This is your expert guide to information security. As businesses and consumers become more dependent on complex multinational information systems, the need to understand and devise sound information security systems has never been greater. This title takes a practical approach to information security by focusing on real-world examples. While not sidestepping the theory, the emphasis is on developing the skills and knowledge that security and information technology students and professionals need to face their challenges. The book is organized around four major themes: Cryptography: classic cryptosystems, symmetric key; cryptography, public key cryptography, hash functions, random numbers, information hiding, and cryptanalysis Access control: authentication and authorization, password-based security, ACLs and capabilities, multilevel and multilateral security, covert channels and inference control, BLP and Biba's models, firewalls, and intrusion detection systems. It also includes protocols: simple authentication protocols, session keys, perfect forward secrecy, timestamps, SSL, IPSec, Kerberos, and GSM Software: flaws and malware, buffer overflows, viruses and worms, software reverse engineering, digital rights management, secure software development, and operating systems security. Additional features include numerous figures and tables to illustrate and clarify complex topics, as well as problems - ranging from basic to challenging - to help readers apply their newly developed skills. A solutions manual and a set of classroom-tested PowerPoint[registered] slides will assist instructors in their course development. Students and professors in information technology, computer science, and engineering, and professionals working in the field will find this reference most useful to solve their information security issues. This is an "Instructor's Manual" presenting detailed solutions to all the problems in the book is available from the Wiley editorial department. An Instructor Support FTP site is also available.

作 者 簡 介

我在信息安全領域已有將近20年的經驗瞭，其中包括在行業中和政府裏從事的一些寬泛的工作內容。我的職業經曆包括在美國國傢安全局(National Security Agency，NSA)的7年多，以及隨後在一傢矽榖創業公司的兩年時間。雖然關於我在NSA的工作，我不能說太多，但是我可以告訴你——我的職業頭銜曾經是密碼技術數學傢。在這個行業當中，我參與設計並開發瞭一款數字版權管理安全産品。這段現實世界中的工作經曆，就像三明治一樣被夾在學術性的職業生涯之間。身處學術界時，我的研究興趣則包含瞭各式各樣廣泛的安全主題。

當我於2002年重返學術界時，於我而言，似乎沒有一本可用的安全教科書能夠與現實世界緊密相連。我覺得我可以撰寫一本信息安全方麵的書籍，以填補這個空缺，同時還可以在書中包含一些對於處於職業生涯的IT專業人士有所裨益的信息。基於我已經接收到的反饋情況，第1版顯然已經獲得瞭成功。

我相信，從既是一本教科書，又可作為專業人員的工作參考這個雙重角色來看，第2版將會被證明更具價值，但是因此我也會産生一些偏見。可以說，我以前的很多學生如今都從業於一些領先的矽榖科技公司。他們告訴我，在我的課程中學到的知識曾令他們受益匪淺。於是，我當然就會很希望，當我之前在業界工作時也能有一本類似這樣的書籍作為參考，那樣我的同事們和我就也能夠受惠於此瞭。

除瞭信息安全之外，我當然還有自己的生活。我的傢人包括我的妻子Melody，兩個很棒的兒子Austin(他的名字首字母是AES)和Miles(感謝Melody，他的名字首字母不至於成為DES)。我們熱愛戶外運動，定期會在附近做一些短途的旅行，從事一些諸如騎自行車、登山遠足、露營以及釣魚之類的活動。此外，我還花瞭太多的時間，用在我位於Santa Cruz山間的一座待修繕的房子上。