Network Security Essentials:

Transcription

1 Network Security Essentials: Applications and Standards Fifth Edition William Stallings International Editions contributions by B. R. Chandavarkar National Institute of Technology Karnataka, Surathkal PEARSON Boston Columbus Indianapolis New York San Francisco Upper Saddle River Amsterdam Cape Town Dubai London Madrid Milan Munich Paris Montreal Toronto Delhi Mexico City Sao Paulo Sydney Hong Kong Seoul Singapore Taipei Tokyo

2 Contents Online Resources 9 Preface 11 About the Author 17 1 Introduction Computer Security Concepts The OSI Security Architecture Security Attacks Security Services Security Mechanisms A Model for Network Security Standards Outline of This Book Recommended Reading Internet and Web Resources Key Terms, Review Questions, and Problems 39 PART ONE CRYPTOGRAPHY 41 2 Symmetric Encryption and Message Confidentiality Symmetric Encryption Principles Symmetric Block Encryption Algorithms Random and Pseudorandom Numbers Stream Ciphers and RC Cipher Block Modes of Operation Recommended Reading Key Terms, Review Questions, and Problems 70 3 Public-Key Cryptography and Message Authentication Approaches to Message Authentication Secure Hash Functions Message Authentication Codes Public-Key Cryptography Principles Public-Key Cryptography Algorithms Digital Signatures Recommended Reading Key Terms, Review Questions, and Problems 106 PART TWO NETWORK SECURITY APPLICATIONS Key Distribution and User Authentication Symmetric Key Distribution Using Symmetric Encryption Kerberos Key Distribution Using Asymmetric Encryption 129

3 6 CONTENTS 4.4 X.509 Certificates Public-Key Infrastructure Federated Identity Management Recommended Reading Key Terms, Review Questions, and Problems Network Access Control and Cloud Security Network Access Control Extensible Authentication Protocol IEEE 802.1X Port-Based Network Access Control Cloud Computing Cloud Security Risks and Countermeasures Data Protection in the Cloud Cloud Security as a Service Recommended Reading Key Terms, Review Questions, and Problems Transport-Level Security Web Security Considerations Secure Sockets Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell (SSH) Recommended Reading Key Terms, Review Questions, and Problems Wireless Network Security Wireless Security Mobile Device Security IEEE Wireless LAN Overview IEEE li Wireless LAN Security Recommended Reading Key Terms, Review Questions, and Problems Electronic Mail Security Pretty Good Privacy (PGP) S/MIME DomainKeys Identified Mail (DKIM) Recommended Reading Key Terms, Review Questions, and Problems IP Security IP Security Overview IP Security Policy Encapsulating Security Payload Combining Security Associations Internet Key Exchange Cryptographic Suites Recommended Reading Key Terms, Review Questions, and Problems 315

4 CONTENTS 7 PART THREE SYSTEM SECURITY Malicious Software Types of Malicious Software (Malware) Propagation Infected Content Viruses Propagation Vulnerability Exploit Worms Propagation Social Engineering SPAM , Trojans Payload System Corruption Payload Attack Agent Zombie, Bots Payload Information Theft Keyloggers, Phishing, Spyware Payload Stealthing Backdoors, Rootkits Countermeasures Distributed Denial of Service Attacks Recommended Reading Key Terms, Review Questions, and Problems Intruders Intruders Intrusion Detection Password Management Recommended Reading Key Terms, Review Questions, and Problems Firewalls The Need for Firewalls Firewall Characteristics Types of Firewalls Firewall Basing Firewall Location and Configurations Recommended Reading Key Terms, Review Questions, and Problems 409 APPENDICES 395 Appendix A Some Aspects of Number Theory 413 A.l Prime and Relatively Prime Numbers 414 A. 2 Modular Arithmetic 416 Appendix B Projects for Teaching Network Security 418 B. l Research Projects 419 B.2 Hacking Project 420 B.3 Programming Projects 420 B.4 Laboratory Exercises 421 B.5 Practical Security Assessments 421 B.6 Firewall Projects 421 B.7 Case Studies 422 B.8 Writing Assignments 422 B.9 Reading/Report Assignments 422 References 423 Credits 430 Index 434

5 ' 8 CONTENTS ONLINE CHAPTERS AND APPENDICES1 13 Network Management Security 13.1 Basic Concepts of SNMP 13.2 S 13.3 SNMPv3 SNMPvl Community Facility 13.4 Recommended Reading 13.5 Key Terms, Review Questions, and Problems 14 Legal and Ethical Issues 14.1 Cybercrime and Computer Crime 14.2 Intellectual Property 14.3 Privacy 14.4 Ethical Issues 14.5 Recommended Reading 14.6 Key Terms, Review Questions, and Problems 15 SHA Evaluation Criteria for SHA The SHA-3 Algorithm ^ 15.3 Recommended Reading 15.4 Key Terms and Review Questions Appendix C Standards and Standards-Setting Organizations Appendix D Appendix E Appen dix F TCP/IP and OSI Pseudorandom Number Generation Kerberos Encryption Techniques Appendix G Data Compression Using ZIP G.l Compression Algorithm G. 2 Decompression Algorithm Appendix H H.l More on PGP True Random Numbers H.2 Pseudorandom Numbers H.3 Cryptographic Keys and Key Rings H.4 Public-Key Management Appendix I The International Reference Alphabet Appendix J Appendix K The Base-Rate Fallacy Radix-64 Conversion Glossary List of acronyms 1Online chapters, appendices, and other documents are Premium Content, available via the access card at the front of this book