Table Of Contentfifth
edition
P
r
i
n
c
i
P
l
e
s
o
f
i
n
f
o
r
m
a
t
i
o
n
s
e
c
u
r
i
t
y
To register or access your online learning solution or purchase materials
for your course, visit www.cengagebrain.com.
Whitman
mattord
48367_cvr_ptg01_hires.indd 1 16/10/14 7:37 PM
Principles of Information Security
Fifth Edition
Michael E. Whitman,
Ph.D., CISM, CISSP
Herbert J. Mattord,
Ph.D., CISM, CISSP
Kennesaw State University
Australia(cid:129)Brazil(cid:129)Mexico(cid:129)Singapore(cid:129)UnitedKingdom(cid:129)UnitedStates
PrinciplesofInformationSecurity, ©2016,2012CengageLearning
FifthEdition WCN:01-100-101
MichaelE.Whitmanand
HerbertJ.Mattord ALLRIGHTSRESERVED.Nopartofthisworkcoveredbythe
copyrighthereinmaybereproduced,transmitted,stored,orusedin
SVP,GMSkills&GlobalProductManagement: anyformorbyanymeans—graphic,electronic,ormechanical,
DawnGerrain
includingbutnotlimitedtophotocopying,recording,scanning,
ProductDevelopmentManager:LeighHefferon digitizing,taping,Webdistribution,informationnetworks,or
SeniorContentDeveloper:NataliePashoukos informationstorageandretrievalsystems,exceptaspermittedunder
DevelopmentEditor:DanSeiter Section107or108ofthe1976UnitedStatesCopyrightAct—without
thepriorwrittenpermissionofthepublisher.
ProductAssistant:ScottFinger
VicePresident,MarketingServices:
Forproductinformationandtechnologyassistance,contactusat
JenniferAnnBaker CengageLearningCustomer&SalesSupport,1-800-354-9706
SeniorMarketingManager:EricLaScola
Forpermissiontousematerialfromthistextorproduct,submitall
SeniorProductionDirector:WendyTroeger requestsonlineatwww.cengage.com/permissions.
ProductionDirector:PattyStephan Furtherpermissionquestionscanbee-mailedto
[email protected]
SeniorContentProjectManager:
BrookeGreenhouse
LibraryofCongressControlNumber:2014944986
ManagingArtDirector:JackPendleton
ISBN:978-1-2854-4836-7
SoftwareDevelopmentManager:PavanEthakota
Coverimage(s):©iStockphoto.com/Vertigo3d
CengageLearning
20ChannelCenterStreet
Boston,MA02210
USA
CengageLearningisaleadingproviderofcustomizedlearning
solutionswithofficelocationsaroundtheglobe,includingSingapore,
theUnitedKingdom,Australia,Mexico,Brazil,andJapan.Locateyour
localofficeat:www.cengage.com/global.
CengageLearningproductsarerepresentedinCanadaby
NelsonEducation,Ltd.
TolearnmoreaboutCengageLearning,visitwww.cengage.com
Purchaseanyofourproductsatyourlocalcollegestoreoratour
preferredonlinestorewww.cengagebrain.com.
NoticetotheReader
Publisherdoesnotwarrantorguaranteeanyoftheproductsdescribedhereinorperformanyindependentanalysisinconnectionwithanyoftheproduct
informationcontainedherein.Publisherdoesnotassume,andexpresslydisclaims,anyobligationtoobtainandincludeinformationotherthanthatprovided
toitbythemanufacturer.Thereaderisexpresslywarnedtoconsiderandadoptallsafetyprecautionsthatmightbeindicatedbytheactivitiesdescribed
hereinandtoavoidallpotentialhazards.Byfollowingtheinstructionscontainedherein,thereaderwillinglyassumesallrisksinconnectionwithsuch
instructions.Thepublishermakesnorepresentationsorwarrantiesofanykind,includingbutnotlimitedto,thewarrantiesoffitnessforparticularpurposeor
merchantability,norareanysuchrepresentationsimpliedwithrespecttothematerialsetforthherein,andthepublishertakesnoresponsibilitywithrespect
tosuchmaterial.Thepublishershallnotbeliableforanyspecial,consequential,orexemplarydamagesresulting,inwholeorpart,fromthereaders’useof,
orrelianceupon,thismaterial.
Printed in the United States of America
Print Number: 01 Print Year: 2014
To Rhonda, Rachel, Alex, and Meghan, thank you for your loving support.
—MEW
To my granddaughter Ellie; the future is yours.
—HJM
Brief Table of Contents
PREFACE. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... xvii
CHAPTER 1
Introductionto Information Security ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. 1
CHAPTER 2
TheNeedforSecurity . ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... . 45
CHAPTER 3
Legal,Ethical, andProfessionalIssuesinInformation Security.. ... ... .. ... ... .. ... ... .. ... 109
CHAPTER 4
PlanningforSecurity .. ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 153
CHAPTER 5
RiskManagement . ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 229
CHAPTER 6
SecurityTechnology:FirewallsandVPNs... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 297
CHAPTER 7
SecurityTechnology:Intrusion DetectionandPreventionSystems,andOther SecurityTools.. ... 355
CHAPTER 8
Cryptography... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 417
CHAPTER 9
PhysicalSecurity. .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 467
CHAPTER 10
ImplementingInformation Security . ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 505
CHAPTER 11
SecurityandPersonnel. ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 547
CHAPTER 12
InformationSecurityMaintenance.. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 591
GLOSSARY. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657
INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677
v
Table of Contents
PREFACE. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... xvii
CHAPTER1
Introductionto Information Security ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. 1
Introduction......................................................................... 3
TheHistoryofInformationSecurity ....................................................... 3
The1960s....................................................................... 4
The1970sand80s................................................................. 5
The1990s....................................................................... 9
2000toPresent ................................................................... 9
WhatIsSecurity?.................................................................... 10
KeyInformationSecurityConcepts .................................................... 11
CriticalCharacteristicsofInformation.................................................. 14
CNSSSecurityModel................................................................. 17
ComponentsofanInformationSystem..................................................... 19
Software ....................................................................... 19
Hardware ...................................................................... 20
Data.......................................................................... 20
People......................................................................... 20
Procedures...................................................................... 21
Networks ...................................................................... 21
BalancingInformationSecurityandAccess.................................................. 21
ApproachestoInformationSecurityImplementation........................................... 22
SecurityintheSystemsLifeCycle ........................................................ 23
TheSystemsDevelopmentLifeCycle................................................... 24
TheSecuritySystemsDevelopmentLifeCycle............................................. 27
SoftwareAssurance—SecurityintheSDLC............................................... 28
SoftwareDesignPrinciples .......................................................... 30
TheNISTApproachtoSecuringtheSDLC............................................... 31
SecurityProfessionalsandtheOrganization................................................. 34
SeniorManagement............................................................... 35
InformationSecurityProjectTeam..................................................... 36
DataResponsibilities .............................................................. 37
CommunitiesofInterest ............................................................... 37
InformationSecurityManagementandProfessionals........................................ 37
InformationTechnologyManagementandProfessionals..................................... 38
OrganizationalManagementandProfessionals............................................ 38
InformationSecurity:IsItanArtoraScience?............................................... 38
SecurityasArt................................................................... 38
SecurityasScience ................................................................ 39
SecurityasaSocialScience.......................................................... 39
SelectedReadings.................................................................... 39
ChapterSummary ................................................................... 40
ReviewQuestions.................................................................... 40
Exercises.......................................................................... 41
CaseExercises...................................................................... 42
Endnotes.......................................................................... 42
vii
viii TableofContents
CHAPTER2
TheNeedforSecurity ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... .. ... ... .. ... .. 45
Introduction........................................................................ 47
BusinessNeedsFirst............................................................... 47
ThreatsandAttacks.................................................................. 49
2.5BillionPotentialHackers......................................................... 49
OtherStudiesofThreats............................................................ 50
CommonAttackPatternEnumerationandClassification(CAPEC).............................. 52
The12CategoriesofThreats ........................................................ 52
CompromisestoIntellectualProperty...................................................... 52
SoftwarePiracy .................................................................. 53
CopyrightProtectionandUserRegistration .............................................. 53
DeviationsinQualityofService.......................................................... 56
InternetServiceIssues.............................................................. 56
CommunicationsandOtherServiceProviderIssues......................................... 57
PowerIrregularities ............................................................... 57
EspionageorTrespass ................................................................ 58
Hackers........................................................................ 59
HackerVariants.................................................................. 64
PasswordAttacks................................................................. 66
ForcesofNature .................................................................... 68
Fire........................................................................... 69
Floods......................................................................... 69
Earthquakes..................................................................... 69
Lightning....................................................................... 69
LandslidesorMudslides............................................................ 69
TornadosorSevereWindstorms ...................................................... 69
Hurricanes,Typhoons,andTropicalDepressions .......................................... 70
Tsunamis....................................................................... 70
ElectrostaticDischarge ............................................................. 70
DustContamination............................................................... 70
HumanErrororFailure............................................................... 71
SocialEngineering ................................................................ 72
InformationExtortion................................................................. 76
SabotageorVandalism................................................................ 77
OnlineActivism.................................................................. 78
SoftwareAttacks .................................................................... 80
Malware....................................................................... 80
BackDoors..................................................................... 87
Denial-of-Service(DoS)andDistributedDenial-of-Service(DDoS)Attacks ........................ 88
E-mailAttacks................................................................... 89
CommunicationsInterceptionAttacks .................................................. 90
TechnicalHardwareFailuresorErrors .................................................... 92
TheIntelPentiumCPUFailure ....................................................... 92
MeanTimeBetweenFailure ......................................................... 93
TechnicalSoftwareFailuresorErrors ..................................................... 93
TheOWASPTop10 .............................................................. 93
TheDeadlySinsinSoftwareSecurity................................................... 94
TechnologicalObsolescence ............................................................ 99
Theft............................................................................ 101
SelectedReadings................................................................... 101
TableofContents ix
ChapterSummary .................................................................. 101
ReviewQuestions................................................................... 102
Exercises......................................................................... 104
CaseExercises..................................................................... 104
Endnotes......................................................................... 105
CHAPTER3
Legal,Ethical, andProfessionalIssuesinInformation Security.. ... ... .. ... ... .. ... ... .. ... 109
Introduction....................................................................... 110
LawandEthicsinInformationSecurity................................................... 110
OrganizationalLiabilityandtheNeedforCounsel........................................ 111
PolicyVersusLaw ............................................................... 112
TypesofLaw................................................................... 112
RelevantU.S.Laws ................................................................. 113
GeneralComputerCrimeLaws...................................................... 113
ExportandEspionageLaws ........................................................ 122
U.S.CopyrightLaw.............................................................. 124
FinancialReporting .............................................................. 124
FreedomofInformationActof1966.................................................. 124
PaymentCardIndustryDataSecurityStandards(PCIDSS).................................. 124
StateandLocalRegulations ........................................................ 126
InternationalLawsandLegalBodies..................................................... 127
U.K.ComputerSecurityLaws....................................................... 127
AustralianComputerSecurityLaws................................................... 127
CouncilofEuropeConventiononCybercrime ........................................... 128
WorldTradeOrganizationandtheAgreementonTrade-RelatedAspectsofIntellectualPropertyRights.. 128
DigitalMillenniumCopyrightAct.................................................... 129
EthicsandInformationSecurity......................................................... 129
EthicalDifferencesAcrossCultures ................................................... 129
EthicsandEducation ............................................................. 135
DeterringUnethicalandIllegalBehavior ............................................... 136
CodesofEthicsatProfessionalOrganizations............................................... 137
MajorInformationSecurityProfessionalOrganizations..................................... 138
KeyU.S.FederalAgencies............................................................. 139
DepartmentofHomelandSecurity.................................................... 139
U.S.SecretService ............................................................... 142
FederalBureauofInvestigation(FBI).................................................. 142
NationalSecurityAgency(NSA) ..................................................... 145
SelectedReadings................................................................... 146
ChapterSummary .................................................................. 147
ReviewQuestions................................................................... 147
Exercises......................................................................... 148
CaseExercises..................................................................... 149
Endnotes......................................................................... 149
CHAPTER4
PlanningforSecurity .. ... .. ... .. ... ... .. ... ... .. ... .. ... ... .. ... ... .. ... ... .. ... 153
Introduction....................................................................... 154
InformationSecurityPlanningandGovernance.............................................. 154
