Browse Books

Reviewer: Diomidis Spinellis

D.E.R. Denning's classic book [1] is 400 pages long. If a field's importance can be judged by the size of its textbooks, then security is certainly in the spotlight. At 845 pages, Charles and Shari Pfleeger's book will require me to rearrange my bookshelf of security books to make space for it. Yet, I would be hard-pressed to find material in it that could be removed. When the Pfleegers can choose between elaborating and outlining a topic, they will typically elaborate, adding examples, diagrams, and sidebars to illustrate its significance. Security experts may find this level of detail tiresome, but I'm sure that students and unversed professionals will appreciate it when trying to grapple with the hundreds of security concepts discussed in the book. The book's organization is eminently practical. After two chapters covering the problem of security in computing and the basics of cryptography, the next chapters of the book address security in specific fields: program code, general-purpose operating systems, trusted systems, databases, and networks. The relevant theory is covered close to the point where it is introduced. Although a separate discussion of security's terms and theoretical underpinnings may be more elegant, I've seen that students find such an approach tiring, if not sleep-inducing. The next four chapters are less technical, dealing with security administration, the economics of cybersecurity, privacy in computing, and legal and ethical issues. A final chapter, "Cryptography Explained," contains the nitty-gritty details of cryptographic algorithms that mercifully weren't covered in the book's second chapter. A further 32 pages of bibliographic references and a 29-page index complete the offering. All chapters end with a summary, an index of terms and concepts, a discussion of where the particular field is headed, references for further reading, and plentiful exercises. The exposition is aided by numerous clear diagrams, sidebars, and many examples. Some of the examples are oversimplified: for instance, in modern systems, a buffer overflow in a user's data area can't overwrite system data or program code, as shown on page 105. Nevertheless, a simplified example is better than an inscrutable one: readers wishing for an in-depth treatment of a particular topic can seek that in more specialized sources. This book's fourth edition adds new material to many of the previous edition's chapters, such as those on networking, operating system attacks and controls, and data mining. More significantly, the book also includes two new chapters, one on the economics of cybersecurity and one on privacy. Both are hot topics that merit the treatment they receive in the book. In summary, this is a valuable textbook, bringing a large, diverse field under one comfortable and spacious roof. Online Computing Reviews Service

Reviewer: Naga R Narayanaswamy

This book is to the field of computer security what Tanenbaum’s book [1] is to computer networks. It presents many aspects of computer security, such as threats, system vulnerabilities, cryptography, program code security, administration of computer systems, laws, privacy issues, and ethics. More than half of the book involves security in applications, operating systems, database management systems, and networks. Security is more important now than ever, as almost all parts of our daily lives are digitized. A few years ago, Microsoft mentioned that it intended to shift its focus from features to security and privacy. It made all of its developers attend a security training program. The crusade to make everything secure must start at the grassroots level of software development. In spite of all these efforts, problems continue to persist. With this in mind, this book is ideal for students and professionals alike. The book is up to date as of late 2006. It is updated to reflect changing times; the new edition includes topics such as wireless, biometrics authentication capabilities, and better software processes and approaches. The book is well organized. There is a bulleted summary at the beginning of each chapter with new terms placed in bold print. Each chapter also includes exercise questions; for example, “List three reasons why people might be reluctant to use biometrics for authentication and how to counter those objections.” There is a mini-index in each chapter as well. Terms and concepts are introduced in the first chapter. Cryptography and mathematical details are presented in two chapters. A lot of emphasis is placed on program security issues like buffer overflow, viruses, and rootkits. Since a computing system has several layers—its operating system, databases, networks, and storage—a weakness in the chain represents a system vulnerability. So, for example, the authors have described in one chapter how to design a trusted operating system. They have tried to avoid specific implementations or platforms. The chapter on network security is the book’s longest, and I was disappointed that Internet protocol security (IPSec) and secure sockets layer (SSL) have only two pages devoted to them. I am not a fan of including Web site addresses in a book, and I found a Web site referred to in chapter 7 to be nonexistent. Policies, ethics, and many nontechnical aspects of security are presented in concluding chapters. Some of the future trends like electronic voting are described briefly. Overall, the book is a definite reference source for various people who are interested in understanding security issues. Though the book addresses computers in general, the principles can be applied to mobile phones, smartphones, personal digital assistants (PDAs), and many other gadgets we use in our daily lives. Online Computing Reviews Service