Security Technologies for the World Wide Web (Artech House Computer Security Series)

866 Pages·1999·4.44 MB·English

by  Rolf Oppliger

Security Technologies for the World Wide Web
title:
Artech House Computer Security Series
author: Oppliger, Rolf.
publisher: Artech House, Inc.
isbn10 | asin: 1580530451
print isbn13: 9781580530453
ebook isbn13: 9780585337654
language: English
Computer security, World Wide Web
subject (Information retrieval system)--Security
measures.
publication date: 2000
lcc: QA76.9.A25O68 1999eb
ddc: 005.8
Computer security, World Wide Web
subject: (Information retrieval system)--Security
measures.
Page i
Security Technologies for the World Wide Web
Page ii
For a recent listing of titles in the Artech House Computing Library, turn to
the back of this book.
Page iii
Security Technologies for the World Wide Web
Rolf Oppliger
Page iv
Library of Congress Cataloging-in-Publication Data
Oppliger, Rolf.
Security technologies for the World Wide Web / Rolf Oppliger.
p. cm. (Artech House computing library)
Includes bibliographical references and index.
ISBN 1-58053-045-1 (alk. paper)
1. Computer security. 2. World Wide Web (Informational retrieval sytems)
Security measure. I. Title. II. Series.
QA76.9A25 068 1999 99-045835
005.8 21dc21 CIP
British Library Cataloguing in Publication Data
Oppliger, Rolf
Security technologies for the World Wide Web. (Artech
House computing library)
1. World Wide Web (Information retrieval system)Security
measures
1. Title
005.8
ISBN 1-58053-045-1
Cover design by Lynda Fishbourne
© 2000 ARTECH HOUSE, INC. 685 Canton Street Norwood, MA 02062
All rights reserved. Printed and bound in the United States of America. No
part of this book may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying, recording, or by any
information storage and retrieval system, without permission in writing from
the publisher.
All terms mentioned in this book that are known to be trademarks or service
marks have been appropriately capitalized. Artech House cannot attest to the
accuracy of this information. Use of a term in this book should not be
regarded as affecting the validity of any trademark or service mark.
International Standard Book Number: 1-58053-045-1
Cataloging-In-Publication: 99-045835
10 9 8 7 6 5 4 3 2
Page v
To my wife, Isabelle
Page vii
Contents
Preface xiii
Acknowledgments xxi
1
Introduction 1
1.1 1
Internet
1.2 4
WWW
1.3 10
Vulnerabilities, Threats, and Countermeasures
1.4 11
Generic Security Model
1.4.1 13
Security Policy
1.4.2 14
Host Security
1.4.3 15
Network Security
1.4.4 17
Organizational Security
1.4.5 18
Legal Security
2
HTTP User Authentication and Authorization 21
2.1 21
Introduction
2.2 24
HTTP Basic Authentication
2.3 27
HTTP Digest Authentication
2.4 33
Certificate-Based Authentication
2.5 34
Authorization and Access Control
2.6 39
Conclusions
Page viii
3
Proxy Servers and Firewalls 41
3.1 42
Introduction
3.2 47
Packet Filtering and Stateful Inspection
3.3 51
Circuit-Level Gateways
3.4 55
Application-Level Gateways and Proxy Servers
3.5 57
Firewall Configurations
3.5.1 58
Screened Subnet Firewalls
3.5.2 59
Dual-Homed Firewalls
3.6 61
Configuring the Browser
3.6.1 62
Netscape Navigator
3.6.2 65
Microsoft Internet Explorer
3.7 67
Conclusions
4
Cryptographic Techniques 73
4.1 74
Introduction
4.2 77