新版《计算机安全原理与实践》：全面更新与深度解析

需积分: 50 196 浏览量更新于2024-07-19 收藏 13.65MB PDF 举报

《计算机安全原理与实践》第二版是由威廉·斯塔林斯和劳里·布朗合著的一本权威教材，自首版发布以来，随着信息技术的快速发展，该领域经历了诸多创新和进步。本书旨在捕捉这些变化，同时保持对整个计算机安全领域的广泛和全面覆盖。在修订过程中，作者们广泛征询了教授们的意见，以及在该领域工作的专业人士，对书中的叙述进行了精炼和强化，插图也得到了显著提升。本书的核心内容涵盖了计算机安全的基础理论，包括但不限于密码学、网络安全、系统安全、应用安全、风险管理、法规遵从性等方面。它不仅探讨了基本概念和技术，还提供了实用的案例研究和实践指南，帮助读者理解和掌握如何在实际环境中实施和维护信息安全策略。对于准备相关考试或希望提升自身技能的专业人士来说，它是一本极具价值的参考书籍，提供了详细的考试指导和认证学习资料。作者们邀请了业内专家米克·鲍尔和迈克尔·霍华德进行贡献，确保了内容的最新性和实用性。米克·鲍尔作为Linux Journal的安全编辑和Wiremonkeys.org的价值削减服务总监，他的专业知识为网络安全章节增添了深度；迈克尔·霍华德则是微软公司的原则安全项目经理，他为操作系统安全和企业级防护提供了实用见解。此外，本书还包含了对当前计算机安全标准和法规的解读，如ISO 27001和PCI DSS等，以及对新兴威胁，如勒索软件、云计算安全挑战和物联网安全的讨论。对于每个章节，都配有丰富的习题和解答，便于读者巩固所学，并通过实践测试自己的理解。总体而言，《计算机安全原理与实践》第二版是一本综合性的教学和参考书，适合大学教育、职业培训和个人自学，它将帮助读者建立起坚实的计算机安全理论基础，提升应对现实世界安全问题的能力。

ABOUT THE AUTHORS

Dr. William Stallings has authored 17 titles, and counting revised editions, over 40 books

on computer security, computer networking, and computer architecture. In over 20 years

in the field, he has been a technical contributor, technical manager, and an executive with

several high-technology firms. Currently he is an independent consultant whose clients

include computer and networking manufacturers and customers, software development

firms, and leading-edge government research institutions. He has nine times received the

award for the best Computer Science textbook of the year from the Text and Academic

Authors Association.

He created and maintains the Computer Science Student Resource Site at Computer

ScienceStudent.com. This site provides documents and links on a variety of subjects of

general interest to computer science students (and professionals). He is a member of the

editorial board of Cryptologia , a scholarly journal devoted to all aspects of cryptology.

Dr. Lawrie Brown is a senior lecturer in the School of Information Technology and Electri-

cal Engineering, at the Australian Defence Force Academy (UNSW@ADFA) in Canberra,

Australia. His professional interests include cryptography, communications and computer

systems security, and most recently, the design of safe mobile code environments using the

functional language Erlang. He has previously worked on the design and implementation

of private key block ciphers, in particular the LOKI family of encryption algorithms. He

currently teaches courses in computer security, cryptography, data communications and java

programming, and conducts workshops in security risk assessment and firewall design.

xvii

PREFACE

WHAT’S NEW IN THE SECOND EDITION

In the four and a half years since the first edition of this book was published, the field has

seen continued innovations and improvements. In this new edition, we try to capture these

changes while maintaining a broad and comprehensive coverage of the entire field. To begin

the process of revision, the first edition of this book was extensively reviewed by a number

of professors who teach the subject and by professionals working in the field. The result is

that in many places the narrative has been clarified and tightened, and illustrations have

been improved.

One obvious change to the book is a revision in the organization, which makes for a

clearer presentation of related topics. There is a new chapter on operating system security

and a new chapter on wireless security. The material in Part Three has been reallocated to

chapters in a way that presents it more systematically.

Beyond these refinements to improve pedagogy and user-friendliness, there have been

major substantive changes throughout the book. Highlights include:

• Operating system security: This chapter reflects the focus in NIST SP800-123. The

chapter also covers the important topic of virtual machine security.

• Cloud security: A new section covers the security issues relating to the exciting new

area of cloud computing.

• Application-based denial-of-service attacks: A new section deals with this prevalent

form of DoS attack.

• Malicious software: This chapter provides a different focus than that of the first edition.

Increasingly, we see backdoor/rootkit type malware installed by social engineering

attacks, rather than more classic virus/worm direct infection. And phishing is even

more prominent than ever. These trends are reflected in the coverage.

• Internet security protocol and standards: This chapter has been expanded to include

two additional important protocols and services: HTTPS and DKIM.

• Wireless security: A new chapter on wireless security has been added.

• Computer security incident response: The section on CSIR has been updated and

expanded.

• Student study aid: Each chapter now begins with a list of learning objectives.

• Sample syllabus: The text contains more material than can be conveniently covered

in one semester. Accordingly, instructors are provided with several sample syllabi

that guide the use of the text within limited time (e.g., 16 weeks or 12 weeks). These

samples are based on real-world experience by professors with the first edition.

• Practice problem set: A set of homework problems, plus solutions, is provided for

student use.

• Test bank: A set of review questions, including yes/no, multiple choice, and fill in the

blank, is provided for each chapter.

xviii PREFACE

BACKGROUND

Interest in education in computer security and related topics has been growing at a dramatic

rate in recent years. This interest has been spurred by a number of factors, two of which

stand out:

1. As information systems, databases, and Internet-based distributed systems and com-

munication have become pervasive in the commercial world, coupled with the

increased intensity and sophistication of security-related attacks, organizations

now recognize the need for a comprehensive security strategy. This strategy encom-

passes the use of specialized hardware and software and trained personnel to meet

that need.

2. Computer security education, often termed information security education or informa-

tion assurance education , has emerged as a national goal in the United States and other

countries, with national defense and homeland security implications. Organizations such

as the Colloquium for Information System Security Education and the National Security

Agency’s (NSA) Information Assurance Courseware Evaluation (IACE) Program are

spearheading a government role in the development of standards for computer security

education.

Accordingly, the number of courses in universities, community colleges, and other

institutions in computer security and related areas is growing.

OBJECTIVES

The objective of this book is to provide an up-to-date survey of developments in compu-

ter security. Central problems that confront security designers and security administrators

include defining the threats to computer and network systems, evaluating the relative risks

of these threats, and developing cost-effective and user-friendly countermeasures.

The following basic themes unify the discussion:

• Principles: Although the scope of this book is broad, there are a number of basic

principles that appear repeatedly as themes and that unify this field. Examples are

issues relating to authentication and access control. The book highlights these princi-

ples and examines their application in specific areas of computer security.

• Design approaches: The book examines alternative approaches to meeting specific

computer security requirements.

• Standards: Standards have come to assume an increasingly important, indeed dominant,

role in this field. An understanding of the current status and future direction of technology

requires a comprehensive discussion of the related standards.

• Real-world examples: A number of chapters include a section that shows the practical

application of that chapter’s principles in a real-world environment.

PREFACE xix

INTENDED AUDIENCE

The book is intended for both an academic and a professional audience. As a textbook,

it is intended as a one- or two-semester undergraduate course for computer science,

computer engineering, and electrical engineering majors. It covers all the topics in OS

Security and Protection , which is one of the core subject areas in the IEEE/ACM Computer

Curriculum 2008: An Interim Revision to CS 2001 , as well as a number of other topics. The

book covers the core area IAS Information Assurance and Security in the IEEE/ACM

Curriculum Guidelines for Undergraduate Degree Programs in Information Technology

2008 ; and CE-OPS6 Security and Protection from the IEEE/ACM Computer Engineering

Curriculum Guidelines 2004 .

For the professional interested in this field, the book serves as a basic reference volume

and is suitable for self-study.

PLAN OF THE TEXT

The book is divided into five parts (see Chapter 0 ):

• Computer Security Technology and Principles

• Software Security and Trusted Systems

• Management Issues

• Cryptographic Algorithms

• Network Security

The book is also accompanied by a number of online appendices that provide more

detail on selected topics.

The book includes an extensive glossary, a list of frequently used acronyms, and a

bibliography. Each chapter includes homework problems, review questions, a list of key

words, suggestions for further reading, and recommended Websites.

COVERAGE OF CISSP SUBJECT AREAS

This book provides coverage of all the subject areas specified for CISSP (Certified Informa-

tion Systems Security Professional) certification. The CISSP designation from the International

Information Systems Security Certification Consortium (ISC)

is often referred to as the “gold

standard” when it comes to information security certification. It is the only universally recognized

certification in the security industry. Many organizations, including the U.S. Department of

Defense and many financial institutions, now require that cyber security personnel have the

CISSP certification. In 2004, CISSP became the first IT program to earn accreditation under the

international standard ISO/IEC 17024 ( General Requirements for Bodies Operating Certification

of Persons ).

The CISSP examination is based on the Common Body of Knowledge (CBK), a

compendium of information security best practices developed and maintained by (ISC)

剩余816页未读，继续阅读

qq_29580531

粉丝: 1
资源: 6

新版《计算机安全原理与实践》：全面更新与深度解析

计算机安全 原理与实践（computer security）-网络安全文档类资源

计算机安全原理与实践第四版答案.docx

密码编码学与网络安全 — 原理与实践 第四版(英文)

《计算机安全原理与实践》第五章

《计算机安全原理与实践》第四章

计算机安全原理与实践第四版（大黑书）答案上

《计算机安全原理与实践》第四版答案解析

计算机安全原理与实践pdf

计算机安全原理与实践第四版pdf

计算机安全 原理与实践_somewhereaop_researchzts_英文版_安全风险评估_settleqyg_

最新资源

计算机安全原理与实践（computer security）-网络安全文档类资源

密码编码学与网络安全 — 原理与实践第四版(英文)

计算机安全原理与实践_somewhereaop_researchzts_英文版_安全风险评估_settleqyg_