Computer Security 3/e Dieter Gollmann 2011 John Wiley
▐ 自2024/1/1 00:00起，台灣樂天市場「屈臣氏」將不贈送 LINE POINTS 點數
▐ 自2023/2/1 00:00起，樂天Kobo電子書不贈送 LINE POINTS 點數，請會員多加留意。
▐ LINE POINT點數回饋依照樂天提供扣除折價券(優惠券)、與運費後之最終金額進行計算。
▐ 愛買與愛票網、a la sha（2023/8/1生效）、GAME休閒館（2023/8/1生效）、專品藥局（2023/8/1生效）等部分店家不參與全站加碼，請詳閱LINE Points 加碼店家清單:https://lin.ee/Y2CcVdk/rcfk
▐ 注意事項
(1)部分服務及店家不符合贈點資格，購買後將不贈送 LINE Points 點數，亦不得使用點數紅包，如：比漾廣場、神腦生活、MyCard、愛美麗福利社、展翔通訊、ezcook 美食廚房、葳豐數位商城、吉盈數位商城、森林巨人、包材中心、KABO佳麗寶家電批發、LuLuLu精品店、NewSTYLE新風尚潮流、0216零食會社、美寶家電、純米小鋪、LILY科技新櫃、登芳3C電子雜貨賣場、豐饌御鴨、鼎耀通訊、誠選3C、Smile、葳豐數位商城二店、米蘭寶、BoBo Outlet代購屋、楊家食品（2022/10/1生效）、樂天Kobo電子書（2023/2/1生效）、屈臣氏（2024/1/1生效）等，請詳閱LINE Points 加碼店家清單。
(2)需透過LINE購物前往台灣樂天市場，並在同一瀏覽器於24小時內結帳，才享有 LINE Points 回饋。
(3)若購買之訂單（包含預購商品）未符合樂天市場 45 天內完成訂單出貨及結帳，則不符合贈點資格。
(4)如使用App、或中途瀏覽比價網、回饋網、Google等其他網頁、或由網頁版(電腦版/手機版網頁)切換為App都將會造成追蹤中斷而無法進行 LINE Points 回饋。
(5) LINE 購物為購物資訊整合性平台，商品資料更新會有時間差，如顯示之商品規格、顏色、價位、贈品與台灣樂天市場銷售網頁不符，以銷售網頁標示為準。
(6)Pickup店家之有效訂單需於下單後40天內使用完畢才符合分潤條件
(7) 若上述或其他原因，致使消費者無接收到點數回饋或點數回饋有爭議，台灣樂天市場保有更改條款與法律追訴之權利，活動詳情以樂天市場網站公告為準。商品描述
【簡介】 Completely updated and up-to-the-minute textbook for courses on computer science. The third edition has been completely revised to include new advances in software and technology over the last few years. Provides sections on Windows NT, CORBA and Java which are not examined in comparable titles. No active previous experience of security issues is necessary making this accessible to Software Developers and Managers whose responsibilities span any technical aspects of IT security. Written for self-study and course use, this book will suit a variety of introductory and more advanced security programs for students of computer science, engineering and related disciplines. Technical and project managers will also find that the broad coverage offers a great starting point for discovering underlying issues and provides a means of orientation in a world populated by a bewildering array of competing security systems. 【目錄】 Preface xvii CHAPTER 1 – History of Computer Security 1 1.1 The Dawn of Computer Security 2 1.2 1970s – Mainframes 3 1.3 1980s – Personal Computers 4 1.4 1990s – Internet 6 1.5 2000s – The Web 8 1.6 Conclusions – The Benefits of Hindsight 10 1.7 Exercises 11 CHAPTER 2 – Managing Security 13 2.1 Attacks and Attackers 14 2.2 Security Management 15 2.3 Risk and Threat Analysis 21 2.4 Further Reading 29 2.5 Exercises 29 CHAPTER 3 – Foundations of Computer Security 31 3.1 Definitions 32 3.2 The Fundamental Dilemma of Computer Security 40 3.3 Data vs Information 40 3.4 Principles of Computer Security 41 3.5 The Layer Below 45 3.6 The Layer Above 47 3.7 Further Reading 47 3.8 Exercises 48 CHAPTER 4 – Identification and Authentication 49 4.1 Username and Password 50 4.2 Bootstrapping Password Protection 51 4.3 Guessing Passwords 52 4.4 Phishing, Spoofing, and Social Engineering 54 4.5 Protecting the Password File 56 4.6 Single Sign-on 58 4.7 Alternative Approaches 59 4.8 Further Reading 63 4.9 Exercises 63 CHAPTER 5 – Access Control 65 5.1 Background 66 5.2 Authentication and Authorization 66 5.3 Access Operations 68 5.4 Access Control Structures 71 5.5 Ownership 73 5.6 Intermediate Controls 74 5.7 Policy Instantiation 79 5.8 Comparing Security Attributes 79 5.9 Further Reading 84 5.10 Exercises 84 CHAPTER 6 – Reference Monitors 87 6.1 Introduction 88 6.2 Operating System Integrity 90 6.3 Hardware Security Features 91 6.4 Protecting Memory 99 6.5 Further Reading 103 6.6 Exercises 104 CHAPTER 7 – Unix Security 107 7.1 Introduction 108 7.2 Principals 109 7.3 Subjects 111 7.4 Objects 113 7.5 Access Control 116 7.6 Instances of General Security Principles 119 7.7 Management Issues 125 7.8 Further Reading 128 7.9 Exercises 128 CHAPTER 8 – Windows Security 131 8.1 Introduction 132 8.2 Components of Access Control 135 8.3 Access Decisions 142 8.4 Managing Policies 145 8.5 Task-Dependent Access Rights 147 8.6 Administration 150 8.7 Further Reading 153 8.8 Exercises 153 CHAPTER 9 – Database Security 155 9.1 Introduction 156 9.2 Relational Databases 158 9.3 Access Control 162 9.4 Statistical Database Security 167 9.5 Integration with the Operating System 172 9.6 Privacy 173 9.7 Further Reading 175 9.8 Exercises 175 CHAPTER 10 – Software Security 177 10.1 Introduction 178 10.2 Characters and Numbers 179 10.3 Canonical Representations 183 10.4 Memory Management 184 10.5 Data and Code 191 10.6 Race Conditions 193 10.7 Defences 194 10.8 Further Reading 201 10.9 Exercises 202 CHAPTER 11 – Bell–LaPadula Model 205 11.1 State Machine Models 206 11.2 The Bell–LaPadula Model 206 11.3 The Multics Interpretation of BLP 212 11.4 Further Reading 216 11.5 Exercises 216 CHAPTER 12 – Security Models 219 12.1 The Biba Model 220 12.2 Chinese Wall Model 221 12.3 The Clark–Wilson Model 223 12.4 The Harrison–Ruzzo–Ullman Model 225 12.5 Information-Flow Models 228 12.6 Execution Monitors 230 12.7 Further Reading 232 12.8 Exercises 233 CHAPTER 13 – Security Evaluation 235 13.1 Introduction 236 13.2 The Orange Book 239 13.3 The Rainbow Series 241 13.4 Information Technology Security Evaluation Criteria 242 13.5 The Federal Criteria 243 13.6 The Common Criteria 243 13.7 Quality Standards 246 13.8 An Effort Well Spent? 247 13.9 Summary 248 13.10 Further Reading 248 13.11 Exercises 249 CHAPTER 14 – Cryptography 251 14.1 Introduction 252 14.2 Modular Arithmetic 256 14.3 Integrity Check Functions 257 14.4 Digital Signatures 260 14.5 Encryption 264 14.6 Strength of Mechanisms 270 14.7 Performance 271 14.8 Further Reading 272 14.9 Exercises 273 CHAPTER 15 – Key Establishment 275 15.1 Introduction 276 15.2 Key Establishment and Authentication 276 15.3 Key Establishment Protocols 279 15.4 Kerberos 283 15.5 Public-Key Infrastructures 288 15.6 Trusted Computing – Attestation 293 15.7 Further Reading 295 15.8 Exercises 295 CHAPTER 16 – Communications Security 297 16.1 Introduction 298 16.2 Protocol Design Principles 299 16.3 IP Security 301 16.4 IPsec and Network Address Translation 308 16.5 SSL/TLS 310 16.6 Extensible Authentication Protocol 314 16.7 Further Reading 316 16.8 Exercises 316 CHAPTER 17 – Network Security 319 17.1 Introduction 320 17.2 Domain Name System 322 17.3 Firewalls 328 17.4 Intrusion Detection 332 17.5 Further Reading 335 17.6 Exercises 336 CHAPTER 18 – Web Security 339 18.1 Introduction 340 18.2 Authenticated Sessions 342 18.3 Code Origin Policies 346 18.4 Cross-Site Scripting 347 18.5 Cross-Site Request Forgery 350 18.6 JavaScript Hijacking 352 18.7 Web Services Security 354 18.8 Further Reading 360 18.9 Exercises 361 CHAPTER 19 – Mobility 363 19.1 Introduction 364 19.2 GSM 364 19.3 UMTS 369 19.4 Mobile IPv6 Security 372 19.5 WLAN 377 19.6 Bluetooth 381 19.7 Further Reading 383 19.8 Exercises 383 CHAPTER 20 – New Access Control Paradigms 385 20.1 Introduction 386 20.2 SPKI 388 20.3 Trust Management 390 20.4 Code-Based Access Control 391 20.5 Java Security 395 20.6 .NET Security Framework 400 20.7 Digital Rights Management 405 20.8 Further Reading 406 20.9 Exercises 406 Bibliography 409 Index 423