MTU Library Catalogue

Syndetics cover image
Image from Syndetics

CORBA security : an introduction to safe computing with objects / Bob Blakley ; foreword by Richard Mark Soley.

By: Blakley, Bob, 1960-.
Material type: materialTypeLabelBookSeries: Addison-Wesley object technology series: Publisher: Reading, Mass. : Addison-Wesley, c2000Description: xx, 135 p. : ill. ; 24 cm.ISBN: 0201325659 .Subject(s): Computer security | CORBA (Computer architecture) | Object-oriented methods (Computer science)DDC classification: 005.8
Contents:
Objects and Security -- Object Security -- Policy -- Identification, Authentication and Privilege -- Access Control -- Message Protection -- Delegation -- Security Auditing -- Non-Repudiation -- Questions to ask your secure object system vendor.

Enhanced descriptions from Syndetics:

The CORBAsecurity specification adopted by the Object Management Group (OMG) represents a major step forward in making object technology suitable for business application development. The specification document, however, is long, detailed, and complex; it is a time-consuming task for software developers to make their way through it, and it is inaccessible to CIOs and other technical managers who need to understand object security and its impact on their organizations. CORBA Security provides a readable and less technical overview of the specification and a guide to the security of object systems. Written from a policy point of view, the book will help you decide what security policies are appropriate for your organization and evaluate the object-based security options that can help you manage those policies. For those unfamiliar with basic security and object technology concepts, clear introductions to these topics will bring you up to speed. The book also provides a list of questions you can ask your secure object system vendor-questions that will get behind the jargon and acronyms and give you the information you need to determine just how safe the product really is. Readers will

Includes bibliographical references (pages 121-122) and index.

Objects and Security -- Object Security -- Policy -- Identification, Authentication and Privilege -- Access Control -- Message Protection -- Delegation -- Security Auditing -- Non-Repudiation -- Questions to ask your secure object system vendor.

Table of contents provided by Syndetics

  • List of Figures (p. ix)
  • Foreword (p. xi)
  • Preface (p. xv)
  • Acknowledgments (p. xviii)
  • 1. Objects and Security
  • What Are Objects? (p. 1)
  • How Do Objects Send Messages? (p. 2)
  • What Is Security? (p. 3)
  • Protection (p. 4)
  • Authorization (p. 4)
  • Accountability (p. 7)
  • Availability (p. 10)
  • Assurance (p. 13)
  • 2. Object Security
  • Special Object Security Requirements (p. 16)
  • Naming (p. 16)
  • Scale (p. 18)
  • Encapsulation (p. 23)
  • An Overview of the CORBAsecurity Model (p. 24)
  • 3. Policy
  • Protection and Policy (p. 29)
  • Subjects (p. 31)
  • Objects (p. 31)
  • Actions (p. 31)
  • Access Control Policy (p. 32)
  • Message Protection Policy (p. 33)
  • Audit Policy (p. 33)
  • Non-Repudiation Policy (p. 34)
  • 4. Identification, Authentication, and Privilege
  • Subjects (p. 37)
  • Authentication and Credentials (p. 40)
  • Contexts (p. 42)
  • 5. Access Control
  • Managing Access Control Policy (p. 45)
  • The Problem of Scale (p. 45)
  • Controlling Access Control Policy Scale (p. 47)
  • Privilege Attributes Are Groups of Subjects (p. 47)
  • Domains Are Groups of Objects (p. 48)
  • Required Rights Are Groups of Actions (p. 50)
  • Enforcing Access Control Policy (p. 56)
  • The accessDecision Procedure (p. 57)
  • Combining Policies to Make Access Decisions (p. 60)
  • 6. Message Protection
  • Managing Message Protection Policy (p. 64)
  • Quality of Protection (p. 64)
  • Defining Message Protection Policy (p. 65)
  • Enforcing Message Protection Policy (p. 67)
  • 7. Delegation
  • The Secure Proxy Problem (p. 73)
  • Managing Delegation Policy (p. 79)
  • Enforcing Delegation Policy (p. 82)
  • 8. Security Auditing
  • Managing Audit Policy (p. 84)
  • Event Generation Policy (p. 84)
  • Enforcing Audit Policy (p. 85)
  • Audit Decisions (p. 86)
  • Audit Channels (p. 87)
  • 9. Non-Repudiation
  • Disputes, Evidence, and the Burden of Proof (p. 91)
  • Disputes (p. 91)
  • Non-Repudiation Evidence (p. 92)
  • Non-Repudiation Policies (p. 94)
  • Managing Non-Repudiation Policy (p. 97)
  • Enforcing Non-Repudiation Policy (p. 99)
  • Non-Repudiation Credentials (p. 99)
  • Generating Non-Repudiation Evidence (p. 100)
  • Arbitrating Disputes Using Non-Repudiation Evidence (p. 102)
  • Examples of Disputes (p. 103)
  • Non-Repudiation Service Structure (p. 104)
  • 10. Questions to Ask Your Secure Object System Vendor
  • Suggested Reading (p. 121)
  • Glossary (p. 123)
  • Index (p. 129)

Author notes provided by Syndetics

Bob Blakley is Chief Scientist at DASCOM, and before joining DASCOM, was IBM's Lead Security Architect. He was the principal designer of IBM's proposal to the OMG for an Object-Oriented Security Service, and he co-edited the CORBAsecurity standard adopted by the OMG in 1996. Bob is a frequent speaker at software industry and software security conferences such as the RSA Conference, Networld+Interop, GUIDE, the Burton Group Catalyst Conference, and Open Systems Security Symposium, and the Mergent Users' Conference.