Security Engineering by
Now that there''s software in everything, how can you make anything secure? Understand how to engineer dependable systems with this newly updated classic In Security Engineering: A Guide to Building Dependable Distributed Systems, Third Edition Cambridge University professor Ross Anderson updates his classic textbook and teaches readers how to design, implement, and test systems to withstand both error and attack. This book became a best-seller in 2001 and helped establish the discipline of security engineering. By the second edition in 2008, underground dark markets had let the bad guys specialize and scale up; attacks were increasingly on users rather than on technology. The book repeated its success by showing how security engineers can focus on usability. Now the third edition brings it up to date for 2020. As people now go online from phones more than laptops, most servers are in the cloud, online advertising drives the Internet and social networks have taken over much human interaction, many patterns of crime and abuse are the same, but the methods have evolved. Ross Anderson explores what security engineering means in 2020, including: How the basic elements of cryptography, protocols, and access control translate to the new world of phones, cloud services, social media and the Internet of Things Who the attackers are - from nation states and business competitors through criminal gangs to stalkers and playground bullies What they do - from phishing and carding through SIM swapping and software exploits to DDoS and fake news Security psychology, from privacy through ease-of-use to deception The economics of security and dependability - why companies build vulnerable systems and governments look the other way How dozens of industries went online - well or badly How to manage security and safety engineering in a world of agile development - from reliability engineering to DevSecOps The third edition of Security Engineering ends with a grand challenge: sustainable security. As we build ever more software and connectivity into safety-critical durable goods like cars and medical devices, how do we design systems we can maintain and defend for decades? Or will everything in the world need monthly software upgrades, and become unsafe once they stop?
CCNA Security 640-554 Official Cert Guide. by 
The Incremental Commitment Spiral Model by
"The title makes a huge promise: a way to divide commitment into increments that are both meetable (good news for developers) and meaningful (good news for managers and stakeholders). And the book makes good on that promise." -Tom DeMarco, Principal, The Atlantic Systems Guild, author of Peopleware, Deadline, and Slack nbsp; "I am seriously impressed with this ICSM book. Besides being conceptually sound, I was amazed by the sheer number of clear and concise characterizations of issues, relationships, and solutions. I wanted to take a yellow highlighter to it until I realized I'd be highlighting most of the book." -Curt Hibbs, Chief Agile Evangelist, Boeing nbsp; Use the ICSM to Generate and Evolve Your Life-Cycle Process Assets to Best Fit Your Organization's Diverse and Changing Needs nbsp; Many systems development practitioners find traditional "one-size-fits-all" processes inadequate for the growing complexity, diversity, dynamism, and assurance needs of their products and services. The Incremental Commitment Spiral Model (ICSM) responds with a principle- and risk-based framework for defining and evolving your project and corporate process assets, avoiding pitfalls and disruption, and leveraging opportunities to increase value. nbsp; This book explains ICSM's framework of decision criteria and principles, and shows how to apply them through relevant examples. It demonstrates ICSM's potential for reducing rework and technical debt, improving maintainability, handling emergent requirements, and raising assurance levels. nbsp; Its coverage includes What makes a system development successful ICSM's goals, principles, and usage as a process-generation framework Creating and evolving processes to match your risks and opportunities Integrating your current practices and adopting ICSM concepts incrementally, focusing on your greatest needs and opportunities nbsp; About the Website: Download the evolving ICSM guidelines, subprocesses, templates, tools, white papers, and academic support resources atcsse.usc.edu/ICSM. nbsp;
The Mobile Application Hacker's Handbook by
See your app through a hacker's eyes to find the real sources of vulnerability The Mobile Application Hacker's Handbook is a comprehensive guide to securing all mobile applications by approaching the issue from a hacker's point of view. Heavily practical, this book provides expert guidance toward discovering and exploiting flaws in mobile applications on the iOS, Android, Blackberry, and Windows Phone platforms. You will learn a proven methodology for approaching mobile application assessments, and the techniques used to prevent, disrupt, and remediate the various types of attacks. Coverage includes data storage, cryptography, transport layers, data leakage, injection attacks, runtime manipulation, security controls, and cross-platform apps, with vulnerabilities highlighted and detailed information on the methods hackers use to get around standard security. Mobile applications are widely used in the consumer and enterprise markets to process and/or store sensitive data. There is currently little published on the topic of mobile security, but with over a million apps in the Apple App Store alone, the attack surface is significant. This book helps you secure mobile apps by demonstrating the ways in which hackers exploit weak points and flaws to gain access to data. Understand the ways data can be stored, and how cryptography is defeated Set up an environment for identifying insecurities and the data leakages that arise Develop extensions to bypass security controls and perform injection attacks Learn the different attacks that apply specifically to cross-platform apps IT security breaches have made big headlines, with millions of consumers vulnerable as major corporations come under attack. Learning the tricks of the hacker's trade allows security professionals to lock the app up tight. For better mobile security and less vulnerable data, The Mobile Application Hacker's Handbook is a practical, comprehensive guide.
Information Warfare and Security by
This is a comprehensive and detailed view of information warfare. It presents methods, laws, and case examples stressing actual incidents to illustrate such instances. What individuals, corporations, and governments need to know about information-related attacks and defenses Every day, we hear reports of hackers who have penetrated computer networks, vandalized Web pages, and accessed sensitive information. We hear how they have tampered with medical records, disrupted emergency 911 systems, and siphoned money from bank accounts. Could information terrorists, using nothing more than a personal computer, cause planes to crash, widespread power blackouts, or financial chaos? Such real and imaginary scenarios, and our defense against them, are the stuff of information warfare-operations that target or exploit information media to win some objective over an adversary. Dorothy E. Denning, a pioneer in computer security, provides in this book a framework for understanding and dealing with information-based threats: computer break-ins, fraud, sabotage, espionage, piracy, identity theft, invasions of privacy, and electronic warfare. She describes these attacks with astonishing, real examples, as in her analysis of information warfare operations during the Gulf War. Then, offering sound advice for security practices and policies, she explains countermeasures that are both possible and necessary.
Managing Complex Systems by
Nine innovative methods to think outside the box and solve complex system problems Managing Complex Systems provides specific tools and guidance needed to be a more creative and innovative thinker. Following the author's methodology, the reader will be better able to devise and implement nontraditional solutions to seemingly intractable complex problems. By challenging the reader to think in new and creative ways, the book offers a road map to success, whether measured in terms of competitive advantage, greater market share, improved productivity, or higher profits, all based upon better solutions to difficult problems. The first four chapters set the foundation for creative thinking by exploring the nature of large-scale systems and complexity, thinking inside and outside the box, and examples of how an inventive mind solves problems in both management and scientific domains. Subsequent chapters address nine focused methods that the author has formulated to help the reader think outside the box: * Broaden and generalize * Crossover * Question conventional wisdom * Back of the envelope * Expanding the dimensions * Obversity * Remove constraints * Thinking with pictures * Systems approach Real-life examples are provided for each method that demonstrate how the approach enhances problem solving and decision making in system development and management. Following the discussion of the nine methods, the author examines group decision making as well as additional creative thinking procedures devised by other researchers, including references that assist in exploring these methods in greater detail. The author ends with a wrap-up chapter that includes a test to help readers practice their tendencies toward creative thinking skills and action with respect to solving real-world problems. The nine methods discussed in this book have broad applicability and can be used successfully by managers with a wide range of responsibilities in business and technology. For anyone who is tired of the same old approach with the same old results, this book is essential reading.
The Art of Deception by
The world's most infamous hacker offers an insider's view of the low-tech threats to high-tech security Kevin Mitnick's exploits as a cyber-desperado and fugitive form one of the most exhaustive FBI manhunts in history and have spawned dozens of articles, books, films, and documentaries. Since his release from federal prison, in 1998, Mitnick has turned his life around and established himself as one of the most sought-after computer security experts worldwide. Now, in The Art of Deception, the world's most notorious hacker gives new meaning to the old adage, "It takes a thief to catch a thief." Focusing on the human factors involved with information security, Mitnick explains why all the firewalls and encryption protocols in the world will never be enough to stop a savvy grifter intent on rifling a corporate database or an irate employee determined to crash a system. With the help of many fascinating true stories of successful attacks on business and government, he illustrates just how susceptible even the most locked-down information systems are to a slick con artist impersonating an IRS agent. Narrating from the points of view of both the attacker and the victims, he explains why each attack was so successful and how it could have been prevented in an engaging and highly readable style reminiscent of a true-crime novel. And, perhaps most importantly, Mitnick offers advice for preventing these types of social engineering hacks through security protocols, training programs, and manuals that address the human element of security.
CEH: Certified Ethical Hacker Version 8 Study Guide by
Prepare for the new Certified Ethical Hacker version 8 exam with this Sybex guide Security professionals remain in high demand. The Certified Ethical Hacker is a one-of-a-kind certification designed to give the candidate a look inside the mind of a hacker. This study guide provides a concise, easy-to-follow approach that covers all of the exam objectives and includes numerous examples and hands-on exercises. Coverage includes cryptography, footprinting and reconnaissance, scanning networks, enumeration of services, gaining access to a system, Trojans, viruses, worms, covert channels, and much more. A companion website includes additional study tools, Including practice exam and chapter review questions and electronic flashcards. Security remains the fastest growing segment of IT, and CEH certification provides unique skills The CEH also satisfies the Department of Defense's 8570 Directive, which requires all Information Assurance government positions to hold one of the approved certifications This Sybex study guide is perfect for candidates studying on their own as well as those who are taking the CEHv8 course Covers all the exam objectives with an easy-to-follow approach Companion website includes practice exam questions, flashcards, and a searchable Glossary of key terms CEHv8: Certified Ethical Hacker Version 8 Study Guide is the book you need when you're ready to tackle this challenging exam Also available as a set, Ethical Hacking and Web Hacking Set, 9781119072171 with The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws, 2nd Edition.
Security in Computing by
The New State of the Art in Information Security: Now Covers Cloud Computing, the Internet of Things, and Cyberwarfare Students and IT and security professionals have long relied on Security in Computing as the definitive guide to computer security attacks and countermeasures. Now, the authors have thoroughly updated this classic to reflect today's newest technologies, attacks, standards, and trends. Security in Computing, Fifth Edition, offers complete, timely coverage of all aspects of computer security, including users, software, devices, operating systems, networks, and data. Reflecting rapidly evolving attacks, countermeasures, and computing environments, this new edition introduces best practices for authenticating users, preventing malicious code execution, using encryption, protecting privacy, implementing firewalls, detecting intrusions, and more. More than two hundred end-of-chapter exercises help the student to solidify lessons learned in each chapter. Combining breadth, depth, and exceptional clarity, this comprehensive guide builds carefully from simple to complex topics, so you always understand all you need to know before you move forward. You'll start by mastering the field's basic terms, principles, and concepts. Next, you'll apply these basics in diverse situations and environments, learning to "think like an attacker" and identify exploitable weaknesses. Then you will switch to defense, selecting the best available solutions and countermeasures. Finally, you'll go beyond technology to understand crucial management issues in protecting infrastructure and data. New coverage includes A full chapter on securing cloud environments and managing their unique risks Extensive new coverage of security issues associated with user--web interaction New risks and techniques for safeguarding the Internet of Things A new primer on threats to privacy and how to guard it An assessment of computers and cyberwarfare-recent attacks and emerging risks Security flaws and risks associated with electronic voting systems
Cybersecurity and Cyberwar by
Dependence on computers has had a transformative effect on human society. Cybernetics is now woven into the core functions of virtually every basic institution, including our oldest ones. War is one such institution, and the digital revolution's impact on it has been profound. The Americanmilitary, which has no peer, is almost completely reliant on high-tech computer systems.Given the Internet's potential for full-spectrum surveillance and information disruption, the marshaling of computer networks represents the next stage of cyberwar. Indeed, it is upon us already. The recent Stuxnet episode, in which Israel fed a malignant computer virus into Iran's nuclearfacilities, is one such example. Penetration into US government computer systems by Chinese hackers-presumably sponsored by the Chinese government-is another. Together, they point to a new era in the evolution of human conflict.In Cybersecurity and Cyberwar: What Everyone Needs to Know, noted experts Peter W. Singer and Allan Friedman lay out how the revolution in military cybernetics occurred and explain where it is headed. They begin with an explanation of what cyberspace is before moving on to discussions of how it canbe exploited and why it is so hard to defend. Throughout, they discuss the latest developments in military and security technology. Singer and Friedman close with a discussion of how people and governments can protect themselves. In sum, Cybersecurity and Cyberwar is the definitive account on thesubject for the educated layman who wants to know more about the nature of war, conflict, and security in the twenty first century.
Network Security Essentials by
For courses in Corporate, Computer and Network Security . Network Security: Innovations and Improvements Network Securities Essentials: Applications and Standards introduces readers to the critical importance of internet security in our age of universal electronic connectivity. Amidst viruses, hackers, and electronic fraud, organizations and individuals are constantly at risk of having their private information compromised. This creates a heightened need to protect data and resources from disclosure, guarantee their authenticity, and safeguard systems from network-based attacks. The Sixth Edition covers the expanding developments in the cryptography and network security disciplines, giving readers a practical survey of applications and standards. The text places emphasis on applications widely used for Internet and corporate networks, as well as extensively deployed internet standards.
The Web Application Hacker's Handbook by
The highly successful security book returns with a new edition, completely updated Web applications are the front door to most organizations, exposing them to attacks that may disclose personal information, execute fraudulent transactions, or compromise ordinary users. This practical book has been completely updated and revised to discuss the latest step-by-step techniques for attacking and defending the range of ever-evolving web applications. You'll explore the various new technologies employed in web applications that have appeared since the first edition and review the new attack techniques that have been developed, particularly in relation to the client side. Reveals how to overcome the new technologies and techniques aimed at defending web applications against attacks that have appeared since the previous edition Discusses new remoting frameworks, HTML5, cross-domain integration techniques, UI redress, framebusting, HTTP parameter pollution, hybrid file attacks, and more Features a companion web site hosted by the authors that allows readers to try out the attacks described, gives answers to the questions that are posed at the end of each chapter, and provides a summarized methodology and checklist of tasks Focusing on the areas of web application security where things have changed in recent years, this book is the most current resource on the critical topic of discovering, exploiting, and preventing web application security flaws.
Penetration Testing by
Penetration testers simulate cyber attacks to find security weaknesses in networks, operating systems, and applications. Information security experts worldwide use penetration techniques to evaluate enterprise defenses. In Penetration Testing, security expert, researcher, and trainer Georgia Weidman introduces you to the core skills and techniques that every pentester needs. Using a virtual machine based lab that includes Kali Linux and vulnerable operating systems, you ll run through a series of practical lessons with tools like Wireshark, Nmap, and Burp Suite. As you follow along with the labs and launch attacks, you ll experience the key stages of an actual assessment including information gathering, finding exploitable vulnerabilities, gaining access to systems, post exploitation, and more. Learn how to: Crack passwords and wireless network keys with brute-forcing and wordlists Test web applications for vulnerabilities Use the Metasploit Framework to launch exploits and write y
Students will have access to the following items of software:
Xen Project Hypervisor
Windows Apache MySQL PHP and Linux Apache MySQL PHP servers
Python
IE Browser Extensions: HttpWatch, IEWatch, TamperIE
Firefox Browser Extensions: HttpWatch, FoxyProxy, LiveHttpHeaders, PrefBar, Wappalyzer, TamperData
Vulnerability Scanners - w3af, Paros, BurpSuite
