

5.8 Comparing Security Attributes 79

5.9 Further Reading 84

5.10 Exercises 84

CHAPTER 6 - Reference Monitors 87

6.1 Introduction 88

6.2 Operating System Integrity 90

6.3 Hardware Security Features 91

6.4 Protecting Memory 99

6.5 Further Reading 103

6.6 Exercises 104

CHAPTER 7 - Unix Security 107

7.1 Introduction 108

7.2 Principals 109

7.3 Subjects 111

7.4 Objects 113

7.5 Access Control 116

7.6 Instances of General Security Principles 119

7.7 Management Issues 125

7.8 Further Reading 128

7.9 Exercises 128

CHAPTER 8 - Windows Security 131

8.1 Introduction 132

8.2 Components of Access Control 135

8.3 Access Decisions 142

8.4 Managing Policies 145

8.5 Task-Dependent Access Rights 147

8.6 Administration 150

8.7 Further Reading 153

8.8 Exercises 153

CHAPTER 9 - Database Security 155

9.1 Introduction 156

9.2 Relational Databases 158

9.3 Access Control 162

9.4 Statistical Database Security 167

9.5 Integration with the Operating System 172

9.6 Privacy 173

9.7 Further Reading 175

9.8 Exercises 175

CHAPTER 10 - Software Security 177

10.1 Introduction 178

10.2 Characters and Numbers 179

10.3 Canonical Representations 183

10.4 Memory Management 184

10.5 Data and Code 191

10.6 Race Conditions 193

10.7 Defences 194

10.8 Further Reading 201

10.9 Exercises 202

CHAPTER 11 - Bell-LaPadula Model 205

11.1 State Machine Models 206

11.2 The Bell-LaPadula Model 206

11.3 The Multics Interpretation of BLP 212

11.4 Further Reading 216

11.5 Exercises 216

CHAPTER 12 - Security Models 219

12.1 The Biba Model 220

12.2 Chinese Wall Model 221

12.3 The Clark-Wilson Model 223

12.4 The Harrison-Ruzzo-Ullman Model 225

12.5 Information-Flow Models 228

12.6 Execution Monitors 230

12.7 Further Reading 232

12.8 Exercises 233

CHAPTER 13 - Security Evalu...