As a diverse collection of information--much of it at a fairly advanced level--
White-Hat Security Arsenal: Tackling the Threats is a valuable primer on matters of computer and network security. The author doesn't offer specific instructions on how to harden your systems against attack, and doesn't go far in explaining how to build security into software you write. But he does offer good overviews of how particular manifestations of malice--such as Babylonia (a specific virus) and distributed denial of service (DDoS) systems (a broad class of attack)--work. Similarly, he details how security protocols and mechanisms--packet filters and the Secure Sockets Layer (SSL) protocol are two examples--go about their tasks. In brief, the book breaks little new ground, but it covers the familiar data communications security material extremely capably and with frequent reference to the most recent exploits of the bad guys.
Rubin is at his best in explaining the details of security protocols, which rarely make intuitive sense. Using the proven "conversation" method of illustration ("Alice sends her public key to Bob..."), he untangles even the remarkably obtuse Diffie-Hellman algorithm. He backs the dialogues with the formulas that underlie encryption and authentication, and usually translates the simplified conversations into the actual messages exchanged by machines.
This book is worth the cover price for its lucid explanations of how security protocols work. It also highlights places in which security technology is lacking (in making sure no unauthorized data goes out from a Web server, for example), which is refreshing. --David Wall
Topics covered: The state of the art in computer and network security, explained from the point of view of the system administrator wishing to keep bad guys out. A menagerie of recent viruses and attack profiles is followed by discussions of secure storage (with emphasis on encrypted file systems and local password authentication), data exchange via public-private key pairs and trust management system (including Kerberos, of course), network defense with firewalls and intrusion detection systems (IDS), and secure communications via the Secure Sockets Layer (SSL) protocol.
Praise for Aviel D. Rubin’s White-Hat Security Arsenal
“As a researcher, Avi has produced excellent work in a number of areas, and is an engaging writer. With the vast new opportunities on the Internet come problems, complex and confusing.... This book considers many of these problems, analyzes them, and presents fine solutions. More importantly, Avi presents approaches to the solutions, which generalize to related problems you will encounter.... A book like this is a tremendous aid.”
—From the foreword by William R. Cheswick
“This is one of the most readable yet exhaustive books on a vital aspect of computer technology. All computer users, whether they be hackers, IT professionals, academics, or just lay users, will benefit from its content and derive pleasure from its clear and user-friendly style. Rubin has done a great service by identifying and explicating the complexities and subtleties of computer security.”
—Jack Goldman, Ph.D., Founder of Xerox PARC
“White-Hat Security Arsenal is an enormously valuable toolkit for anyone who depends on the Internet today. It gives a refreshingly realistic and hype-free picture of the threats, with practical and up-to-date guidance not only on how to protect yourself, but on what to worry about if you don’t.”
—Matt Blaze, Ph.D., AT&T Labs-Research
“Avi’s book has breadth and depth relating to information security defense needs. It tackles your shackles and threats in Nets with blistery history and constructive realism.”
—Peter G. Neumann, Ph.D., Principal Scientist, Computer Science Lab, SRI International, author of
Computer-Related Risks, moderator of the ACM Risks Forum
“Avi Rubin has done a stunning job of presenting the material and correctly stressing key points.... I can’t wait to recommend this book to security folks in my own company and other companies with whom I am affiliated. It is extremely well done and offers many you-can-use-them-today insights.”
—Sandra Henry-Stocker, Lead Systems Engineer, E-Trade, and Security Columnist, UNIX Insider
“White-Hat Security Arsenal is an intelligent, informative, and well-written book. It’s one of the most readable computer science books I’ve ever picked up.”
—Bruce Davie, Ph.D., Cisco Fellow, Cisco Systems, Inc., coauthor of
Computer Networks: A Systems Approach “Avi’s book examines commonly encountered security problems and offers sufficient insight for even the most lay computer user to appreciate the nature of threats and vulnerabilities associated with Internet-connected computers. But the book offers much more than basic diagnosis and treatment. More advanced network and security professionals should learn enough about the building blocks of security from this book to feel confident in designing, selecting, and implementing security systems and services.”
—David M. Piscitello, Core Competence, Inc.
“An excellent resource for students and professionals wishing to learn about computer security. Each chapter directly delves into a specific branch of computer security. Rubin succinctly presents the main challenges and common solutions to each topic. Throughout the book the discussion is motivated by many entertaining real-world examples. The reader is quickly exposed to various security blunders and cutting-edge systems designed to defend against such blunders. Overall, this book is fun to read and introduces the reader to all current techniques used in computer security.”
—Dan Boneh, Ph.D., Computer Science Professor, Stanford University
“This book is not your standard how-to security book. This is a well-designed, well-written volume on just what the threats are, how they work, and what you have on hand to resist them. Viruses, worms, and denial of service attacks are just the beginning. Most interestingly, Rubin dissects the Morris Worm, Melissa, I Love You, and several other malicious invertebrates. His explanations of just how these infiltrative beasties work are just brilliant. This is a ‘different’ security book, and it’s one you really need.”
—Peter H. Salus, Ph.D., Chief Knowledge Officer, Matrix.Net, author of
A Quarter Century of UNIX and
Casting the Net
"Avi Rubin does a great job of explaining the motivations behind many security solutions, as well as providing practical information about how you can solve real-world problems. White-Hat Security Arsenal is an invaluable resource--a judicious mix of practical information and the theory behind it."
--Marcus J. Ranum, CTO, NFR Security, Inc.
"White-Hat Security Arsenal ups the ante for the good guys in the arms race against computer-based crime. Like a barrage of cruise missiles, Avi's excellent book attains air superiority by leveraging smarts and advanced GPS technology to zero in on critical targets. Intended to educate and inform information security professionals with a no-nonsense, hold-the-hype approach to security, this book is a critical weapon for modern information warriors. If you wear a white hat and are on the good guys' team, buy this book. Don't go into battle without it!"
--Gary McGraw, Ph.D., CTO, Cigital
How do I allow secure remote access to my site? How do I protect data on my laptop in case it's stolen? How should I configure my firewall? Will I regret using my credit card online? How will the bad guys attack? If these are some of the questions that keep you awake at night, you need to read this book.
As a computer security expert at AT&T Labs, author Avi Rubin regularly meets with IT staffs from all types of companies. When asked to recommend resource material to his customers, Rubin realized that there just wasn't a book on the market that would give them concise, direct answers to all their security questions. So he wrote one.
Using a problem-oriented approach, Rubin walks you through everything from protecting against network threats to using credit cards on the Web. Each chapter begins with a problem statement, continues with a description of the threat, explains the technologies involved, and then offers solutions. Chapters conclude with one or more case studies.
You'll find easy-to-understand information that will help you
- Identify the risks
- Put attacks in perspective
- Store information securely
- Perform reliable and secure backups
- Transfer information securely across hostile networks
- Understand Public Key Infrastructure (PKI) and its limitations
- Protect against network threats
- Set up firewalls
- Deal with denial of service attacks
- Understand online commerce and privacy
Whether you are an IT professional, a system administrator, an academic, or simply a regular Internet user, White-Hat Security Arsenal is full of information you can't afford to miss.
