Applied Information Security

Size: px

Start display at page:

Download "Applied Information Security"

Shauna Summers
6 years ago
Views:

1 Applied Information Security A Hands-on Approach Bearbeitet von David Basin, Patrick Schaller, Michael Schläpfer 1. Auflage Buch. xiv, 202 S. Hardcover ISBN Format (B x L): 15,5 x 23,5 cm Gewicht: 491 g Weitere Fachgebiete > EDV, Informatik > Hardwaretechnische Grundlagen > Computersicherheit Zu Leseprobe schnell und portofrei erhältlich bei Die Online-Fachbuchhandlung beck-shop.de ist spezialisiert auf Fachbücher, insbesondere Recht, Steuern und Wirtschaft. Im Sortiment finden Sie alle Medien (Bücher, Zeitschriften, CDs, ebooks, etc.) aller Verlage. Ergänzt wird das Programm durch Services wie Neuerscheinungsdienst oder Zusammenstellungen von Büchern zu Sonderpreisen. Der Shop führt mehr als 8 Millionen Produkte.

2 Contents 1 Security Principles Objectives ProblemContext ThePrinciples Simplicity OpenDesign Compartmentalization Minimum Exposure LeastPrivilege Minimum Trust and Maximum Trustworthiness Secure, Fail-Safe Defaults CompleteMediation NoSinglePointofFailure Traceability Generating Secrets Usability Discussion Assignment Exercises The Virtual Environment Objectives VirtualBox Setting up a New Virtual Machine TheNetwork TheLabEnvironment TheHosts Installing the Virtual Machines Installing host alice Installing host bob Installing host mallet xi

3 xii Contents 3 Network Services Objectives Networking Background Internet Layer Transport Layer TheAdversary spointofview InformationGathering Finding Potential Vulnerabilities Exploiting Vulnerabilities Vulnerable Configurations TheAdministrator spointofview ActionstoBeTaken Deactivating Services RestrictingServices Exercises Authentication and Access Control Objectives Authentication Telnet and Remote Shell Secure Shell UserIDsandPermissions File Access Permissions SetuidandSetgid Shell Script Security SymbolicLinks TemporaryFiles Environment DataValidation Quotas Change Root Exercises Logging and Log Analysis Objectives Logging Mechanisms and Log Files Remote Logging Problems with Logging TamperingandAuthenticity Tamper-Proof Logging Input Validation Rotation IntrusionDetection LogAnalysis SuspiciousFilesandRootkits... 76

4 Contents xiii Integrity Checks Exercises Web Application Security Objectives Preparatory Work Black-Box Audit Attacking Web Applications Remote File Upload Vulnerability in Joomla! RemoteCommandExecution SQLInjections PrivilegeEscalation User Authentication and Session Management A PHP-Based Authentication Mechanism HTTPBasicAuthentication Cookie-Based Session Management Cross-SiteScripting(XSS) Persistent XSS Attacks Reflected XSS Attacks DOM-Based XSS Attacks SQLInjectionsRevisited Secure Socket Layer Further Reading Exercises Certificates and Public Key Cryptography Objectives Fundamentals of Public Key Cryptography Distribution of Public Keys and Certificates Creating Keys and Certificates Running a Certificate Authority Certificate-Based Client Authentication Exercises Risk Management Objectives Risk and Risk Management TheCoreElementsofRiskAnalysis RiskAnalysis:AnImplementation SystemDescription Stakeholders Assets and Vulnerabilities Vulnerabilities Threat Sources Risks and Countermeasures

5 xiv Contents Summary A Using This Book in a Lab Course A.1 CourseStructure A.2 Project B Report Template B.1 SystemCharacterization B.1.1 SystemOverview B.1.2 System Functionality B.1.3 Components and Subsystems B.1.4 Interfaces B.1.5 Backdoors B.1.6 Additional Material B.2 Risk Analysis and Security Measures B.2.1 InformationAssets B.2.2 Threat Sources B.2.3 Risks and Countermeasures B.3 ReviewoftheExternalSystem B.3.1 Background B.3.2 Completeness in Terms of Functionality B.3.3 Architecture and Security Concepts B.3.4 Implementation B.3.5 Backdoors B.3.6 Comparison C Linux Basics and Tools C.1 System Documentation C.2 Tools C.2.1 Variables C.2.2 Quoting and Wildcards C.2.3 Pipelining and Backquotes C.2.4 ls, find and locate C.2.5 wc, sort, uniq, head and tail C.2.6 ps, pgrep, kill and killall C.2.7 grep C.2.8 awk and sed C.2.9 Tcpdump D Answers to Questions References Index...199

X.media.publishing. Multimedia Systems. Bearbeitet von Ralf Steinmetz, Klara Nahrstedt

X.media.publishing. Multimedia Systems. Bearbeitet von Ralf Steinmetz, Klara Nahrstedt X.media.publishing Multimedia Systems Bearbeitet von Ralf Steinmetz, Klara Nahrstedt 1. Auflage 2004. Buch. xvi, 466 S. Hardcover ISBN 978 3 540 40867 3 Format (B x L): 17,8 x 23,5 cm Gewicht: 2510 g Weitere