information system securityvamc.chaparala
Copyright © 2016 by McGraw-Hill Education. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a data base or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication.
ISBN: 978-0-07-183597-8 MHID: 0-07-183597-0
The material in this eBook also appears in the print version of this title: ISBN: 978-0-07-183601-2, MHID: 0-07-183601-2.
eBook conversion by codeMantra Version 1.0
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.
McGraw-Hill Education eBooks are available at special quantity discounts to use as premiums and sales promotions or for use in corporate training programs. To contact a representative, please visit the Contact Us page at www.mhprofessional.com.
SANS Institute IT Code of Ethics reproduced with permission, © SANS Institute.
Information has been obtained by McGraw-Hill Education from sources believed to be reliable. However, because of the possibility of human or mechanical error by our sources, McGraw-Hill Education, or others,
McGraw-Hill Education does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such information.
McGraw-Hill Education is an independent entity from CompTIA®. This publication and digital content may be used in assisting students to prepare for the CompTIA Security+ exam. Neither CompTIA nor McGraw-Hill Education warrants that use of this publication and digital content will ensure passing any exam. CompTIA and CompTIA Security+ are trademarks or registered trademarks of CompTIA in the United States and/or other countries. All other trademarks are trademarks of their respective owners.
This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Education’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.
About the Authors Dr. Wm. Arthur Conklin is an associate professor and Director of the Center for Information Security Research and Education in the College of Technology at the University of Houston. He holds two terminal degrees, a Ph.D. in Business Administration (specializing in Information Security) from The University of Texas at San Antonio (UTSA) and the degree Electrical Engineer (specializing in Space Systems Engineering) from the Naval Postgraduate School in Monterey, CA. He holds CompTIA Security+, CISSP, CSSLP, CRISC, DFCP, GICSP, and CASP certifications. An ISSA Fellow, he is also a senior member of ASQ and a member of IEEE and ACM. His research interests include the use of systems theory to explore information security, specifically in cyber- physical systems. He has coauthored six security books and numerous academic articles associated with information security. He is active in the DHS-sponsored Industrial Control Systems Joint Working Group (ICSJWG) efforts associated with workforce development and cybersecurity aspects of industrial control systems. He has an extensive background in secure coding and is a former co-chair of the DHS/DoD Software Assurance Forum working group for workforce education, training, and development.
Dr. Gregory White has been involved in computer and network security since 1986. He spent 19 years on active duty with the U.S. Air Force and is currently in the Air Force Reserves assigned to the Pentagon. He obtained his Ph.D. in Computer Science from Texas A&M University in 1995. His dissertation topic was in the area of computer network intrusion detection, and he continues to conduct research in this area today. He is currently the Director for the Center for Infrastructure Assurance and Security and is an associate professor of computer science at The University of Texas at San Antonio. Dr. White has written and presented numerous articles and conference papers on security. He is also the coauthor for five textbooks on computer and network security and has written chapters for two other security books. Dr. White continues to be active in security research. His
current research initiatives include efforts in high-speed intrusion detection, community infrastructure protection, and visualization of community and organization security postures.
Dwayne Williams is Associate Director, Special Projects for the Center for Infrastructure Assurance and Security (CIAS) at the University of Texas at San Antonio and has more than 22 years of experience in information systems and network security. Mr. Williams’s experience includes six years of commissioned military service as a Communications- Computer Information Systems Officer in the U.S. Air Force, specializing in network security, corporate information protection, intrusion detection systems, incident response, and VPN technology. Prior to joining the CIAS, he served as Director of Consulting for SecureLogix Corporation, where he directed and provided security assessment and integration services to Fortune 100, government, public utility, oil and gas, financial, and technology clients. Mr. Williams graduated in 1993 from Baylor University with a Bachelor of Arts in Computer Science. Mr. Williams is a Certified Information Systems Security Professional (CISSP), CompTIA Advanced Security Practitioner (CASP), and coauthor of McGraw-Hill’s Voice and Data Security, CompTIA Security+ All-in-One Exam Guide, and CASP CompTIA Advanced Security Practitioner Certification Study Guide.
Roger L. Davis, CISSP, CISM, CISA, is an Account Manager for Microsoft. He has served as president of the Utah chapter of the Information Systems Security Association (ISSA) and various board positions for the Utah chapter of the Information Systems Audit and Control Association (ISACA). He is a retired Air Force lieutenant colonel with 35 years of military and information systems/security experience. Mr. Davis served on the faculty of Brigham Young University and the Air Force Institute of Technology. He coauthored McGraw-Hill’s CompTIA Security+ All-in-One Exam Guide and Voice and Data Security. He holds a Master’s degree in Computer Science from George Washington University, a Bachelor’s degree in Computer Science from Brigham
Young University, and performed post-graduate studies in electrical engineering and computer science at the University of Colorado.
Chuck Cothren, CISSP, is a Principal Solutions Specialist at Symantec Corporation applying a wide array of network security experience, including performing controlled penetration testing, incident response, and security management to assist a wide variety of clients in the protection of their critical data. He has also analyzed security methodologies for Voice over Internet Protocol (VoIP) systems and supervisory control and data acquisition (SCADA) systems. He is coauthor of the books Voice and Data Security, and CompTIA Security+ All-in-One Exam Guide.
About the Technical Editor Bobby E. Rogers is an Information Security Engineer working as a contractor for Department of Defense agencies, helping to secure, certify, and accredit their information systems. His duties include information system security engineering, risk management, and certification and accreditation efforts. He retired after 21 years in the United States Air Force, serving as a network security engineer and instructor, and has secured networks all over the world. Bobby has a Master’s degree in Information Assurance (IA), and is pursuing a doctoral degree in Cybersecurity from Capitol Technology University, Maryland. His many certifications include CRISC, CISSP-ISSEP, C|EH, and MCSE: Security as well as the CompTIA A+, Network+, Security+, and Mobility+ certifications.
Acknowledgments This book is dedicated to the many security professionals who daily
work to ensure the safety of our nation’s critical infrastructures. We want to recognize the thousands of dedicated individuals who strive to protect
our national assets but who seldom receive praise and often are only noticed when an incident occurs. To you, we say thank you for a job well
We, the authors of Principles of Computer Security, Fourth Edition, have many individuals who we need to acknowledge—individuals without whom this effort would not have been successful. This edition would not have been possible without Tim Green, whose support and faith in the authors made this edition possible. He brought together an all-star production team that made this book more than just a new edition, but a complete learning system. The list needs to start with those folks at McGraw-Hill Education who
worked tirelessly with the project’s multiple authors and contributors and led us successfully through the minefield that is a book schedule and who took our rough chapters and drawings and turned them into a final, professional product we can be proud of. We thank all the good people from the Acquisitions team, Tim Green and Amy Stonebraker; from the Editorial Services team, Jody McKenzie and Howie Severson; from the Illustration and Production teams, James Kussow and Amarjeet Kumar and the composition team at Cenveo Publisher Services. We also thank the technical editor, Bobby Rogers; the copy editor, Bill McManus; the proofreader, Paul Tyler; and the indexer, Jack Lewis; for all their attention to detail that made this a finer work after they finished with it. We also need to acknowledge our current employers who, to our great
delight, have seen fit to pay us to work in a career field that we all find exciting and rewarding. There is never a dull moment in security, because it is constantly changing. We would like to thank Art Conklin for herding the cats on this one.
Finally, we would each like to individually thank those people who—on a personal basis—have provided the core support for us individually. Without these special people in our lives, none of us could have put this work together.
—The Author Team
To Susan, your love and support is what enables me to do all the things I do.
—Art Conklin, Ph.D. I would like to thank my wife, Charlan, for the tremendous support she has always given me. It doesn’t matter how many times I have sworn that I’ll never get involved with another book project only to return within months to yet another one; through it all, she has remained supportive. I would also like to publicly thank the United States Air Force, which
provided me numerous opportunities since 1986 to learn more about security than I ever knew existed. To whoever it was who decided to send me as a young captain—fresh from completing my master’s degree in artificial intelligence—to my first assignment in computer security: thank you, it has been a great adventure!
—Gregory B. White, Ph.D. Josie, thank you for all the love and support. Macon, John, this is for you.
—Chuck Cothren Geena, thanks for being my best friend and my greatest support. Anything I am is because of you. Love to my kids and grandkids!
—Roger L. Davis To my wife and best friend, Leah, for your love, energy, and support— thank you for always being there. Here’s to many more years together.
ABOUT THIS BOOK
Important Technology Skills Information technology (IT) offers many career paths, and information security is one of the fastest-growing tracks for IT professionals. This book provides coverage of the materials you need to begin your exploration of information security. In addition to covering all of the CompTIA Security+ exam objectives, additional material is included to help you build a solid introductory knowledge of information security.
Proven Learning Method Keeps You on Track Designed for classroom use and written by instructors for use in their own classes, Principles of Computer Security is structured to give you comprehensive knowledge of information security. The textbook’s active learning methodology guides you beyond mere recall and— through thought-provoking activities, labs, and sidebars—helps you develop critical-thinking, diagnostic, and communication skills.
Effective Learning Tools This feature-rich textbook is designed to make learning easy and enjoyable and to help you develop the skills and critical-thinking abilities that will enable you to adapt to different job situations and to troubleshoot problems. Written by instructors with decades of combined information security experience, this book conveys even the most complex issues in an accessible, easy-to understand format.
Each chapter includes
Learning Objectives that set measurable goals for chapter-by- chapter progress
Illustrations that give you a clear picture of the concepts and technologies
Try This!, Cross Check, and Tech Tip sidebars that encourage you to practice and apply concepts in real-world settings
Notes, Tips, and Warnings that guide you, and Exam Tips that give you advice or provide information specifically related to preparing for the exam
Chapter Summaries and Key Terms Lists that provide you with an easy way to review important concepts and vocabulary
Challenging End-of-Chapter Tests that include vocabulary- building exercises, multiple-choice questions, essay questions, and on-the-job lab projects
CompTIA APPROVED QUALITY CONTENT
It Pays to Get Certified In a digital world, digital literacy is an essential survival skill. Certification demonstrates that you have the knowledge and skill to solve technical or business problems in virtually any business environment. CompTIA certifications are highly valued credentials that qualify you for jobs, increased compensation, and promotion.
CompTIA Security+ Certification Helps Your
Security is one of the highest demand job categories, growing in importance as the frequency and severity of security threats continues to be a major concern for organizations around the world.
Jobs for security administrators are expected to increase by 18% —the skill set required for these types of jobs maps to the CompTIA Security+ certification.
Network Security Administrators can earn as much as $106,000 per year.
CompTIA Security+ is the first step in starting your career as a Network Security Administrator or Systems Security Administrator.
More than 250,000 individuals worldwide are CompTIA Security+ certified.
CompTIA Security+ is regularly used in organizations such as Hitachi Systems, Fuji Xerox, HP, Dell, and a variety of major U.S. government contractors.
Approved by the U.S. Department of Defense (DoD) as one of the required certification options in the DoD 8570.01-M directive, for Information Assurance Technical Level II and Management Level I job roles.
Steps to Getting Certified and Staying Certified 1. Review the exam objectives. Review the certification objectives to
make sure you know what is covered in the exam: http://certification.comptia.org/examobjectives.aspx
2. Practice for the exam. After you have studied for the certification exam, review and answer sample questions to get an idea of what type of questions might be on the exam: http://certification.comptia.org/samplequestions.aspx
3. Purchase an exam voucher. You can purchase exam vouchers on the CompTIA Marketplace, www.comptiastore.com.
4. Take the test! Go to the Pearson VUE website, www.pearsonvue.com/comptia/, and schedule a time to take your exam.
5. Stay certified! Effective January 1, 2011, new CompTIA Security+ certifications are valid for three years from the date of certification. There are a number of ways the certification can be renewed. For more information go to http://certification.comptia.org/ce.
For More Information Visit CompTIA online Go to http://certification.comptia.org/home.aspx to learn more about getting CompTIA certified.
Contact CompTIA Please call 866-835-8020 and choose Option 2, or e-mail [email protected]
Connect with CompTIA Find CompTIA on Facebook, LinkedIn, Twitter, and YouTube.
Content Seal of Quality This courseware bears the seal of CompTIA Approved Quality Content. This seal signifies this content covers 100 percent of the exam objectives and implements important instructional design principles. CompTIA recommends multiple learning tools to help increase coverage of the learning objectives.
CAQC Disclaimer The logo of the CompTIA Approved Quality Content (CAQC) program and the status of this or other training material as “Approved” under the CompTIA Approved Quality Content program signifies that, in CompTIA’s opinion, such training material covers the content of CompTIA’s related certification exam. The contents of this training material were created for the CompTIA
Security+ exam covering CompTIA certification objectives that were current as of the date of publication. CompTIA has not reviewed or approved the accuracy of the contents of
this training material and specifically disclaims any warranties of merchantability or fitness for a particular purpose. CompTIA makes no guarantee concerning the success of persons using any such “Approved” or other training material in order to prepare for any CompTIA certification exam.
CONTENTS AT A GLANCE
Chapter 1 Introduction and Security Trends
Chapter 2 General Security Concepts
Chapter 3 Operational and Organizational Security
Chapter 4 The Role of People in Security
Chapter 5 Cryptography
Chapter 6 Public Key Infrastructure
Chapter 7 PKI Standards and Protocols
Chapter 8 Physical Security
Chapter 9 Network Fundamentals
Chapter 10 Infrastructure Security
Chapter 11 Authentication and Remote Access
Chapter 12 Wireless Security and Mobile Devices
Chapter 13 Intrusion Detection Systems and Network Security
Chapter 14 System Hardening and Baselines
Chapter 15 Types of Attacks and Malicious Software
Chapter 16 E-Mail and Instant Messaging
Chapter 17 Web Components
Chapter 18 Secure Software Development
Chapter 19 Business Continuity and Disaster Recovery, and Organizational Policies
Chapter 20 Risk Management
Chapter 21 Change Management
Chapter 22 Incident Response
Chapter 23 Computer Forensics
Chapter 24 Legal Issues and Ethics
Chapter 25 Privacy
Appendix A CompTIA Security+ Exam Objectives: SY0-401
Appendix B About the Download
Foreword Preface Introduction Instructor Web Site
Chapter 1 Introduction and Security Trends The Computer Security Problem
Definition of Computer Security Historical Security Incidents The Current Threat Environment Threats to Security Security Trends
Targets and Attacks Specific Target Opportunistic Target Minimizing Possible Avenues of Attack
Approaches to Computer Security Ethics Additional References Chapter 1 Review
Chapter 2 General Security Concepts Basic Security Terminology
Security Tenets Security Approaches Security Principles Access Control Authentication Mechanisms Authentication and Access Control Policies
Security Models Confidentiality Models Integrity Models
Chapter 2 Review
Chapter 3 Operational and Organizational Security Policies, Procedures, Standards, and Guidelines
Security Policies Change Management Policy Data Policies Human Resources Policies Due Care and Due Diligence Due Process Incident Response Policies and Procedures
Security Awareness and Training Security Policy Training and Procedures Role-Based Training Compliance with Laws, Best Practices, and Standards User Habits New Threats and Security Trends/Alerts Training Metrics and Compliance
Interoperability Agreements Service Level Agreements Business Partnership Agreement
Memorandum of Understanding Interconnection Security Agreement
The Security Perimeter Physical Security
Physical Access Controls Physical Barriers
Environmental Issues Fire Suppression
Wireless Electromagnetic Eavesdropping
Modern Eavesdropping Chapter 3 Review
Chapter 4 The Role of People in Security People—A Security Problem
Social Engineering Poor Security Practices
People as a Security Tool Security Awareness Security Policy Training and Procedures
Chapter 4 Review
Chapter 5 Cryptography Cryptography in Practice
Fundamental Methods Comparative Strengths and Performance of Algorithms
Historical Perspectives Substitution Ciphers One-Time Pads
Algorithms Key Management Random Numbers
Hashing Functions SHA RIPEMD Message Digest Hashing Summary
Symmetric Encryption DES 3DES AES CAST RC Blowfish Twofish IDEA Block vs. Stream Symmetric Encryption Summary
Asymmetric Encryption Diffie-Hellman RSA ElGamal ECC Asymmetric Encryption Summary Symmetric vs. Asymmetric
Quantum Cryptography Steganography Cryptography Algorithm Use
Authentication Nonrepudiation Cipher Suites Key Exchange Key Escrow Session Keys Ephemeral Keys Key Stretching Secrecy Principles Transport Encryption Digital Signatures Digital Rights Management Cryptographic Applications Use of Proven Technologies
Chapter 5 Review
Chapter 6 Public Key Infrastructure The Basics of Public Key Infrastructures Certificate Authorities Registration Authorities
Local Registration Authorities Digital Certificates
Certificate Extensions Certificate Attributes
Certificate Lifecycles Registration and Generation CSR Renewal Suspension Revocation
Key Destruction Certificate Repositories Trust and Certificate Verification Centralized and Decentralized Infrastructures
Hardware Security Modules Private Key Protection Key Recovery Key Escrow
Public Certificate Authorities In-House Certificate Authorities
Choosing Between a Public CA and an In-House CA Outsourced Certificate Authorities Tying Different PKIs Together Trust Models
Certificate-Based Threats Stolen Certificates
Chapter 6 Review
Chapter 7 PKI Standards and Protocols PKIX and PKCS
PKIX Standards PKCS Why You Need to Know the PKIX and PKCS Standards
X.509 SSL/TLS Cipher Suites ISAKMP CMP XKMS S/MIME
IETF S/MIME History IETF S/MIME v3 Specifications
PGP How PGP Works
HTTPS IPsec CEP Other Standards
FIPS Common Criteria WTLS ISO/IEC 27002 (Formerly ISO 17799) SAML
Chapter 7 Review
Chapter 8 Physical Security The Security Problem Physical Security Safeguards
Walls and Guards Physical Access Controls and Monitoring Convergence Policies and Procedures Environmental Controls
Fire Suppression Water-Based Fire Suppression Systems Halon-Based Fire Suppression Systems Clean-Agent Fire Suppression Systems Handheld Fire Extinguishers Fire Detection Devices
UPS Backup Power and Cable Shielding Electromagnetic Interference
Electronic Access Control Systems Access Tokens
Chapter 8 Review
Chapter 9 Network Fundamentals Network Architectures Network Topology Network Protocols
Internet Protocol IP Packets TCP vs. UDP ICMP
IPv4 vs. IPv6 Packet Delivery
Ethernet Local Packet Delivery Remote Packet Delivery IP Addresses and Subnetting Network Address Translation
Security Zones DMZ Internet Intranet Extranet Flat Networks
Enclaves VLANs Zones and Conduits
Tunneling Storage Area Networks
iSCSI Fibre Channel FCoE
Chapter 9 Review
Chapter 10 Infrastructure Security Devices
Workstations Servers Virtualization Mobile Devices Device Security, Common Concerns Network Attached Storage Removable Storage
Networking Network Interface Cards Hubs Bridges Switches Routers Firewalls How Do Firewalls Work? Next-Generation Firewalls Web Application Firewalls vs. Network Firewalls Concentrators
Wireless Devices Modems Telephony VPN Concentrator
Security Devices Intrusion Detection Systems Network Access Control Network Monitoring/Diagnostic Load Balancers Proxies Web Security Gateways Internet Content Filters Data Loss Prevention Unified Threat Management
Media Coaxial Cable UTP/STP Fiber Unguided Media
Removable Media Magnetic Media Optical Media Electronic Media
Security Concerns for Transmission Media Physical Security Concerns Cloud Computing
Private Public Hybrid Community Software as a Service
Platform as a Service Infrastructure as a Service
Chapter 10 Review
Chapter 11 Authentication and Remote Access User, Group, and Role Management
User Group Role
Password Policies Domain Password Policy
Single Sign-On Time of Day Restrictions Tokens Account and Password Expiration
Security Controls and Permissions Access Control Lists Mandatory Access Control (MAC) Discretionary Access Control (DAC) Role-Based Access Control (RBAC) Rule-Based Access Control Attribute Based Access Control (ABAC) Account Expiration
Preventing Data Loss or Theft The Remote Access Process
Identification Authentication Authorization Access Control
Remote Access Methods
IEEE 802.1X RADIUS TACACS+ Authentication Protocols FTP/FTPS/SFTP VPNs IPsec Vulnerabilities of Remote Access Methods
Connection Summary Chapter 11 Review
Chapter 12 Wireless Security and Mobile Devices Introduction to Wireless Networking Mobile Phones
Wireless Application Protocol 3G Mobile Networks 4G Mobile Networks
Bluetooth Bluetooth Attacks
Near Field Communication IEEE 802.11 Series
802.11: Individual Standards Attacking 802.11 Current Security Methods
Wireless Systems Configuration Antenna Types Antenna Placement Power Level Controls Site Surveys Captive Portals
Securing Public Wi-Fi Mobile Devices
Mobile Device Security BYOD Concerns Location Services Mobile Application Security
Chapter 12 Review
Chapter 13 Intrusion Detection Systems and Network Security History of Intrusion Detection Systems IDS Overview
IDS Models Signatures False Positives and False Negatives
Network-Based IDSs Advantages of a NIDS Disadvantages of a NIDS Active vs. Passive NIDSs NIDS Tools
Host-Based IDSs Advantages of HIDSs Disadvantages of HIDSs Active vs. Passive HIDSs Resurgence and Advancement of HIDSs
Intrusion Prevention Systems Honeypots and Honeynets Tools
Protocol Analyzer Switched Port Analyzer Port Scanner
Passive vs. Active Tools Banner Grabbing
Chapter 13 Review
Chapter 14 System Hardening and Baselines Overview of Baselines Operating System and Network Operating System Hardening
OS Security Host Security
Machine Hardening Operating System Security and Settings OS Hardening Hardening Microsoft Operating Systems Hardening UNIX- or Linux-Based Operating Systems Updates (a.k.a. Hotfixes, Service Packs, and Patches) Antimalware White Listing vs. Black Listing Applications Trusted OS Host-based Firewalls Hardware Security Host Software Baselining
Host-Based Security Controls Hardware-Based Encryption Devices Data Encryption Data Security Handling Big Data Cloud Storage Storage Area Network Permissions/ACL