Web Security, Privacy and Commerce 68
| Web Security, Privacy and Commerce | |
| author | Simson Garfinkel, Gene Spafford (Contributor), Debby Russell |
| pages | 800 |
| publisher | O'Reillly & Associates |
| rating | 10 |
| reviewer | rw2 |
| ISBN | 0596000456 |
| summary | A needed update to a reliable classic by well respected security experts. |
My single biggest problem is typically that, while highly technical , I don't do security as a full time job. Reading the literature needed to become really expert just isn't in the cards. It's enough to keep up with Java, Python, C++ and grid computing stuff. Even though there is substantial overlap between grids and security, much of grid thought is separate from the implementations that are dealt with in this book. Besides, my group does large-scale data storage. We leave the security infrastructure to specialists.
Garfinkel's book is great for a guy like me. They take every subject from a level that is trivial to understand down to as much detail as you need. Even in areas that I understand pretty well, I found this book taught me new stuff. For example, in their section dealing with the history of browsers I had a handful of false memories corrected, despite having been around for longer than the web.
They've broken the book down into four sections, Web Technology, Privacy and Security for Users, Web Server Security and Security for Content Providers.
Web Technology
This section deals with the pieces that all the other sections depend on. Particularly interesting are the parts about the different kinds of cryptographic systems. They talk about symmetric and public key systems and message digest functions. These building blocks are then put to use in chapters on SSL/TLS and digital identification. This section also gives a brief history of the web and how it was assembled.
Privacy and Security for Users
These chapters are split between mobile code, Java, ActiveX, Flash and such and all other safety/privacy issues. In the chapter on backups, the authors tell an amusing story about backups that were being done by someone who hadn't been properly trained. She would start the job, then go and read a book. The backup would throw errors, but when the session timed out the errors were lost and the screen looked like a normal termination when she returned. This apparently went on for quite some time before being caught. So check your backups, kids!
This sections also has an interesting chapter on email privacy and a couple different services/methods for using encryption to secure your mail and, better yet, send email that cannot be read after a certain date.
Web Server Security
Every sysad in the business should make sure to read this section, which starts out talking about physical security (because if you don't have that the rest may not matter), and continues all the way down to deploying certificates.
Security for Content Providers
Finally, the book finishes up with a few chapters that are mostly about the legalities of running a site. This combines client authentication with privacy policies, digital payments and intellectual property into a good if less technical ending.
Overall
One interesting aspect of the authors' overall approach is that they are so platform neutral. I didn't expect this from a team that wrote books on Unix security, but they have chapters on ActiveX issues and it isn't dealt with in the flip manner that Unix people often use toward other OSes. Even their screen shots are in Windows. You definitely get the feeling these guys know there stuff from more than one perspective.
We happen to be talking a lot about public key infrastructures at work lately, and the chapters on digital certificates were quite handy in getting up to speed on the different issues. As with other sections, they deal not only with the bit twiddling involved but also with history and policy. The human issues. Very useful stuff about an area that not many think about and about which the existing writing is fairly opaque.
So, if you're needing to learn more about this subject I can't think of another book I would recommend before it. I've been motivated enough to write a review on it, and for most of us that's probably a ringing endorsement by itself!
You can purchase Web Security, Privacy and Commerce at Fatbrain.
Enough already! It was a typo damn it! (Score:1)
I HATE that term as much as anyone - so let's kill it once and for all and chalk it up to a very BAD typo.
the problem i've noticed.. (Score:2, Troll)
*sigh* just my 2 cents as always
MCSE = Microsoft Certified Solitaire Expert
Re:the problem i've noticed.. (Score:3, Interesting)
I'm all up for microsoft bashing in some situations. Bitching about security caused by poor admins is not one of them. Fix the admins, by not hiring the bad ones, and maybe they'll realize that if none of the brand new MCSE's can get a job, there's something wrong with the course.
Re:the problem i've noticed.. (Score:2, Interesting)
1. Pay is generally increased
2. Easy to do, if you know your stuff.
3. Resume fluff.
4. In a crappy economy, if you don't have one, the person who does, gets the job
Re:the problem i've noticed.. (Score:1)
This has to be one of the most backwards lines of thought I've heard in a while.
First off, in a correctly conducted job search a candidate's worth would be based on their actual experience as determined by a hopefully extensive interview process and not judged on the alphabet soup of buzzwords they have on their resume.
There are many extremely experienced technical folks out there that are smart enough to realize that certifications (MSCE or other) can be very helpful in securing employment, which is why they get them!
In addition, many companies are able to maintain reseller agreements, and other business partnerships with vendors based on having a certain number of certified staff on board, thus making the hire of a person who is already certified even more attractive.
So I would say the implicit assumption that someone with an MCSE is inherently less "cluefull" then someone without is just another line of clap-trap from the cro-mags that expound other useless philosophies such as "real men don't read manuals."
Blah to the lot of ya.
Re:the problem i've noticed.. (Score:1)
MCSE = Must Call Someone Experienced
dynamic-ness (Score:4, Insightful)
However, this ringing review would indicate otherwise. please enlighten?
dynamic-ness yes out of date no (Score:1)
Interesting review, but... (Score:4, Insightful)
As a senior web and database developer, I'm probably more likely to check into security mailing lists and watch out for advisories about the core products of my service delivery systems (whether PHP, JSP, Vignette, Apache, IAS, or whatever). Still, any book that raises awareness of security issues and introduces key concepts in an easy to understand manner is to be applauded.
Re:Interesting review, but... (Score:3, Informative)
This book is not a programmers manual, so you will have to keep looking if that's what you want.
I understand what you are looking for, but I wonder if it isn't too language specific to be a practical seller.
Re:Interesting review, but... (Score:2, Informative)
Crispin
----
Crispin Cowan, Ph.D.
Chief Scientist, WireX Communications, Inc. [wirex.com]
Immunix: [immunix.org] Security Hardened Linux Distribution
Available for purchase [wirex.com]
Eyes Glazing Over (Score:2)
Of course, that is likely why most folks will need this, and why many sites are deficient on security. You need to be fairly expert to run a secure site, and this is an area where alot of folks sorta fall down.
Re:Eyes Glazing Over (Score:3, Funny)
There are a lot of analogies between doing proper computer security and life in the Army.
Mind numbing bureaucracy, paperwork, jargon, 98% of the time you are bored stiff, and, then, 2% of the time is pure terror.
Knowing multiple platforms is a good thing (Score:3, Insightful)
Grammar aside, that's a good recommendation for the book. I'm getting tired of all the dismissals of anything Windows with flippant, often incorrect, remarks. (For example, it seems that many Slashdotters don't realize that Windows XP is based on Windows NT, not Windows 95.) When you expand your horizons, you expand your knowledge. And as a bonus it makes you less bitter.
Re:Knowing multiple platforms is a good thing (Score:1)
Re:Knowing multiple platforms is a good thing (Score:1)
I've seen it said, a few times, that linux is for those who hate microsoft, while bsd is for those who love unix. The more anti-microsoft posts I see on this site, the more I'm convinced that this saying is absolutely true.
Re:Knowing multiple platforms is a good thing (Score:1)
Makes it sense... (Score:1)
The information in there would be outdated in a couple of months, and the new version would be aviable in some years.
You can get decent security information on the net why even brother to buy a book ?
(Ha, you can even get the tools to test your security on the net...just ask some script kiddie)
Another good resource (Score:2)
You made two statements ... (Score:3, Insightful)
One interesting aspect of the authors' overall approach is that they are so platform neutral. I didn't expect this from a team that wrote books on Unix
I believe there is only so much that this book (which I have not seen yet) can cover. If there were "levels" of detail regarding a book, this sounds like it covers the first three, and leave the bottom two to that of the reader to explore furthor.
As for being "platform neutral", it should be. The "web" was never designed to be used for a particular OS or browser (though Microsoft would like to believe otherwise [cnet.com]).
The book covers "web" issues and not OS issues.
Open source "at least as secure as proprietary" (Score:1)
It's not just Microsoft's own sites that have locked out non-Microsoft browsers--the UK government's Microsoft-commissioned site for electronic filing of tax returns was in the news [theregister.co.uk] earlier this year when non-MSIE users found themselves locked out. Fortunately, the British have shown some sense, and a recent report acknowledged that "Properly configured open source software can be at least as secure as proprietary systems, and open source software is currently subject to fewer Internet attacks." [theregister.co.uk]
The government is set to conform to an EU strategy to make more use of open source software.
only certain security issues date (Score:1)
methods change of protecting data common exploits
change.
The data to go after is always research data as it's most valuable. prime targets are small players researching 'edge' technology that will get to market b 4 the big boys.
the big boys will pay a lotta dosh for that kind of info.
remember as well that all fortune 500 companies are always monitoring each other some ways legal
i.e what colour is the smoke coming out of your factory what trucks are delivering where are the company execs travelling to etc. seems like small things but i promise you it's done all the time.
yoda? (Score:2)
ancient wizard, you?
Jedi mind tricking your way past security, yes.
Simson Garfinkel? (Score:1)
"Simon & Garfunkel"
-bigginal
Simpson Garfinkel (Score:1)
O'Reilly manual on PGP [amazon.com] was very approachable and useful. I'm looking forward to this book.
Re:Simpson Garfinkel (Score:3, Informative)
(And as always with books from Garfinkel, a good and fun read)
To Improve Security 100%...... (Score:5, Interesting)
The point was raised above about how out of date this book would be by the time it was released. I honestly don't believe that's as big of an issue as people seem to think, 99% of the battle with keeping our networks secure is just getting people to consider the issue in the first place. Any book I can throw at our apps developers that gets them even thinking about the broad issues is a good thing, because once the seed is planted, then they come over and ask us what we would reccomend as they're working on their apps. Over the past six months we've seen the 'Ooops, you mean that travel site with the form for people to put their CC number in should be SSL'd?' to almost daily informal meetings about what they're doing and how we can support them.
Our biggest nightmare has been the sysadmins. The NT sysadmin refuses to apply any patches, 'because then things break', and won't close a single port, 'if you want features, you have to leave things open'. Lots of guerilla midnight work going on behind that boy.
Our solaris sysadmin is no better, if you could take the words 'Well, back at Siemans..' out of his vocabulary, he wouldn't have anything to say. Yet, he's very good at the above mentioned meetings for arguing that we're too paranoid, 'Only a very skilled attacker could sniff passwords of our switched network,' and this after multiple times of showing him dsniff and ettercap in action, complete with grabbing his passwords several times. Once again, lots of midnight cowboy fixes behind the back.
There's a really good book out, Building Secure Software [buildingse...ftware.com] where he brings out some very good points. The best one being that security is put on networkings shoulders, when the real problem is that the developers don't build their applications with security in mind. Therefore, the strategy is to deny attackers access to the errors in the code, when the best practice would be to remove those errors in the first place. That and the quote about ecrypting information in transit is like a guy living on the sidewalk using an armored car to send his credit card information to a man living on the beach in a cardboard box is simply priceless.
Want a free car?!? (Score:1, Funny)
We give away the cars for free and then we sell services for those cars! If you want to we can clean your car, wax it or you can use some of our other services.
We get cash from a couple of VC's, the rest of them simple don't "get it". If we need more we just call "the suits".
in 3 years? (Score:2)
There is no perfect security. That doesn't mean you should just be happy with no security.
One subject that was left out. (Score:4, Informative)
The topic left out is the issue of third-party servers. Many companies, particularly small business, use third party hosting. As such, the SSL provided for their form submission process only protects the information from the client computer (the consumer) to the web server (at the third party location). It does nothing to protect how that information gets from that third-party server back to the company. You would be surprised how many companies simply take that sensitive information (credit card numbers, etc.) and package it into an email message and send it to the company via plaintext email. Not very secure.
I wrote a paper on this subject in 1999 which is still posted at http://jsweb.net/paper.htm [jsweb.net] entitled "Are Secure Internet Transactions Really Secure?" I encourage you to take a look at it to learn more about how many companies are only providing a false sense of security, and not really protecting your information as it transits the Internet.
The real security hole... (Score:2)
I agree that SSL does give a false sense of security, especially with credit card numbers. Truly private info like credit card numbers should always be stored in ecrypted form, not just transmitted in encrypted form. I'm amazed especially at stories of dot-coms where a hacker managed to penetrate a database and then have access to a million credit cards. Ridiculous. You can keep 9 out of 10 hackers out with good external security. Out of the ones that get thru, the 1 in 100 who could deal with and decrypt the card numbers in the database will probably decide it's not worthwhile and go steal them from someone less cautious.
Re:One subject that was left out. (Score:1)
And don't even get me started about their pathetic passwords.
Re:One subject that was left out. (Score:1)
The book will be outdated? Think again. (Score:3, Insightful)
If it is a good read that makes the complicated less intimidating, I would consider it an excellent foundation for those who aren't up on the issues but want to get started.