Browse Books

Reviewer: Stanley A. Kurzban

The second edition of Pfleeger's book, knowledgeably corrected and supplemented with material from outside the cryptological and US Department of Defense (DoD) communities, can serve its primary intended audience of students and professors extraordinarily well as a textbook for a one- or two-semester course in computer security. Contrary to the assertion in the preface, however, it does not “function equally well as a reference for a computer professional”: such an individual would find it woefully incomplete and too often misleading or inaccurate. Those familiar with the first edition [1] will find that the second has new material on malicious code, firewalls, electronic mail, federal cryptographic initiatives, the program development process, and administration. All are welcome, though any material on malicious code and federal initiatives must quickly lose currency. Material retained from the first edition—most of it excellent, well organized, and well presented—deals with security in general; cryptography; security for operating systems, databases, and networks; administration; and ethics. Although written by a member of the DoD community and biased toward the peculiar concerns thereof, the book treats such concerns as law, administration, human factors, and mainframe commercial systems relatively well and comprehensively. There are exercises after each chapter and a respectable index. The bibliography is extensive, yet has few references to the huge and tremendously useful segment of the literature that the DoD community has not dominated. The book's greatest weakness is inappropriate emphasis. The author includes “integrity” within the scope of “security” and includes authorized acts among those that can compromise integrity. In fact, the most prevalent sources of loss are errors and misuse of authority. Nonetheless, the author devotes almost none of the book to them, focusing instead on prevention of unauthorized acts. Aside from one virus and one worm, the author offers no example of any fraud or crime that caused great loss and resulted from an unauthorized act. Astonishingly and tellingly, a seven-page section on covert channels ends frankly with the accurate observation that “reports of covert channel attacks just do not exist.” Despite the book's attention to cracking, it hardly touches on the subject of user-friendly password mechanisms. (When it does, it touts supposedly pronounceable system-chosen passwords, but ignores voluminous literature on better methods.) In a few places the book is simply inaccurate. Contrary to the author's assertion, courts have accepted media as adequate evidence. Although the book aptly uses the terms “apocryphal” and “legendary” with reference to salami attacks, it goes on to state falsely that “roundoff error can be substantial.” The author treats several items superficially or even dismissively. The brief discussion of unattended session control does not refer to the subsequent discussion of time-out mechanisms. The author leaves a false impression of mainframes' vulnerability to viruses by, among other things, failing to relate program protection to viruses. The brief section on biometric means of identity verification makes no mention of signature dynamics. The value of a vendor's commitment to the integrity of its systems or the systems' history of robustness is inaccurately portrayed and dismissed out of hand, and the problem of distributing fixes without alerting potential abusers to systems' flaws receives no attention at all. The author says nothing about the fact that unmotivated users will ignore “LAST LOG-ON AT” messages; or about defensive measures and opponents' countermeasures that apply to the detection of successive unsuccessful attempts to log on; or about the legal implications of first displays shown to those who call into systems. All in all, while there is much about computer security that the book treats inadequately or misleadingly, it can serve students and professors seeking a useful basic text. The field is very large, and those who need comprehensive and scrupulously accurate material can consult Ruthberg and Tipton [2 ].