I found another book at Digital Guru: UC Davis Prof. Matt Bishop's Computer Security: Art and Science. Apparently, it's been out since early 2003, but this is the first copy I've seen. Bishop is well-known for the practical advice he's published on writing secure privileged programs.
I've only read the table of contents and dipped-in here and there, but it seems incredibly comprehensive. At a little less than 1100 pages, it's 58% the length of Russell and Whitehead.
It's got the obligatory chapter on Bell-LaPadula1, and three chapters on crypto, but that's out of 35 chapters. Less usual, and more welcome, is the chapter on identity, and the four chapter-long section on assurance. There are five chapters in the "End Matter" section that seem like padding (I mean, a does a chapter on symbolic logic belong in the book?), but there may be requirements in textbook publishing I don't understand.
Unfortunately, it doesn't have any material on security and economics or human factors; of course, that's a fault shared by almost all other books on computer security.2
As I said, it's quite comprehensive and it looks like a great combination reference and textbook. I'm glad I bought it. Now I've got 900-odd pages to go...
[1] The Bell-LaPadula Model was developed in the mid-60's as a formal description of the necessary properties for computer systems supporting military-style classification of information. There's a hierarchy of classification labels (e.g., Unclassified ← Confidential ← Secret ← Top Secret) for data, and system users have clearance to corresponding levels. Sigh. Most thinking about computer security has started from this point — too bad it has nothing to do with the requirements of real systems.
[2] With the exception of Ross Anderson's Security Engineering: A Guide to Building Dependable Distributed Systems. But Anderson's book actually has surprisingly little material on economics and the book is far less comprehensive than Bishop's.
No comments:
Post a Comment