General Book Information

Author:

Amjad Umar, Ph.D.

Publisher:

NGE solutions

Includes glossary of terms and index

Publication Date:

December 2003 Edition (Revised: AUG 2004)

Number of Pages:

440 pages

Book Objectives and Salient Features

The objective of this book is to provide a practical and managerial perspective on the information security issues vital in this digital age. The topics discussed include:

• Management issues of policies, procedures, risks, controls, and requirements.
• Practical review of security technologies such as cryptography, authentication, authorization, non-repuduation, and commercially available security packages (PKI, PGP, Kerberos, SSL, VPN)
• Securing wireless and wired networks by using the security technologies.
• Securing applications, databases, and platforms by using the security technologies.
• Examination of security risks associated with newer areas such as e-business, mobile applications, XML and Web Services, wireless communications, and application server.
• Audits and controls for continued secure operations.
• A methodology that puts all of the above into a procedure.

The salient features of this classroom tested book are:

1. Broad coverage of recent and relevant topics such as the following based on a systems approach to security:
• Wireless security that includes Wi-Fi security, cellular network security, satellite security, wireless home networking security, and wireless middleware security.
• Semantic Web security with a discussion of XML security.
• Web Services security, SAML (Security Assertion Markup Language) and .NET security.
• Internet security (Public Internet, Intranet, Extranet), firewalls, remote access and perimeter security.
• Application and database security with emphasis on modern issues such as e-commerce and mobile application security.
2. A systematic approach to build total systems solutions that combine policies, procedures, risk analysis, threat assessment through attack trees, honeypots, and commercially available security packages to secure the IT assets (applications, databases, hosts) as well as the paths (the network) to these assets.
3. Discussion of security technologies (cryptography), authentication, authorization, accountability and availability with emphasis on intrusion detection, intrusion tolerance, and non-repudiation.
4. Discussion of how audits and controls can be used for continued compliance to a solution after deployment.
5. Case study orientation with numerous real-life examples and a single case study that is developed throughout to clarify and illustrate key points.
6. A mixture of management and technical issues for a balanced coverage of the topics.
7. Complete instructor materials (PowerPoint slides, course outline, project assignments) to support an academic or industrial course.