INDEX
A
AAA (authentication, authorization, and auditing)
Diameter protocol, 67
TACACS+, 68
abstract machine (security kernel), 79, 91–92
abstraction
benefits of, 333
in third-generation programming languages, 328
academic software, software licensing and, 280
acceptance testing, 318
access control
analyzing products for, 41, 60
architecture for, 80
auditing physical access, 120
authorization creep and, 4
database security and, 21
detecting/preventing misuse of access rights, 345, 364
directory services and, 47
dynamic, 100
lock mechanism for server room doors, 144
mechanisms embedded in OSs, 83, 112
in physical security design, 122
privileges, 4
topics related to, 37
WAM (Web access management) software, 38
X.500 standard and, 48
access control lists (ACLs)
capability lists compared with, 64
mapping values from access control matrix to objects, 69
access control matrix, 43, 68–69
access points (APs), in wireless networks, 186
access triple, in Clark-Wilson access model, 91
accounting practices, SOX (Sarbanes-Oxley) Act and, 281
accounts
identity theft, 63
lock out, 366
ACID (atomicity, consistency, isolation, durability) testing, 313–315
ACKS (acknowledgements), in TCP, 167
ACLs (access control lists)
capability lists compared with, 64
mapping values from access control matrix to objects, 69
acoustical detection system, 143
Active Directory, 48
address bus, hardwired to RAM chips, 116
administrators
guidelines for remote administration, 368–369
managing audit logs, 59
Advisory policies, in security program, 32
AES (Advanced Encryption Standard)
bulk data encryption with, 218
included in TKIP, 186
as symmetric block cipher, 215
uses of, 197
aggregation, of information from separate sources, 99
AIC (availability, integrity, and confidentiality)
access control and, 37
security steering committee responsible for, 14
alarms, responding to IDSs, 145
ALE (annualized loss expectancy), in risk management, 22
algorithms
AES. See AES (Advanced Encryption Standard)
asymmetric. See asymmetric algorithms
countermeasures to brute-force attacks, 366
hashing. See hashing algorithms
link-state, 176
public key algorithm, 215
RC4, 186
security services provided by, 197
symmetric. See symmetric algorithms
analysis stage, of incident response, 286, 295
ANN (artificial neural network), 325–326
annual rate of occurrence (ARO), in risk management, 22
annualized loss expectancy (ALE), in risk management, 22
annunciator systems, complementing CCTV monitors, 134
anomaly-based IDS, 61–62
antispam software. See also spam
anti-relaying features of, 367
as type of security control, 3
antivirus software. See also viruses
disinfecting damaged files, 346, 368
as type of security control, 3
types of, 330
virus detection methods, 307
ANZ 4360, risk management focus of, 26
APIs (application program interface), 332
applications
checkpoint function in, 310, 336
end-to-end encryption within, 209
information exchange over Internet via SOAP, 324
markup languages sharing application security policies, 40, 58
topics related to application security, 303
trusted recovery, 357
virtual machines and legacy applications, 97
approval process, in change control policy, 351
APs (access points), in wireless networks, 186
architecture, security. See security architecture
ARO (annual rate of occurrence), in risk management, 22
art
capacitance detector for protection of, 143
IDS for protection of, 123
artificial neural network (ANN), 325–326
ASs (autonomous systems), Internet architecture and, 175
Assembly languages, 327
assessments aspect, of physical security design, 137
assets
employee role in protecting, 33
intruder methods for accessing, 3
assisted password reset, 49
asymmetric algorithms calculating numbers of keys needed for company, 196, 214
comparing PKI with public key cryptography, 210
mathematically intensive tasks in, 207
use in protection of symmetric keys, 218
asymmetric key systems, 207
asynchronous tokens, for authentication, 75
ATM (Asynchronous Transfer Mode), 187–188
atomicity, in ACID testing, 314–315
attacks
birthday attacks on hashing functions, 228
brute-force. See brute-force attacks
buffer overflow. See buffer overflow attacks
computer-assisted crime and, 276
covert channels. See covert channel attacks
denial-of-service. See DoS (denial-of-service) attacks
on DNS (Domain Name Service), 157
DNS spoofing, 171
emanations capturing, 274
IM clients and, 183
inference, 98–99
intruders covering tracks, 59
IP phones vulnerability to, 178
IP spoofing. See IP spoofing attacks
microprocessor technology increasing potency of, 78, 88
password sniffing, 298–299
on passwords, 39
pharming. See pharming attacks
phishing. See phishing attacks
preventing by limiting electrical signals emitted by computers, 298
race condition, 336
session hijacking. See session hijacking attacks
shoulder surfing, 366
side-channel, 90
side-channel attacks on smart cards, 38
on smart cards, 50
social engineering. See social engineering attacks
technical. See technical attacks
timing, 366
unauthorized access and, 346
attributes (columns), in relational databases, 339
audit committee, responsibilities of, 14
audit logs
auditing physical access, 120, 129–130
detective nature of, 365
auditors, information systems, 26
authentication
AAA (authentication, authorization, and auditing), 67, 68
algorithms providing, 197
asynchronous tokens for, 75
comparing PKI with public key cryptography, 210
cryptographic methods, 201, 227–228
for data and voice networks, 172
digital signatures providing, 217–218
IEEE 802.1 and, 184
IM (instant messaging) and, 183
OSA (open system authentication), 186
preventive nature of, 365
SMTP lacking adequate, 180
SSL providing, 219
technologies for, 160
authenticity, of evidence, 289–290
authorization
AAA (authentication, authorization, and auditing), 67, 68
creating new authorized user on compromised system, 20
modification of data without, 18
authorization creep
access control and, 4
factors in, 22–23
auto-iris lens, in CCTV cameras, 132, 138
autonomous objects, in object-oriented programming, 331
autonomous systems (ASs), Internet architecture and, 175
availability
device backup and, 354
solutions, 342–343
availability, integrity, and confidentiality (AIC)
access control and, 37
security steering committee responsible for, 14
awareness, learning objectives for, 33
B
backup power, adding to IDS, 145
backups
alternative facility for, 253
deciding what to back up and how often, 233
of devices, 342–343
electronic vaulting, 258
extending what is included in backup operations, 254
hierarchical storage management and, 348–349, 372–373
types of, 247
warm site for restoring and using backup tapes, 232, 244
bandwidth management, FHSS (frequency hopping spread spectrum), 185
banks, construction materials in walls of, 121, 132–133
Basic Rate Interface (BRI), ISDN technologies, 189
Basic Service Set (BSS), 186
BCP team, 257
BCPs (business continuity plans)
benefits of, 250–251
graphic view of, 238–239
management supporting, 234, 251
need for updating, 234, 249–250
NIST practices for creating, 241
recruiting members to BCP committee, 232, 242
steps in creating, 253
threat evaluation in, 237, 262
topics related to, 231
behavior-based IDS, 61–62
behavior blocking, antivirus software, 330
Bell-LaPadula model
access models, 91
lattice of security levels in, 111
protection of sensitive information, 101
best evidence, 289
BGP (Border Gateway Protocol), 176
BIA (business impact analysis)
components in, 232
as first step in disaster recovery and continuity planning, 253
NIST practices for creating continuity plans, 241
when to conduct, 252
Biba model
access models, 91
as state machine model, 111
biometric readers, 144
birthday attacks, 228
blacklisting, mail relay servers that deliver spam, 180
block ciphers
stream ciphers compared with, 216
as symmetric ciphers, 196
uses of, 215
Bluejacking
Bluetooth and, 170
description of, 157
board members, role in security governance program, 27
Border Gateway Protocol (BGP), 176
Brewer-Nash model, for access control, 91, 100
BRI (Basic Rate Interface), ISDN technologies, 189
broadband transmission, satellite links providing, 182
brute-force attacks
on passwords, 54
BSS (Basic Service Set), 186
buffer overflow attacks
in computer-targeted crime category, 276
exploiting space limitations, 344–345, 362
graphic view of, 309
IM clients and, 183
programmers awareness of, 335
business case, for management support of business continuity plans, 251
business continuity coordinator, 261
business functions
BIA (business impact analysis) and, 246–247
dependency analysis, 261
documenting, 243
order for restoring following disaster, 252–253
outlining, 254
business interruption insurance, 258
business objectives, mapping object methods to, 331
business resumption plan, 268
bytecode, converting into machine-level code, 321
C
cable modems, 189
cache memory
functions of, 115
impact of microprocessor technology on potency of attacks, 88
calling trees, in physical security design, 137
capability lists
access control matrix and, 69
basis of, 41
subject basis of, 64
Capability Maturity Model Integration. See CMMI (Capability Maturity Model Integration)
capacitance detector
protecting specific objects with, 143
as volumetric IDS system, 141
carrier files, in steganography, 204
Carrier Sense Multiple Access with Collision Detection (CSMA/CD), 191
CAs (Certificate Authorities)
cross-certification architecture, 225–226
in PKI environment, 208
revoking certificates, 197, 220
supplying certificates, 174
cathode ray tube (CRT), 134
CBC (Cipher Block Chaining), 229
CCD (charged-coupled devices), in CCTV cameras, 133–134
CCTV cameras
annunciator systems complementing, 134
changing view field of, 121, 136
light-sensitive chip in, 121, 133–134
manual iris vs. auto iris lens, 122, 138
mounting, 138
mounting in full view for crime prevention, 140
used with CPTED, 150
central processing units. See CPUs (central processing units)
CEO (Chief Executive Officer), executive succession planning, 259
Certificate Authorities. See CAs (Certificate Authorities)
Certificate Revocation Lists (CRLs), 197, 220, 226
CFO (Chief Financial Officer)
executive succession planning and, 259
responsibilities of, 25
chain of custody, of evidence, 287
change control committee, 352
change management
documenting changes, 364
emergency response and, 345
integrating business continuity plans with, 249–250
reviewing emergency changes, 363
service-level agreement approval, 351
charged-coupled devices (CCD), in CCTV cameras, 133–134
checklist tests, for disaster recovery and business continuity plans, 255
checkpoint function, in applications and databases, 310, 336
Chief Executive Officer (CEO), executive succession planning, 259
Chief Financial Officer (CFO)
executive succession planning and, 259
responsibilities of, 25
Chief Information Officer (CIO), executive succession planning and, 259
Chief Information Security Officer (CISO), 25
Chief Privacy Officer (CPO), 5, 24–25
Chief Security Officer (CSO), 25
child pornography, “computer is incidental” crime category, 276
Chinese Wall model, for access control, 91, 110
CIO (Chief Information Officer), executive succession planning and, 259
Cipher Block Chaining (CBC), 229
cipher locks, lock mechanism for server room doors, 144
circuits, impact of microprocessor technology on potency of attacks, 88
circumstantial evidence, 289
CISO (Chief Information Security Officer), 25
civil law
codified nature of, 279
overview of, 294
Clark-Wilson access model
data integrity and, 100
read up and write down rule, 91
subject and application binding in, 78
Class A fires, 153
Class B fires, 153
Class C fires, 153
Class D fires, 153
Class IV gates, 148
Class K fires, 153
classes, object, 334
classification scheme, in business impact analysis, 243
classified information. See data classification
Cleanroom, approach to system development, 324
client-server architecture, 166
clients, filtering against spam, 165
clipping levels, countermeasures to brute-force attacks, 365
clustering, for fault-tolerance, 373
CMMI (Capability Maturity Model Integration)
software development and, 95
CobiT (Control Objectives for Information and Related Technology)
derived from COSO framework, 24
IT management as focus of, 13
code analysis, in computer forensics, 286
code modules, cohesion and coupling and, 306, 322–323
cohesion, and coupling for describing code modules, 306, 322–323
cohesiveness, of programming modules, 334
cold sites
compared with reciprocal agreements, 245
functions of, 264
collisions, of hashed messages, 228
columns (attributes), in relational databases, 339
commercial software, 280
commit operations, databases, 337
Committee of Sponsoring Organizations of the Treadway Commission. See COSO (Committee of Sponsoring Organizations of the Treadway Commission)
Common Criteria
evaluating IDSs, 87
identifying missing component in, 82
protection profiles in, 79–80, 96–97, 108–109
common law
criminal law section, 294
custom and precedent in, 279
types of, 273
communication
calling trees in physical security design, 137
between layers of OSI model, 168
telecommunication technologies, 162, 188–189
wireless communication via satellite links, 159, 182
companies. See also corporations
calculating numbers of keys needed, 196, 214
intruder methods for accessing company assets, 3, 19
OECD guidelines for global organizations, 277
practices preventing security breaches, 271, 282
completeness, of evidence, 289–290
compliance, 269
component-based system development, 305, 319
computer-assisted crime, 276
Computer Ethics Institute, 292
computer forensics. See also forensics
capturing clues from computers or devices, 274, 297
chain of custody in, 287
characteristics of, 272, 286–287
Computer Fraud and Abuse Act (U.S.), 281–282
“computer is incidental” crime, 276
computer-targeted crime, 276–277
computers, logical grouping based on resource requirements, 174
concealment ciphers, in steganography, 204, 224
conclusive evidence, 289
concurrency controls, for databases, 304, 315
concurrent integrity, 322
confidentiality
AIC (availability, integrity, and confidentiality), 14
comparing PKI with public key cryptography, 210
cryptography technologies for, 199, 223–224
encryption algorithms providing, 217–218
vs. integrity, 18
configuration management change control, 342, 351
conflicts of interest, access control models and, 111
consistency, in ACID testing, 314–315
constrained interfaces, 69
construction materials
used in exterior walls of a bank, 121
used in exterior walls of banks, 132–133
used in walls, 125
containment stage, of incident response, 285, 295
contamination, in forensic investigation, 296
content management application, testing, 305, 318
contingency planning, 234
continuity of operations plan. See COOP (continuity of operations plan)
Continuity Planning Guide for Information Technology Systems, 241
continuity planning policy statement, NIST, 241
control gap, in calculating residual risk, 22
Control Objectives for Information and Related Technology. See CobiT (Control Objectives for Information and Related Technology)
Convention on Cybercrime, Council of Europe, 277–278
convergence, benefits of VoIP, 181
cookies, 90
COOP (continuity of operations plan)
in disaster recovery, 233
establishing management and headquarters following disasters, 248–249
focus of, 268–269
cooperative multitasking, in Windows 3.1 and Mac OS systems, 89
copyright law, 279–280
corporations. See also companies
COSO model for corporate governance, 11
regulation of accounting practices of, 281
COSO (Committee of Sponsoring Organizations of the Treadway Commission)
model for corporate governance, 11
sponsoring National Commission on Fraudulent Financial Reporting, 13
cost, benefits of VoIP, 181
cost-effectiveness, in risk assessment process, 17
Council of Europe, 277–278
Counter Mode (CTR), block cipher modes, 230
counter synchronous tokens, for authentication, 75
countermeasures. See security countermeasures
coupling, and cohesion for describing code modules, 306, 322–323
covert channel attacks
expertise required for, 366
noninterference preventing, 98
overview of, 336
CPO (Chief Privacy Officer), 5, 24–25
CPTED (Crime Prevention Through Environmental Design)
issues addressed by, 148–149
main components of, 124–125, 150–151
reducing crime rate and fear of crime, 140–141
CPUs (central processing units)
address bus, 116
execution domain switching, 93
impact of microprocessor technology on potency of attacks, 78, 88
interrupts, 114–115
sending data to I/O devices, 104–105
time multiplexing, 102
Crack, dictionary attacks with, 366
crime
categories of computer crime in cyberlaw, 270
factors in choosing facility site, 143
Locard’s Principle of Exchange, 274, 300
Motive, Opportunity, and Means in approach to, 288
reducing crime rate and fear of crime, 122, 140–141
steps of incident response team in responding to, 271, 284
Crime Prevention Through Environmental Design. See CPTED (Crime Prevention Through Environmental Design)
crime scene analysis, in forensic investigation, 296–297
criminal law, 294
criminalistics, principles of, 296
CRLs (Certificate Revocation Lists), 197, 220, 226
cross-certification architecture, in PKI, 225–226
cross-site scripting. See XSS (cross-site scripting)
CRT (cathode ray tube), 134
cryptography. See also encryption
confidentiality technologies, 199, 223–224
integrity and authentication methods, 201, 227–228
PKI (Public Key Infrastructure). See PKI (Public Key Infrastructure)
SSL and TLS as cryptographic protocols, 205
topics related to, 193
CSMA/CD (Carrier Sense Multiple Access with Collision Detection), 191
CSO (Chief Security Officer), 25
CTR (Counter Mode), block cipher modes, 230
cyber-incident response plan, 249
cybersquatting, 179–180
D
DAC (discretionary access control), 51, 73
damage assessment
phase of business continuity plan, 256, 268
team responsibilities, 257
DASDs (Direct Access Storage Devices)
RAID as type of, 371
types of storage devices, 343, 356
data availability, responsibilities of information custodian, 15
data classification
analyzing products for access control, 60
database security and, 21
development of program for, 6, 28
MAC (mandatory access control), 80
noninterference preventing unauthorized access, 98–99
responsibilities of information owner, 14–15
roles in data classification system, 5, 25–26
data dictionary, commit operation, 337–338
data diddling, 294
Data Encryption Standard (DES), 218
data-gathering step, in business impact analysis, 246
data integrity. See integrity
data link layer (Layer 2), OSI model, 156, 164, 209
data owners, roles in data classification system, 26
data protection
data classification program for, 28
responsibilities of CPO (Chief Privacy Officer), 24–25
responsibilities of information owner, 2–3, 14–15
data retention
policies, 2–3
responsibilities of information owner, 14–15
data users, role in data classification system, 25
database views, as logical access controls, 316
databases
ACID testing database software, 304, 313–314
checkpoint function in, 310, 336
commit operations, 337–338
concurrency controls, 304, 315
hierarchical. See hierarchical databases normalization, 304, 316
object-oriented. See object-oriented databases
software integrity service, 306, 322
SQL, 327
datagrams, frames, 168–169
DCE (Distributed Computing Environment), 326
debugging, benefits of virtualization, 99
deferred commitment, in object-oriented programming, 308, 331
Defined level (level 3), CMMI, 107
degaussing, as example of purging, 353
delay aspect, of physical security design, 137
deluge sprinkler systems, 135
demilitarized zone (DMZ), mail servers in, 367
denial-of-service attacks. See DoS (denial-of-service) attacks
Department of Defense Architecture Framework (DoDAF), 95
depth of focus (or field), in CCTV cameras, 131–132, 136
deputy executive roles, executive succession planning and, 259
DES (Data Encryption Standard), 218
design step, in rolling out physical security program, 146
detection, in physical security design, 137
deterrence aspect, of physical security design, 137
devices. See also hardware
MTTR (mean time to repair), 343, 355
storage, 343
Diameter protocol, 67
dictionary attacks
Crack or LOphcrack for, 366
on passwords, 54
differential backup, 247
differential power analysis (DPA), attacks on smart cards, 50
Diffie-Hellman algorithms, 211
digital certificates. See CAs (Certificate Authorities)
digital forensics. See computer forensics
Digital Light Processing (DLP), 134
digital signatures
authentication, nonrepudiation, and integrity services provided by, 217–218
integrity and authentication methods, 227–228
Digital Subscriber Line (DSL), 188–189
Direct Access Storage Devices (DASDs)
RAID as type of, 371
types of storage devices, 343, 356
direct memory access (DMA)
overview of, 88
transferring data between I/O devices, 105
directory services
identity management systems and, 71
virtual directory compared with, 39, 53–54
disaster recovery
continuity of operations plan in, 233
reasons for implementing disaster recovery plans, 235, 254
steps in, 253
topics related to, 231
disasters
damage assessment following, 233, 248
establishing management and headquarters following, 233
restoring facility following, 234
risk of natural disaster as factor in selecting facility site, 142
team responsible for recovery following, 235
discretionary access control (DAC), 51, 73
disk drives, mirroring, 348
disk duplexing, 370–371
distance-vector routing protocols, 175–177
distinguished names (DNs), 47
Distributed Computing Environment (DCE), 326
DLP (Digital Light Processing), 134
DMA (direct memory access)
overview of, 88
transferring data between I/O devices, 105
DMZ (demilitarized zone), mail servers in, 367
DNs (distinguished names), 47
DNS (Domain Name Service)
attacks on, 157
poisoning cache of DNS server, 170–171
separating zones into public and private servers, 166–167
DNS poisoning, 57
DNS servers, internal to companies, 179
DNS spoofing attacks, 171
Document Object Model (DOM), 173
documentation
steps in disaster recovery and continuity planning, 253
DoDAF (Department of Defense Architecture Framework), 95
DOM-based XSS vulnerability
malicious code exploiting, 307, 328
overview of, 173
DOM (Document Object Model), 173
domain names
domain litigation, 171–172
mapping to IP addresses, 171
domains, 113
doors
choosing lock mechanism for, 123, 144
comparing electromagnetic and volumetric IDS systems, 139
natural access control, 141
DoS (denial-of-service) attacks
hackers using, 329
purpose of, 293
virtual storage and, 90
downstream liability, 282
DPA (differential power analysis), attacks on smart cards, 50
drills, steps in disaster recovery and continuity planning, 253
drives. See disk drives
dry pipe sprinkler systems, 135
DSL (Digital Subscriber Line), 188–189
due care
company practices preventing security breaches, 271, 282
liability and negligence and, 287
due diligence, 283
duplexing, 370–371
durability, in ACID testing, 314
dynamic routing protocol, 177
E
filtering spam, 165
security controls, 3
factors in ease of, 159
SMTP and, 180
EAL (evaluation assurance levels), in Common Criteria, 96, 109
EAP (Extensible Authentication Protocol), 184
eavesdropping, 273
ECB (Electronic Code Book Mode), 229
ECC (elliptic curve cryptosystem), 195, 211
EDI (electronic data interchange), 174
education, learning objectives for, 33–34
EEPROM (erasable and programmable read-only memory), 104
EGP (Exterior Gateway Protocol), 175, 176
EJB (Enterprise JavaBeans), 326
El Gamal, 211
electrical fires, suppression methods for, 153
electrical power. See power electromagnetic analysis, attacks on smart cards, 50
electromagnetic IDS systems, 122, 139–140
Electronic Code Book Mode (ECB), 229
electronic data discovery, in computer forensics, 286
electronic data interchange (EDI), 174
electronic vaulting
backup solution, 258
copying database files as modified, 266
elliptic curve cryptosystem (ECC), 195, 211
emanations capturing
attacks, 274
preventing, 298
embedded wires, in windows glazing, 131
emergency response
in disaster recovery planning, 254
making changes, 345
reviewing emergency changes, 363
emergency restart, of operating system, 357
employee training, access control and, 60
encapsulation, process isolation and, 101
encryption. See also cryptography
bulk data encryption with AES, 218
confidentiality provided by, 217–218
link encryption and end-to-end encryption modes, 221
PPTP encryption at data link layer, 209
SSL providing, 219
steganography compared with, 206
of voice data, 172
end-to-end encryption
within applications, 209
enterprise architecture framework
creating robust, 94
reducing fragmentation, 79, 95
Enterprise JavaBeans (EJB), 326
enterprise security architecture, 79
enticement, 290–291
entity integrity, guaranteeing tuples are uniquely identified by primary key values, 322
entrapment, 290–291
environment
change management and, 250
environmental security. See physical security
erasable and programmable read-only memory (EEPROM), 104
erasure, of media, 342
error containment, benefits of virtualization, 99
Ethernet, 164
ethics
Computer Ethics Institute, 292
of dumpster diving, 293
(ISC)2 Code of Ethics, 274, 299–300
role of Internet Architecture Board regarding, 273, 291
European Union Principles on Privacy, 12, 277
evaluation assurance levels (EAL), in Common Criteria, 96, 109
evidence
admissibility of, 272, 289–290
proper handling of, 272, 287–288
execution domain switching, in TCB (trusted computing base), 93
executive succession planning, 236, 259
executives, senior. See management; senior executives
exigent circumstances, 272
expert systems, 306
Exploratory Model, approach to system development, 324
eXtensible Access Control Markup Language (XACML), 58
Extensible Authentication Protocol (EAP), 184
Extensible Markup Language. See XML (Extensible Markup Language)
Exterior Gateway Protocol (EGP), 175, 176
external entities, WAM software controls, 47–48
extreme programming, approach to system development, 319
F
facilities
cold sites. See cold sites
factors in choosing site for, 123, 142–143
hot sites. See hot sites
reciprocal agreement. See reciprocal agreement
redundant sites, 266
restoring following disaster, 234, 252–253
salvage and restoration teams, 257
team responsible for recovery following disaster, 235
warm sites. See warm sites
facility manager, 130
fail-secure doors, 128
fail-soft doors, 128
fault containment, benefits of virtualization, 99
fault-tolerance
clustering, 373
devices, 354
hard drives, 370
RAID providing, 358
FDDI (Fiber Distributed Data Interface), 188, 191
Federal Sentencing Guidelines, 291
federated identities, in identity management systems, 39, 54–55, 70
fences
deterrent aspect of physical security design, 137
natural access control, 141
PIDAS (Perimeter Intrusion Detection and Assessment System), 148
types of, 124
FHSS (frequency hopping spread spectrum), 185
Fiber Distributed Data Interface (FDDI), 188, 191
fiber-optic cable
FDDI and, 191
SONET and, 188
file copy tool, in forensic investigation, 296
file descriptors, exploiting, 362–363
filters, countermeasures against spam, 165
financial reporting, commission on fraud in, 13
financial systems, attacks on as example of computer-assisted crime, 276
fingerprint detection, in antivirus software, 330
fire extinguishers, 153
fire protection
choosing facility site based on proximity to fire station, 142
classes of fires and corresponding suppression methods, 126, 153
construction materials and, 133, 152
fire and smoke detectors, 124, 149–150
sprinkler systems, 121, 134–135
window fire codes, 120
fire suppression methods, by fire type, 153
firewalls, screened host architecture, 166
first-generation programming languages, 327
fixed focal length lenses, in CCTV cameras, 131–132
flexibility, benefits of VoIP, 181
fluorescent lighting, protecting against radio frequency interference from, 148
focal length, of lens in CCTV camera, 132, 138
follow up stage, of incident response, 295–296
forensics
capturing clues from computers or devices, 297
chain of custody in, 287
characteristics of forensics investigation, 274, 296–297
choosing internal investigation vs. external experts, 284
computer forensics, 272
fourth-generation programming languages, 326–327
fragmentation, enterprise architecture framework reducing, 79, 95
frames, datagrams and, 168
fraud, financial
COSO framework and, 23–24
National Commission on Fraudulent Financial Reporting, 13
freeware, 280
frequency-division multiplexing, 188
frequency hopping spread spectrum (FHSS), 185
full backup, 247
full-interruption tests, for ensuring validity of BCPs, 243
full knowledge, in penetration testing, 361
functionality, documenting for systems, 364
G
garbage collector, 103
gates, Class IV, 148
gateways
filtering against spam on e-mail gateways, 165
limiting IP session going through media gateway, 172
Generalized Markup Language (GML)
functions of, 58
as predecessor of SGML, 52
glass-clad polycarbonate, 129, 131
global organizations, OECD guidelines for, 277
GML (Generalized Markup Language)
functions of, 58
as predecessor of SGML, 52
government agencies, regulatory law and, 295
Graham-Denning model, for access rights between subjects and objects, 100–101
grid computing, 373
guard dogs, 137
guests. See virtual machines
H
hacking
Computer Fraud and Abuse Act, 281–282
DoS (denial-of-service) attacks by hackers, 329
legality and ethics of, 291
hard drives
fault-tolerance of, 370
swapping contents from RAM to hard drive, 102–103
hardware. See also devices
change management and, 250
hot-swappable, 354
virtual machines and, 97
hashes, digital signatures as hash values, 217
hashing algorithms
data integrity provided by, 217–218
in forensic investigation, 297
integrity and authentication methods, 227–228
HAVAL algorithm, 218
headquarters, establishing following disasters, 248–249
Health Insurance Portability and Accountability Act (HIPAA), 12, 281
heat-activated detectors, for fire and smoke, 149
heavy timber construction materials, 153
heuristics
in antivirus software, 330
fourth-generation programming languages and, 326–327
in intrusion detection. See anomaly-based IDS
hierarchical databases
object-oriented database compared with, 317
tree structure of, 338–339
hierarchical storage management. See HSM (hierarchical storage management)
high-level programming languages, 327
HIPAA (Health Insurance Portability and Accountability Act), 12, 281
holistic information infrastructure, Zachman Architecture Framework for, 94
honeypots, as enticement method, 291
hosts file
DNS servers and, 171
manipulating, 179
hosts, screened host architecture, 166
hot sites
compared with reciprocal agreements, 245
functions of, 264
hot-swapping
failed components, 355
hardware, 354
RAID and, 360
HSM (hierarchical storage management)
as backup technology, 348–349
graphic view of, 372
storage area networks compared with, 344, 360–361
HTML (Hypertext Markup Language)
based on SGML, 52
as precursor to XML and SGML, 66–67
HTTP (Hypertext Transport Protocol), 325
human language, third-generation programming languages using similar syntax, 326
human resources, in recovery and continuity planning, 251
hybrid model, for incident response teams, 284
Hypertext Markup Language (HTML)
based on SGML, 52
as precursor to XML and SGML, 66–67
Hypertext Transport Protocol (HTTP), 325
I
I/O (input/output)
operations, 93
procedures in OSs (operating systems), 81, 104–105
IAB (Internet Architecture Board)
ethics concerning use of Internet, 300
role regarding technology and ethics, 273, 291
identity management systems
directory services and, 47
federated identities and, 39, 54–55
password management approaches, 38, 49
technologies for, 43–44, 70–71
identity store, virtual directory compared with, 53
IDSs (intrusion detection systems)
adding redundant power supply and backup power to, 145
characteristics of, 123
criteria for evaluating, 78, 87–88
electromagnetic and volumetric systems, 122, 139–140
monitoring via disruptions to magnetic field, 122–123
for protection of valuable art, 123
IEEE (Institute of Electrical and Electronics Engineers), 164, 184
IETF (Internet Engineering Task Force), 291
IF-THEN-ELSE statements, in third-generation programming languages, 328
if/then statements, in expert systems, 306
IGP (Interior Gateway Protocol), 175
IGRP (Interior Gateway Routing Protocol), 175, 176
illumination requirements, of CCTV cameras. See also lighting
in choosing lens, 138–139
overview of, 136
IM (instant messaging)
authentication and, 183
incident response stages, 271, 273, 285–286, 295
incident response teams
response to suspected crime, 271, 284
incremental backup, 247
independent modules, in component-based system development, 319
inference attacks, 98–99
information, aggregation of, 99
information custodian, 15
information security
classification of. See data classification
regulation of information transfer across international borders, 2
responsibilities of information owner, 2–3
topics related to, 1
Information Systems Audit and Control Association (ISACA), 11
information systems auditors, 26
Information Technology Infrastructure Library. See ITIL (Information Technology Infrastructure Library)
information technology (IT), 286
Information Technology Security Evaluation Criteria (ITSEC), 87
Informative policies, in security program, 32
infrared flame detectors, fire detection with, 149
infrastructure. See also facilities
change management and, 250
commission on national infrastructure, 149
Initial level (level 1), CMMI, 107
input/output (I/O)
operations, 93
procedures in OSs (operating systems), 81, 104–105
authentication and, 183
Institute of Electrical and Electronics Engineers (IEEE), 164, 184
insurance
for assets, 20
for business interruption, 258
Integrated Services Digital Network (ISDN), 189
integration testing, 318
integrity
AIC (availability, integrity, and confidentiality), 14
algorithms providing, 197
Clark-Wilson access model and, 100
cryptographic methods, 201, 227–228
database software integrity service, 306, 322
digital signatures providing, 217–218
PKI compared with public key cryptography, 210
SSL providing, 219
Interior Gateway Protocol (IGP), 175
Interior Gateway Routing Protocol (IGRP), 175, 176
interior routing protocols
choosing best path with, 158
types of, 175–176
Intermediate System to Intermediate System (IS-IS), 175
International Organization for Standardization (ISO)
global standardization as focus of, 13
guidelines for software-intensive system architectures, 95
Internet
application information exchange over, 324
ASs (autonomous systems) in architecture of, 175
IAB ethics concerning use of, 300
less secure than physical phone lines, 178
three-tiered model for connectivity, 156
Internet Architecture Board (IAB)
ethics concerning use of Internet, 300
role regarding technology and ethics, 273, 291
internet chat relay (IRC), 329
Internet Engineering Task Force (IETF), 291
Internet Protocol Security. See IPSec (Internet Protocol Security)
interrupts
controlling CPU slots, 114–115
interrupt-driven I/O, 105
interviews, in business impact analysis, 243
intranets, 174
intruders
covering tracks, 59
detecting with IDSs, 139
masquerading and, 19
methods for accessing company assets, 3
resistance of IDSs to tampering, 145
security countermeasures and, 57
intrusion detection systems. See IDSs (intrusion detection systems)
inventions, patents on, 279
investigations
characteristics of forensics investigation, 274, 296–297
collection of data during, 287–288
stages in incident response, 285
topics related to, 269
ionization detectors, for smoke, 150
IP addresses
mapping domain names to, 171
purpose of, 168
IP phones, vulnerability to attack, 178
IP softphones, 178
IP spoofing attacks
for hijacking SSL and IPSec secure communications, 358
overview of, 19
IP telephony
caution regarding use of softphones, 178
security measures for, 157–158, 172
vulnerabilities of, 181
IPSec (Internet Protocol Security)
functions of, 190–191
IP spoofing attacks and, 358
SAs (security associations), 198, 222–223
as security standard for VPNs, 169
IRC (internet chat relay), 329
IS-IS (Intermediate System to Intermediate System), 175
ISACA (Information Systems Audit and Control Association), 11
on computer forensics, 286
ISDN (Integrated Services Digital Network), 189
ISO/IEC 42010, 95
ISO (International Organization for Standardization)
global standardization as focus of, 13
guidelines for software-intensive system architectures, 95
isolation, in ACID testing, 314–315
IT contingency plan, 249
IT Governance Institute (ITGI), 11
IT (information technology), 286
Iterative Development, approach to system development, 324
ITGI (IT Governance Institute), 11
ITIL (Information Technology Infrastructure Library)
core set of instructional books, 81
Service Strategy, 106
ITSEC (Information Technology Security Evaluation Criteria), 87
J
Java Virtual Machine (JVM), 305, 321
job rotation, as security countermeasure, 42, 65
JVM (Java Virtual Machine), 305, 321
K
KDFs (Key Derivation Functions), 195, 210–211
Kerberos, 73
kernel
flaws in, 363
security kernel (abstract machine), 79, 91–92
Key Derivation Functions (KDFs), 195, 210–211
keys
calculating numbers of keys needed for company, 214
in creation of digital signatures, 217
generating from master key, 210
recovering, 218
symmetric key systems and, 207
keystreams, attributes of good stream ciphers, 216
keyword filtering, countermeasure to spam, 180
L
L2TP (Layer 2 Tunneling Protocol)
WANs (wide area networks) and, 190
laminated glass windows, fire codes and physical security, 129
landscaping, as natural access control, 141
LANs (local area networks)
ATM (Asynchronous Transfer Mode) and, 187
backbone connecting, 188
VLANs (virtual LANs), 174
WLANs (wireless LANs), 186
LaTeX, 52–53
law. See also crime; cyberlaw; regulation
factors in analyzing products for access control, 60
topics related to legal regulations, 269
Layer 2 (data link layer), OSI model, 156, 164, 209
Layer 2 Tunneling Protocol (L2TP)
WANs (wide area networks) and, 190
layered defense model, 140
LDAP (Lightweight Directory Access Protocol)
accessing X.500 databases, 48
directory services and, 47
identity management systems and, 71
learning objectives, in security program, 8–9
“least privilege” principle, authorization creep as violation of, 23
least significant bit (LSB), in steganography, 206
legacy applications, virtual machines and, 97
legality. See crime; law
lenses, in CCTV cameras, 121, 131–132, 138
liability, due care protecting against, 287
light frame construction materials, 152–153
light-sensitive chip, in CCTV cameras, 121, 133–134
lighting. See also illumination requirements, of CCTV cameras
fluorescent lighting, 148
installing for new facility, 142
natural access control, 141
Lightweight Directory Access Protocol. See LDAP (Lightweight Directory Access Protocol)
link-state routing protocols
building topology database of network, 177
types of IGPs, 175
liquid fires, suppression methods for, 153
LLC (Logical Link Control), 164
local area networks. See LANs (local area networks)
Locard’s Principle of Exchange, 274, 300
locks
choosing lock mechanism for server room doors, 123
fail-soft and fail-secure doors, 128
in physical security design, 122
logging
auditing physical access, 120, 129–130
detective nature of audit logs, 365
protecting audit logs, 40–41, 58–59
unauthorized access attempts, 57
logic, expert system emulating human logic, 325
logical access controls
database views as, 316
factors in analyzing products for access control, 60
Logical Link Control (LLC), 164
logos, protecting against unauthorized use, 270
LOphcrack, 366
LSB (least significant bit), in steganography, 206
M
MAC (mandatory access control)
access control models, 73–74
classification of data and, 80
noninterference as expression of multilevel security, 98
MAC (Media Access Control), sublayers of data link layer, 164
machine languages, as first-generation programming languages, 327
machine-level code, converting bytecode into, 321
MAID (massive array of inactive disks)
benefits of, 371
as Direct Access Storage Device, 356
mail relay servers
countermeasures against spam, 165
malformed packet attacks, 183
malicious code
botnets and, 329
exploiting DOM-based cross-site scripting, 307, 328
Managed level (level 2), CMMI, 108
management
detecting/preventing misuses of access rights, 364
establishing management and headquarters following disasters, 248–249
executive succession planning, 236, 259
support for business continuity plans, 234, 251
when to report incidents to senior management, 285
mandatory access control. See MAC (mandatory access control)
MANs (metropolitan area networks), 188
manual iris lens, in CCTV cameras, 136, 138
marketplace, role in valuation of assets, 20
markup languages
overview of, 52
passing service requests and receiving access to services, 42, 66
predecessor of SGML, 52
sharing application security policies, 40, 58
masquerading, intruder methods for gaining access, 19
massive array of inactive disks (MAID)
benefits of, 371
as Direct Access Storage Device, 356
maximum tolerable downtime (MTD)
damage assessment and, 248
ranking threats in business continuity planning, 262
MD2 algorithm, 218
MD4 algorithm, 218
mean time between failure (MTBF), estimating lifetime of equipment, 263, 355
mean time to repair (MTTR)
estimating equipment repair time, 262–263
Media Access Control (MAC), sublayers of data link layer, 164
media files, steganographic transmission of, 206–207
memory
combining with secondary memory with RAM, 78, 90
mapping virtual memory to real memory, 93
read-only, 81
memory manager
mapping virtual memory to real memory, 93
responsibilities of, 81, 102–103
mesh networks, of routers and switches, 317
message digests, encrypting, 217
messages, in object-oriented programming, 308, 332
meta-directory, 53
methods
database procedures and, 317
mapping to business objectives, 331
object classes and, 334
metrics, in security governance program, 27
metropolitan area networks (MANs), 188
microprobing, attacks on smart cards, 50
microprocessors. See CPUs (central processing units)
mirroring (RAID 1). See also RAID (redundant array of inexpensive disks)
disk drives, 348
disk duplexing compared with, 370–371
RAID levels and, 358–360
misuse detection system, 61
mnemonics, in second generation language, 327
MO (Modus Operandi), of criminals, 300–301
Modified Prototype Method, of system development, 323–324
monitoring user activities, 57
motion detectors, wave-pattern, 141
Motive, Opportunity, and Means, strategy for understanding crime, 288, 301
mounting CCTV cameras
in full view for crime prevention, 140
how to, 138
MTBF (mean time between failure), estimating lifetime of equipment, 263, 355
MTD (maximum tolerable downtime)
damage assessment and, 248
ranking threats in business continuity planning, 262
MTTR (mean time to repair)
estimating equipment repair time, 262–263
multiplexing
graphic view of, 161
overview of, 187
multiprogramming, 88
multitasking
CPUs, 78
OSs (operating systems), 78, 115
preemptive multitasking mode, 89
mutual aid. See reciprocal agreement
N
namespaces, directory services and, 47
National Commission on Fraudulent Financial Reporting, 13, 24
National Institute of Standards and Technology. See NIST (National Institute of Standards and Technology)
natural access control, 151
natural disaster risk, factors in choosing facility site, 142
natural surveillance, as component of CPTED, 150–151
NDS (NetWare Directory Service), 48
“need-to-know” concept, authorization creep and, 23
negligence, due care protecting against, 287
“Neighborhood Crime Watch,” 137
NetWare Directory Service (NDS), 48
network analysis, in computer forensics, 286
network databases, 339
ANN (artificial neural network), 325–326
grouping computers to share resources, 158
local area networks. See LANs (local area networks)
metropolitan area networks, 188
open network architecture, 174
penetration testing, 344
topics related to, 155
VoIP and network security, 178
wide area networks. See WANs (wide area networks)
NIST (National Institute of Standards and Technology)
best practices for creating continuity plans, 232, 241
nondiscretionary access control. See RBAC (role-based access control)
noninterference
conflicts of interest and, 111
as expression of multilevel security, 98
nonpersistent XSS vulnerability, 173, 328
nonrepudiation
algorithms providing, 197
comparing PKI with public key cryptography, 210
digital signatures providing, 217–218
nonsensitive data, protection of, 16
nontechnical attacks, 293
normalization, of databases, 304, 316
O
object-oriented database management system (ODBMS), 339
object-oriented databases
designed to handle variety of data, 339
object-oriented programming. See OOP (object-oriented programming)
occupant emergency plan, 249
OCSP (Online Certificate Status Protocol)
real-time validation of certificates, 226
revoking certificates, 197, 220
OCTAVE, 26
ODBMS (object-oriented database management system), 339
OECD (Organisation for Economic Co-operation and Development)
data privacy guidelines, 13
international regulations of, 270, 277
OFB (Output Feedback Mode), 230
OFDM (orthogonal frequency-division multiplexing), 185
OLTP (online transaction processing), 314
one-time pads
as encryption scheme, 195, 224
requirements for implementing, 212
stream ciphers similar to, 196, 215
one-way hash, 228
Online Certificate Status Protocol (OCSP)
real-time validation of certificates, 226
revoking certificates, 197, 220
online transaction processing (OLTP), 314
OOP (object-oriented programming)
Java as, 321
reusability, 331–332
open mail relay servers
SMTP, 165
spam and, 180
open network architecture, 174
Open Shortest Path First (OSPF), 175–176
Open Software Foundation (OSF), 326
open system authentication (OSA), 186
operating systems. See OSs (operating systems)
operations security, 341
optical smoke detectors, 149
oral evidence, 289
Orange Book, 87–88
ordered sets of relationships, principles governing, 94
Organisation for Economic Co-operation and Development (OECD)
data privacy guidelines, 13
international regulations of, 270, 277
organizations. See companies
orthogonal frequency-division multiplexing (OFDM), 185
OSA (open system authentication), 186
OSF (Open Software Foundation), 326
OSI model
communication between layers, 168
open network architecture and, 174
OSPF (Open Shortest Path First), 175–176
OSs (operating systems)
access control mechanisms embedded in, 83
classifying failures of, 343, 357
I/O procedures in, 81
identifying components of multitasking processes, 84–85
patching, 99
process isolation in, 80–81, 101–102
security enforcement components, 84, 113–114
virtual machines as instance of, 97–98
Output Feedback Mode (OFB), 230
P
packets, sockets for transmission of, 156, 168
parallel tests
at alternate offsite facility, 255
for ensuring validity of BCPs, 243
parity, RAID levels and, 358–359, 369–370
partial backup, 247
partial knowledge, in penetration testing, 361
passive infrared (PIR) system, 141
password sniffing attacks, 298–299
password synchronization, 49
passwords
approaches to managing, 38, 49
capturing as example of computer-targeted crime, 276–277
one-time use in authentication, 45, 74–76
patents, 279
payload, in steganography, 204
PCCIP (President’s Commission on Critical Infrastructure Protection), 149
PCI DSS (PCI Data Security Standard), 281
penetration testing, 344
Perimeter Intrusion Detection and Assessment System (PIDAS), 148
permissions, authorization creep and, 23
persistent XSS vulnerability, 173, 328
personal conduct, customary law addressing, 278
personal health information, protection of, 2, 281
personnel
change management and, 250
human resources in recovery and continuity planning, 251
when to move back into restored facility, 252
pharming attacks
phishing attacks compared with, 40, 55–57
technical attacks, 63
phishing attacks
masquerading and, 19
pharming attacks compared with, 40, 55–57
social engineering attacks, 63
photoelectric systems
not usable in rooms with windows, 143
for smoke detection, 149
as volumetric IDS systems, 142
physical layer, OSI model, 209
physical security
auditing physical access, 120, 129–130
categories in designing, 137
CCTV cameras. See CCTV cameras
CPTED (Crime Prevention Through Environmental Design), 124–125, 140
design, 122
doors. See doors
fences, 124
fire protection. See fire protection
IDSs (intrusion detection systems). See IDSs (intrusion detection systems)
risk analysis as first step in rolling out program for, 145–146
steps in roll out of program for, 124
topics related to, 119
walls. See walls
windows. See windows
PID (process identification) values, 102
PIDAS (Perimeter Intrusion Detection and Assessment System), 148
PIR (passive infrared) system, 141
PKI (Public Key Infrastructure)
architectures in, 200
calculating numbers of keys needed for company, 196, 214
CAs (Certificate Authorities) in, 174
cross-certification architecture, 225–226
public key cryptography compared with, 209–210
platform independence, Java, 321
point-to-point (PPP) connections, 184
Point-to-Point Tunneling Protocol. See PPTP (Point-to-Point Tunneling Protocol)
police station, choosing facility site based on proximity to, 142
policies
markup language allowing sharing application security policies, 40
privacy-aware role-based access control, 51
security policy committee, 14
Polycarbonate acrylic window glazing, 128, 130–131
polyinstantiation, software protection mechanism, 333–334
polymorphism
object-orientation and, 316
overview of, 334
portable identities, federated identities and, 54–55
ports, as communication endpoint, 168
power
adding redundant power supply and backup power to IDS, 145
protecting devices from voltage fluctuations, 124, 147
power line monitors, 147
PPP (point-to-point) connections, 184
PPTP (Point-to-Point Tunneling Protocol)
encryption at data link layer, 209
encryption at different layers of operating system and network stack, 195
L2TP compared with, 190
for use with VPNs, 169
preaction sprinkler systems, 135
preemptive multitasking mode, 78, 89
presentation, in change control policy, 351
President’s Commission on Critical Infrastructure Protection (PCCIP), 149
preventive controls, identifying, 241
PRI (Primary Rate Interface), 189
primary keys, guaranteeing tuples are uniquely identified by, 322
Primary Rate Interface (PRI), 189
privacy
European Union Principles on Privacy, 277
harmonizing US and European data privacy practices, 12
policies, 51
protection of, 2
self-regulation in approach to, 281
privacy-aware role-based access control, 39, 51
privileges
elevating, 19
“least privilege” principle, 23
user groups and, 4
probability of risk, measuring with risk management scorecard, 30–31
process identification (PID) values, 102
process isolation, in OSs (operating systems), 80–81, 101–102
processes
concurrency controls, 315
deactivation, 93
tracking running, 116–117
processing power, CPUs, 88
profiling criminals, 301
programmable I/O, 105
programmable read-only memory (PROM), 104
programming languages, generations of, 307, 326–327
project initiation phase, of business continuity plan, 256
PROM (programmable read-only memory), 104
protection profiles, in Common Criteria, 79–80, 96–97, 108–109
protection rings, security enforcement components built into OSs, 113–114
proximity detector. See capacitance detector
public key cryptography
description of, 195
PKI compared with, 209–210
RSA algorithm, 215
SSL using, 219
Public Key Infrastructure. See PKI (Public Key Infrastructure)
purging
description of, 342
sensitive data, 353
Q
qualitative risk analysis, 34–35
quantitative risk analysis, 35
race condition attacks, 336
radio frequency interference (RFI), 148
RADIUS (Remote Authentication Dial-In User Service), 67–68
RAID (redundant array of inexpensive disks)
as Direct Access Storage Device, 356
parity information in, 347, 369–370
redundancy techniques, 344
RAIT (redundant array of independent tapes), 356
RAM
combining with secondary memory for system memory, 78, 90
swapping contents from RAM to hard drive, 102–103
RAs (registration authorities), 208, 226
RBAC (role-based access control)
centrally administered set of controls in, 69
RC4 algorithm, 186
read-only memory (ROM), 81, 103–104
read up and write down rule, in Clark-Wilson access model, 91
rebar, reinforcing exterior walls with, 152
reciprocal agreement
as option for offsite facility, 258, 264
reconstitution phase, of business continuity plan, 256, 266
recovery. See also disaster recovery
NIST practices, 241
phase of business continuity plan, 256
stage in incident response, 295–296
Red Book, 87
redundant array of independent tapes (RAIT), 356
redundant array of inexpensive disks. See RAID (redundant array of inexpensive disks)
redundant technologies and strategies
RAID. See RAID (redundant array of inexpensive disks)
redundant sites, 266
reference monitor
mediating subject access to objects, 112
relationship to security kernel, 79, 91–92
referential integrity, 322
reflected vulnerability. See nonpersistent XSS vulnerability
registers, for temporary storage, 116
registration authorities (RAs), 208, 226
regression testing, 318
regulation. See also law
factors in analyzing products for access control, 60
regulatory law, 295
regulatory policies in security program, 32
regulators, of voltage, 147
relational databases
attributes (columns) and tuples (rows) in, 339
object-oriented database compared with, 317
relay agents, mail servers using, 367
reliability, of evidence, 289–290
religious law systems, 278
remote administration, guidelines for securing, 347, 368–369
Remote Authentication Dial-In User Service (RADIUS), 67–68
remote journaling, transmitting data offshore, 265–266
Remote Procedure Calls (RPCs), 306, 325
Repeatable level (level 2), CMMI, 107
replay attacks, for capturing passwords, 54
reporting
in change control policy, 351
on security incidents and mitigation, 346, 367
Request for Comments (RFCs), 291
residual risk, formula for, 22
response aspect, of physical security design, 137
restoration team, responsibility for getting alternate site working, 257
reusability, of objects, 331–332
RFCs (Request for Comments), 291
RFI (radio frequency interference), 148
rings, protection rings in OSs, 114
RIP (Routing Information Protocol), 175–176
risk acceptance
methods for dealing with risk, 29
overview of, 17–18
business continuity plans and, 252
calculating risk of business functions, 246
determining construction materials for new facility, 133
as first step in rolling out a security program, 145–146
risk assessment
calculating residual risk, 4, 22
committee responsible for defining acceptable risk, 2
factors in choosing facility site, 142
risk avoidance
discontinuing activities that introduce risk, 16
methods for dealing with risk, 29
vs. risk mitigation, 18
risk management
ANZ 4360, 26
measuring impact with risk management scorecard, 30–31
methods, 6
topics related to, 1
risk management committee, 14
risk management scorecard, 7, 30–31
risk mitigation
methods for dealing with risk, 29–30
security controls for, 17
risk transference
methods for dealing with risk, 29
overview of, 18
rogue devices, on IP telephony and data networks, 172
role-based access control (RBAC)
centrally administered set of controls in, 69
ROM (read-only memory), 81, 103–104
routing
description of routing, 175
on Internet, 158
mesh networks and, 317
Routing Information Protocol (RIP), 175–176
routing protocols
building topology database of network, 158, 176–177
description of routing, 175
types of, 176
rows (tuples)
identifying by primary key values, 306, 322
in relational databases, 339
RPCs (Remote Procedure Calls), 306, 325
running key ciphers, 224
S
Safe Harbor, harmonizing US and European data privacy practices, 12, 278
salami attacks, 298
salvage team, responsibility for starting site recovery, 257
SANs (storage area networks), 344, 360–361
Sarbanes-Oxley (SOX) Act, 281
SAs (security associations), in IPSec, 198, 222–223
satellite links, wireless communication via, 159, 182
schema, of database system, 316
screened host architecture, 166
scrubbing, intruder attacks, 59
search and seizure, exigent circumstances and, 290
Search for Extra Terrestrial Intelligence (SETI), 373
search warrants. See also warrants, 290
second-generation programming languages, 327
second order XSS vulnerability. See persistent XSS vulnerability
secondary evidence, 288–289
secondary memory, combining with RAM, 78, 90
secure computing platform, 99
Secure European System for Applications in a Multivendor Environment (SESAME), 72–73
Secure Sockets Layer. See SSL (Secure Sockets Layer)
security
application security, 303
operations security, 341
physical. See physical security
model for access rights between subjects and objects, 80, 100–101
topics related to, 77
security associations (SAs), in IPSec, 198, 222–223
security breaches, due care in preventing, 271, 282
security controls
protecting databases, 21
protecting e-mail system, 3
separation of duties and job rotation, 65
security countermeasures
Bluejacking, 170
brute-force attacks, 365
job rotation and separation of duties, 42
spam, 156
steps in rolling out physical security program, 146
transparency to users, 40
security governance program, 5, 27
security kernel (abstract machine), 79, 91–92
security parameter index (SPI), 223
security perimeter, dividing trusted from untrusted processes, 112–113
security personnel
managing audit logs, 59
security officer, 345
security policies
preventive nature of, 365
responsibilities of security policy committee, 14
in security program, 8
security program
learning objectives, 8–9
policies in, 8
steps in roll out, 124, 145–146
security steering committee, 14
security target, evaluating against Common Criteria, 109
self-regulation
example of, 271
PCI Data Security Standard, 281
self-service password reset, 49
semantic integrity, 322
senior executives. See also management
executive succession planning, 259
when to report incidents to, 285
sensitive data
audit logs containing, 59
Bell-LaPadula model for, 101
encrypting, 172
protecting, 16
purging, 353
regulating transport across international borders, 270
transmitting via IM, 183
separation of duties, as security countermeasure, 42, 65
Sequential Access Storage Devices, 343, 356
server room, choosing lock mechanism for, 123
Service Design, in Information Technology Infrastructure Library, 106
service-level agreements (SLAs)
change management and, 351
Service Operation, in Information Technology Infrastructure Library, 106
service-oriented architecture (SOA), 95
Service Provisioning Markup Language (SPML), 58, 66
Service Set ID (SSID), 186
Service Strategy, in Information Technology Infrastructure Library, 106
Service Transition, in Information Technology Infrastructure Library, 107
SESAME (Secure European System for Applications in a Multivendor Environment), 72–73
session hijacking attacks
description of, 344
spoofing attacks supporting, 359
session keys
clients creating, 219
KDFs and, 210–211
SETI (Search for Extra Terrestrial Intelligence), 373
SGML (Standard Generalized Markup Language)
provisioning functionality absent in, 66
SHA/SHA-256
in forensic investigation, 297
as hashing algorithm, 218
shareware, 280
sharing resources, grouping computers for, 158
shielded cable, protecting against radio frequency interference, 148
shoulder surfing attacks, 366
side-channel attacks
nonintrusive nature of, 90
on smart cards, 38
signature-based IDS, 61–62, 330
Simple Mail Transfer Protocol (SMTP)
lacking adequate authentication, 180
open mail relay servers and, 165
Simple Object Access Protocol (SOAP)
for application information exchange over Internet, 324
description of, 306
simulation test, for assessing business continuity plans, 255
single sign-on, 44
sites. See facilities
skeleton crew, for critical functions following disaster, 259
SLAs (service-level agreements)
change management and, 351
SMTP (Simple Mail Transfer Protocol)
lacking adequate authentication, 180
open mail relay servers and, 165
SOA (service-oriented architecture), 95
SOAP (Simple Object Access Protocol)
for application information exchange over Internet, 324
description of, 306
social engineering attacks
on passwords, 54
pharming attacks, 56–57
unauthorized access via, 171
sockets
packet transmission and, 156, 168
softphones, caution regarding use, 178
software
ACID test for database software, 304, 313–315
change management and, 250
licensing, 270–271
protection mechanisms integrated into, 308–309, 333–334
software development. See also system development
CMMI (Capability Maturity Model Integration), 95
Iterative Development approach, 324
software integrity service, 306
SONET (Synchronous Optical Networks), 188
SOX (Sarbanes-Oxley) Act, 281
spam
anti-relaying features of antispam applications, 367
open mail relay servers and, 180
use of botnets in sending, 329
spammers, botnets and, 329
SPI (security parameter index), 223
spiral method, approaches to system development, 319
SPML (Service Provisioning Markup Language), 58, 66
sprinkler systems, for fire protection, 121, 134–135
SQL database, 327
SSID (Service Set ID), 186
SSL (Secure Sockets Layer)
connection setup process, 197
IP spoofing attacks, 358
at transport layer, 209
Standard Generalized Markup Language (SGML)
provisioning functionality absent in, 66
standardized modules, in component-based system development, 319
state machine model, 111
static routing protocol, 177
statistical anomaly-based IDS, 61
statistically unbiased keystream, 216
steganography
carrier files in, 204
components in, 194
hiding data with, 224
what occurs in PKI environment, 194
stego-medium, 204
Direct Access and Sequential Access storage devices, 356
hierarchical vs. storage area networks, 344
storage area networks (SANs), 344, 360–361
stream ciphers
attributes of good, 216
block ciphers compared with, 216
one-time pads similar to, 196, 215
striping
overview of, 371
RAID levels and, 358–359
structured programming, approaches to system development, 319
structured walk-through tests, 255
sublayers, of data link layer, 164
sufficiency, of evidence, 289–290
surge protectors, 147
surveillance component, of CPTED, 150–151
swap space, extending RAM with, 90
swipe cards, 144
switches, mesh networks, 317
symbolic links, 362
symmetric algorithms
comparing PKI with public key cryptography, 210
confidentiality provided by, 217–218
mathematically simple tasks in, 207
symmetric block cipher, 215
symmetric keys
drawback of symmetric key systems, 194, 207
KDFs and, 210
Synchronous Optical Networks (SONET), 188
synchronous tokens, for authentication, 75
system cold start, 357
system development. See also software development
component-based approach to, 305, 319
system documentation, 345, 364
system owners, 364
system performance, 57
system reboot, 357
T
TACACS+, 67–68
tape vaulting, for backups, 265
target of evaluation (ToE), evaluating against Common Criteria, 109
TCB (trusted computing base)
execution domain switching, 93
relationship of security kernel to reference monitor, 92
retrieval of sensitive data and, 79
security perimeter and, 112–113
TCP/IP (Transmission Control Protocol/Internet Protocol), 167
TCP (Transmission Control Protocol)
networking protocols, 156
sockets and, 168
transport layer protocols, 167
TCSEC (Trusted Computer System Evaluation Criteria), 87–88
technical attacks
pharming attacks as, 63
phishing attacks as, 56–57
technology
IAB role regarding, 291
IT (information technology), 286
role of Internet Architecture Board regarding, 273
telecommunications
technologies for, 162, 188–189
topics related to, 155
telephony, security measures for, 157
Telnet, 369
tempered glass, fire codes and physical security, 129
Temporal Key Integrity Protocol (TKIP), 186
territorial reinforcement, as component of CPTED, 151
testing
assessing business continuity plans, 255
in change control policy, 351
content management application, 305, 318
steps in disaster recovery and continuity planning, 253
TeX, 52–53
The Open Group Architecture Framework (TOGAF), 95
thermal-fusible links, in sprinkler systems, 134–135
third-generation programming languages
abstraction in, 328
pros/cons of, 326
threads, multitasking and, 115–116
threats
evaluating in business continuity plans, 237
identifying in risk assessment process, 17
ranking in business continuity planning, 262–263
understanding threats to business continuity, 252
three-tiered model, for Internet connectivity, 156
time multiplexing, sharing CPUs between processes and, 102
time-stamps, computer forensics and, 297
timing analysis, attacks on smart cards, 50
timing attacks, 366
TKIP (Temporal Key Integrity Protocol), 186
TLS (Transport Layer Security), 194, 205
ToE (target of evaluation), evaluating against Common Criteria, 109
TOGAF (The Open Group Architecture Framework), 95
Token Ring, 164
tokens, in authentication, 75
topologies, mesh networks, 317
tort law. See civil law
tracking stage, of incident response, 295
trade secret law, 280
trademarks
domain litigation and, 172
protecting logos with, 279
traffic analysis, in penetration testing, 335–336
training
access control and, 60
learning objectives for, 33–34
Transmission Control Protocol. See TCP (Transmission Control Protocol)
Transmission Control Protocol/Internet Protocol (TCP/IP), 167
transparency of security measures
system performance and, 57
to users, 40
transponders, communication via satellite links and, 182
transport layer
SSL (Secure Sockets Layer) at, 209
TCP/IP as transport layer protocol, 167
Transport Layer Security (TLS), 194, 205
triage stage, in incident response, 285
trialware, 280
true name, identity theft and, 63
Trusted Computer System Evaluation Criteria (TCSEC), 87–88
trusted computing base. See TCB (trusted computing base)
trusted recovery, of operating systems or applications, 357
tunneling protocols
tunneling virus, 320
tuples (rows)
identifying by primary key values, 306, 322
in relational databases, 339
two-phase commit, in databases, 337–338
two-tiered model, for client-server architecture, 166
U
UDP (User Datagram Protocol)
networking protocols, 156
sockets and, 168
as transport layer protocol, 167
unauthorized access. See also access control
attacks, 346
shoulder surfing attacks, 366
social engineering attacks, 171
unit testing, 318
usability, balancing with security, 57
User Datagram Protocol (UDP)
networking protocols, 156
sockets and, 168
as transport layer protocol, 167
user groups
database security and, 21
privileges and, 4
user interfaces, 69
user provisioning, identity management systems and, 71
monitoring activities of, 57
transparency of security measures to, 40
V
VANs (value-added networks), 174
variable focal length lenses, in CCTV cameras, 131–132
variables, object classes and, 334
Vernam, Gilbert, 212
vibrations sensors, 143
virtual address mapping, 101–102
virtual incident response team, 271, 283
virtual LANs (VLANs), 174
virtual machines
virtual instances of OSs, 114
virtual memory, mapping to real memory, 93
virtual private networks (VPNs), 157
viruses
behavior blocking in detection, 330
detection methods, 307
disinfecting damaged files, 346, 368
VLANs (virtual LANs), 174
VoIP (Voice over IP)
network security, 178
voltage, protecting against fluctuation in, 124, 147
volumetric IDS systems
compared with electromagnetic systems, 139–140
VPNs (virtual private networks), 157
W
walls
comparing electromagnetic and volumetric IDS systems, 139
construction materials, 121, 125, 132–133, 152
physical security design, 137
WAM (Web access management) software
basic components and activities of, 47–48
function of, 38
identity management systems and, 71
WANs (wide area networks)
ATM (Asynchronous Transfer Mode) and, 187
connecting LANs to, 188
warm sites
compared with reciprocal agreements, 245
functions of, 264
for restoring and using backup tapes, 232, 244
warning signs, deterrent aspect of physical security design, 137
warrants
for eavesdropping, 273
for search and seizure, 290
for wiretapping, 293
Watchdog timers, 67–68
wave-pattern motion detectors, 141
Web access management software. See WAM (Web access management) software
WEP (wired equivalent privacy), 186
wet pipe sprinkler systems, 135
wide-angle lens, in CCTV cameras, 132, 138
wide area networks. See WANs (wide area networks)
window films, 131
windows
comparing electromagnetic and volumetric IDS systems, 139
fire codes and physical security, 120, 128, 130–131
in high fire risk area, 120
wired equivalent privacy (WEP), 186
wireless connectivity, 159, 182
wiretapping, 293
WLANs (wireless LANs)
ad hoc, 186
specification, 802.11, 164
X
X.500 standard
access control and, 48
for directory hierarchy, 47, 71
XACML (eXtensible Access Control Markup Language), 58
XML (Extensible Markup Language)
functions of, 58
overview of, 52
SOAP based on, 325
SPML based on, 66
XSS (cross-site scripting)
malicious code exploiting DOM-based XSS, 307, 328
types of vulnerabilities, 173
vulnerability in Web applications, 157
Z
Zachman Architecture Framework, 79, 94
Zachman, John, 94
zero knowledge, in penetration testing, 361–362
zeroization, as example of purging, 353
zones, DNS
separating into public and private servers, 166–167
zoom lenses, changing view field of CCTV cameras, 136