Information Security Management Handbook, Volume 3

440 Pages·2009·4.936 MB·\440

by  Harold F. Tipton (Editor), Micki Krause (Editor)

Information Security
Management Handbook
Sixth Edition
Volume 3
InformatIon SecurIty management handbook
Information Security Management Handbook, Sixth Edition
Edited by Harold F. Tipton, CISSP and Micki Krause, CISSP
Volume 1, 2007, ISBN: 978-0-8493-7495-1
Volume 2, 2008, ISBN: 978-1-4200-6708-8
Volume 3, 2009, ISBN: 978-1-4200-9092-5
Information Security Management Handbook, 2009 CD-ROM Edition
ISBN: 978-1-4200-9098-7
auerbach PublIcatIonS
www.auerbach-publications.com
To Order Call: 1-800-272-7737 • Fax: [phone]
E-mail: [email protected]
Information Security
Management Handbook
Sixth Edition
Volume 3
Edited by
Harold F. Tipton, CISSP • Micki Krause, CISSP
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2010 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Version Date: 20140808
International Standard Book Number-13: 978-1-4200-9095-6 (eBook - PDF)
This book contains information obtained from authentic and highly regarded sources. Reasonable
efforts have been made to publish reliable data and information, but the author and publisher cannot
assume responsibility for the validity of all materials or the consequences of their use. The authors and
publishers have attempted to trace the copyright holders of all material reproduced in this publication
and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any
future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information stor-
age or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copy-
right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222
Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro-
vides licenses and registration for a variety of users. For organizations that have been granted a photo-
copy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Preface ............................................................................................................ix
Contributors ...................................................................................................xi
DOMAIN 1 ACCESS CONTROL
1 Expanding PKI-Based Access Control Capabilities with Attribute
Certificates .............................................................................................3
ALEX GOLOD
2 Five Components to Identity Management Systems .............................19
KEVIN CASTELLOW
3 Security Weaknesses of System and Application Interfaces Used
to Process Sensitive Information ..........................................................33
SEAN M. PRICE
DOMAIN 2 TELECOMMUNICATIONS AND NETWORK
SECURITY
4 Mobile Data Security ...........................................................................43
GEORGE G. MCBRIDE
5 Enhanced Security Through Open Standards: A Path to a
Stronger Global Digital Ecosystem ......................................................57
DAVID O’BERRY
6 Web Application Firewalls ...................................................................73
GEORGES J. JAHCHAN
7 Botnets .................................................................................................77
ROBERT M. SLADE
v
vi ◾ Contents
DOMAIN 3 INFORMATION SECURITY AND RISK
MANAGEMENT
8 Collaborating Information Security and Privacy to Create
Effective Awareness and Training ........................................................89
REBECCA HEROLD
9 Security Information and Event Management (SIEM)
Technology .........................................................................................111
E. EUGENE SCHULTZ
10 The Insider Threat: A View from the Outside .....................................127
TODD FITZGERALD
11 Pod Slurping .......................................................................................137
BEN ROTHKE
12 The USB (Universal Security Burden) Nightmare:
Pod Slurping and Other High Storage Capacity Portable
Device Vulnerabilities ........................................................................145
KENNETH F. BELVA
13 Diary of a Security Assessment: “Put That in Your Pipe and
Smoke It!” ...........................................................................................149
KEN M. SHAURETTE
14 NERC Compliance: A Compliance Review ........................................163
BONNIE GOINS PILEWSKI AND CHRISTOPHER A. PILEWSKI
DOMAIN 4 APPLICATION SECURITY
15 Mashup Security .................................................................................189
MANO PAUL
16 Format String Vulnerabilities .............................................................199
MANO PAUL
17 Fast Scanning Worms .........................................................................207
PAUL A. HENRY
DOMAIN 5 CRYPTOGRAPHY
18 Message Digests ..................................................................................217
RALPH SPENCER POORE
Contents ◾ vii
19 Quantum Computing: The Rise of the Machine ................................227
ROBBY FUSSELL
DOMAIN 6 SECURITY ARCHITECTURE AND DESIGN
20 Information Flow and Covert Channels .............................................239
SEAN M. PRICE
21 Securing Data at Rest: From Smart Phones to Tapes Defining
Data at Rest ........................................................................................281
SAMUEL CHUN AND LEOPOLD KAHNG
DOMAIN 7 OPERATIONS SECURITY
22 Validating Tape Backups ....................................................................303
SANDY BACIK
DOMAIN 8 BUSINESS CONTINUITY PLANNING AND
DISASTER RECOVERY PLANNING
23 Determining Business Unit Priorities in Business Continuity
Management .......................................................................................313
KEVIN HENRY
24 Continuity Program Testing, Maintenance, Training, and
Awareness ...........................................................................................323
CARL JACKSON
DOMAIN 9 LEGAL, REGULATIONS, COMPLIANCE, AND
INVESTIGATION
25 Bluesnarfing .......................................................................................337
MANO PAUL
26 Virtualization and Digital Investigations ..........................................347
MARCUS K. ROGERS AND SEAN C. LESHNEY
DOMAIN 10 PHYSICAL SECURITY
27 Halon Fire Suppression Systems .........................................................367
CHRIS HARE
viii ◾ Contents
28 Crime Prevention through Environmental Design ............................377
MOLLIE E. KREHNKE
29 Data Center Site Selection and Facility Design Considerations .........393
SANDY BACIK
Index ...........................................................................................................401
Preface
Lions and Tigers and Bears, Oh My!!
The sky may not be falling but the onslaught of threats from new technologies, soft-
ware vulnerabilities, and disgruntled employees hasn’t vanished. Combating the bad
and safeguarding information assets continue to be our job and we do it with all the
ammunition we can muster. Like savvy organizations that protect themselves with
knowledgeable and able-bodied security professionals, those professionals, in turn,
arm themselves with the best information, guidance, and counsel they can obtain.
Ergo, the Information Security Management Handbook, which is an anthology of
treatises dealing with the management and technical facets of information security.
The Handbook is a virtual coat of armor, shielding the reader with practical and timely
instruction and implementable recommendations for a more secure environment.
Arm Yourself with Knowledge and Practical
Advice
•Knee-jerk legislation
•Anywhere computing
•Virtualization
ISMH
•Podslurping
•Quantum computing
•Mashups
•Blue snarfing
•Mobile device theft
•Social computing
• Voting machine in-
security
•Format string
vulnerabilities
ix