MTU Library Catalogue

Syndetics cover image
Image from Syndetics

Web security, privacy and commerce / Simson Garfinkel with Gene Spafford.

By: Garfinkel, Simson.
Contributor(s): Spafford, Gene.
Material type: materialTypeLabelBookPublisher: Cambridge, Mass. : O\'Reilly, 2002Edition: 2nd ed.Description: xxviii, 756 p. : ill. : 24 cm. + pbk.ISBN: 0596000456.Subject(s): Computer networks -- Security measures | World Wide Web -- Security measures | Web sites -- Security measuresDDC classification: 005.8
Contents:
Part I: Web Technology -- The Web Security Landscape -- The Architecture of the World Wide Web -- Cryptography Basics -- Cryptography and the Web -- Understanding SSL and TLS -- Digital Identification I: Passwords, Biometrics and Digital Signatures -- Digital Identification II: Digital Certificates, CAs and PKI -- Part II: Privacy and Security for Users -- The Web's War on Your Privacy -- Privacy-Protecting Techniques -- Privacy-Protecting Technologies -- Backups and Antitheft -- Mobile Code I: Plug-Ins, ActiveX and Visual Basic -- Mobile Code II: Java, Javascript, Flash and Shockwave -- Part III: Web Server Security -- Physical Security for Servers -- Host Security for Servers -- Securing Web Applications -- Deploying SSL Server Certificates -- Securing Your Web Service -- Computer Crime -- Part IV: Security for Content Providers -- Controlling Access to Your Web Content -- Client-Side Digital Certificates -- Code Signing and Microsoft's Authenticode -- Pornography, Filtering Software and Censorship -- Privacy Policies, Legislation and P3P -- Digital Payments -- Intellectual Property and Actionable Content.
Holdings
Item type Current library Call number Copy number Status Barcode
General lending MTU Bishopstown Library Lending 005.8 (Browse shelf(Opens below)) 1 Available 00094745
Total holds: 0

Enhanced descriptions from Syndetics:

Since the first edition of this classic reference was published, World Wide Web use has exploded and e-commerce has become a daily part of business and personal life. As Web use has grown, so have the threats to our security and privacy--from credit card fraud to routine invasions of privacy by marketers to web site defacements to attacks that shut down popular web sites. Web Security, Privacy & Commerce goes behind the headlines, examines the major security risks facing us today, and explains how we can minimize them. It describes risks for Windows and Unix, Microsoft Internet Explorer and Netscape Navigator, and a wide range of current programs and products. In vast detail, the book covers: Web technology--The technological underpinnings of the modern Internet and the cryptographic foundations of e-commerce are discussed, along with SSL (the Secure Sockets Layer), the significance of the PKI (Public Key Infrastructure), and digital identification, including passwords, digital signatures, and biometrics. Web privacy and security for users--Learn the real risks to user privacy, including cookies, log files, identity theft, spam, web logs, and web bugs, and the most common risk, users' own willingness to provide e-commerce sites with personal information. Hostile mobile code in plug-ins, ActiveX controls, Java applets, and JavaScript, Flash, and Shockwave programs are also covered. Web server security--Administrators and service providers discover how to secure their systems and web services. Topics include CGI, PHP, SSL certificates, law enforcement issues, and more. Web content security--Zero in on web publishing issues for content providers, including intellectual property, copyright and trademark issues, P3P and privacy policies, digital payments, client-side digital signatures, code signing, pornography filtering and PICS, and other controls on web content. Nearly double the size of the first edition, this completely updated volume is destined to be the definitive reference on Web security risks and the techniques and technologies you can use to protect your privacy, your organization, your system, and your network.

Rev. ed. of: Web security & commerce. 1997.

Includes bibliographical references (pages 716-734) and index.

Part I: Web Technology -- The Web Security Landscape -- The Architecture of the World Wide Web -- Cryptography Basics -- Cryptography and the Web -- Understanding SSL and TLS -- Digital Identification I: Passwords, Biometrics and Digital Signatures -- Digital Identification II: Digital Certificates, CAs and PKI -- Part II: Privacy and Security for Users -- The Web's War on Your Privacy -- Privacy-Protecting Techniques -- Privacy-Protecting Technologies -- Backups and Antitheft -- Mobile Code I: Plug-Ins, ActiveX and Visual Basic -- Mobile Code II: Java, Javascript, Flash and Shockwave -- Part III: Web Server Security -- Physical Security for Servers -- Host Security for Servers -- Securing Web Applications -- Deploying SSL Server Certificates -- Securing Your Web Service -- Computer Crime -- Part IV: Security for Content Providers -- Controlling Access to Your Web Content -- Client-Side Digital Certificates -- Code Signing and Microsoft's Authenticode -- Pornography, Filtering Software and Censorship -- Privacy Policies, Legislation and P3P -- Digital Payments -- Intellectual Property and Actionable Content.

Table of contents provided by Syndetics

  • Preface (p. xi)
  • Part I. Web Technology
  • 1. The Web Security Landscape (p. 3)
  • The Web Security Problem (p. 3)
  • Risk Analysis and Best Practices (p. 10)
  • 2. The Architecture of the World Wide Web (p. 13)
  • History and Terminology (p. 13)
  • A Packet's Tour of the Web (p. 20)
  • Who Owns the Internet? (p. 33)
  • 3. Cryptography Basics (p. 46)
  • Understanding Cryptography (p. 46)
  • Symmetric Key Algorithms (p. 53)
  • Public Key Algorithms (p. 65)
  • Message Digest Functions (p. 71)
  • 4. Cryptography and the Web (p. 78)
  • Cryptography and Web Security (p. 78)
  • Working Cryptographic Systems and Protocols (p. 81)
  • What Cryptography Can't Do (p. 88)
  • Legal Restrictions on Cryptography (p. 90)
  • 5. Understanding SSL and TLS (p. 107)
  • What Is SSL? (p. 107)
  • SSL: The User's Point of View (p. 115)
  • 6. Digital Identification I: Passwords, Biometrics, and Digital Signatures (p. 119)
  • Physical Identification (p. 119)
  • Using Public Keys for Identification (p. 130)
  • Real-World Public Key Examples (p. 140)
  • 7. Digital Identification II: Digital Certificates, CAs, and PKI (p. 153)
  • Understanding Digital Certificates with PGP (p. 153)
  • Certification Authorities: Third-Party Registrars (p. 160)
  • Public Key Infrastructure (p. 174)
  • Open Policy Issues (p. 187)
  • Part II. Privacy and Security for Users
  • 8. The Web's War on Your Privacy (p. 203)
  • Understanding Privacy (p. 204)
  • User-Provided Information (p. 207)
  • Log Files (p. 210)
  • Understanding Cookies (p. 216)
  • Web Bugs (p. 225)
  • Conclusion (p. 229)
  • 9. Privacy-Protecting Techniques (p. 230)
  • Choosing a Good Service Provider (p. 230)
  • Picking a Great Password (p. 231)
  • Cleaning Up After Yourself (p. 242)
  • Avoiding Spam and Junk Email (p. 252)
  • Identity Theft (p. 256)
  • 10. Privacy-Protecting Technologies (p. 262)
  • Blocking Ads and Crushing Cookies (p. 262)
  • Anonymous Browsing (p. 268)
  • Secure Email (p. 275)
  • 11. Backups and Antitheft (p. 284)
  • Using Backups to Protect Your Data (p. 284)
  • Preventing Theft (p. 295)
  • 12. Mobile Code I: Plug-Ins, ActiveX, and Visual Basic (p. 298)
  • When Good Browsers Go Bad (p. 299)
  • Helper Applications and Plug-ins (p. 304)
  • Microsoft's ActiveX (p. 308)
  • The Risks of Downloaded Code (p. 318)
  • Conclusion (p. 326)
  • 13. Mobile Code II: Java, JavaScript, Flash, and Shockwave (p. 327)
  • Java (p. 327)
  • JavaScript (p. 346)
  • Flash and Shockwave (p. 358)
  • Conclusion (p. 359)
  • Part III. Web Server Security
  • 14. Physical Security for Servers (p. 363)
  • Planning for the Forgotten Threats (p. 363)
  • Protecting Computer Hardware (p. 366)
  • Protecting Your Data (p. 381)
  • Personnel (p. 392)
  • Story: A Failed Site Inspection (p. 392)
  • 15. Host Security for Servers (p. 396)
  • Current Host Security Problems (p. 397)
  • Securing the Host Computer (p. 405)
  • Minimizing Risk by Minimizing Services (p. 411)
  • Operating Securely (p. 413)
  • Secure Remote Access and Content Updating (p. 423)
  • Firewalls and the Web (p. 431)
  • Conclusion (p. 433)
  • 16. Securing Web Applications (p. 435)
  • A Legacy of Extensibility and Risk (p. 435)
  • Rules to Code By (p. 443)
  • Securely Using Fields, Hidden Fields, and Cookies (p. 448)
  • Rules for Programming Languages (p. 454)
  • Using PHP Securely (p. 457)
  • Writing Scripts That Run with Additional Privileges (p. 467)
  • Connecting to Databases (p. 468)
  • Conclusion (p. 471)
  • 17. Deploying SSL Server Certificates (p. 472)
  • Planning for Your SSL Server (p. 472)
  • Creating SSL Servers with FreeBSD (p. 477)
  • Installing an SSL Certificate on Microsoft IIS (p. 501)
  • Obtaining a Certificate from a Commercial CA (p. 503)
  • When Things Go Wrong (p. 506)
  • 18. Securing Your Web Service (p. 510)
  • Protecting Via Redundancy (p. 510)
  • Protecting Your DNS (p. 514)
  • Protecting Your Domain Registration (p. 515)
  • 19. Computer Crime (p. 517)
  • Your Legal Options After a Break-In (p. 517)
  • Criminal Hazards (p. 523)
  • Criminal Subject Matter (p. 526)
  • Part IV. Security for Content Providers
  • 20. Controlling Access to Your Web Content (p. 533)
  • Access Control Strategies (p. 533)
  • Controlling Access with Apache (p. 538)
  • Controlling Access with Microsoft IIS (p. 545)
  • 21. Client-Side Digital Certificates (p. 550)
  • Client Certificates (p. 550)
  • A Tour of the VeriSign Digital ID Center (p. 553)
  • 22. Code Signing and Microsoft's Authenticode (p. 560)
  • Why Code Signing? (p. 560)
  • Microsoft's Authenticode Technology (p. 564)
  • Obtaining a Software Publishing Certificate (p. 577)
  • Other Code Signing Methods (p. 577)
  • 23. Pornography, Filtering Software, and Censorship (p. 579)
  • Pornography Filtering (p. 579)
  • PICS (p. 582)
  • RSACi (p. 589)
  • Conclusion (p. 591)
  • 24. Privacy Policies, Legislation, and P3P (p. 592)
  • Policies That Protect Privacy and Privacy Policies (p. 592)
  • Children's Online Privacy Protection Act (p. 601)
  • P3P (p. 606)
  • Conclusion (p. 609)
  • 25. Digital Payments (p. 610)
  • Charga-Plates, Diners Club, and Credit Cards (p. 610)
  • Internet-Based Payment Systems (p. 620)
  • How to Evaluate a Credit Card Payment System (p. 640)
  • 26. Intellectual Property and Actionable Content (p. 642)
  • Copyright (p. 642)
  • Patents (p. 645)
  • Trademarks (p. 646)
  • Actionable Content (p. 650)
  • Part V. Appendixes
  • A. Lessons from Vineyard.NET (p. 655)
  • B. The SSL/TLS Protocol (p. 688)
  • C. P3P: The Platform for Privacy Preferences Project (p. 699)
  • D. The PICS Specification (p. 708)
  • E. References (p. 716)
  • Index (p. 735)

Author notes provided by Syndetics

Simson Garfinkel, CISSP, is a journalist, entrepreneur, and international authority on computer security. Garfinkel is chief technology officer at Sandstorm Enterprises, a Boston-based firm that develops state-of-the-art computer security tools. Garfinkel is also a columnist for Technology Review Magazine and has written for more than 50 publications, including Computerworld, Forbes, and The New York Times. He is also the author of Database Nation; Web Security, Privacy, and Commerce; PGP: Pretty Good Privacy; and seven other books. Garfinkel earned a master's degree in journalism at Columbia University in 1988 and holds three undergraduate degrees from MIT. He is currently working on his doctorate at MIT's Laboratory for Computer Science.

Gene Spafford, Ph.D., CISSP, is an internationally renowned scientist and educator who has been working in information security, policy, cybercrime, and software engineering for nearly two decades. He is a professor at Purdue University and is the director of CERIAS, the world's premier multidisciplinary academic center for information security and assurance. Professor Spafford and his students have pioneered a number of technologies and concepts well-known in security today, including the COPS and Tripwire tools, two-stage firewalls, and vulnerability databases. Spaf, as he is widely known, has achieved numerous professional honors recognizing his teaching, his research, and his professional service. These include being named a fellow of the AAAS, the ACM, and the IEEE; receiving the National Computer Systems Security Award; receiving the William Hugh Murray Medal of the NCISSE; election to the ISSA Hall of Fame; and receiving the Charles Murphy Award at Purdue. He was named a CISSP, honoris causa in 2000. In addition to over 100 technical reports and articles on his research, Spaf is also the coauthor of Web Security, Privacy, and Commerce, and was the consulting editor for Computer Crime: A Crimefighters Handbook (both from O'Reilly).

Previous
Back to results
Next
Close