Security Engineering
Full Title of Reference
Security Engineering: A Guide to Building Dependable Distributed Systems, 2nd Edition
Full Citation
Ross J. Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems (2d ed. 2008)
Categorization
- Overview: Books
- Threats and Actors: Financial Institutions and Networks; Military Networks (.mil); Public Data Networks; Telephone; Terrorists
- Issues: Economics of Cybersecurity; Espionage; Incentives; Government to Government; Cybercrime; Cyberwar
- Approaches: Regulation/Liability
Key Words
Antivirus, Botnet, Computer Network Attack, Credit Card Fraud, Cyber Crime, Cyber Security as an Externality, Cyber Security as a Public Good, Cyber Warfare, DDoS Attack, Hackers, Honeypot, Identity Fraud/Theft, Internet Relay Chat (IRC), Internet Service Providers, Keylogger, Malware, Organized Crime, Password Weakness, Patching, Phishing, Shoulder Surfing, Social Engineering, Software Vulnerability, SPAM, Trojan, White Hat, Whitelist, Worm, Zero-Day Exploit
Synopsis
This book contains a comprehensive introduction to security engineering – the discipline of making systems resilient in the face of malice, error and mischance. The author provides the crucial do's and don'ts of creating high quality security software that works to prevent all manner of security breaches. Topics range from firewalls, through phone phreaking and copyright protection, to frauds against e-businesses. Anderson's book shows how to use a wide range of tools, from cryptology through smartcards to applied psychology.
A number of applications are described in some detail. These include the common electronic commerce protocols; copyright protection mechanisms (from pay-TV through DVD); the telephone system (including not just wireline phones but GSM and 3gpp); burglar alarms; medical record systems; banking systems (from automatic teller machines through branch bookkeeping to interbank money transfer); and a number of military systems (ranging from communications and logistics through electronic warfare). These are not just used to teach how tools such as cryptography should be applied, but a number of general system-level lessons – such as what makes systems vulnerable to service denial attacks, and how to manage the trade-off between false alarms and missed alarms.
The book also provides a reference to a number of attack and defence technologies. These include anonymity systems (from anonymous remailers through de-identified medical databases); biometrics; security printing and seals; tamper-resistant electronics; emission security (from Tempest protection of PCs through power analysis attacks on smartcards). Although only a few dozen pages can be devoted to each topic, there are copious references for readers who need to learn more.
The third theme of the book is how the security engineering process can be managed. This includes topics ranging from cryptography policy, through the interaction of information security with economics, to what we can reasonably expect from evaluation and assurance.
The subject matter grew out of lectures in security given to students at Cambridge University, however,the material has been rewritten and expanded to be both self-contained and accessible to the working programmer or engineer. It can be used as a self-study guide, and read through from cover to cover; it can be used as a quick reference to particular applications or protection technologies; and it could also be used as a textbook. However, it is aimed at the professional, rather than the academic, market.
The revisions and updates from the first edition include new pages on Vista, Xen, phishing, Google issues, declassified military doctrine, "Richard Clarke issues," Skype, mobile fraud, music security issues, antitrust issues, and more.
Additional Notes and Highlights
Table of Contents with selected chapters available online:
Table of Contents Preface to the Second Edition. Foreword by Bruce Schneier. Preface. Acknowledgments. Part I. Chapter 1 What Is Security Engineering? Chapter 2 Usability and Psychology. Chapter 3 Protocols. Chapter 4 Access Control. Chapter 5 Cryptography. Chapter 6 Distributed Systems. Chapter 7 Economics. Part II. Chapter 8 Multilevel Security. Chapter 9 Multilateral Security. Chapter 10 Banking and Bookkeeping. Chapter 11 Physical Protection. Chapter 12 Monitoring and Metering. Chapter 13 Nuclear Command and Control. Chapter 14 Security Printing and Seals. Chapter 15 Biometrics. Chapter 16 Physical Tamper Resistance. Chapter 17 Emission Security. Chapter 18 API Attacks. Chapter 19 Electronic and Information Warfare. Chapter 20 Telecom System Security. Chapter 21 Network Attack and Defense. Chapter 22 Copyright and DRM. Chapter 23 The Bleeding Edge. Part III. Chapter 24 Terror, Justice and Freedom. Chapter 25 Managing the Development of Secure Systems. Chapter 26 System Evaluation and Assurance. Chapter 27 Conclusions. Bibliography. Index.