C S omputer eCurity P P rinciPles and ractice Third Edition William Stallings Lawrie Brown UNSW Canberra at the Australian Defence Force Academy Boston Columbus Indianapolis New York San Francisco Upper Saddle River Amsterdam CapeT own Dubai London Madrid Milan Munich Paris Montreal Toronto Delhi Mexico City São Paulo Sydney Hong Kong Seoul Singapore Taipei Tokyo Editorial Director, ECS: Marcia Horton Cover Designer: Marta Samsel Executive Editor: Tracy Johnson (Dunkelberger) Managing Project Editor: Dr. Priyadharshini Editorial Assistant: Kelsey Loanes Dhanagopal Director of Marketing: Christy Lesko Production Project Manager: Jennifer Sargunar Marketing Manager: Yez Alayan Permissions Supervisor: Rachel Youdelman Marketing Assistant: Jon Bryant Permissions Administrator: William Opaluch Director of Program Management: Erin Gregg Cover Art: © Arnaud Chicurel/Hemis/Corbis Program Management – Team Lead: Scott Disanno Associate Web Developer: Barry Offringa Program Manager: Carole Snyder Full-Service Project Management: Project Manager: Robert Engelhardt Mahalatchoumy Saravanan, Jouve India Procurement Specialist: Linda Sager Credits and acknowledgments borrowed from other sources and reproduced, with permission, in this textbook appear on page 815. Copyright © 2015, 2012, 2008 by Pearson Education, Inc. All rights reserved. Printed in the United States of America. This publication is protected by copyright, and permission should be obtained from the publisher prior to any prohibited reproduction, storage in a retrieval system, or transmission in any form or by any means, electronic, mechanical, photocopying, recording, or likewise. To obtain permission(s) to use material from this work, please submit a written request to Pearson Education, Inc., Permissions Department, One Lake Street, Upper Saddle River, New Jersey 07458, or you may fax your request to 201-236-3290. Many of the designations by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations have been printed in initial caps or all caps. Library of Congress Cataloging-in-Publication Data Stallings, William, author. Computer security : principles and practice / William Stallings, Lawrie Brown, University of New South Wales, Australian Defence Force Academy. — Third edition. pages cm ISBN 978-0-13-377392-7 — ISBN 0-13-377392-2 1. Computer security. 2. Computer security—Examinations—Study guides. 3. Computer networks—Security measures—Examinations—Study guides. 4. Electronic data processing personnel—Certification—Study guides. I. Brown, Lawrie, author. II. Title. QA76.9.A25S685 2014 005.8—dc23 2014012092 10 9 8 7 6 5 4 3 2 1 ISBN-10: 0-13-377392-2 ISBN-13: 978-0-13-377392-7 For my loving wife, Tricia —WS To my extended family, who helped make this all possible —LB This page intentionally left blank C ontentS Online Resources xi Preface xii Notation xviii About the Authors xix Chapter 0 Reader’s and Instructor’s Guide 1 0.1 Outline of this Book 2 0.2 A Roadmap for Readers and Instructors 2 0.3 Support for CISSP Certification 3 0.4 Support for NSA/DHS Certification 5 0.5 Support for ACM/IEEE Computer Society Computer Science Curricula 2013 6 0.6 Internet and Web Resources 8 0.7 Standards 9 Chapter 1 Overview 11 1.1 Computer Security Concepts 12 1.2 Threats, Attacks, and Assets 19 1.3 Security Functional Requirements 25 1.4 Fundamental Security Design Principles 27 1.5 Attack Surfaces and Attack Trees 31 1.6 Computer Security Strategy 34 1.7 Recommended Reading 36 1.8 Key Terms, Review Questions, and Problems 37 Part One COmPuter SeCurity teChnOlOgy and PrinCiPleS 40 Chapter 2 Cryptographic Tools 40 2.1 Confidentiality with Symmetric Encryption 41 2.2 Message Authentication and Hash Functions 47 2.3 Public-Key Encryption 55 2.4 Digital Signatures and Key Management 60 2.5 Random and Pseudorandom Numbers 64 2.6 Practical Application: Encryption of Stored Data 66 2.7 Recommended Reading 67 2.8 Key Terms, Review Questions, and Problems 68 Chapter 3 User Authentication 72 3.1 Electronic User Authentication Principles 74 3.2 Password-Based Authentication 78 3.3 Token-Based Authentication 90 3.4 Biometric Authentication 96 3.5 Remote User Authentication 100 v vi Contents 3.6 Security Issues for User Authentication 103 3.7 Practical Application: An Iris Biometric System 105 3.8 Case Study: Security Problems for ATM Systems 107 3.9 Recommended Reading 110 3.10 Key Terms, Review Questions, and Problems 110 Chapter 4 Access Control 113 4.1 Access Control Principles 114 4.2 Subjects, Objects, and Access Rights 117 4.3 Discretionary Access Control 118 4.4 Example: UNIX File Access Control 124 4.5 Role-Based Access Control 127 4.6 Attribute-Based Access Control 133 4.7 Identity, Credential, and Access Management 139 4.8 Trust Frameworks 143 4.9 Case Study: RBAC System for a Bank 147 4.10 Recommended Reading 150 4.11 Key Terms, Review Questions, and Problems 151 Chapter 5 Database and Cloud Security 155 5.1 The Need for Database Security 156 5.2 Database Management Systems 157 5.3 Relational Databases 159 5.4 SQL Injection Attacks 163 5.5 Database Access Control 169 5.6 Inference 173 5.7 Database Encryption 176 5.8 Cloud Computing 180 5.9 Cloud Security Risks and Countermeasures 187 5.10 Data Protection in the Cloud 189 5.11 Cloud Security as a Service 189 5.12 Recommended Reading 193 5.13 Key Terms, Review Questions, and Problems 194 Chapter 6 Malicious Software 199 6.1 Types of Malicious Software (Malware) 200 6.2 Advanced Persistent Threat 203 6.3 Propagation—Infected Content—Viruses 204 6.4 Propagation—Vulnerability Exploit—Worms 210 6.5 Propagation—Social Engineering—Spam E-Mail, Trojans 218 6.6 Payload—System Corruption 221 6.7 Payload—Attack Agent—Zombie, Bots 222 6.8 Payload—Information Theft—Keyloggers, Phishing, Spyware 224 6.9 Payload—Stealthing—Backdoors, Rootkits 226 6.10 Countermeasures 229 6.11 Recommended Reading 235 6.12 Key Terms, Review Questions, and Problems 236 Contents vii Chapter 7 Denial-of-Service Attacks 240 7.1 Denial-of-Service Attacks 241 7.2 Flooding Attacks 248 7.3 Distributed Denial-of-Service Attacks 250 7.4 Application-Based Bandwidth Attacks 252 7.5 Reflector and Amplifier Attacks 254 7.6 Defenses Against Denial-of-Service Attacks 259 7.7 Responding to a Denial-of-Service Attack 263 7.8 Recommended Reading 264 7.9 Key Terms, Review Questions, and Problems 264 Chapter 8 Intrusion Detection 267 8.1 Intruders 268 8.2 Intrusion Detection 272 8.3 Analysis Approaches 275 8.4 Host-Based Intrusion Detection 278 8.5 Network-Based Intrusion Detection 283 8.6 Distributed or Hybrid Intrusion Detection 289 8.7 Intrusion Detection Exchange Format 291 8.8 Honeypots 294 8.9 Example System: Snort 296 8.10 Recommended Reading 300 8.11 Key Terms, Review Questions, and Problems 300 Chapter 9 Firewalls and Intrusion Prevention Systems 304 9.1 The Need for Firewalls 305 9.2 Firewall Characteristics and Access Policy 306 9.3 Types of Firewalls 308 9.4 Firewall Basing 314 9.5 Firewall Location and Configurations 317 9.6 Intrusion Prevention Systems 322 9.7 Example: Unified Threat Management Products 326 9.8 Recommended Reading 330 9.9 Key Terms, Review Questions, and Problems 331 Part twO SOftware SeCurity and truSted SyStemS 336 Chapter 10 Buffer Overflow 336 10.1 Stack Overflows 338 10.2 Defending Against Buffer Overflows 359 10.3 Other Forms of Overflow Attacks 365 10.4 Recommended Reading 372 10.5 Key Terms, Review Questions, and Problems 372 Chapter 11 Software Security 375 11.1 Software Security Issues 376 11.2 Handling Program Input 380 viii Contents 11.3 Writing Safe Program Code 392 11.4 Interacting with the Operating System and Other Programs 396 11.5 Handling Program Output 409 11.6 Recommended Reading 411 11.7 Key Terms, Review Questions, and Problems 412 Chapter 12 Operating System Security 416 12.1 Introduction to Operating System Security 418 12.2 System Security Planning 419 12.3 Operating Systems Hardening 419 12.4 Application Security 424 12.5 Security Maintenance 425 12.6 Linux/Unix Security 426 12.7 Windows Security 430 12.8 Virtualization Security 432 12.9 Recommended Reading 436 12.10 Key Terms, Review Questions, and Problems 437 Chapter 13 Trusted Computing and Multilevel Security 439 13.1 The Bell-LaPadula Model for Computer Security 440 13.2 Other Formal Models for Computer Security 450 13.3 The Concept of Trusted Systems 456 13.4 Application of Multilevel Security 459 13.5 Trusted Computing and the Trusted Platform Module 465 13.6 Common Criteria for Information Technology Security Evaluation 469 13.7 Assurance and Evaluation 475 13.8 Recommended Reading 480 13.9 Key Terms, Review Questions, and Problems 481 Part three management iSSueS 485 Chapter 14 IT Security Management and Risk Assessment 485 14.1 IT Security Management 486 14.2 Organizational Context and Security Policy 489 14.3 Security Risk Assessment 492 14.4 Detailed Security Risk Analysis 495 14.5 Case Study: Silver Star Mines 507 14.6 Recommended Reading 512 14.7 Key Terms, Review Questions, and Problems 513 Chapter 15 IT Security Controls, Plans, and Procedures 515 15.1 IT Security Management Implementation 516 15.2 Security Controls or Safeguards 516 15.3 IT Security Plan 524 15.4 Implementation of Controls 525 15.5 Monitoring Risks 526 15.6 Case Study: Silver Star Mines 529 15.7 Recommended Reading 532 15.8 Key Terms, Review Questions, and Problems 532 Contents ix Chapter 16 Physical and Infrastructure Security 534 16.1 Overview 535 16.2 Physical Security Threats 536 16.3 Physical Security Prevention and Mitigation Measures 543 16.4 Recovery From Physical Security Breaches 546 16.5 Example: A Corporate Physical Security Policy 546 16.6 Integration of Physical and Logical Security 547 16.7 Recommended Reading 553 16.8 Key Terms, Review Questions, and Problems 554 Chapter 17 Human Resources Security 556 17.1 Security Awareness, Training, and Education 557 17.2 Employment Practices and Policies 563 17.3 E-Mail and Internet Use Policies 566 17.4 Computer Security Incident Response Teams 567 17.5 Recommended Reading 574 17.6 Key Terms, Review Questions, and Problems 575 Chapter 18 Security Auditing 577 18.1 Security Auditing Architecture 579 18.2 Security Audit Trail 584 18.3 Implementing the Logging Function 588 18.4 Audit Trail Analysis 600 18.5 Example: An Integrated Approach 604 18.6 Recommended Reading 607 18.7 Key Terms, Review Questions, and Problems 608 Chapter 19 Legal and Ethical Aspects 610 19.1 Cybercrime and Computer Crime 611 19.2 Intellectual Property 615 19.3 Privacy 621 19.4 Ethical Issues 626 19.5 Recommended Reading 633 19.6 Key Terms, Review Questions, and Problems 634 Part fOur CryPtOgraPhiC algOrithmS 637 Chapter 20 Symmetric Encryption and Message Confidentiality 637 20.1 Symmetric Encryption Principles 638 20.2 Data Encryption Standard 643 20.3 Advanced Encryption Standard 645 20.4 Stream Ciphers and RC4 651 20.5 Cipher Block Modes of Operation 655 20.6 Location of Symmetric Encryption Devices 660 20.7 Key Distribution 662 20.8 Recommended Reading 664 20.9 Key Terms, Review Questions, and Problems 664