Web security and commerce - Brossura

Garfinkel, Simson

Brossura

ISBN 10: 1565922697 ISBN 13: 9781565922693

Casa editrice: O'Reilly Media Inc, 1997

Riassunto

Explaining what the real security risks of web commerce are, this text goes on to explain how you can minimize them. Designed for Web surfers and system administrators responsible for the security of a critical web server, this provides information on all there is to know. Entertaining as well as illuminating, it looks behind the headlines at the technologies, risks, and benefits of the web.

Su questo libro

L'autore

Simson Garfinkel, CISSP, is a journalist, entrepreneur, and international authority on computer security. Garfinkel is chief technology officer at Sandstorm Enterprises, a Boston-based firm that develops state-of-the-art computer security tools. Garfinkel is also a columnist for Technology Review Magazine and has written for more than 50 publications, including Computerworld, Forbes, and The New York Times. He is also the author of Database Nation; Web Security, Privacy, and Commerce; PGP: Pretty Good Privacy; and seven other books. Garfinkel earned a master's degree in journalism at Columbia University in 1988 and holds three undergraduate degrees from MIT. He is currently working on his doctorate at MIT's Laboratory for Computer Science.

Gene Spafford, Ph.D., CISSP, is an internationally renowned scientist and educator who has been working in information security, policy, cybercrime, and software engineering for nearly two decades. He is a professor at Purdue University and is the director of CERIAS, the world's premier multidisciplinary academic center for information security and assurance. Professor Spafford and his students have pioneered a number of technologies and concepts well-known in security today, including the COPS and Tripwire tools, two-stage firewalls, and vulnerability databases. Spaf, as he is widely known, has achieved numerous professional honors recognizing his teaching, his research, and his professional service. These include being named a fellow of the AAAS, the ACM, and the IEEE; receiving the National Computer Systems Security Award; receiving the William Hugh Murray Medal of the NCISSE; election to the ISSA Hall of Fame; and receiving the Charles Murphy Award at Purdue. He was named a CISSP, honoris causa in 2000. In addition to over 100 technical reports and articles on his research, Spaf is also the coauthor of Web Security, Privacy, and Commerce, and was the consulting editor for Computer Crime: A Crimefighters Handbook (both from O'Reilly).

Contenuti

Preface; The Web: Promises and Threats; About This Book; Conventions Used in This Book; Comments and Questions; Acknowledgments; Introduction; Chapter 1: The Web Security Landscape; 1.1 Web Security in a Nutshell; 1.2 The Web Security Problem; 1.3 Credit Cards, Encryption, and the Web; 1.4 Firewalls: Part of the Solution; 1.5 Risk Management; User Safety; Chapter 2: The Buggy Browser: Evolution of Risk; 2.1 Browser History; 2.2 Data-Driven Attacks; 2.3 Implementation Flaws: A Litany of Bugs; Chapter 3: Java and JavaScript; 3.1 Java; 3.2 JavaScript; 3.3 Denial-of-Service Attacks; 3.4 JavaScript-Enabled Spoofing Attacks; 3.5 Conclusion; Chapter 4: Downloading Machine Code with ActiveX and Plug-Ins; 4.1 When Good Browsers Go Bad; 4.2 Netscape Plug-Ins; 4.3 ActiveX and Authenticode; 4.4 The Risks of Downloaded Code; 4.5 Is Authenticode a Solution?; 4.6 Improving the Security of Downloaded Code; Chapter 5: Privacy; 5.1 Log Files; 5.2 Cookies; 5.3 Personally Identifiable Information; 5.4 Anonymizers; 5.5 Unanticipated Disclosure; Digital Certificates; Chapter 6: Digital Identification Techniques; 6.1 Identification; 6.2 Public Key Infrastructure; 6.3 Problems Building a Public Key Infrastructure; 6.4 Ten Policy Questions; Chapter 7: Certification Authorities and Server Certificates; 7.1 Certificates Today; 7.2 Certification Authority Certificates; 7.3 Server Certificates; 7.4 Conclusion; Chapter 8: Client-Side Digital Certificates; 8.1 Client Certificates; 8.2 A Tour of the VeriSign Digital ID Center; Chapter 9: Code Signing and Microsoft’s Authenticode; 9.1 Why Code Signing?; 9.2 Microsoft’s Authenticode Technology; 9.3 Obtaining a Software Publisher’s Certificate; 9.4 Other Code Signing Methods; Cryptography; Chapter 10: Cryptography Basics; 10.1 Understanding Cryptography; 10.2 Symmetric Key Algorithms; 10.3 Public Key Algorithms; 10.4 Message Digest Functions; 10.5 Public Key Infrastructure; Chapter 11: Cryptography and the Web; 11.1 Cryptography and Web Security; 11.2 Today’s Working Encryption Systems; 11.3 U.S. Restrictions on Cryptography; 11.4 Foreign Restrictions on Cryptography; Chapter 12: Understanding SSL and TLS; 12.1 What Is SSL?; 12.2 TLS Standards Activities; 12.3 SSL: The User’s Point of View; Web Server Security; Chapter 13: Host and Site Security; 13.1 Historically Unsecure Hosts; 13.2 Current Major Host Security Problems; 13.3 Minimizing Risk by Minimizing Services; 13.4 Secure Content Updating; 13.5 Back-End Databases; 13.6 Physical Security; Chapter 14: Controlling Access to Your Web Server; 14.1 Access Control Strategies; 14.2 Implementing Access Controls with Blocks; 14.3 A Simple User Management System; Chapter 15: Secure CGI/API Programming; 15.1 The Danger of Extensibility; 15.2 Rules To Code By; 15.3 Specific Rules for Specific Programming Languages; 15.4 Tips on Writing CGI Scripts That Run with Additional Privileges; 15.5 Conclusion; Commerce and Society; Chapter 16: Digital Payments; 16.1 Charga-Plates, Diners Club, and Credit Cards; 16.2 Internet-Based Payment Systems; 16.3 How to Evaluate a Credit Card Payment System; Chapter 17: Blocking Software and Censorship Technology; 17.1 Blocking Software; 17.2 PICS; 17.3 RSACi; Chapter 18: Legal Issues: Civil; 18.1 Intellectual Property; 18.2 Torts; Chapter 19: Legal Issues: Criminal; 19.1 Your Legal Options After a Break-In; 19.2 Criminal Hazards That May Await You; 19.3 Criminal Subject Matter; 19.4 Play it Safe . . .; 19.5 Laws and Activism; Appendixes; Lessons from Vineyard.NET; Planning and Preparation; IP Connectivity; Commercial Start-Up; Ongoing Operations; Conclusion; Creating and Installing WebServer Certificates; Downloading and Installing Your Web Server; Apache-SSL; The SSL 3.0 Protocol; History; SSL 3.0 Record Layer; SSL 3.0 Protocols; SSL 3.0 Handshake; SSLeay; The PICS Specification; Rating Services; PICS Labels; References; Electronic References; Paper References; Colophon;

Dettagli dell?edizione

• Editore: O'Reilly Media Inc
• Data di pubblicazione: 1997
• Lingua: Inglese
• ISBN 10: 1565922697
• ISBN 13: 9781565922693
• Rilegatura: Copertina flessibile
• Numero edizione: 1
• Numero di pagine: 483
• Redattore: Spafford Gene
• Contatto del produttore: non disponibile
• Persona responsabile: non disponibile