Computer system security : basic concepts and solved exercises

Computer System Security: Basic Concepts and Solved Exercises is designed to expose students and others to the basic aspects of computer security. Written by leading experts and instructors, it covers e-mail security; viruses and antivirus programs; program and network vulnerabilities; firewalls, address translation and filtering; cryptography; secure communications; secure applications; and security management. Written as an accompanying text for courses on network protocols, it also provides a basic tutorial for those whose livelihood is dependent upon secure systems. The solved exercises included have been taken from courses taught in the Communication Systems department at the EPFL.
.

Author Notes

Gildas Avoine is postdoctoral researcher at the Massachusetts Institute of Technology
Philippe Oechslin has worked in research at Bell Labs and at the University College of London

Foreword	p. xi
Chapter 1 Forged E-Mail and Spam	p. 1
1.1 Forging E-Mail Headers	p. 1
1.2 Spamming	p. 3
1.3 Notes	p. 7
Exercises	p. 8
1 Forged E-Mail	p. 8
2 Web Mail Services and Anonymity	p. 8
3 Information Disclosure	p. 8
4 Spam and Open Relays	p. 8
5 SMTP Servers that Allow Relaying	p. 9
6 Anonymous Mails	p. 9
7 Rules to Avoid Open Relay	p. 10
8 Anti-Spam Software	p. 10
9 Prevention against Spam	p. 10
Solutions	p. 11
Chapter 2 Malwares	p. 19
2.1 Description and Classification	p. 19
2.2 Protection	p. 28
2.3 Notes	p. 31
Exercises	p. 32
10 Viruses and Worms	p. 32
11 Backdoors and Trojan Horses	p. 32
12 Undetectable Viruses	p. 33
13 Virus with an Encrypted Attached File	p. 33
14 BIOS Virus	p. 33
15 Analysis of a Malware	p. 34
16 Virus Detection	p. 35
17 Antivirus Software	p. 35
18 Filtering Attached Files	p. 36
19 Restoring the System after Infection	p. 36
Solutions	p. 37
Chapter 3 Network and Application Vulnerabilities	p. 43
3.1 TCP/IP Basics	p. 43
3.2 Denial of Service	p. 46
3.3 IP Spoofing	p. 51
3.4 Session Hijacking	p. 53
3.5 Sniffing	p. 55
3.6 Exploits	p. 56
3.7 Notes	p. 60
Exercises	p. 61
20 Denial of Service Attack	p. 61
21 Kevin Mitnick's Attack	p. 61
22 IP Spoofing	p. 63
23 TCP Hijacking	p. 64
24 Network Traffic Analysis	p. 65
25 ARP/DNS Spoofing	p. 66
26 DHCP Vulnerabilities	p. 68
27 Reminder on C Pointers	p. 69
28 Address Modification in the Stack	p. 69
29 Exploit on a Program in C	p. 70
30 Vulnerabilities of CGI Scripts	p. 71
31 SQL Injection	p. 72
Solutions	p. 73
Chapter 4 Firewalls and Proxies	p. 85
4.1 Firewalls	p. 85
4.2 Proxies	p. 103
4.3 Notes	p. 111
Exercises	p. 112
32 Basic Principles for Configuring a Firewall	p. 112
33 Filtering Rules for a Stateless Firewall	p. 112
34 Filtering Rules for a Stateless Firewall (2)	p. 112
35 Filtering Rules for a Stateful Firewall	p. 113
36 Vulnerabilities of a Stateless Firewall	p. 113
37 Network Address Translation	p. 114
38 E-mail Headers	p. 114
39 Maximum Number of TCP Connections	p. 115
40 Peer-to-Peer	p. 115
41 FTP Client using NAT	p. 115
42 FTP Server using NAT	p. 115
43 Fool of Addresses	p. 115
44 Connection Authentication	p. 116
45 HTTPS Proxies' Security	p. 116
46 FTP Proxy	p. 116
47 Transparent Proxy	p. 117
48 Proxy Circumvention	p. 117
49 Intrusion Detection	p. 118
50 Intrusion Detection System and Proxy	p. 119
51 Wild Modems	p. 119
52 Network Security Assessment	p. 119
53 Startup SAs Network Security	p. 127
Solutions	p. 129
Chapter 5 Cryptography	p. 147
5.1 Main Goals of Cryptography	p. 147
5.2 Symmetric-Key Cryptography	p. 148
5.3 Asymmetric Cryptography	p. 150
5.4 Cryptanalysis	p. 153
5.5 Notes	p. 154
Exercises	p. 156
54 Kerckhoffs' Principles	p. 156
55 Security Objectives	p. 156
56 RSA Algorithm	p. 156
57 Decryption of an Encrypted Message Using RSA	p. 157
58 RSA Vulnerabilities	p. 157
59 Exhaustive Search for Symmetric Keys	p. 157
60 Exhaustive Search for Asymmetric Keys	p. 158
61 Hash Functions and the Birthday Paradox	p. 158
62 Symmetric Encryption Modes	p. 158
63 Symmetric and Asymmetric Encryption	p. 160
64 Loss of a Private Key	p. 160
65 Certificates	p. 161
Solutions	p. 162
Chapter 6 Secure Communications	p. 169
6.1 Virtual Private Networks	p. 169
6.2 Transport Layer Security	p. 175
6.3 Secure Shell	p. 177
6.4 Notes	p. 178
Exercises	p. 179
66 L2TP	p. 179
67 IPSec	p. 180
68 L2TP and IPSec	p. 180
69 IPSec Between Intermediate Routers	p. 180
70 IPSec and NAT	p. 181
71 IKE	p. 181
72 IKE's Main Mode and Aggressive Mode	p. 181
73 SSH and VPN	p. 182
74 Use of SSH	p. 183
75 Authentication Without Passwords Using SSH	p. 183
76 SSL/TLS	p. 184
77 HTTPS	p. 184
78 Remote Access to a Mail Server	p. 184
Solutions	p. 186
Chapter 7 Security at the User Level	p. 195
7.1 Password-Based Authentication	p. 195
7.2 Challenge-Response Protocols	p. 202
7.3 Kerberos: A Network Authentication Protocol	p. 203
7.4 PGP: Pretty Good Privacy	p. 206
7.5 Notes	p. 211
Exercises	p. 212
79 Authentication Using Passwords	p. 212
80 Types of Authentication	p. 212
81 Password Hashes	p. 212
82 Password Cracking Using an Exhaustive Search	p. 213
83 Password Cracking Using a Dictionary	p. 213
84 Stolen Hashes	p. 213
85 Authentication on a Web Site	p. 214
86 Physical Access Control	p. 214
87 Wireless Local Area Network	p. 217
88 Kerberos Authentication System	p. 218
89 Kerberos Key Server	p. 218
90 Stealing Kerberos Keys	p. 218
91 Kerberos Tickets	p. 219
92 Third-Party-Based Authentication Protocol	p. 219
93 Authentication with a Centralized Server	p. 220
94 PGP Certificates and S/MIME	p. 222
95 Generating PGP Keys	p. 222
96 Distinguishing the Keys in PGP	p. 223
97 PGP Web of Trust	p. 223
98 PGP Deployment	p. 223
99 Approaches to Secure E-Mails	p. 224
100 Choosing a Layer to Secure Communications	p. 225
Solutions	p. 226
Chapter 8 Management of Information Security	p. 243
8.1 Risk Analysis	p. 243
8.2 Key Documents	p. 244
8.3 ISO 27001: the Information Security Management System	p. 245
8.4 ISO 17799: Code of Practice for Information Security Management	p. 246
8.5 The German IT Baseline Protection Manual	p. 247
8.6 The Common Criteria	p. 248
8.7 Notes	p. 250
Exercises	p. 251
101 Your Position as a Security Officer	p. 251
102 Documentation	p. 251
103 Security Standards	p. 251
104 The Security Gap	p. 252
105 Risk Analysis	p. 252
106 Audit	p. 253
Solutions	p. 254
Acronyms	p. 257
References	p. 259

Available:*

On Order

Summary

Summary

Author Notes

Table of Contents