Security Engineering by
Now that there''s software in everything, how can you make anything secure? Understand how to engineer dependable systems with this newly updated classic In Security Engineering: A Guide to Building Dependable Distributed Systems, Third Edition Cambridge University professor Ross Anderson updates his classic textbook and teaches readers how to design, implement, and test systems to withstand both error and attack. This book became a best-seller in 2001 and helped establish the discipline of security engineering. By the second edition in 2008, underground dark markets had let the bad guys specialize and scale up; attacks were increasingly on users rather than on technology. The book repeated its success by showing how security engineers can focus on usability. Now the third edition brings it up to date for 2020. As people now go online from phones more than laptops, most servers are in the cloud, online advertising drives the Internet and social networks have taken over much human interaction, many patterns of crime and abuse are the same, but the methods have evolved. Ross Anderson explores what security engineering means in 2020, including: How the basic elements of cryptography, protocols, and access control translate to the new world of phones, cloud services, social media and the Internet of Things Who the attackers are - from nation states and business competitors through criminal gangs to stalkers and playground bullies What they do - from phishing and carding through SIM swapping and software exploits to DDoS and fake news Security psychology, from privacy through ease-of-use to deception The economics of security and dependability - why companies build vulnerable systems and governments look the other way How dozens of industries went online - well or badly How to manage security and safety engineering in a world of agile development - from reliability engineering to DevSecOps The third edition of Security Engineering ends with a grand challenge: sustainable security. As we build ever more software and connectivity into safety-critical durable goods like cars and medical devices, how do we design systems we can maintain and defend for decades? Or will everything in the world need monthly software upgrades, and become unsafe once they stop?
CEH: Certified Ethical Hacker Version 8 Study Guide by
Prepare for the new Certified Ethical Hacker version 8 exam with this Sybex guide Security professionals remain in high demand. The Certified Ethical Hacker is a one-of-a-kind certification designed to give the candidate a look inside the mind of a hacker. This study guide provides a concise, easy-to-follow approach that covers all of the exam objectives and includes numerous examples and hands-on exercises. Coverage includes cryptography, footprinting and reconnaissance, scanning networks, enumeration of services, gaining access to a system, Trojans, viruses, worms, covert channels, and much more. A companion website includes additional study tools, Including practice exam and chapter review questions and electronic flashcards. Security remains the fastest growing segment of IT, and CEH certification provides unique skills The CEH also satisfies the Department of Defense's 8570 Directive, which requires all Information Assurance government positions to hold one of the approved certifications This Sybex study guide is perfect for candidates studying on their own as well as those who are taking the CEHv8 course Covers all the exam objectives with an easy-to-follow approach Companion website includes practice exam questions, flashcards, and a searchable Glossary of key terms CEHv8: Certified Ethical Hacker Version 8 Study Guide is the book you need when you're ready to tackle this challenging exam Also available as a set, Ethical Hacking and Web Hacking Set, 9781119072171 with The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws, 2nd Edition.
Students will have access to the following items of software:
Xen Project Hypervisor
Windows Apache MySQL PHP and Linux Apache MySQL PHP servers
Python
IE Browser Extensions: HttpWatch, IEWatch, TamperIE
Firefox Browser Extensions: HttpWatch, FoxyProxy, LiveHttpHeaders, PrefBar, Wappalyzer, TamperData
Vulnerability Scanners - w3af, Paros, BurpSuite
The Incremental Commitment Spiral Model by
"The title makes a huge promise: a way to divide commitment into increments that are both meetable (good news for developers) and meaningful (good news for managers and stakeholders). And the book makes good on that promise." -Tom DeMarco, Principal, The Atlantic Systems Guild, author of Peopleware, Deadline, and Slack nbsp; "I am seriously impressed with this ICSM book. Besides being conceptually sound, I was amazed by the sheer number of clear and concise characterizations of issues, relationships, and solutions. I wanted to take a yellow highlighter to it until I realized I'd be highlighting most of the book." -Curt Hibbs, Chief Agile Evangelist, Boeing nbsp; Use the ICSM to Generate and Evolve Your Life-Cycle Process Assets to Best Fit Your Organization's Diverse and Changing Needs nbsp; Many systems development practitioners find traditional "one-size-fits-all" processes inadequate for the growing complexity, diversity, dynamism, and assurance needs of their products and services. The Incremental Commitment Spiral Model (ICSM) responds with a principle- and risk-based framework for defining and evolving your project and corporate process assets, avoiding pitfalls and disruption, and leveraging opportunities to increase value. nbsp; This book explains ICSM's framework of decision criteria and principles, and shows how to apply them through relevant examples. It demonstrates ICSM's potential for reducing rework and technical debt, improving maintainability, handling emergent requirements, and raising assurance levels. nbsp; Its coverage includes What makes a system development successful ICSM's goals, principles, and usage as a process-generation framework Creating and evolving processes to match your risks and opportunities Integrating your current practices and adopting ICSM concepts incrementally, focusing on your greatest needs and opportunities nbsp; About the Website: Download the evolving ICSM guidelines, subprocesses, templates, tools, white papers, and academic support resources atcsse.usc.edu/ICSM. nbsp;
The Mobile Application Hacker's Handbook by
See your app through a hacker's eyes to find the real sources of vulnerability
The Mobile Application Hacker's Handbook is a comprehensive guide to securing all mobile applications by approaching the issue from a hacker's point of view. Heavily practical, this book provides expert guidance toward discovering and exploiting flaws in mobile applications on the iOS, Android, Blackberry, and Windows Phone platforms. You will learn a proven methodology for approaching mobile application assessments, and the techniques used to prevent, disrupt, and remediate the various types of attacks. Coverage includes data storage, cryptography, transport layers, data leakage, injection attacks, runtime manipulation, security controls, and cross-platform apps, with vulnerabilities highlighted and detailed information on the methods hackers use to get around standard security.
Mobile applications are widely used in the consumer and enterprise markets to process and/or store sensitive data. There is currently little published on the topic of mobile security, but with over a million apps in the Apple App Store alone, the attack surface is significant. This book helps you secure mobile apps by demonstrating the ways in which hackers exploit weak points and flaws to gain access to data.
Understand the ways data can be stored, and how cryptography is defeated
Set up an environment for identifying insecurities and the data leakages that arise
Develop extensions to bypass security controls and perform injection attacks
Learn the different attacks that apply specifically to cross-platform apps
IT security breaches have made big headlines, with millions of consumers vulnerable as major corporations come under attack. Learning the tricks of the hacker's trade allows security professionals to lock the app up tight. For better mobile security and less vulnerable data, The Mobile Application Hacker's Handbook is a practical, comprehensive guide.
Information Warfare and Security by
This is a comprehensive and detailed view of information warfare. It presents methods, laws, and case examples stressing actual incidents to illustrate such instances. What individuals, corporations, and governments need to know about information-related attacks and defenses Every day, we hear reports of hackers who have penetrated computer networks, vandalized Web pages, and accessed sensitive information. We hear how they have tampered with medical records, disrupted emergency 911 systems, and siphoned money from bank accounts. Could information terrorists, using nothing more than a personal computer, cause planes to crash, widespread power blackouts, or financial chaos? Such real and imaginary scenarios, and our defense against them, are the stuff of information warfare-operations that target or exploit information media to win some objective over an adversary. Dorothy E. Denning, a pioneer in computer security, provides in this book a framework for understanding and dealing with information-based threats: computer break-ins, fraud, sabotage, espionage, piracy, identity theft, invasions of privacy, and electronic warfare. She describes these attacks with astonishing, real examples, as in her analysis of information warfare operations during the Gulf War. Then, offering sound advice for security practices and policies, she explains countermeasures that are both possible and necessary.
Managing Complex Systems by
Nine innovative methods to think outside the box and solve complexsystem problems Managing Complex Systems provides specific tools and guidanceneeded to be a more creative and innovative thinker. Following theauthor's methodology, the reader will be better able to devise andimplement nontraditional solutions to seemingly intractable complexproblems. By challenging the reader to think in new and creativeways, the book offers a road map to success, whether measured interms of competitive advantage, greater market share, improvedproductivity, or higher profits, all based upon better solutions todifficult problems. The first four chapters set the foundation for creative thinking byexploring the nature of large-scale systems and complexity,thinking inside and outside the box, and examples of how aninventive mind solves problems in both management and scientificdomains. Subsequent chapters address nine focused methods that theauthor has formulated to help the reader think outside thebox: * Broaden and generalize * Crossover * Question conventional wisdom * Back of the envelope * Expanding the dimensions * Obversity * Remove constraints * Thinking with pictures * Systems approach Real-life examples are provided for each method that demonstratehow the approach enhances problem solving and decision making insystem development and management. Following the discussion of thenine methods, the author examines group decision making as well asadditional creative thinking procedures devised by otherresearchers, including references that assist in exploring thesemethods in greater detail. The author ends with a wrap-up chapterthat includes a test to help readers practice their tendenciestoward creative thinking skills and action with respect to solvingreal-world problems. The nine methods discussed in this book have broad applicabilityand can be used successfully by managers with a wide range ofresponsibilities in business and technology. For anyone who istired of the same old approach with the same old results, this bookis essential reading.
The Art of Deception by
The world's most infamous hacker offers an insider's view of thelow-tech threats to high-tech security Kevin Mitnick's exploits as a cyber-desperado and fugitive form oneof the most exhaustive FBI manhunts in history and have spawneddozens of articles, books, films, and documentaries. Since hisrelease from federal prison, in 1998, Mitnick has turned his lifearound and established himself as one of the most sought-aftercomputer security experts worldwide. Now, in The Art of Deception,the world's most notorious hacker gives new meaning to the oldadage, "It takes a thief to catch a thief." Focusing on the human factors involved with information security,Mitnick explains why all the firewalls and encryption protocols inthe world will never be enough to stop a savvy grifter intent onrifling a corporate database or an irate employee determined tocrash a system. With the help of many fascinating true stories ofsuccessful attacks on business and government, he illustrates justhow susceptible even the most locked-down information systems areto a slick con artist impersonating an IRS agent. Narrating fromthe points of view of both the attacker and the victims, heexplains why each attack was so successful and how it could havebeen prevented in an engaging and highly readable style reminiscentof a true-crime novel. And, perhaps most importantly, Mitnickoffers advice for preventing these types of social engineeringhacks through security protocols, training programs, and manualsthat address the human element of security.
Security in Computing by
This book offers complete coverage of all aspects of computer security, including users, software, devices, operating systems, networks, law, and ethics. Reflecting rapidly evolving attacks, countermeasures, and computing environments, it introduces up-to-the-minute best practices for authenticating users, preventing malicious code execution, using encryption, protecting privacy, implementing firewalls, detecting intrusions, and more.
Cybersecurity and Cyberwar by
Dependence on computers has had a transformative effect on human society. Cybernetics is now woven into the core functions of virtually every basic institution, including our oldest ones. War is one such institution, and the digital revolution's impact on it has been profound. The Americanmilitary, which has no peer, is almost completely reliant on high-tech computer systems. Given the Internet's potential for full-spectrum surveillance and information disruption, the marshaling of computer networks represents the next stage of cyberwar. Indeed, it is upon us already. The recentStuxnet episode, in which Israel fed a malignant computer virus into Iran's nuclear facilities, is one such example. Penetration into US government computer systems by Chinese hackers - presumably sponsored by the Chinese government - is another. Together, they point to a new era in the evolution ofhuman conflict. In Cybersecurity and Cyberwar: What Everyone Needs to Know, noted experts Peter W. Singer and Allan Friedman lay out how the revolution in military cybernetics occurred and explain where it is headed. They begin with an explanation of what cyberspace is before moving on to discussions of how it canbe exploited and why it is so hard to defend. Throughout, they discuss the latest developments in military and security technology. Singer and Friedman close with a discussion of how people and governments can protect themselves. In sum, Cybersecurity and Cyberwar is the definitive account on thesubject for the educated layman who wants to know more about the nature of war, conflict, and security in the twenty first century.
Network Security Essentials by
For courses in Corporate, Computer and Network Security . Network Security: Innovations and Improvements Network Securities Essentials: Applications and Standards introduces readers to the critical importance of internet security in our age of universal electronic connectivity. Amidst viruses, hackers, and electronic fraud, organizations and individuals are constantly at risk of having their private information compromised. This creates a heightened need to protect data and resources from disclosure, guarantee their authenticity, and safeguard systems from network-based attacks. The Sixth Edition covers the expanding developments in the cryptography and network security disciplines, giving readers a practical survey of applications and standards. The text places emphasis on applications widely used for Internet and corporate networks, as well as extensively deployed internet standards.
The Web Application Hacker's Handbook by
The highly successful security book returns with a new edition, completely updated Web applications are the front door to most organizations, exposing them to attacks that may disclose personal information, execute fraudulent transactions, or compromise ordinary users. This practical book has been completely updated and revised to discuss the latest step-by-step techniques for attacking and defending the range of ever-evolving web applications. You'll explore the various new technologies employed in web applications that have appeared since the first edition and review the new attack techniques that have been developed, particularly in relation to the client side. Reveals how to overcome the new technologies and techniques aimed at defending web applications against attacks that have appeared since the previous edition Discusses new remoting frameworks, HTML5, cross-domain integration techniques, UI redress, framebusting, HTTP parameter pollution, hybrid file attacks, and more Features a companion web site hosted by the authors that allows readers to try out the attacks described, gives answers to the questions that are posed at the end of each chapter, and provides a summarized methodology and checklist of tasks Focusing on the areas of web application security where things have changed in recent years, this book is the most current resource on the critical topic of discovering, exploiting, and preventing web application security flaws. Also available as a set with, CEHv8: Certified Hacker Version 8 Study Guide, Ethical Hacking and Web Hacking Set, 9781119072171.
Penetration Testing by
Penetration testers simulate cyber attacks to find security weaknesses in networks, operating systems, and applications. Information security experts worldwide use penetration techniques to evaluate enterprise defenses. In Penetration Testing, security expert, researcher, and trainer Georgia Weidman introduces you to the core skills and techniques that every pentester needs. Using a virtual machine-based lab that includes Kali Linux and vulnerable operating systems, you'll run through a series of practical lessons with tools like Wireshark, Nmap, and Burp Suite. As you follow along with the labs and launch attacks, you'll experience the key stages of an actual assessment - including information gathering, finding exploitable vulnerabilities, gaining access to systems, post exploitation, and more. Learn how to: Crack passwords and wireless network keys with brute-forcing and wordlists Test web applications for vulnerabilities Use the Metasploit Framework to launch exploits and write your own Metasploit modules Automate social-engineering attacks Bypass antivirus software Turn access to one machine into total control of the enterprise in the post exploitation phase You'll even explore writing your own exploits. Then it's on to mobile hacking - Weidman's particular area of research - with her tool, the Smartphone Pentest Framework. With its collection of hands-on lessons that cover key tools and strategies, Penetration Testing is the introduction that every aspiring hacker needs.
