White-Hat Security Arsenal: Tackling the Threats
Author: Aviel D. Rubin
Pages: 368
Publisher: Addison-Wesley
ISBN: 0-201-71114-1
Available for download is chapter 6 entitled “Secure Backup”.
Introduction
In order to bring you up to speed with this book, I’ve quoted M. Korolew’s article “Which hat are you?”, to make you understand the title better.
“First understand the terminology, a whitehat is a professional security expert; you’ll know a whitehat from the understanding of security and the scene. The whitehats web site should contain allot of security information, whitepapers and be current with security news and latest vulnerable findings. Whitehats may conduct product evaluation services; network auditing, network monitoring and penetration testing. After all, professional whitehats have spent years in the security scene and are helping secure computers and the Internet in general. But how can you trust a whitehat?, they are too good. These guys are stealth, you can trust them because they don’t need to be doing this, they want to be doing this. They want to make it as difficult as possible for someone to steal your information.” So, this book is intended for anyone interested in securing and protecting computers from any mischievous activity. Does it deliver? Read on.
Some technical tidbits concerning the book
The book is written by Aviel D. Rubin, a computer scientst and principal researcher at AT&T Labs-Research. Being a recognized security expert should provide you with a clue that he trully knows what he is talking about, and indeed it is so.
The book itself consists of five major parts, divided into thirtheen chapters. The first part is kind of a introduction to the book, and the reader is acquinted about various security issues, the importance of computer security and the security personnel. It serves as a guide on why it’s neccessary to think about security and the author gives quite a few examples of malicious activities, such as viruses and worms. This part should be read by anyone new to the concept of computer security, and the dangers to data integrity.
The second part consists of 3 chapters, deals with data storage whether it may be local or remote, including backups and security implications of it all. This includes physical security, crpytography, passwords, remote storage, NFS, ACL’s, pathnames and various other details.
The third part, oh yes, the third part. Now, this part deals with secure data transfer, and it is a heaven for all you interested in cryptography out there. You’ll find a lot of useful information about various types of cryptography and ciphers there. It’s spread out on almost a hundred pages, which is 1/3 of the book, so you’ll probably find it worth reading. It includes public keys, identities, long-term keys, and various information about ciphers and cryptographic standards.
Parts four and five are based on protecting the internal networks, defending against the attacks and cover issues of privacy and e-commerce. Each of these chapters s concluded with a listing of useful references on the web, for those of you who feel curious on arious topics covered. On top of all this, it includes a nice little glossary with several acronyms explained. All this on 300 pages.
My 2 cents
This book is an odd one. It is fairly brief, and it covers a plethora of security topics, most things any security implied personnel or just a curios seeker of knowledge might look for. To put it simply, it reminds me of a movie teaser, or a appetiser. It gives you the full flavour, stunns you with details and effects and yet leaves you empty, craving for more. It just does not manage to feed your hunger for information regarding security issues, from a point of security personnel. Now, it would be unfair to say bad things about it, as it is a good book, especially if you are interested in ciphers and cryptography, but from a beginners point. It does cover most problems that may come up, but like I said it leaves somewhat of a void, leading the reader to feel not satisfied, wanting more. It successfully discusses various security standards such as the above mentioned cryptography, backups, solutions for e-commerce, and others.
My biggest objection to the book, apart its length, is that it is primarily focused on the ‘white hat’ security aspects, with bringing far too little ‘black hat’ details in the book than necessary. Sure, it does cover it a bit, but in order to defend against your enemy, one must get to know it. A bit more reference and details on that one would be nice. And the title is a bit awkward, as the book focuses on general problems and solutions, so it can hardly be called ‘security arsenal’. A bit too pretentious, don’t you think? With the name like that one would expect a 800+ page book dealing with every known software package created for security purposes and all possible variations of security problems and solutions.
The author discusses general problems and general solutions, not limited by the software running on the computer, which is good. It provides enough clues and solutions for you to grab on and continue for yourself, including choosing your flavour of poison for those malicious intentions. So, if you want a general introduction to computer security, with general issues addressed, coupled with more than enough references to look out for, this is the book for you.
I can recommend this book to anybody who is novice in the world of computer security as it will provide you with a good clue what you’re up against, and how to deal with it. For all of you out there seeking information about the security protocols and ciphers, also.
If you seek detailed information, with regards to specific problems and solutions, you’ll have to look elsewhere. Mind you, apart from the texts found scattered on the internet, I’m unsure weather such a comprehensive book exists.