Computer Security Principles and Practice 5Th Edition William Stallings Full Chapter

Computer Security Principles and
Practice 5th Edition William Stallings

Visit to download the full and correct content document:
https://ebookmass.com/product/computer-security-principles-and-practice-5th-edition-
william-stallings/
Page 1 of 1641
Computer Security
Principles and Practice
Fifth Edition
William Stallings
Lawrie Brown
UNSW Canberra at the Australian Defence Force Academy
Page 2 of 1641
Content Management: Tracy Johnson
Content Production: Dr Rajul Jain
Product Management: Tracy Johnson
Product Marketing: Krista Clark and Wayne Stevens
Rights and Permissions: Chandan Kumar
Please contact https://support.pearson.com/getsupport/s/
with any queries on this content.
Cover Image by ra2studio/123RF.
Microsoft and/or its respective suppliers make no
representations about the suitability of the information
contained in the documents and related graphics published
as part of the services for any purpose. All such documents
and related graphics are provided “as is” without warranty of
any kind. Microsoft and/or its respective suppliers hereby
disclaim all warranties and conditions with regard to this
information, including all warranties and conditions of
merchantability, whether express, implied or statutory,
fitness for a particular purpose, title and non-infringement. In
no event shall Microsoft and/or its respective suppliers be
liable for any special, indirect or consequential damages or
any damages whatsoever resulting from loss of use, data or
profits, whether in an action of contract, negligence or other
tortious action, arising out of or in connection with the use or
performance of information available from the services.
The documents and related graphics contained herein could

include technical inaccuracies or typographical errors.
Page 3 of 1641
Changes are periodically added to the information herein.
Microsoft and/or its respective suppliers may make
improvements and/or changes in the product(s) and/or the
program(s) described herein at any time. Partial screen shots
may be viewed in full within the software version specified.
Microsoft® and Windows® are registered trademarks of the

Microsoft Corporation in the U.S.A. and other countries. This
book is not sponsored or endorsed by or affiliated with the
Microsoft Corporation.
Copyright © 2024, 2018, 2015 by Pearson Education, Inc. or

its affiliates, 221 River Street, Hoboken, NJ 07030. All Rights
Reserved. Manufactured in the United States of America. This
publication is protected by copyright, and permission should
be obtained from the publisher prior to any prohibited
reproduction, storage in a retrieval system, or transmission in
any form or by any means, electronic, mechanical,
photocopying, recording, or otherwise. For information
regarding permissions, request forms, and the appropriate
contacts within the Pearson Education Global Rights and
Permissions department, please visit
www.pearsoned.com/permissions/.
Acknowledgments of third-party content appear on the

appropriate page within the text.
PEARSON is an exclusive trademark owned by Pearson

Education, Inc. or its affiliates in the U.S. and/or other
countries.
Page 4 of 1641
Unless otherwise indicated herein, any third-party
trademarks, logos, or icons that may appear in this work are
the property of their respective owners, and any references
to third-party trademarks, logos, icons, or other trade dress
are for demonstrative or descriptive purposes only. Such
references are not intended to imply any sponsorship,
endorsement, authorization, or promotion of Pearson’s
products by the owners of such marks, or any relationship
between the owner and Pearson Education, Inc., or its
affiliates, authors, licensees, or distributors.
Library of Congress Cataloging-in-Publication Data
Names: Stallings, William, author. | Brown, Lawrie, author.
Title: Computer security : principles and practice / William

Stallings, Lawrie Brown, UNSW Canberra at the Australian
Defence Force Academy.
Description: Fifth edition. | Hoboken, NJ : Pearson Education,

Inc., [2024] | Includes bibliographical references and index.
Identifiers: LCCN 2023000040 | ISBN 9780138091675

(hardcover) | ISBN 0138091676 (hardcover)
Subjects: LCSH: Computer security. | Computer networks—

Security measures.
Classification: LCC QA76.9.A25 S685 2024 | DDC 005.8—

dc23/eng/20230109
Page 5 of 1641
LC record available at https://lccn.loc.gov/2023000040
ISBN-10: 0-13-809167-6
ISBN-13: 978-0-13-809167-5
Scout Automated Print Code
Page 6 of 1641
For my loving wife, Tricia
—WS
To my extended family and friends, who helped make this all possible
—LB
Page 7 of 1641
Pearson’s Commitment to Diversity, Equity,
and Inclusion
Pearson is dedicated to creating bias-free content that reflects the diversity, depth, and
breadth of all learners’ lived experiences.
We embrace the many dimensions of diversity, including but not limited to race, ethnicity,
gender, sex, sexual orientation, socioeconomic status, ability, age, and religious or political
beliefs.
Education is a powerful force for equity and change in our world. It has the potential to
deliver opportunities that improve lives and enable economic mobility. As we work with
authors to create content for every product and service, we acknowledge our responsibility to
demonstrate inclusivity and incorporate diverse scholarship so that everyone can achieve
their potential through learning. As the world’s leading learning company, we have a duty to
help drive change and live up to our purpose to help more people create a better life for
themselves and to create a better world.
Our ambition is to purposefully contribute to a world where:
• Everyone has an equitable and lifelong opportunity to succeed through learning.

• Our educational content accurately reflects the histories and lived experiences of the
learners we serve.
• Our educational products and services are inclusive and represent the rich diversity of
learners.
• Our educational content prompts deeper discussions with students and motivates them
to expand their own learning (and worldview).
Accessibility
We are also committed to providing products that are fully accessible to all learners. As per
Pearson’s guidelines for accessible educational Web media, we test and retest the capabilities
of our products against the highest standards for every release, following the WCAG
guidelines in developing new products for copyright year 2022 and beyond.
You can learn more about Pearson’s commitment to accessibility at

https://www.pearson.com/us/accessibility.html
Contact Us
While we work hard to present unbiased, fully accessible content, we want to hear from you
about any concerns or needs with this Pearson product so that we can investigate and address
them.
Please contact us with concerns about any potential bias at

https://www.pearson.com/report-bias.html
Page 8 of 1641
For accessibility-related issues, such as using assistive technology with Pearson products,
alternative text requests, or accessibility documentation, email the Pearson Disability Support
team at disability.support@pearson.com
Page 9 of 1641
Preface
What’s New in the Fifth Edition
Since the fourth edition of this book was published, the field has seen continued innovations
and improvements. In this new edition, we try to capture these changes while maintaining a
broad and comprehensive coverage of the entire field. There have been a number of
refinements to improve pedagogy and user-friendliness, updated references, and mention of
recent security incidents, along with a number of more substantive changes throughout the
book. The most noteworthy of these changes include:
• Multi-factor authentication and mobile authentication: Chapter 3 includes a new

discussion on multi-factor authentication (MFA) in which the user presents two or
more pieces of evidence (or factors) to verify their identity. This is increasingly used
to address the known problems with just using a password for authentication. This is
commonly done using either a hardware authentication token, or using SMS text
messages or an authentication app on mobile devices, as we discuss.
• Mandatory access control (MAC): Chapter 4 includes some revised discussion on
mandatory access controls that was previously included in the online Chapter 27.
These controls are now included as part of the underlying security enhancements in
recent releases of some Linux, macOS, and Windows systems.
• Social engineering and ransomware attacks: The discussion in Chapters 6 and 8 on
social engineering, and its use in enabling ransomware attacks have been updated,
reflecting the growing incidence of such attacks, and the need to defend against them.
These defenses include improved security awareness training, as we discuss in
Chapter 17.
• Supply-chain and business email compromise attacks: Chapter 8 includes new
discussion on the growth of supply-chain and business email compromise (BEC)
attacks, including the recent SolarWinds attack, which have been used to compromise
many commercial and government organizations in recent years.
• Updated list of the most dangerous software errors: Chapter 11 includes an
updated list of the Top 25 Most Dangerous Software Errors. It also discusses the
recent widely exploited code injection attack on the Apache Log4j package.
• Updated list of essential controls: Chapter 12 includes updated lists of essential
controls, including the Australian Signals Directorate’s “Essential Eight” that should
be used by all organizations to improve the security of their operating systems.
• Trusted computer systems: Chapter 12 includes some revised discussion on trusted
computer systems that was previously included in the online Chapter 27, which is
relevant to the use of secure systems in some government organizations.
• Updated list of security controls: Chapter 15 includes a significantly updated list of
the NIST security controls that should be considered when addressing identified
security risks in organizations.
• Security awareness and training: Chapter 17 includes a significantly revised section
on security awareness and training for personnel, which is of increasing importance
given the rise in security incidents that result from deliberate or accidental personnel
actions.
• European Union (EU) General Data Protection Regulation (GDPR): Chapter 19
includes a new section on the EU’s 2016 GDPR that is effectively the global standard
for the protection of personal data, its collection, access, and use.
Page 10 of 1641
• The ChaCha20 stream cipher: Chapter 20 includes a new section with details of the
ChaCha20 stream cipher, replacing details of the now depreciated RC4 cipher.
• Galois Counter Mode: Appendix E now includes details of the new Galois Counter
authenticated encryption mode of use for block ciphers.
Background
Interest in education in computer security and related topics has been growing at a dramatic
rate in recent years. This interest has been spurred by a number of factors, two of which stand
out:
1. As information systems, databases, and Internet-based distributed systems and

communication have become pervasive in the commercial world, coupled with the
increased intensity and sophistication of security-related attacks, organizations now
recognize the need for a comprehensive security strategy. This strategy encompasses
the use of specialized hardware and software and trained personnel to meet that need.
2. Computer security education, often termed information security education or
information assurance education, has emerged as a national goal in the United States
and other countries, with national defense and homeland security implications. The
NSA/DHS National Center of Academic Excellence in Information Assurance/Cyber
Defense is spearheading a government role in the development of standards for
computer security education.
Accordingly, the number of courses in universities, community colleges, and other

institutions in computer security and related areas is growing.
Objectives
The objective of this book is to provide an up-to-date survey of developments in computer
security. Central problems that confront security designers and security administrators
include defining the threats to computer and network systems, evaluating the relative risks of
these threats, and developing cost-effective and user friendly countermeasures.
The following basic themes unify the discussion:
• Principles: Although the scope of this book is broad, there are a number of basic
principles that appear repeatedly as themes and that unify this field. Examples are
issues relating to authentication and access control. The book highlights these
principles and examines their application in specific areas of computer security.
• Design approaches: The book examines alternative approaches to meeting specific
computer security requirements.
• Standards: Standards have come to assume an increasingly important, indeed
dominant, role in this field. An understanding of the current status and future direction
of technology requires a comprehensive discussion of the related standards.
• Real-world examples: A number of chapters include a section that shows the

practical application of that chapter’s principles in a real-world environment.
Support of ACM/IEEE Cybersecurity Curricula 2017
Page 11 of 1641
The book is intended for both an academic and a professional audience. As a textbook, it is
intended as a one- or two-semester undergraduate course for computer science, computer
engineering, and electrical engineering majors. This edition is designed to support the
recommendations of the ACM/IEEE Cybersecurity Curricula 2017 (CSEC2017). The
CSEC2017 curriculum recommendation includes eight knowledge areas. Table P.1 shows the
support for the these knowledge areas provided in this textbook. It also identifies six
crosscutting concepts that are designed to help students explore connections among the
knowledge areas, and are fundamental to their ability to understand the knowledge area
regardless of the underlying computing discipline. These concepts, which are topics we
introduce in Chapter 1, are as follows:
• Confidentiality: Rules that limit access to system data and information to authorized
persons.
• Integrity: Assurance that the data and information are accurate and trustworthy.
• Availability: The data, information, and system are accessible.
• Risk: Potential for gain or loss.
• Adversarial thinking: A thinking process that considers the potential actions of the
opposing force working against the desired result.
• Systems thinking: A thinking process that considers the interplay between social and
technical constraints to enable assured operations.
Table P.1
Coverage of CSEC2017 Cybersecurity Curricula
Knowledge Units Essentials Textbook Coverage
Data Security • Basic cryptography concepts Part 1—Network Security

• Digital forensics Technology and Principles
• End-to-end secure Part 3—Management Issues
communications Part 4—Cryptographic
• Data integrity and Algorithms
authentication Part 5—Network Security
• Information storage security
Software Security • Fundamental design principles 1—Overview

including least privilege, open Part 2—Software Security
design, and abstraction 19—Legal and Ethical Aspects
• Security requirements and role
in design
• Implementation issues
• Static and dynamic testing
• Configuring and patching
• Ethics, especially in
development, testing and
vulnerability disclosure
Component Security • Vulnerabilities of system 1—Overview

components 8—Intrusion Detection
• Component lifecycle 10—Buffer Overflow
11—Software Security
Page 12 of 1641
• Secure component design
principles
• Supply chain management
security
• Security testing
• Reverse engineering
Connection Security • Systems, architecture, models, Part 5—Network Security

and standards 8—Intrusion Detection
• Physical component interfaces 9—Firewalls and Intrusion
• Software component interfaces Prevention Systems
• Connection attacks 13—Cloud and IoT Security
• Transmission attacks
System Security • Holistic approach 1—Overview

• Security policy 3—User Authentication
• Authentication 4—Access Control
• Access control 14—IT Security Management
• Monitoring and Risk Assessment
• Recovery 15—IT Security Controls, Plans,
• Testing and Procedures
• Documentation
Human Security • Identity management 3—User Authentication

• Social engineering 4—Access Control
• Awareness and understanding 6—Malicious Software
• Social behavioral privacy and 17—Human Resources Security
security 19—Legal and Ethical Aspects
• Personal data privacy and
security
Organizational • Risk management 14—IT Security Management

Security • Governance and policy and Risk Assessment
• Laws, ethics, and compliance 15—IT Security Controls, Plans,
• Strategy and planning and Procedures
17—Human Resources Security
19—Legal and Ethical Aspects
Societal Security • Cybercrime 8—Intrusion Detection
• Cyber law 19—Legal and Ethical Aspects
• Cyber ethics
• Cyber policy
• Privacy
This text discusses all of these knowledge areas and crosscutting concepts.
Coverage of CISSP Subject Areas
Page 13 of 1641
This book provides coverage of all the subject areas specified for CISSP (Certified
Information Systems Security Professional) certification. The CISSP designation from the
International Information Systems Security Certification Consortium is often referred
to as the “gold standard” when it comes to information security certification. It is the only
universally recognized certification in the security industry. Many organizations, including
the U.S. Department of Defense and many financial institutions, now require that cyber
security personnel have the CISSP certification. In 2004, CISSP became the first IT program
to earn accreditation under the international standard ISO/IEC 17024 (General Requirements
for Bodies Operating Certification of Persons).
The CISSP examination is based on the Common Body of Knowledge (CBK), a compendium
of information security best practices developed and maintained by , a nonprofit
organization. The CBK is made up of 8 domains that comprise the body of knowledge that is
required for CISSP certification.
The eight domains are as follows, with an indication of where the topics are covered in this
textbook:
• Security and risk management: Confidentiality, integrity, and availability concepts;

security governance principles; risk management; compliance; legal and regulatory
issues; professional ethics; and security policies, standards, procedures, and
guidelines. (Chapter 14)
• Asset security: Information and asset classification; ownership (e.g. data owners,
system owners); privacy protection; appropriate retention; data security controls; and
handling requirements (e.g., markings, labels, storage). (Chapters 5, 15, 16, 19)
• Security architecture and engineering: Engineering processes using secure design
principles; security models; security evaluation models; security capabilities of
information systems; security architectures, designs, and solution elements
vulnerabilities; web-based systems vulnerabilities; mobile systems vulnerabilities;
embedded devices and cyber-physical systems vulnerabilities; cryptography; and site
and facility design secure principles; physical security. (Chapters 1, 2, 13, 15, 16)
• Communication and network security: Secure network architecture design (e.g., IP
and non-IP protocols, segmentation); secure network components; secure
communication channels; and network attacks. (Part Five)
• Identity and access management: Physical and logical assets control; identification
and authentication of people and devices; identity as a service (e.g. cloud identity);
third-party identity services (e.g., on-premise); access control attacks; and identity and
access provisioning lifecycle (e.g., provisioning review). (Chapters 3, 4, 8, 9)
• Security assessment and testing: Assessment and test strategies; security process
data (e.g., management and operational controls); security control testing; test outputs
(e.g., automated, manual); and security architectures vulnerabilities. (Chapters 14, 15,
18)
• Security operations: Investigations support and requirements; logging and
monitoring activities; provisioning of resources; foundational security operations
concepts; resource protection techniques; incident management; preventative
measures; patch and vulnerability management; change management processes;
recovery strategies; disaster recovery processes and plans; business continuity
planning and exercises; physical security; and personnel safety concerns. (Chapters
11, 12, 15, 16, 17)
Page 14 of 1641
• Software development security: Security in the software development lifecycle;
development environment security controls; software security effectiveness; and
acquired software security impact. (Part Two)
Support for NCAE-C Certification

The National Centers of Academic Excellence in Cybersecurity (NCAE-C) program is
managed by the National Security Agency, with partners including the Cybersecurity and
Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI). The
NCAE-C program office collaborates closely with the National Institute of Standards and
Technology (NIST), the National Science Foundation (NSF), the Department of Defense
Office of the Chief Information Officer (DoD-CIO), and US Cyber Command
(CYBERCOM). The goal of this program is to promote higher education and research in
cyber defense and produce professionals with cyber defense expertise in order expand to the
cybersecurity workforce and to reduce vulnerabilities in our national infrastructure.
Academic institutions may choose from three designations: Cyber Defense, Cyber Research,
and Cyber Operations. To achieve that purpose, NSA/DHS have defined a set of Knowledge
Units that must be supported in the curriculum to gain NCAE-C designation. Each
Knowledge Unit is composed of a minimum list of required topics to be covered and one or
more outcomes or learning objectives. Designation is based on meeting a certain threshold
number of core and optional Knowledge Units. In the area of Cyber Defense, the 2022
Foundational Knowledge Units are as follows:
• Cybersecurity foundations: Provides students with a basic understanding of the

fundamental concepts behind cybersecurity including attacks, defenses, and incidence
response.
• Cybersecurity principles: Provides students with basic security design fundamentals
that help create systems that are worthy of being trusted.
• IT systems components: Provides students with a basic understanding of the
hardware and software components in an information technology system and their
roles in system operation.
This book provides extensive coverage in these foundational areas, as well as coverage of
many of the other technical, nontechnical, and optional Knowledge Units.
Plan of the Text

The book is divided into five parts (see Chapter 0):
• Computer Security Technology and Principles

• Software and System Security
• Management Issues
• Cryptographic Algorithms
• Network Security
The text includes an extensive glossary, a list of frequently used acronyms, and a
bibliography. Each chapter includes homework problems, review questions, a list of key
words, and suggestions for further reading.
Page 15 of 1641
Student Resources
For this new edition, a tremendous amount of original supporting material for students is
available online at pearsonhighered.com/stallings. The Companion Website, at
Pearsonhighered.com/cs-resources (search for Stallings).
The Companion Website contains the following support materials:
• Homework problems and solutions: In addition to the homework problems in the

book, more homework problems and solutions are made available to students to test
their understanding and deepen learning.
• Support Files: Provides collections of useful papers and a Recommended Reading
list.
Instructor Support Materials
Page 16 of 1641
The major goal of this text is to make it as effective a teaching tool for this exciting and fast-
moving subject as possible. This goal is reflected both in the structure of the book and in the
supporting material. The text is accompanied by the following supplementary material to aid
the instructor:
• Projects manual: Project resources including documents and portable software, plus
suggested project assignments for all of the project categories listed in the following
section
• Solutions manual: Solutions to end-of-chapter Review Questions and Problems
• PowerPoint slides: A set of slides covering all chapters, suitable for use in lecturing
• PDF files: Reproductions of all figures and tables from the book
• Test bank: A chapter-by-chapter set of questions
All of these support materials are available on the Instructor Resource Center (IRC) for this
textbook, which can be reached through the publisher’s Website www.pearsonhighered.com.
To gain access to the IRC, please contact your local Pearson sales representative via
https://www.pearson.com/us/contact-us/find-your-rep.html or call Pearson Faculty Services
at 1-800-922-0579.
Projects and Other Student Exercises

For many instructors, an important component of a computer security course is a project or
set of projects by which the student gets hands-on experience to reinforce concepts from the
text. The instructor’s support materials created for this text not only include guidance on how
to assign and structure the projects but also include a set of user manuals for various project
types and assignments, all written especially for this book. Instructors can assign work in the
following areas:
• Hacking exercises: Two projects that enable students to gain an understanding of the
issues in intrusion detection and prevention.
• Laboratory exercises: A series of projects that involve programming and
experimenting with concepts from the book.
• Security education (SEED) projects: The SEED projects are a set of hands-on
exercises, or labs, covering a wide range of security topics.
• Research projects: A series of research assignments that instruct the students to
research a particular topic on the Internet and write a report.
• Programming projects: A series of programming projects that cover a broad range
of topics and that can be implemented in any suitable language on any platform.
• Practical security assessments: A set of exercises to examine current infrastructure
and practices of an existing organization.
• Firewall projects: A portable network firewall visualization simulator is provided,
together with exercises for teaching the fundamentals of firewalls.
• Case studies: A set of real-world case studies, including learning objectives, case
description, and a series of case discussion questions.
• Reading/report assignments: A list of papers that can be assigned for reading and
writing a report, plus suggested assignment wording
• Writing assignments: A list of writing assignments to facilitate learning the material.
Page 17 of 1641
This diverse set of projects and other student exercises enables the instructor to use the book
as one component in a rich and varied learning experience and to tailor a course plan to meet
the specific needs of the instructor and students. See Appendix A in this book for details.
Acknowledgments
This new edition has benefited from review by a number of people, who gave generously of
their time and expertise. The following professors and instructors reviewed all or a large part
of the manuscript: Bernardo Palazzi (Brown University), Jean Mayo (Michigan
Technological University), Scott Kerlin (University of North Dakota), Philip Campbell (Ohio
University), Scott Burgess (Humboldt State University), Stanley Wine (Hunter
College/CUNY), and E. Mauricio Angee (Florida International University).
Thanks also to the many people who provided detailed technical reviews of one or more
chapters: Umair Manzoor (UmZ), Adewumi Olatunji (FAGOSI Systems, Nigeria), Rob
Meijer, Robin Goodchil, Greg Barnes (Inviolate Security LLC), Arturo Busleiman (Buanzo
Consulting), Ryan M. Speers (Dartmouth College), Wynand van Staden (School of
Computing, University of South Africa), Oh Sieng Chye, Michael Gromek, Samuel
Weisberger, Brian Smithson (Ricoh Americas Corp, CISSP), Josef B. Weiss (CISSP),
Robbert-Frank Ludwig (Veenendaal, ActStamp Information Security), William Perry,
Daniela Zamfiroiu (CISSP), Rodrigo Ristow Branco, George Chetcuti (Technical Editor,
TechGenix), Thomas Johnson (Director of Information Security at a banking holding
company in Chicago, CISSP), Robert Yanus (CISSP), Rajiv Dasmohapatra (Wipro Ltd), Dirk
Kotze, Ya’akov Yehudi, and Stanley Wine (Adjunct Lecturer, Computer Information
Systems Department, Zicklin School of Business, Baruch College).
Dr. Lawrie Brown would first like to thank Bill Stallings for the pleasure of working with
him to produce this text. I would also like to thank my colleagues in the School of
Engineering and Information Technology, UNSW Canberra at the Australian Defence Force
Academy for their encouragement and support. In particular, thanks to Gideon Creech,
Edward Lewis, and Ben Whitham for discussion and review of some of the chapter content.
Finally, we would like to thank the many people responsible for the publication of the book,
all of whom did their usual excellent job. This includes the staff at Pearson, particularly our
editor Tracy Johnson, with support from Carole Snyder, Erin Sullivan, and Rajul Jain. Also
Mahalakshmi Usha and the team at Integra for their support with the production of the book.
Thanks also to the marketing and sales staffs at Pearson, without whose efforts this book
would not be in front of you.
Page 18 of 1641
Notation
Symbol Expression Meaning
D, K Symmetric decryption of ciphertext Y using secret key
K
Asymmetric decryption of ciphertext Y using A’s
private key
Asymmetric decryption of ciphertext Y using A’s
public key
E, K Symmetric encryption of plaintext X using secret key
K
Asymmetric encryption of plaintext X using A’s
private key
K Secret key
Private key of user A
Public key of user A
H Hash function of message X
Logical OR: x OR y
Logical AND: x AND y
Logical NOT: NOT x
C A characteristic formula, consisting of a logical

formula over the values of attributes in a database
Page 19 of 1641
X Query set of C, the set of records satisfying C
Magnitude of : the number of records in
Set intersection: the number of records in both

and
x concatenated with y
Page 20 of 1641
About the Authors
Dr. William Stallings has authored 18 textbooks, and, counting revised editions, a total of 70
books on various aspects of these subjects. His writings have appeared in numerous ACM
and IEEE publications, including the Proceedings of the IEEE and ACM Computing Reviews.
He has 13 times received the award for the best Computer Science textbook of the year from
the Text and Academic Authors Association.
In over 30 years in the field, he has been a technical contributor, technical manager, and an
executive with several high-technology firms. He has designed and implemented both
TCP/IP-based and OSI-based protocol suites on a variety of computers and operating
systems, ranging from microcomputers to mainframes. Currently he is an independent
consultant whose clients have included computer and networking manufacturers and
customers, software development firms, and leading-edge government research institutions.
He created and maintains the Computer Science Student Resource Site at Computer
ScienceStudent.com. This site provides documents and links on a variety of subjects of
general interest to computer science students (and professionals). He is a member of the
editorial board of Cryptologia, a scholarly journal devoted to all aspects of cryptology.
Page 21 of 1641
Dr. Lawrie Brown is a visiting senior lecturer in the School of Engineering and Information
Technology, UNSW Canberra at the Australian Defence Force Academy.
His professional interests include communications and computer systems security and
cryptography, including research on pseudo-anonymous communication, authentication,
security and trust issues in Web environments, the design of secure remote code execution
environments using the functional language Erlang, and on the design and implementation of
the LOKI family of block ciphers.
During his career, he has presented courses on cryptography, cybersecurity, data

communications, data structures, and programming in Java to both undergraduate and
postgraduate students.
Page 22 of 1641
Pearson’s Commitment to Diversity, Equity, and Inclusion...................................................... 8
Preface...................................................................................................................................... 10
What’s New in the Fifth Edition .......................................................................................... 10
Background .......................................................................................................................... 11
Objectives ............................................................................................................................. 11
Support of ACM/IEEE Cybersecurity Curricula 2017 ........................................................ 11
Table P.1 ....................................................................................................................... 12
Coverage of CSEC2017 Cybersecurity Curricula ........................................................ 12
Coverage of CISSP Subject Areas ....................................................................................... 13
Support for NCAE-C Certification ...................................................................................... 15
Plan of the Text .................................................................................................................... 15
Student Resources ................................................................................................................ 16
Instructor Support Materials................................................................................................. 16
Projects and Other Student Exercises................................................................................... 17
Acknowledgments ................................................................................................................ 18
Learning Objectives ............................................................................................................. 37
1.1 Computer Security Concepts ............................................................................................. 39
A Definition of Computer Security ...................................................................................... 39
Figure 1.1 Essential Network and Computer Security Requirements .......................... 40
Examples .............................................................................................................................. 41
Confidentiality .................................................................................................................. 41
Integrity ............................................................................................................................ 41
An example of a low-integrity requirement is an anonymous online poll. Many websites,
such as news organizations, offer these polls to their users with very few safeguards.
However, the inaccuracy and unscientific nature of such polls is well
understoodAvailability ..................................................................................................... 42
The Challenges of Computer Security ................................................................................. 43
Table 1.1 ....................................................................................................................... 44
Computer Security Terminology .................................................................................. 44
1.2 Threats, Attacks, and Assets .............................................................................................. 47
Threats and Attacks .............................................................................................................. 47
Confidentiality .................................................................................................................. 50
Integrity ............................................................................................................................ 50
Availability ....................................................................................................................... 51
Threats and Attacks .............................................................................................................. 52
Table 1.2 Threat Consequences and the Types of Threat Actions that Cause Each
Consequence ................................................................................................................. 52
Threats and Assets ................................................................................................................ 55
Figure 1.3 Scope of Computer Security ........................................................................ 55
Page 23 of 1641
Table 1.3 Computer and Network Assets, with Examples of Threats .......................... 55
Hardware .......................................................................................................................... 56
Software ............................................................................................................................ 56
Data ................................................................................................................................... 56
Communication Lines and Networks ............................................................................... 57
1.3 Security Functional Requirements ..................................................................................... 59
1.4 Fundamental Security Design Principles ........................................................................... 62
1.5 Attack Surfaces and Attack Trees ...................................................................................... 66
Attack Surfaces .................................................................................................................... 67
Figure 1.4 Defense in Depth and Attack Surface ......................................................... 67
Attack Trees ......................................................................................................................... 68
1.6 Computer Security Strategy ............................................................................................... 71
Security Policy ..................................................................................................................... 72
Assurance and Evaluation .................................................................................................... 73
1.7 Standards ............................................................................................................................ 74
1.8 Key Terms, Review Questions, and Problems................................................................... 75
Key Terms ............................................................................................................................ 75
Review Questions ................................................................................................................. 77
Problems ............................................................................................................................... 78
2.1 Confidentiality with Symmetric Encryption ...................................................................... 82
Symmetric Encryption.......................................................................................................... 83
Figure 2.1 ...................................................................................................................... 83
Simplified Model of Symmetric Encryption................................................................. 83
Symmetric Block Encryption Algorithms ............................................................................ 84
Data Encryption Standard ................................................................................................. 85
Triple DES ........................................................................................................................ 86
Advanced Encryption Standard ........................................................................................ 87
Practical Security Issues ................................................................................................... 87
Stream Ciphers ..................................................................................................................... 88
2.2 Message Authentication and Hash Functions .................................................................... 90
Authentication Using Symmetric Encryption ...................................................................... 90
Message Authentication without Message Encryption ........................................................ 91
Message Authentication Code .......................................................................................... 92
One-Way Hash Function .................................................................................................. 94
Secure Hash Functions ......................................................................................................... 97
Hash Function Requirements............................................................................................ 98
Security of Hash Functions............................................................................................... 99
Secure Hash Function Algorithms .................................................................................... 99
Page 24 of 1641
Other Applications of Hash Functions ............................................................................... 100
2.3 Public-Key Encryption..................................................................................................... 101
Public-Key Encryption Structure ....................................................................................... 102
Applications for Public-Key Cryptosystems ...................................................................... 105
Requirements for Public-Key Cryptography...................................................................... 106
Asymmetric Encryption Algorithms .................................................................................. 107
RSA ................................................................................................................................ 108
Diffie–Hellman Key Agreement .................................................................................... 108
Digital Signature Standard.............................................................................................. 108
Elliptic Curve Cryptography .......................................................................................... 108
2.4 Digital Signatures and Key Management ........................................................................ 110
Digital Signature ................................................................................................................ 110
Public-Key Certificates ...................................................................................................... 112
Symmetric Key Exchange Using Public-Key Encryption ................................................. 114
Digital Envelopes ............................................................................................................... 115
2.5 Random and Pseudorandom Numbers ............................................................................. 118
The Use of Random Numbers ............................................................................................ 118
Randomness .................................................................................................................... 119
Unpredictability .............................................................................................................. 120
Random versus Pseudorandom .......................................................................................... 120
2.6 Practical Application: Encryption of Stored Data ........................................................... 121
2.7 Key Terms, Review Questions, and Problems................................................................. 123
Key Terms .......................................................................................................................... 123
Review Questions ............................................................................................................... 125
Problems ............................................................................................................................. 126
A Model for Digital User Authentication .......................................................................... 132
Means of Authentication .................................................................................................... 134
Multifactor Authentication ................................................................................................. 134
Assurance Levels for User Authentication......................................................................... 136
3.2 Password-Based Authentication ...................................................................................... 137
The Vulnerability of Passwords ......................................................................................... 138
The Use of Hashed Passwords ........................................................................................... 140
UNIX Implementations .................................................................................................. 143
Password Cracking of User-Chosen Passwords ................................................................. 143
Traditional Approaches .................................................................................................. 144
Modern Approaches ....................................................................................................... 145
Password File Access Control ............................................................................................ 146
Password Selection Strategies ............................................................................................ 147
Page 25 of 1641
Rule Enforcement ........................................................................................................... 149
Password Checker........................................................................................................... 149
Bloom Filter .................................................................................................................... 150
3.3 Token-Based Authentication ........................................................................................... 150
Memory Cards .................................................................................................................... 151
Smart Cards ........................................................................................................................ 152
Electronic Identity Cards .................................................................................................... 154
Eid Functions .................................................................................................................. 155
Password Authenticated Connection Establishment (PACE) ........................................ 157
Hardware Authentication Tokens....................................................................................... 158
Authentication Using a Mobile Phone ............................................................................... 161
3.4 Biometric Authentication ................................................................................................. 163
Physical Characteristics Used in Biometric Applications .................................................. 164
Operation of a Biometric Authentication System .............................................................. 166
Figure 3.8 A Generic Biometric System ..................................................................... 167
Biometric Accuracy............................................................................................................ 167
3.5 Remote User Authentication ............................................................................................ 171
Password Protocol .............................................................................................................. 172
Figure 3.12 Basic Challenge-Response Protocols for Remote User Authentication .. 172
Token Protocol ................................................................................................................... 173
Static Biometric Protocol ................................................................................................... 174
Dynamic Biometric Protocol .............................................................................................. 175
3.6 Security Issues for User Authentication .......................................................................... 176
3.7 Practical Application: An Iris Biometric System............................................................. 179
3.8 Case Study: Security Problems for ATM Systems .......................................................... 182
Key Terms .......................................................................................................................... 184
Problems ............................................................................................................................. 186
Learning Objectives ........................................................................................................... 189
4.1 Access Control Principles ................................................................................................ 191
Access Control Context ...................................................................................................... 192
Figure 4.1 Relationship among Access Control and Other Security Functions ......... 192
Access Control Policies ...................................................................................................... 194
4.2 Subjects, Objects, and Access Rights .............................................................................. 195
4.3 Discretionary Access Control .......................................................................................... 196
Figure 4.2 Example of Access Control Structures ...................................................... 196
Table 4.2 Authorization Table for Files in Figure 4.2 ................................................ 198
Page 26 of 1641
An Access Control Model .................................................................................................. 199
Figure 4.3 Extended Access Control Matrix............................................................... 199
Figure 4.4 An Organization of the Access Control Function ..................................... 200
Table 4.3 Access Control System Commands ............................................................ 201
The ability of one subject to create another subject and to have ‘owner’ access right to
that subject can be used to define a hierarchy of subjects. For example, in Figure 4.3,
owns and so and are subordinate to By the rules of Table 4.3, can grant and delete to
access rights that already has. Thus, a subject can create another subject with a subset
of its own access rights. This might be useful, for example, if a subject is invoking an
application that is not fully trusted and does not want that application to be able to
transfer access rights to other subjects. ....................................................................... 202
Protection Domains ............................................................................................................ 203
4.4 Example: UNIX File Access Control .............................................................................. 204
Traditional UNIX File Access Control .............................................................................. 205
Figure 4.5 UNIX File Access Control ........................................................................ 205
Access Control Lists in UNIX ........................................................................................... 207
4.5 Mandatory Access Control .............................................................................................. 208
Bell-LaPadula (BLP) Model .............................................................................................. 209
4.6 Role-Based Access Control ............................................................................................. 210
Figure 4.7 Access Control Matrix Representation of RBAC ..................................... 212
4.6 Role Base Access Control ............................................................................................ 212
RBAC Reference Models ................................................................................................... 212
Figure 4.8 A Family of Role-Based Access Control Models ..................................... 213
Base Model— ................................................................................................................. 213
Role Hierarchies— ......................................................................................................... 214
Figure 4.9 Example of Role Hierarchy ....................................................................... 214
Constraints— .................................................................................................................. 215
4.7 Attribute-Based Access Control ...................................................................................... 217
Attributes ............................................................................................................................ 218
ABAC Logical Architecture............................................................................................... 219
Figure 4.10 ABAC Scenario ....................................................................................... 219
ABAC Policies ................................................................................................................... 222
4.8 Identity, Credential, and Access Management ................................................................ 225
Figure 4.12 Identity, Credential, and Access Management (ICAM) .......................... 225
Identity Management.......................................................................................................... 226
Credential Management ..................................................................................................... 227
Access Management ........................................................................................................... 228
Identity Federation ............................................................................................................. 229
4.9 Trust Frameworks ............................................................................................................ 230
Traditional Identity Exchange Approach ........................................................................... 231
Page 27 of 1641
Figure 4.13 Identity Information Exchange Approaches ............................................ 231
Open Identity Trust Framework ......................................................................................... 234
4.10 Case Study: RBAC System for a Bank .......................................................................... 237
Table 4.5 Functions and Roles for Banking Example ................................................ 237
Figure 4.14 Example of Access Control Administration ............................................ 239
4.11 Key Terms, Review Questions, and Problems............................................................... 240
Key Terms .......................................................................................................................... 240
Problems ............................................................................................................................. 243
Figure 4.15 VAX/VMS Access Modes ...................................................................... 244
5.1 The Need for Database Security ...................................................................................... 248
5.2 Database Management Systems ....................................................................................... 249
5.3 Relational Databases ........................................................................................................ 251
Elements of a Relational Database System ........................................................................ 253
Table 5.1 Basic Terminology for Relational Databases ............................................. 253
Structured Query Language ............................................................................................... 255
5.4 SQL Injection Attacks...................................................................................................... 256
A Typical SQLi Attack ...................................................................................................... 257
The Injection Technique..................................................................................................... 259
SQLi Attack Avenues and Types ....................................................................................... 260
SQLi Countermeasures ...................................................................................................... 262
5.5 Database Access Control ................................................................................................. 263
SQL-Based Access Definition ........................................................................................... 264
Cascading Authorizations .................................................................................................. 266
Figure 5.6 Teri Revokes Privilege from David ........................................................... 266
Role-Based Access Control ................................................................................................ 268
Table 5.2 Fixed Roles in Microsoft SQL Server ........................................................ 268
5.6 Inference .......................................................................................................................... 271
Figure 5.7 Indirect Information Access via Inference Channel .................................. 271
5.7 Database Encryption ........................................................................................................ 275
Figure 5.10 Encryption Scheme for Database of Figure 5.3 ....................................... 277
5.8 Data Center Security ........................................................................................................ 280
Data Center Elements ......................................................................................................... 281
Figure 5.11 Key Data Center Elements ...................................................................... 281
Data Center Security Considerations ................................................................................. 282
Figure 5.12 Data Center Security Model .................................................................... 283
TIA-492 .............................................................................................................................. 283
Page 28 of 1641
Table 5.4 Data Center Tiers Defined in TIA-942 ....................................................... 284
Key Terms .......................................................................................................................... 286
Problems ............................................................................................................................. 288
A Broad Classification of Malware .................................................................................... 301
Attack Kits.......................................................................................................................... 302
Attack Sources.................................................................................................................... 303
Macro and Scripting Viruses .............................................................................................. 310
A Brief History of Worm Attacks ...................................................................................... 321
State of Worm Technology ................................................................................................ 324
Mobile Code ....................................................................................................................... 325
Clickjacking ....................................................................................................................... 328
6.5 Propagation—Social Engineering—Spam E-Mail, Trojans ............................................ 329
Trojan Horses ..................................................................................................................... 332
Mobile Phone Trojans ........................................................................................................ 334
Figure 8.9 Snort Architecture ..................................................................................... 468
Circuit-Level Gateway ....................................................................................................... 497
Figure 13.11 IoT Gateway Security Functions ........................................................... 771
Figure 14.5 Judgment about Risk Treatment .............................................................. 819
Problems ............................................................................................................................. 865
Table 16.1 Characteristics of Natural Disasters .......................................................... 871
Table 16.3 Saffir/Simpson Hurricane Scale................................................................ 873
Table 16.4 Temperature Thresholds for Damage to Computing Resources ............... 875
Figure 16.1 Standard Fire Temperature–Time Relations Used for Testing of Building
Elements ...................................................................................................................... 877
Table 16.6 Degrees of Security and Control for Protected Areas [ARMY10] ........... 896
Table 17.1 Comparative Framework .......................................................................... 908
Table 17.3 Examples of Possible Information Flow to and from the Incident-Handling
Service......................................................................................................................... 935
Table 18.1 Security Audit Terminology (RFC 4949) ................................................. 943
Figure 18.1 Security Audit and Alarms Model (X.816) ............................................. 946
Figure 18.2 Distributed Audit Trail Model (X.816) ................................................... 947
Figure 18.3 Common Criteria Security Audit Class Decomposition ......................... 949
Table 18.2 Auditable Items Suggested in X.816 ........................................................ 954
Page 29 of 1641
Monitoring Areas Suggested in ISO 27002 ................................................................ 955
Figure 18.4 Examples of Audit Trails......................................................................... 956
Table 18.4 Windows Event Schema Elements ........................................................... 961
Figure 18.5 Windows System Log Entry Example .................................................... 963
Figure 18.6 .................................................................................................................. 967
Examples of Syslog Messages .................................................................................... 967
Table 18.5 UNIX Syslog Facilities and Severity Levels ............................................ 968
Figure 18.9 Run-Time Environment for Application Auditing .................................. 976
Table 19.1 ................................................................................................................... 996
Cybercrimes Cited in the Convention on Cybercrime ................................................ 996
Table 19.2 CERT 2007 E-Crime Watch Survey Results ............................................ 999
Figure 19.2 DRM Components ................................................................................. 1011
Figure 19.4 Common Criteria Privacy Class Decomposition ................................... 1019
Figure 19.6 ACM Code of Ethics and Professional Conduct ................................... 1030
Figure 19.8 AITP Standard of Conduct .................................................................... 1032
Table 20.1 Types of Attacks on Encrypted Messages .............................................. 1048
Triple DES........................................................................................................................ 1056
Figure 20.2 Triple DES ............................................................................................. 1056
The SHA Secure Hash Function ...................................................................................... 1103
Table 21.1 ................................................................................................................. 1104
Comparison of SHA Parameters ............................................................................... 1104
HMAC Algorithm ............................................................................................................ 1112
Figure 21.4 HMAC Structure ................................................................................... 1112
Figure 21.5 OCB Encryption and Authentication..................................................... 1118
Figure 21.6 ................................................................................................................ 1122
OCB Algorithms ....................................................................................................... 1122
Description of the Algorithm ........................................................................................... 1124
Figure 21.8 Example of RSA Algorithm .................................................................. 1126
Timing Attacks ............................................................................................................. 1129
21.5 Diffie-hellman and Other Asymmetric Algorithms ..................................................... 1132
Diffie-Hellman Key Exchange ......................................................................................... 1132
21.5 Diffie-hellman and Other Asymmetric Algorithms ..................................................... 1132
Diffie-Hellman Key Exchange ......................................................................................... 1132
The Algorithm .............................................................................................................. 1133
Figure 21.9 The Diffie-Hellman Key Exchange Algorithm ..................................... 1134
Key Exchange Protocols ............................................................................................... 1135
Figure 21.10 .............................................................................................................. 1135
Other Public-Key Cryptography Algorithms ................................................................... 1140
Page 30 of 1641
Digital Signature Standard............................................................................................ 1034
Elliptic-Curve Cryptography ........................................................................................ 1034
Post-Quantum Cryptography ........................................................................................ 1034
21.6 Key Terms, Review Questions, and Problems............................................................. 1141
Key Terms ........................................................................................................................ 1141
Problems ........................................................................................................................... 1143
MIME ............................................................................................................................... 1150
S/MIME............................................................................................................................ 1151
Table 22.1 S/MIME Content Types .......................................................................... 1152
Figure 22.1 Simplified S/MIME Functional Flow .................................................... 1153
Signed and Clear-Signed Data ...................................................................................... 1154
Enveloped Data............................................................................................................. 1155
Public-Key Certificates................................................................................................. 1155
22.2 Domainkeys Identified Mail ........................................................................................ 1156
Internet Mail Architecture ................................................................................................ 1157
Figure 22.2 Function Modules and Standardized Protocols Used Between Them in the
Internet Mail Architecture......................................................................................... 1159
DKIM Strategy ................................................................................................................. 1161
Figure 22.3 Simple Example of DKIM Deployment ................................................ 1162
22.3 Secure Sockets Layer (SSL) and Transport Layer Security (TLS).............................. 1164
TLS Architecture .............................................................................................................. 1165
Figure 22.4 SSL/TLS Protocol Stack........................................................................ 1165
TLS Protocols ................................................................................................................... 1167
Record Protocol ............................................................................................................ 1167
Figure 22.5 TLS Record Protocol Operation ............................................................ 1167
Change Cipher Spec Protocol ....................................................................................... 1168
Alert Protocol ............................................................................................................... 1168
Handshake Protocol ...................................................................................................... 1169
Figure 22.6 Handshake Protocol Action ................................................................... 1170
Heartbeat Protocol ........................................................................................................ 1172
SSL/TLS Attacks.............................................................................................................. 1174
Attack Categories ......................................................................................................... 1174
Heartbleed ..................................................................................................................... 1176
Figure 22.7 The Heartbleed Exploit.......................................................................... 1177
22.4 HTTPS ......................................................................................................................... 1179
Connection Initiation ........................................................................................................ 1180
Connection Closure .......................................................................................................... 1181
22.5 IPv4 and IPv6 Security ................................................................................................ 1182
Page 31 of 1641
IP Security Overview ....................................................................................................... 1182
Applications of IPsec .................................................................................................... 1183
Benefits of IPsec ........................................................................................................... 1184
Routing Applications .................................................................................................... 1184
The Scope of IPsec ........................................................................................................... 1186
Security Associations ....................................................................................................... 1187
Encapsulating Security Payload ....................................................................................... 1189
Figure 22.8 IPsec ESP Format .................................................................................. 1190
Transport and Tunnel Modes ........................................................................................... 1191
Transport Mode ............................................................................................................ 1191
Tunnel Mode................................................................................................................. 1191
Key Terms ........................................................................................................................ 1193
Review Questions ............................................................................................................. 1194
Figure 22.9 Antireplay Mechanism .......................................................................... 1196
Chapter 23Internet Authentication AChapter 23 Internet Authentication Applicationsications
.............................................................................................................................................. 1198
Learning Objectives ......................................................................................................... 1198
23.1 Kerberos ....................................................................................................................... 1199
The Kerberos Protocol ..................................................................................................... 1200
Figure 23.1 Overview of Kerberos ........................................................................... 1201
Kerberos Realms and Multiple Kerberi ........................................................................... 1207
Figure 23.2 Request for Service in Another Realm .................................................. 1208
Version 4 and Version 5 ................................................................................................... 1210
Performance Issues ........................................................................................................... 1211
23.2 X.509............................................................................................................................ 1212
Figure 23.3 X.509 Formats ....................................................................................... 1213
Public Key Infrastructure X.509 (PKIX) ......................................................................... 1217
Figure 23.4 PKIX Architectural Model .................................................................... 1218
Key Terms ........................................................................................................................ 1220
Problems .......................................................................................................................... 1222
ChapterChapter 24 ............................................................................................................... 1225
Wireless Network Securityeless Network Security ............................................................. 1225
Learning Objectives ......................................................................................................... 1226
24.1 Wireless Security ......................................................................................................... 1227
Figure 24.1 Wireless Networking Components ........................................................ 1228
Page 32 of 1641
Wireless Network Threats ................................................................................................ 1229
Wireless Security Measures ............................................................................................. 1231
Securing Wireless Transmissions ................................................................................. 1231
Securing Wireless Access Points .................................................................................. 1232
Securing Wireless Networks ........................................................................................ 1232
24.2 Mobile Device Security ............................................................................................... 1233
Security Threats................................................................................................................ 1235
Lack of Physical Security Controls .............................................................................. 1235
Use of Untrusted Mobile Devices ................................................................................ 1235
Use of Untrusted Networks .......................................................................................... 1236
Use of Untrusted Applications ..................................................................................... 1236
Interaction with Other Systems .................................................................................... 1236
Use of Untrusted Content ............................................................................................. 1236
Use of Location Services .............................................................................................. 1237
Mobile Device Security Strategy ..................................................................................... 1238
Figure 24.2 Mobile Device Security Elements ......................................................... 1238
Device Security............................................................................................................. 1239
Traffic Security ............................................................................................................. 1240
Barrier Security............................................................................................................. 1241
24.3 IEEE 802.11 Wireless LAN Overview ........................................................................ 1242
Table 24.1 IEEE 802.11 Terminology ...................................................................... 1242
The Wi-Fi Alliance........................................................................................................... 1243
IEEE 802 Protocol Architecture ....................................................................................... 1244
Figure 24.3 IEEE 802.11 Protocol Stack .................................................................. 1244
Physical Layer .............................................................................................................. 1245
Medium Access Control ............................................................................................... 1245
Figure 24.4 General IEEE 802 MPDU Format ......................................................... 1246
Logical Link Control .................................................................................................... 1246
IEEE 802.11 Network Components and Architectural Model ......................................... 1247
Figure 24.5 IEEE 802.11 Extended Service Set ....................................................... 1248
IEEE 802.11 Services ....................................................................................................... 1251
Table 24.2 IEEE 802.11 Services ............................................................................. 1251
Distribution of Messages Within a DS ......................................................................... 1252
Association-Related Services ....................................................................................... 1252
24.4 IEEE 802.11i Wireless LAN Security ......................................................................... 1255
Figure 24.6 Elements of IEEE 802.11i ..................................................................... 1257
IEEE 802.11i Phases of Operation ................................................................................... 1259
Figure 24.7 IEEE 802.11i Phases of Operation ........................................................ 1261
Page 33 of 1641
Discovery Phase ............................................................................................................... 1263
Figure 24.8 IEEE 802.11i Phases of Operation: Capability Discovery, Authentication,
and Association ......................................................................................................... 1263
Security Capabilities ..................................................................................................... 1264
MPDU Exchange .......................................................................................................... 1265
Authentication Phase ........................................................................................................ 1268
IEEE 802.1X Access Control Approach ...................................................................... 1268
Figure 24.9 802.1X Access Control .......................................................................... 1269
MPDU Exchange .......................................................................................................... 1269
EAP Exchange .............................................................................................................. 1270
Key Management Phase ................................................................................................... 1272
Figure 24.10 IEEE 802.11i Key Hierarchies ............................................................ 1272
Table 24.3 IEEE 802.11i Keys for Data Confidentiality and Integrity Protocols .... 1273
Pairwise Keys ............................................................................................................... 1275
Group Keys ................................................................................................................... 1276
Pairwise Key Distribution ............................................................................................ 1276
Figure 24.11 IEEE 802.11i Phases of Operation: 4-Way Handshake and Group Key
Handshake ................................................................................................................. 1278
Protected Data Transfer Phase ......................................................................................... 1280
TKIP ............................................................................................................................. 1280
CCMP ........................................................................................................................... 1281
The IEEE 802.11i Pseudorandom Function ..................................................................... 1282
Figure 24.12 IEEE 802.11i Pseudorandom Function ............................................... 1283
Key Terms ........................................................................................................................ 1284
Problems ........................................................................................................................... 1287
Figure 24.13 WEP Authentication ............................................................................ 1288
Appendix A: Projects and Other Student Exercises for Teaching Computer Security ........ 1290
A.1 Hacking Project ............................................................................................................. 1292
A.2 Laboratory Exercises..................................................................................................... 1294
A.3 Security Education (Seed) Projects ............................................................................... 1295
Table A.1 Mapping of SEED Labs to Textbook Chapters ....................................... 1296
A.4 Research Projects .......................................................................................................... 1299
A.5 Programming Projects ................................................................................................... 1300
A.6 Practical Security Assessments ..................................................................................... 1301
A.7 Firewall Projects ........................................................................................................... 1302
A.8 Case Studies .................................................................................................................. 1303
Page 34 of 1641
A.9 Reading/Report Assignments ........................................................................................ 1304
A.10 Writing Assignments................................................................................................... 1305
Appendix B: Some Aspects of Number Theory .................................................................. 1306
B.1 Prime and Relatively Prime Numbers ........................................................................... 1307
Divisors ............................................................................................................................ 1308
Prime Numbers ................................................................................................................. 1309
Relatively Prime Numbers ............................................................................................... 1310
B.2 Modular Arithmetic ....................................................................................................... 1311
Figure B.1 The Relationship .................................................................................... 1311
Modular Arithmetic Operations ....................................................................................... 1313
Inverses............................................................................................................................. 1314
(B.1) .......................................................................................................................... 1314
(B.2) .......................................................................................................................... 1314
B.3 Fermat’s and Euler’s Theorems .................................................................................... 1315
Fermat’s Theorem ............................................................................................................ 1316
(B.3) .......................................................................................................................... 1316
Euler’s Totient Function................................................................................................... 1318
Appendix C: Standards and Standard-Setting Organizations .............................................. 1323
C.1 The Importance of Standards ........................................................................................ 1324
C.2 Internet Standards and the Internet Society................................................................... 1326
The Internet Organizations and RFC Publication ............................................................ 1327
Table C.1 IETF Areas ............................................................................................... 1328
The Standardization Process ............................................................................................ 1330
Figure C.1 Internet RFC Publication Process ........................................................... 1331
Internet Standards Categories........................................................................................... 1333
Other RFC Types ............................................................................................................. 1334
C.3 The National Institute of Standards and Technology .................................................... 1336
C.4 The International Telecommunication Union ............................................................... 1338
ITU Telecommunication Standardization Sector ............................................................. 1339
Schedule ........................................................................................................................... 1340
C.5 The International Organization for Standardization...................................................... 1341
C.6 Significant Security Standards and Documents ............................................................ 1344
International Organization for Standardization (ISO) ...................................................... 1345
National Institute of Standards and Technology (NIST) ................................................. 1346
International Telecommunication Union Telecommunication Standardization Sector (ITU-
T) ...................................................................................................................................... 1347
Internet Standards and the Internet Society...................................................................... 1349
Appendix D: Random and Pseudorandom Number Generation .......................................... 1350
Page 35 of 1641
D.1 The Use of Random Numbers ....................................................................................... 1351
Randomness ..................................................................................................................... 1352
Unpredictability ................................................................................................................ 1354
D.2 Pseudorandom Number Generators (PRNGS) .............................................................. 1355
Linear Congruential Generators ....................................................................................... 1356
Cryptographically Generated Random Numbers ............................................................. 1359
Cyclic Encryption ......................................................................................................... 1359
Figure D.1 Pseudorandom Number Generation from a Counter .............................. 1360
DES Output Feedback Mode ........................................................................................ 1361
ANSI X9.17 PRNG ...................................................................................................... 1361
Figure D.2 ANSI X9.17 Pseudorandom Number Generator .................................... 1362
Blum Blum Shub Generator ............................................................................................. 1364
D.3 True Random Number Generators ................................................................................ 1367
Appendix E: Message Authentication Codes Based on Block Ciphers ............................... 1369
E.1 Cipher-Based Message Authentication Code (CMAC) ................................................ 1370
Page 36 of 1641
Chapter 1 Overview
1. 1.1 Computer Security Concepts
1. A Definition of Computer Security

2. Examples
3. The Challenges of Computer Security
4. A Model for Computer Security
2. 1.2 Threats, Attacks, and Assets
1. Threats and Attacks

2. Threats and Assets
3. 1.3 Security Functional Requirements
4. 1.4 Fundamental Security Design Principles
5. 1.5 Attack Surfaces and Attack Trees
1. Attack Surfaces
2. Attack Trees
6. 1.6 Computer Security Strategy
1. Security Policy
2. Security Implementation
3. Assurance and Evaluation
7. 1.7 Standards
8. 1.8 Key Terms, Review Questions, and Problems
Learning Objectives
After studying this chapter, you should be able to:
• Describe the key security requirements of confidentiality, integrity, and availability.

• Discuss the types of security threats and attacks that must be dealt with and give
examples of the types of threats and attacks that apply to different categories of
computer and network assets.
• Summarize the functional requirements for computer security.
• Explain the fundamental security design principles.
• Discuss the use of attack surfaces and attack trees.
• Understand the principle aspects of a comprehensive security strategy.
This chapter provides an overview of computer security. We begin with a discussion of what
we mean by computer security. In essence, computer security deals with computer-related
assets that are subject to a variety of threats and the various measures that are taken to protect
those assets. Accordingly, the next section of this chapter provides a brief overview of the
categories of computer-related assets that users and system managers wish to preserve and
protect and offers a look at the various threats and attacks that can be made on those assets.
Then, we survey the measures that can be taken to deal with such threats and attacks. This we
do from three different viewpoints in Sections 1.3 through 1.5. We then lay out in general
terms a computer security strategy.
The focus of this chapter, and indeed this book, is on three fundamental questions:
Page 37 of 1641
1. What assets do we need to protect?
2. How are those assets threatened?
3. What can we do to counter those threats?
Page 38 of 1641
1.1 Computer Security Concepts
A Definition of Computer Security
The NIST Internal/Interagency Report NISTIR 7298 (Glossary of Key Information Security
Terms, July 2019) defines the term computer security as follows:
Computer Security: Measures and controls that ensure confidentiality, integrity, and
availability of information processed and stored by a computer, including hardware, software,
firmware, information data, and telecommunications.
This definition introduces three key objectives that are at the heart of computer security:
• Confidentiality: This term covers two related concepts:

o Data confidentiality:1 Assures that private or confidential information is not
made available or disclosed to unauthorized individuals.
o Privacy: Assures that individuals control or influence what information
related to them may be collected and stored and by whom and to whom that
information may be disclosed.
• Integrity: This term covers two related concepts:

o Data integrity: Assures that information and programs are changed only in a
specified and authorized manner.
o System integrity: Assures that a system performs its intended function in an
unimpaired manner, free from deliberate or inadvertent unauthorized
manipulation of the system.
• Availability: Assures that systems work promptly and service is not denied to
authorized users.
These three concepts form what is often referred to as the CIA triad. The three concepts
embody the fundamental security objectives for both data and information and computing
services. For example, the NIST standard FIPS 199 (Standards for Security Categorization of
Federal Information and Information Systems, February 2004) lists confidentiality, integrity,
and availability as the three security objectives for information and information systems.
FIPS 199 provides a useful characterization of these three objectives in terms of requirements
and the definition of a loss of security in each category:
These three concepts form what is often referred to as the CIA triad. The three concepts
embody the fundamental security objectives for both data and information and computing
services. For example, the NIST standard FIPS 199 (Standards for Security Categorization of
Federal Information and Information Systems, February 2004) lists confidentiality, integrity,
and availability as the three security objectives for information and information systems.
FIPS 199 provides a useful characterization of these three objectives in terms of requirements
and the definition of a loss of security in each category:
• Confidentiality: Preserving authorized restrictions on information access and

disclosure, including means for protecting personal privacy and proprietary
information. A loss of confidentiality is the unauthorized disclosure of information.
Page 39 of 1641
• Integrity: Guarding against improper information modification or destruction,
including ensuring information nonrepudiation and authenticity. A loss of integrity is
the unauthorized modification or destruction of information.
• Availability: Ensuring timely and reliable access to and use of information. A loss of
availability is the disruption of access to or use of information or an information
system.
Although the use of the CIA triad to define security objectives is well established, some in
the security field feel that additional concepts are needed to present a complete picture (see
Figure 1.1). Two of the most commonly mentioned are as follows:
• Authenticity: The property of being genuine and being able to be verified and trusted;
confidence in the validity of a transmission, a message, or a message originator. This
means verifying that users are who they say they are and that each input arriving at
the system came from a trusted source.
• Accountability: The security goal that generates the requirement for actions of an
entity to be traced uniquely to that entity. This supports nonrepudiation, deterrence,
fault isolation, intrusion detection and prevention, and after-action recovery and legal
action. Because truly secure systems are not yet an achievable goal, we must be able
to trace a security breach to a responsible party. Systems must keep records of their
activities to permit later forensic analysis to trace security breaches or to aid in
transaction disputes.
Note that FIPS 199 includes authenticity under integrity.
Figure 1.1 Essential Network and Computer Security Requirements
Page 40 of 1641
Examples
We now provide some examples of applications that illustrate the requirements just
enumerated.2 For these examples, we use three levels of impact on organizations or
individuals should there be a breach of security (i.e., a loss of confidentiality, integrity, or
availability). These levels are defined in FIPS 199:
• Low: The loss could be expected to have a limited adverse effect on organizational
operations, organizational assets, or individuals. A limited adverse effect means that,
for example, the loss of confidentiality, integrity, or availability might (i) cause a
degradation in mission capability to an extent and duration that the organization is
able to perform its primary functions, but the effectiveness of the functions is
noticeably reduced; (ii) result in minor damage to organizational assets; (iii) result in
minor financial loss; or (iv) result in minor harm to individuals.
• Moderate: The loss could be expected to have a serious adverse effect on
organizational operations, organizational assets, or individuals. A serious adverse
effect means that, for example, the loss might (i) cause a significant degradation in
mission capability to an extent and duration that the organization is able to perform its
primary functions, but the effectiveness of the functions is significantly reduced; (ii)
result in significant damage to organizational assets; (iii) result in significant financial
loss; or (iv) result in significant harm to individuals that does not involve loss of life
or serious life-threatening injuries.
• High: The loss could be expected to have a severe or catastrophic adverse effect on
organizational operations, organizational assets, or individuals. A severe or
catastrophic adverse effect means that, for example, the loss might (i) cause a severe
degradation in or loss of mission capability to an extent and duration that the
organization is not able to perform one or more of its primary functions; (ii) result in
major damage to organizational assets; (iii) result in major financial loss; or (iv) result
in severe or catastrophic harm to individuals involving loss of life or serious life-
threatening injuries.
Confidentiality
Student grade information is an asset whose confidentiality is considered to be highly

important by students. In the United States, the release of such information is regulated by the
Family Educational Rights and Privacy Act (FERPA). Grade information should be available
only to students, their parents, and employees who require the information to do their job.
Student enrollment information may have a moderate confidentiality rating. While still
covered by FERPA, this information is seen by more people on a daily basis, is less likely to
be targeted than grade information, and results in less damage if disclosed. Directory
information, such as lists of students or faculty or departmental lists, may be assigned a low
confidentiality rating or indeed no rating. This information is typically freely available to the
public and published on a school’s website.
Integrity
Several aspects of integrity are illustrated by the example of a hospital patient’s allergy
information stored in a database. The doctor should be able to trust that the information is
correct and current. Now, suppose an employee (e.g., a nurse) who is authorized to view and
update this information deliberately falsifies the data to cause harm to the hospital. The
database needs to be restored to a trusted state quickly, and it should be possible to trace the
Page 41 of 1641
error back to the person responsible. Patient allergy information is an example of an asset
with a high requirement for integrity. Inaccurate information could result in serious harm or
death to a patient and expose the hospital to massive liability.
An example of an asset that may be assigned a moderate level of integrity requirement is a

website that offers a forum to registered users to discuss some specific topic. Either a
registered user or a hacker could falsify some entries or deface the website. If the forum
exists only for the enjoyment of the users, brings in little or no advertising revenue, and is not
used for something important such as research, then potential damage is not severe. The
website administrator may experience some data, financial, and time loss.
An example of a low-integrity requirement is an anonymous online poll. Many websites, such

as news organizations, offer these polls to their users with very few safeguards. However, the
inaccuracy and unscientific nature of such polls is well understood
Availability
The more critical a component or service is, the higher the level of availability required.
Consider a system that provides authentication services for critical systems, applications, and
devices. An interruption of service results in the inability of customers to access computing
resources and staff to access the resources they need to perform critical tasks. The loss of the
service translates into a large financial loss in lost employee productivity and potential
customer loss.
An example of an asset that would typically be rated as having a moderate availability

requirement is a public website for a university that provides information for current and
prospective students and donors. Such a site is not a critical component of the university’s
information system, but its unavailability will cause some embarrassment.
An online telephone directory lookup application would be classified as a low availability

requirement. Although the temporary loss of the application may be an annoyance, there are
other ways to access the information, such as a hardcopy directory or the operator.
Page 42 of 1641
The Challenges of Computer Security
Computer security is both fascinating and complex. Some of the reasons are as follows:
1. Computer security is not as simple as it might first appear to the novice. The
requirements seem to be straightforward; indeed, most of the major requirements for
security services can be given self-explanatory one-word labels: confidentiality,
authentication, nonrepudiation, and integrity. But the mechanisms used to meet those
requirements can be quite complex, and understanding them may involve rather subtle
reasoning.
2. In developing a particular security mechanism or algorithm, one must always consider
potential attacks on those security features. In many cases, successful attacks are
designed by looking at the problem in a completely different way and therefore
exploiting an unexpected weakness in the mechanism.
3. Because of Point 2, the procedures used to provide particular services are often
counterintuitive. Typically, a security mechanism is complex, and it is not obvious
from the statement of a particular requirement that such elaborate measures are
needed. Only when the various aspects of the threat are considered do elaborate
security mechanisms make sense.
4. Once various security mechanisms have been designed, it is necessary to decide
where to use them. This is true both in terms of physical placement (e.g., at what
points in a network are certain security mechanisms needed) and in a logical sense
(e.g., at what layer or layers of an architecture such as TCP/IP [Transmission Control
Protocol/Internet Protocol] should mechanisms be placed).
5. Security mechanisms typically involve more than a particular algorithm or protocol.
They also require that participants possess some secret information (e.g., an
encryption key), which raises questions about the creation, distribution, and protection
of that secret information. There may also be a reliance on communications protocols
whose behavior may complicate the task of developing the security mechanism. For
example, if the proper functioning of the security mechanism requires setting time
limits on the transit time of a message from sender to receiver, then any protocol or
network that introduces variable, unpredictable delays may render such time limits
meaningless.
6. Computer security is essentially a battle of wits between a perpetrator who tries to
find holes and the designer or administrator who tries to close them. The great
advantage that the attacker has is that they need only find a single weakness, while the
designer must find and eliminate all weaknesses to achieve perfect security.
7. There is a natural tendency on the part of users and system managers to perceive little
benefit from security investment until a security failure occurs.
8. Security requires regular, even constant, monitoring, and this is difficult in today’s
short-term, overloaded environment.
9. Security is still too often an afterthought and is incorporated into a system after the
design is complete, rather than being an integral part of the design process.
10. Many users and even security administrators view strong security as an impediment to
efficient and user-friendly operation of an information system or use of information.
The difficulties just enumerated will be encountered in numerous ways as we examine the
various security threats and mechanisms throughout this book.
Page 43 of 1641
A Model for Computer Security
We now introduce some terminology that will be useful throughout the book. Table 1.1
defines terms and Figure 1.2, based on [CCPS12a], shows the relationship among some of
these terms. We start with the concept of a system resource or asset that users and owners
wish to protect. The assets of a computer system can be categorized as follows:
• Hardware: Including computer systems and other data processing, data storage, and
data communications devices.
• Software: Including the operating system, system utilities, and applications.
• Data: Including files and databases, as well as security-related data, such as password
files.
• Communication facilities and networks: Local and wide area network
communication links, bridges, routers, and so on.
Table 1.1
Computer Security Terminology
Adversary (threat agent)
Individual, group, organization, or government that conducts or has the intent to conduct
detrimental activities.
Attack
Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy
information system resources or the information itself.
Countermeasure
A device or technique that has as its objective the impairment of the operational effectiveness
of undesirable or adversarial activity, or the prevention of espionage, sabotage, theft, or
unauthorized access to or use of sensitive information or information systems.
Risk
A measure of the extent to which an entity is threatened by a potential circumstance or event,

and typically a function of 1) the adverse impacts that would arise if the circumstance or
event occurs; and 2) the likelihood of occurrence.
Security Policy
A set of criteria for the provision of security services. It defines and constrains the activities
of a data processing facility in order to maintain a condition of security for systems and data.
System Resource (Asset)
A major application, general support system, high impact program, physical plant, mission
critical system, personnel, equipment, or a logically related group of systems.
Threat
Page 44 of 1641
Any circumstance or event with the potential to adversely impact organizational operations
(including mission, functions, image, or reputation), organizational assets, individuals, other
organizations, or the Nation through an information system via unauthorized access,
destruction, disclosure, modification of information, and/or denial of service.
Vulnerability
Weakness in an information system, system security procedures, internal controls, or

implementation that could be exploited or triggered by a threat source.
Figure 1.2
Security Concepts and Relationships
In the context of security, our concern is with the vulnerabilities of system resources.
[NRC02] lists the following general categories of vulnerabilities of a computer system or
network asset:
• The system can be corrupted so that it does the wrong thing or gives wrong answers.
For example, stored data values may differ from what they should be because they
have been improperly modified.
• The system can become leaky. For example, someone who should not have access to
some or all of the information available through the network obtains such access.
• The system can become unavailable or very slow. That is, using the system or
network becomes impossible or impractical.
These three general types of vulnerability correspond to the concepts of integrity,

confidentiality, and availability, enumerated earlier in this section.
Page 45 of 1641
Another random document with
no related content on Scribd:
I could not always lightly pass
Through the same gateways, sleep where they had slept,
Wake where they waked; I could not always print
Ground where the grass had yielded to the steps
Of generations of illustrious men,
Unmoved....
Their several memories here
Put on a lowly and a touching grace
Of more distinct humanity.
And not only the buildings, but the other archæological

monuments of the University (for so I think I may be permitted to
call the pictures and the busts, and the statues, and the tombs,
which are the glories of our chapels, our libraries and our halls)
teach the same great lessons. They raise up again our own
worthies before our very eyes, calling on us to strive to walk as
they walked, dead though they be and buried; for their effigies
and their sepulchres are ‘with us to this day.’ I must repeat, then,
that I am glad that the Disney Professor is not obliged to confine
himself to classical archæology, sorry as I should be if he were
wholly unable to give lectures on one or more branches of that
most interesting department, which has moreover a special
connexion with the classical studies of the University. It is
manifest that the University intended the Professor to consider
no kind of human antiquities as alien from him; and I think this in
itself a very great gain. For, if the truth must be confessed,
antiquaries above most others have been guilty of the error of
despising those branches of study which are not precisely their
own. I forbear to adduce proofs of this, though I am not
unprovided with them; and even although you would certainly be
amused if I were to read them; classicists against gothicists;
gothicists against classicists.
I could wish that the learned and meritorious writers on both
sides had profited by the judicious remarks of Mr Willson,
prefixed to Mr Pugin’s Specimens of Gothic Architecture in
England. “The respective beauties and conveniences proper to
the Grecian orders in their pure state or as modified by the
Romans and their successors in the Palladian school may be
fully allowed, without a bigoted exclusion of the style we are
accustomed to term Gothic. Nor ought its merits to be asserted
to the disadvantage of the classic style. Each has its beauties,
each has its proportions[3].” One of the most eminent Gothic
architects, Mr George Gilbert Scott, expresses himself in a very
similar spirit. “It may be asked, what influence do we expect that
the present so-called classic styles will exercise upon the result
we are imagining, (i.e. the developement of the architecture of
the future). Is the work of three centuries to be unfelt in the future
developements, and are its monuments to remain among us in a
state of isolation, exercising no influence upon future art? It
would, I am convinced, be as unphilosophical to wish, as it would
be unreasonable to expect this[4].” To turn from them to the
classicists. “See how much Athens gains,” says Prof. T. L.
Donaldson, “upon the affections of every people, of every age,
by her Architectural ruins. Not a traveller visits Greece whose
chief purpose is not centred in the Acropolis of Minerva.... But in
thus rendering the homage due to ancient Art it were unjust to
pass without notice those sublime edifices due to the Genius of
our Fathers. It is now unnecessary to enter upon the question,
whether the first ideas of Gothic Architecture were the result of a
casual combination of lines or a felicitous adaptation of form
derived immediately from Nature: But graceful proportion,
solemnity of effect, variety of plan, playfulness of outline and the
profoundest elements of knowledge of construction place these
edifices on a par with any of ancient times. Less pure in
conception and detail, they excel in extent of plan and of
disposition, and yield not in the mysterious effect produced on
the feelings of the worshipper. The sculptured presence of the
frowning Jove or the chryselephantine statue of Minerva were
necessary to awe the Heathen into devotion. But the presence of
the Godhead appears, not materially but spiritually, to pervade
the whole atmosphere of one of our Gothic Cathedrals[5].” The
Editor of The Museum of Classical Antiquities, well says, “As
antiquity embraces all knowledge, so investigations into it must
be distinct and various. Each antiquary labours for his own
particular object, and each severally assists the other[6].” It
should be borne in mind moreover that archæological remains of
every kind and sort are really a part of human history; and if all
parts of history deserve to be studied, as they most assuredly
do, being parts, though not equally important parts, of the Epic
unity of our race, it will follow even with mathematical precision
that all monuments relating to all parts of that history must be
worthy of study also.
3. P. xix. London, 1821.
4. Scott’s Remarks on Secular and Domestic Architecture, present and future, p.

272. London, 1857.
5. Preliminary Discourse pronounced before the University College of London, upon

the commencement of a series of Lectures on Architecture, pp. 17-24. London,
1842.
6. Museum of Classical Antiquities, Vol. I. p. 1. London, 1851.
I desire therefore to express in language as strong as may be

consistent with propriety, my entire disapproval of pitting one
branch of archæology against another, or indeed any study
against another study. And on this very account I rejoice that the
Disney Professor’s field of choice is as wide as the world itself,
so far as concerns its archæology. There is no country, there is
no period about which he may not occupy himself, or on which
he may not lecture, if he feel himself qualified to do so. He is in a
manner bound by the tenure of his office to treat every branch of
archæology with honourable respect; and this in itself may not be
without a wholesome influence both upon his words and
sentiments. I have been somewhat longer over this matter than I
could have wished; but I thought it desirable that the position of
the Disney Professor should be rightly understood; and I have
also endeavoured to shew the real advantage of that position.
His field then is the world itself; but as this is so (and as I think
rightly so) there is a very true and real danger lest he and his
hearers should be mazed and bewildered at the contemplation of
its magnitude. Yet in spite of that danger I will venture to invite
you to follow the outlines of the great entirety of the relics of the
ages that have for ever passed away. I say the outlines, and
even this is almost too much, for I am compelled to shade some
parts of the picture so obscurely, and to throw so much of other
parts into the background, that even of the outlines I can
distinctly present to you but a portion. Thus I will say little more
of the archæology of the New World, than that there is one which
reaches far beyond the period of Spanish conquest, comprising
among many other things ruins of Mexican cities, exquisite
monuments of bas-reliefs and other carvings in stone; I will not
invite you into the far East of the Old World, to explore the long
walls and Buddhist temples of the ancient and stationary
civilisation of China, or to dwell upon the objects of its fictile and
other arts; but leaving both this and all the adjacent countries of
Thibet, Japan and even India without further notice, or with only
passing allusions, spatiis conclusus iniquis, I will endeavour, so
far as my very limited knowledge permits, the delineation of the
most salient peculiarities of the various remains of the old world
till the fall of the Roman Empire in the West, and then attempt to
trace briefly the remains of successive medieval classes of
antiquities, until we arrive at almost modern times. I can name
but few objects under each division of the vast subject; but these
will be selected so as to suggest as much as possible others of a
kindred kind. In addressing myself to such an audience, I may, if
anywhere, act upon the assumption, Verbum sapienti sat est: a
single word may suggest a train of thought. If I cannot wholly
escape the charge of tediousness, I must still be content: for I
am firmly convinced after the most careful consideration that I
can pursue no course which is equally profitable, though I might
take many others which might be more amusing.
It would now appear probable that the earliest extant remains
of human handicraft or skill have as yet been found, not on the
banks of the Nile or the Euphrates, but in the drift and in the
caverns of Western Europe. Only yesterday, as I may say, it has
been found out that in a geological period when the reindeer was
the denizen of Southern France, and when the climate was
possibly arctic, there dwelt in the caverns of the Périgord a race
of men, who were unacquainted with the use of metals, but who
made flint and bone weapons and instruments; who lived by
fishing and the chase, eating the flesh of the reindeer, the
aurochs, the wild goat and the chamois; using their skins for
clothes which they stitched with bone needles, and their bones
for weapon handles, on which they have etched representations
of the animals themselves. Specimens of these things were
placed last year in the British Museum; and a full account of the
discoveries in 1862 and 1863 may be seen in the Revue
Archéologique. Some distinguished antiquaries consider that
they are the earliest human remains in Western Europe. Various
other discoveries in the same regions of late years have tended
towards shewing that the time during which man has lived upon
the earth is much greater than we had commonly supposed. The
geological and archæological circumstances under which the flint
implements were found at Abbeville, and St Acheul, near
Amiens, in the valley of the Somme, left no doubt that they were
anterior by many ages to the Roman Empire. They have a few
points of similarity to those found in the caverns of the Périgord,
and as they occur along with the remains of the Elephas
Antiquus and the hippopotamus, Sir Charles Lyell infers that both
these animals coexisted with man; and perhaps on the whole we
may consider them rather than those of the Périgord to be the
earliest European remains of man, or of man at all. Similar
weapons have been found in the drift in this country, in Suffolk,
Bedfordshire, and elsewhere. At Brixham, near Torquay, a
cavern was examined in 1858, covered with a floor of stalagmite,
in which were imbedded bones of the reindeer and also an entire
hind leg of the extinct cave-bear, every bone of which was in its
proper place; the leg must consequently have been deposited
there when the separate bones were held together by their
ligaments. Below this floor was a mass of loam or bone-earth,
varying from one to fifteen feet in thickness, and amongst it, and
the gravel lying below it, were discovered about fifteen flint
knives, recognised by practised archæologists as artificially
formed, and among them one very perfect tool close to the leg of
the bear. It thus becomes manifest that the extinct bear lived
after the flint tools were made, or at any rate not earlier; so that
man in this district was either the contemporary of the cave-bear,
or (as would seem more probable) his predecessor. But
shortness of time forbids me to do more than to indicate that in
western Europe generally, as well as in Britain, we have an
archæology beginning with the age of the extinct animals or
quaternary geological epoch and connecting itself with the age of
the Roman Empire, when the first literary notices of those
countries, with slight exceptions, commence. The antiquaries
and naturalists of Denmark conjointly (these indeed should
always be united, having much in common; and I am happy in
being able to say that a love of archæology has often been
united with a love of natural science by members of this
University, among whom the late and the present Professor of
Botany may be quoted as examples)—these Danish
archæologists and naturalists I say, have made out three distinct
periods during this interval: the age of stone contemporary with
the pine forests; the age of bronze commencing with the oak
forests which lie over the pine in the peat; and the age of iron co-
extensive with the beech forests which succeeded the oak, and
which covered the country in the Roman times as they cover it
now. The skulls belonging to the oldest or stone age resemble
those of the modern Laplanders; those of the second and third
are of a more elongated type.
The refuse-heaps along the shores of the islands of the Baltic,
consisting of the remains of mollusks and vertebrated animals,
mingled with stone weapons, prove the great antiquity of the age
of stone; the oyster then flourished in places where, by reason of
the exclusion of the ocean from the brackish Baltic, it does not
now exist. None of the animals now extinct, however, occur in
these Kjökkenmödding, as they are called, except the wild bull,
the Bos primigenius, which was alive in Roman times; but the
bones of the auk, now, in all probability, extinct in Europe, are
frequent; also those of the capercailzie, now very rare in the
southern districts of Scandinavia, though abundant in Norway,
which would find abundant food in the buds of the pines growing
in pre-historic times in the peat bogs. Similar refuse-heaps, left in
Massachusetts and in Georgia by the North American Indians,
are considered by Sir C. Lyell, who has seen them, to have been
there for centuries before the white man arrived. They have also
been found, I understand, very recently in Scotland in Caithness.
The stone weapons have now been sharpened by rubbing, and
are less rude and probably more recent than those of the drift of
the Somme valley, or of the caverns of the Périgord. The only
domestic animal belonging to the stone age, yet found in
Scandinavia, is the dog; and even this appears to have been
wanting in France. In the ages of bronze and iron various
domestic animals existed; but no cereal grains, as it would seem,
in the whole of Scandinavia. Weapons and tools belonging to
these three periods, as well as fragments of pottery and other
articles, are very widely diffused over Europe, and have been
met with in great abundance in our own country (in Ireland more
especially), as well as near the Swiss-lake habitations, built on
piles, to which attention has only been called since 1853. It is
strange that all the Lake settlements of the bronze period are
confined to West and Central Switzerland: in the more Eastern
Lakes those of the stone period alone have been discovered.
Similar habitations of a Pæonian tribe dwelling in Lake
Prasias, in modern Roumelia, are mentioned by Herodotus, and
they may be compared, in some degree, with the Irish Lake-
dwellings or Crannoges, i.e. artificial islands, and more
especially with the stockaded islands, occurring in various parts
of the country: and which are accompanied by the weapons and
instruments and pottery of the three aforesaid periods. Even in
England slight traces of similar dwellings have been found near
Thetford, not accompanied by any antiquities, but by the bones
of various animals, the goat, the pig, the red deer, and the extinct
ox, the Bos longifrons, the skulls of which last were in almost all
instances fractured by the butcher.
As to the chronology and duration of the three periods I shall
say nothing, though not ignorant that some attempts have been
made to determine them. They must have comprehended
several thousand years, but how many seems at present
extremely uncertain. I should perhaps say that Greek coins of
Marseilles, which would probably be of the age of the Roman
Republic, have been found in Switzerland in some few aquatic
stations, and in tumuli among bronze and iron implements
mixed. The cereals wanting in Scandinavia appear in
Switzerland from the most remote period; and domestic animals,
the ox, sheep, and goat, as well as the dog, even in the earliest
stone-settlements. Among the ancient mounds of the valley of
the Ohio, in North America, have been found (besides pottery
and sculpture and various articles in silver and copper) stone
weapons much resembling those discovered in France and other
places in Europe. Before passing from these pre-historic
remains, as they are badly called, to the historic, let me beg you
to observe a striking illustration of the relation of archæology to
history. Archæology is not the handmaid of history; she occupies
a far higher position than that: archæology is, as I said at the
outset, the science of teaching history by its monuments. Now
for all western and northern Europe nearly the whole of its early
history must be deduced, so far as it can be deduced at all, from
the monuments themselves; for the so-called monuments of
literature afford scanty aid, and for that reason our knowledge of
these early ages is necessarily very incomplete. Doubtless,
many a brave Hector and many a brave Agamemnon lived,
fought, and died in the ages of stone and of bronze; but they are
oppressed in eternal night, unwept and unknown, because no
Scandinavian Homer has recorded their illustrious deeds. Still,
we must be thankful for what we can get; and if archæological
remains (on which not a letter of an alphabet is inscribed) cannot
tell us everything, yet, at least, everything that we do know about
these ages, or very nearly so, is deduced by archæology alone.
We must now take a few rapid glances at the remains of the
great civilised nations of the ancient world. Mr Kenrick observes
that the seats of its earliest civilisation extend across southern
Asia in a chain, of which China forms the Eastern, and Egypt the
Western extremity; Syria, Mesopotamia, Assyria, and India, are
the intermediate links. In all these countries, when they become
known to us, we find the people cultivating the soil, dwelling in
cities, and practising the mechanical arts, while their neighbours
lie in barbarism and ignorance. We cannot, he thinks, fix by
direct historical evidence the transmission of this earliest
civilisation from one country to another. But we may determine
with which of them ancient history and archæology must begin.
The monuments of Egypt surpass those of all the rest, as it
would appear, by many centuries. None of the others exercised
much influence on European civilisation till a later period, some
exception being made for the Phœnician commerce; but the
connection of European with Egyptian civilisation is both direct
and important. “From Egypt,” he remarks, “it came to Greece,
from Greece to Rome, from Rome to the remoter nations of the
West, by whom it has been carried throughout the globe[7].” As
regards its archæology, which is very peculiar and indeed in
some respects unique, I must now say a few words. The present
remains of Memphis, the earliest capital, said to have been
founded by Athothis, the son of Menes, the first king of the first
dynasty, are not great; but so late as the fourteenth century they
were very considerable. Temples and gateways, colossal statues
and colossal lions then existed, which are now no more. Whether
any of them approached the date of the foundation it is useless
to enquire. Now, the most remarkable relic is a colossal statue of
Rameses II., which, when perfect, must have been about forty-
three feet high. This monarch is of the XVIIIth dynasty, which
embraces the most splendid and flourishing period of Egyptian
history; and though much uncertainty still prevails for the early
Egyptian chronology, it appears to be well made out and agreed
that this dynasty began to reign about fifteen centuries before the
Christian era. But the pyramids and tombs of Ghizeh, and of
several other places at no great distance from Memphis, are of a
much earlier date; and the great pyramid is securely referred to a
king of the fourth dynasty. “Probably at no place in the entire
history of Egypt,” says Mr Osburn, “do the lists and the Greek
authors harmonize better with the historical notices on the
monuments than at the commencement of this dynasty[8].” The
system of hieroglyphic writing was the same (according to Mr
Kenrick) in all its leading peculiarities, as it continued to the end
of the monarchy. I regret to say that some eminent men have
tried to throw discredit, and even ridicule, on the attempts which,
I think, have been most laudably made with great patience, great
acuteness, and great learning, to decipher and interpret the
Egyptian and other ancient languages. Many of us, doubtless,
have seen a piece of pleasantry in which Heigh-diddle-diddle,
The cat and the fiddle is treated as an unknown language; the
letters are divided into words—all wrongly, of course—these
words are analysed with a great show of erudition, and a literal
Latin version accompanies the whole. If I remember (for I have
mislaid the amusing production) it proves to be an invocation of
the gods, to be used at a sacrifice. Now, a joke is a good thing in
its place; only do not let it be made too much of. Every
archæologist, beginning with Jonathan Oldbuck, must
sometimes fall into blunders, when he takes inscriptions in hand,
even if the language be a known one; and, of course, à fortiori,
when but little known. My own opinion on hieroglyphics would be
of no value whatever, as I know nothing beyond what I have read
in a few modern authors, and have never studied the subject;
but, allow me to observe, that I had a conversation very lately
with my learned and excellent friend, Dr Birch, of the British
Museum, who is now engaged in making a dictionary of
hieroglyphics, and he assured me that a real progress has been
made in the study of them, that a great deal of certainty has
been attained to; while there is still much that requires further
elucidation. To the judgment of such a man, who has spent a
great part of his life in the study of Egyptian antiquities, though
he has splendidly illustrated other antiquities also, I must think
that greater weight should be attached than to the judgment of
others, eminent as they may be in some branches of learning,
who have never studied this as a specialty.
7. Ancient Egypt, Vol. I. p. 3. London, 1850.
8. Monumental History of Egypt, Vol. I. p. 262. London, 1854.
The relation of archæology to Egyptian history deserves

especial notice. We have not here, as in pre-historic Europe, a
mere multitude of uninscribed and inconsiderable remains; but
we have colossal monuments of all kinds—temples, gateways,
obelisks, statues, rock sculptures—more or less over-written with
hieroglyphics; also sepulchral-chambers, in many instances
covered with paintings, in addition to a variety of smaller works,
mummy cases, jewelry, scarabæi, pottery, &c., upon many of
which are inscriptions. By aid of these monuments mostly, but by
no means exclusively, the history of the Pharaohs and the
manners and customs of their people are recovered. The
monumenta litterarum themselves are frequently preserved on
the monuments of stone and other materials.
For the pyramids of Ghizeh and the adjoining districts, for the
glorious temples of Dendera, of Karnak, the grandest of all the
remains of the Pharaohs, as well as for those of Luxor, with its
now one obelisk, of Thebes, of Edfou, of Philæ, likewise for the
grottoes of Benihassan, I must leave you to your own
imagination or recollection, which may be aided in some degree
by a few of the beautiful photographs by Bedford, which are now
before your eyes. They extend along the banks and region of the
Nile—for this is Egypt—from the earliest times down to the age
of the Ptolemies and of Cleopatra herself, and even of the
Roman empire, in the case of Dendera, where the portico was
added by Tiberius to Cleopatra’s temple. Before quitting these
regions I would remark, that the extraordinary rock-hewn temple
of Aboo-Simbel in Nubia, which includes the most beautiful
colossal statues yet found—their height as they sit is more than
fifty feet—bears some similarity to certain Indian temples,
especially to the temple of Siva at Tinnevelly, and the Kylas at
Ellora, which last has excited the astonishment of all travellers.
“Undoubtedly,” says Mr Fergusson, “there are many very striking
points of resemblance ... but, on the other hand, the two styles
differ so widely in details and in purpose, that we cannot
positively assert the actual connexion between them, which at
first sight seems unquestionable[9].”
9. Handbook of Architecture, p. 101. London, 1859.
The archæology of the Babylonian empire need only occupy a

few moments. The antiquity of Babylon is proved to be as remote
as the fifteenth century B.C., by the occurrence of the name on a
monument of Thothmes III., an Egyptian monarch of the XVIIIth
dynasty. It may be much older than that; but the archæological
remains of the Birs Nimroud (which was long imagined to be the
tower of Babel) hitherto found are not older than the age of
Nebuchadnezzar. This palatial structure consisted, in Mr
Layard’s opinion, of successive horizontal terraces, rising one
above another like steps in a staircase. Every inscribed brick
taken from it,—and there are thousands and tens of thousands
of these,—bears the name of Nebuchadnezzar. It is indeed
possible that he may have added to an older structure, or rebuilt
it; and if so we may one day find more ancient relics in the Birs.
But at a place called Mujelibé (the Overturned) are remains of a
Babylonian palace not covered by soil, also abounding with
Nebuchadnezzar’s bricks, where Mr Layard found one solitary
fragment of a sculptured slab, having representations of gods in
head-dresses of the Assyrian fashion, and indicating that the
Babylonian palaces were probably similarly ornamented. A very
curious tablet was also brought from Bagdad of the age of
Nebuchadnezzar, giving, according to Dr Hincks, an account of
the temples which he built. Besides these, “a few inscribed
tablets of stone and baked clay, figures in bronze and terra cotta,
metal objects of various kinds, and many engraved cylinders and
gems are almost the only undoubted Babylonian antiquities
hitherto brought to Europe.” Babylonia abounds in remains, but
they are so mixed—Babylonian, Greek, Roman, Arsacian,
Sassanian, and Christian—that it is hard to separate them.
Scarcely more than one or two stone figures or slabs have been
dug out of the vast mass of débris; and, as Isaiah has said,
“Babylon is fallen, is fallen; and all the graven images of her
gods hath Jehovah broken unto the ground[10].”
10. See Layard’s Nineveh and Babylon, chapters xxii, xxiii., especially pp. 504, 528,
532. London, 1853.
The most splendid archæological discovery of our age is the

disinterment of the various palaces and other monuments of the
Assyrian Empire. The labours of Mr Layard and M. Botta have
made ancient Assyria rise before our eyes in all its grandeur and
in all its atrocity. In visiting the British Museum we seem to live
again in ancient Nineveh. We behold the sculptured slabs of its
palaces, on which the history of the nation is both represented
and written; we wonder at its strange compound divinities, its
obelisks, its elegant productions in metal, in ivory, and in terra
cotta. By patient and laborious attention to the cuneiform
inscriptions, aided by the notices in ancient authors, sacred and
profane, men like Sir H. Rawlinson and Dr Hincks have
recovered something like a succession of Assyrian kings,
ranging from about 1250 B.C. to about 600 B.C., and many
particulars of their reigns, some of which bring out in a distinct
manner the accurate knowledge of the writers of the Old
Testament.
The remains of ancient Persia are too considerable to be
passed over. Among other monuments at Pasargadæ, a city of
the early Persians, is a great monolith, on which is a bas-relief,
and a cuneiform inscription above, “I am Cyrus the king, the
Achæmenian.” Here is the tomb of the founder of the empire.
At Susa, the winter seat of the Persian kings from the time of
Cyrus, Mr Loftus and Sir W. F. Williams have found noble marble
structures raised by Darius, the son of Hystaspes (424—405
B.C.), whose great palace was here: commenced by himself and
completed by Artaxerxes II. or Mnemon (405—359 B.C.). Both
here and at Persepolis, the richest city after Susa (destroyed, as
we all remember from Dryden’s ode, by Alexander), are ruins of
magnificent columns of the most elaborate ornamentation, and
many cuneiform inscriptions, deciphered by Lassen and
Rawlinson. Mr Loftus remarks on the great similarity of the
buildings of Persepolis and Susa, which form a distinct style of
architecture. This is the salient feature of Persian archæology,
and to him I refer you upon it[11]. I cannot dwell upon other ruins
in these regions, or on the minor objects, coins, cylinders, and
vases of the ancient Persian empire; and still less on the very
numerous coins of the Arsacidæ, and Sassanidæ, who
afterwards succeeded to it.
11. See his Travels and Researches in Chaldæa and Susiana, ch. xxviii. London,
1857; also Smith’s Dict. of Greek and Roman Geography, s. v. Pasargadæ,
Persepolis, Susa; and Vaux’s Nineveh and Persepolis, London, 1850.
Of ancient Judæa we possess as yet very scanty

archæological monuments indeed before the fall of the
monarchy. The so-called Tombs of the Kings are now, I believe,
generally considered to belong to the Herodian period. Of the
Temple of Jerusalem, the holy place of the Tabernacle of the
Most Highest, not one stone is left upon another. And we may
well conceive that nothing less than its destruction would
effectually convince the world of the great truth that an hour had
arrived in which neither that holy mountain on which it was built,
nor any other in the whole world, was to be the scene of the
exclusive worship of the Father. The sites of the Holy Places,
however, have naturally excited much attention, and have been
well illustrated by several distinguished resident members of our
University, and also by a foreign gentleman who for some time
resided among us. Dr Pierotti had the singular good fortune to
discover the subterranean drains by which the blood of the
victims, slaughtered in the Temple, was carried off; and this
discovery afforded valuable aid in determining various previously
disputed matters in connexion with the Temple. He likewise came
upon some masonry in the form of bevelled stones below the
surface, which was not unreasonably supposed to belong to
Solomon’s Temple; but it now appears that this opinion is
doubtful. Besides these, we have the sepulchres of the
patriarchs at Hebron, guarded with scrupulous jealousy; and
tanks at the same place, which may be as old as the time of
David, and perhaps one or two things more of a similar kind. We
may well hope that the explorations which are now being set on
foot for bringing to light the antiquities of Palestine may add to
their number.
In the relation of Jewish archæology to Jewish history we have
a case quite different to all those that have gone before it: there
the native archæology was more or less extensive, the
independent native literature scanty or non-existent; here, where
the archæology is almost blotted out, is it precisely the reverse.
We have in the sacred books of the Old Testament an ample
literary history: we have scarcely any monumental remains of
regal Judæa at all. With regard to the New Testament the matter
is otherwise; archæological illustrations, as well as literary, exist
in abundance, and some very striking proofs from archæology
have been adduced of the veracity and trustworthiness of its
authors. My predecessor bestowed great attention on the
numismatic and other monumental illustrations of Scripture, and
herein set a good example to all that should come after him.
Archæology is worthily employed in illustrating every kind of
ancient literature; most worthily of all does she occupy herself in
the illustration and explanation and confirmation of the sacred
writings, of the Book of books.
The antiquities of Phœnicia need not detain us long. Opposite
to Aradus is an open quadrangular enclosure, excavated in rock,
with a throne in the centre for the worship of Astarte and
Melkarth; this is the only Phœnician temple discovered in
Phœnicia, except a small monolithal temple at Ornithopolis,
about nine miles from Tyre, of high antiquity, dedicated
apparently to Astarte. I wish however to direct your attention to
the characteristic feature of Phœnician architecture, its
enormous blocks of stone bevelled at the joints. You have them
in the walls of Aradus and in other places in Phœnicia. They are
also found in the temple of the Sun at Baalbec, and may with
great probability, I conceive, be regarded as Phœnician; though
the rest of the beautiful architectural remains there are Greco-
Roman of the Imperial period, and perhaps the best specimens
of their kind in existence. Among other Phœnician antiquities we
have sarcophagi, and sepulchral chambers for receiving them,
also very beautiful variegated glass found over a good part of
Europe and Asia, commonly called Greek, but perhaps more
reasonably presumed to be Phœnician. Most of the remains
found on the sites of the Phœnician settlements are either so
late Phœnician, or so little Phœnician at all, as at Carthage, that
I shall make no apology for passing over both them, and the few
exceptions also, just alluding however to the existence of a
remarkable hypæthral temple in Malta, which I myself saw nearly
twenty years ago, not long, I believe, after it was uncovered.
With regard to the strange vaulted towers of Sardinia, called
Nuraggis, they may be Phœnician or Carthaginian, but their
origin is uncertain. “All Phœnician monuments,” says Mr Kenrick,
“in countries unquestionably occupied by the Phœnicians are
recent[12].” He makes the remark in reference to the Lycian
archæology. Whether the Lycians were of Phœnician origin or
not, their rock-temples and rock-tombs, abounding in sculptures
(illustrative both of their mythology and military history), shew
that they were not much behind the Greeks in the arts. With the
general appearance of their Gothic-like architecture, and of their
strange bilingual inscriptions, Greek and Lycian, we are of
course familiarised by the Lycian Room in the British Museum.
With regard to the relation of Phœnician and Lycian archæology
to the history of the peoples themselves, it must be sufficient to
say, that their history, both literary and monumental, is quite
fragmentary; in the case of Phœnicia the literary notices perhaps
preserve more to us than the monumental; in regard to Lycia the
remark must rather be reversed.
12. Phœnicia, p. 88. London, 1855. See also Smith’s Dict. of Greek and Roman
Geography, s. v. Phœnicia and Lycia.
From Phœnicia, which first carried letters to Greece, let us

also pass to Greece. But Greece, in the sense in which I shall
use it, includes not only Greece Proper, but many parts of Asia
Minor, as well as Sicily and the Great Greece of Italy. And here I
must unwillingly be brief, and make the splendid extract from
Canon Marsden, quoted before, in some degree do duty for me.
But think for a minute first on its architecture, I do not mean its
earliest remains, such as the Cyclopian walls and the lion-gate at
Mycenæ, and the so-called treasury of Atreus, which ascend to
the heroic ages or farther back, but its temple architecture.
Before I can name them, images of the Parthenon, the
Erectheum, the temple of Jupiter Panhellenius at Ægina, the
temple of Apollo Epicurius at Phigalia or Bassæ, that of Concord
(so-called) at Agrigentum, the most perfect in Sicily, the three
glorious Doric temples of Pæstum, the Ionic ruins of Branchidæ,
will, I am confident, have arisen before your eyes. Many of us
perhaps have seen some of them; if not, we all feel as though we
had. Think of its sepulchral monuments, which are in the form of
temples; and first of Queen Artemisia’s Mausoleum, the most
splendid architectural expression of conjugal affection that has
ever existed, the wonder of the world, with its colossal statue of
her husband and its bas-reliefs by Bryaxis and Scopas and other
principal sculptors; and remember that we have these in our
national museum. Various fine rock-tombs, likewise in the form of
temples, occur in Asia Minor, e.g. that of Midas at Nacoleia, the
Lion-tomb at Cnidus, the necropolis at Telmessus.
The transition from temples and tombs to statuary is easy, as
these were more or less decorated with its aid. Although we still
possess the great compositions of some of the first sculptors and
brass-casters, for example, the Quoit-thrower of Myron, the
Diadumenos of Polycleitus, (i.e. a youth binding his head with a
fillet in token of an athletic victory,) and perhaps several of the
Venuses of Praxiteles; yet it is needless for me to remind you
that these with few exceptions are considered to be copies, not
originals. But yet there are exceptions. “The extant relics of
Greek sculpture,” says Mr Bunbury, “few and fragmentary as
they undoubtedly are, are yet in some degree sufficient to enable
us to judge of the works of the ancient masters in this branch of
art. The metopes of Selinus, the Æginetan, the Elgin, and the
Phigaleian marbles, to which we now add the noble fragments
recently brought to this country from Halicarnassus, not only
serve to give us a clear and definite idea of the progress of the
art of sculpture, but enable us to estimate for ourselves the
mighty works which were so celebrated in antiquity[13].” Of
bronzes of the genuine Greek period, which we may call their
metal statuary, the most beautiful that occur to my remembrance
are those of Siris, now in the British Museum. They are
considered by Brönsted to agree in the most remarkable and
striking manner with the distinctive character of the school of
Lysippus. But most of the extant bronzes are, I believe, of the
Roman period, executed however, like their other best works, by
Greco-Roman artists.
13. Edinburgh Review for 1858, Vol. CVIII. p. 382. I follow common fame in assigning
this article to Mr Bunbury; few others indeed were capable of writing it. Besides
the sculptures named by him we have in the British Museum a bas-relief by
Scopas, as it is thought, who may also be the author of the Niobid group at
Florence; likewise the Ceres (so-called) from Eleusis, and the statue of Pan from
Athens, now in our Fitzwilliam Museum. For other antique statues and bronzes
and for the later copies see Müller’s Ancient Art, passim.
With the Greek schools of painting, Attic, Asiatic, and

Sicyonian, no less celebrated than their sculpture, it has fared far
worse. There is not one of their works surviving; no, not one. Of
these schools and their paintings I need not here say anything,
as I am concerned only with the archæological monuments
which are now in existence. But the loss is compensated in some
degree by the paintings on vases, in which we may one day
recognise the compositions of the various great masters of the
different schools, just as in the majolica and other wares of the
16th and following centuries we have the compositions of
Raffaelle, Giulio Romano, and other painters. “The glorious art of
the Greek painters,” says K. O. Müller, the greatest authority for
ancient art generally, “as far as regards light, tone, and local
colours, is wholly lost to us; and we know nothing of it except
from obscure notices and later imitations;” (referring, I suppose,
to the frescoes of Herculaneum and of Pompeii more especially;)
“on the contrary, the pictures on vases with thinly scattered bright
figures give us the most exalted idea of the progress and
achievements of the art of design, if we venture, from the
workmanship of common handicraftsmen, to draw conclusions
as to the works of the first artists[14].” But of this matter and of the
vases themselves, which rank among the most graceful remains
of Greek antiquity, and are found over the whole Greek world, I
shall say no more now, as they will form the subject of my
following lectures. We have also many terra cottas of delicate
Greek workmanship, mostly plain, but some gilded, others
painted, from Athens, as well as from a great variety of other
places, of which the finest are now at Munich. Relief ornaments,
sometimes of great beauty, in the same material, were
impressed with moulds, and Cicero, in a letter to Atticus, wishes
for such typi from Athens, in order to fix them on the plaster of an
atrium. Most of those which now remain seem to be of Greco-
Roman times.
14. Ancient Art and its Remains, p. 119. Translated (with additions from Welcker) by
Leitch. London, 1852. This invaluable work is a perfect thesaurus for the student,
and will conduct him to the most trustworthy authorities on every branch of the
subject.
Of the art of coinage invented by the Greeks and carried by

them to the highest perfection which it has ever attained, a few
words must now be said. The history of a nation, said the first
Napoleon, is its coinage: and the art which the Greeks invented
became soon afterwards, and now is, the history of the world.
Numismatics are the epitome of all archæological knowledge,
and any one who is versed in this study must by necessity be
more or less acquainted with many others also. Architecture,
sculpture, iconography, topography, palæography, the public and
private life of the ancients and their mythology, are all illustrated
by numismatics, and reciprocally illustrate them.
Numismatics give us also the succession of kings and tyrants
over the whole Greek world. In the case of Bactria or Bactriana,
whose capital Bactra is the modern Balk, this value of
numismatics is perhaps most conspicuous. From coins, and from
coins almost alone, we obtain the succession of kings, beginning
with the Greek series in the third century B.C., and going on with
various dynasties of Indian language and religion, till we come
down to the Mohammedan conquest. “Extending through a
period of more than fifteen centuries,” says Professor H. H.
Wilson, “they furnish a distinct outline of the great political and
religious vicissitudes of an important division of India, respecting
which written records are imperfect or deficient[15].”
15. Ariana Antiqua, p. 439. London, 1841. For the more recent views of English and
German numismatists on these coins, see Mr Thomas’s Catalogue of Bactrian
Coins in the Numismatic Chronicle for 1857, Vol. XIX. p. 13 sqq.
Coins are so much more durable than most other monuments,

that they frequently survive, when the rest have perished. This is
well put by Pope in his Epistle to Addison, on his Discourse on
Medals:
Ambition sighed, she saw it vain to trust
The faithless column and the crumbling bust,
Huge moles whose shadows stretched from shore to shore,
Their ruins perished and their place no more.
Convinced she now contracts her vast design,
And all her triumphs shrink into a coin.
A narrow orb each crowded conquest keeps,
Beneath her palm here sad Judæa weeps;
Now scantier limits the proud arch confine;
And scarce are seen the prostrate Nile or Rhine;
A small Euphrates thro’ the piece is rolled,
And little eagles wave their wings in gold.
The Medal, faithful to its charge of fame,
Through climes and ages bears each form and name;
In one short view subjected to our eye,
Gods, emperors, heroes, sages, beauties, lie.
Regarded simply as works of art the coins of Magna Græcia

and Sicily, more especially those of Syracuse and its tyrants, as
well as those of Thasos, Opus, and Elis, also the regal coins of
Philip, Alexander, Mithridates, and some of the Seleucidæ, are
amongst the most exquisite productions of antiquity. Not even in
gem-engraving, an art derived by Greece from Egypt and
Assyria, but carried by her to the highest conceivable perfection,
do we find anything superior to these. I must, before quitting the
subject of numismatics, congratulate the University on the
acquisition of one of the largest and most carefully selected
private collections of Greek coins ever formed, viz. the cabinet of
the late Col. Leake, which is now one of the principal treasures
of the Fitzwilliam Museum.
Inferior as gems are to coins in most archæological respects,
especially in respect of their connection with literary history, and
though not superior to the best of them artistically, gems have
nevertheless one advantage over coins, that they are commonly
quite uninjured by time. Occasionally (it is true) this is the case
with coins; but with gems it is the rule. Of course, to speak
generally, the art of gems, whose material is always more or less

Computer Security Principles and Practice 5Th Edition William Stallings Full Chapter

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Computer Security Principles and Practice 5Th Edition William Stallings Full Chapter

Uploaded by

Copyright:

Available Formats

Computer Security Principles and

Practice 5th Edition William Stallings

The documents and related graphics contained herein could

Microsoft® and Windows® are registered trademarks of the

Copyright © 2024, 2018, 2015 by Pearson Education, Inc. or

Acknowledgments of third-party content appear on the

PEARSON is an exclusive trademark owned by Pearson

Library of Congress Cataloging-in-Publication Data

Names: Stallings, William, author. | Brown, Lawrie, author.

Title: Computer security : principles and practice / William

Description: Fifth edition. | Hoboken, NJ : Pearson Education,

Identifiers: LCCN 2023000040 | ISBN 9780138091675

Subjects: LCSH: Computer security. | Computer networks—

Classification: LCC QA76.9.A25 S685 2024 | DDC 005.8—

Scout Automated Print Code

Our ambition is to purposefully contribute to a world where:

• Everyone has an equitable and lifelong opportunity to succeed through learning.

You can learn more about Pearson’s commitment to accessibility at

Please contact us with concerns about any potential bias at

• Multi-factor authentication and mobile authentication: Chapter 3 includes a new

1. As information systems, databases, and Internet-based distributed systems and

Accordingly, the number of courses in universities, community colleges, and other

The following basic themes unify the discussion:

• Real-world examples: A number of chapters include a section that shows the

Support of ACM/IEEE Cybersecurity Curricula 2017

Knowledge Units Essentials Textbook Coverage

Data Security • Basic cryptography concepts Part 1—Network Security

Software Security • Fundamental design principles 1—Overview

Component Security • Vulnerabilities of system 1—Overview

Connection Security • Systems, architecture, models, Part 5—Network Security

System Security • Holistic approach 1—Overview

Human Security • Identity management 3—User Authentication

Organizational • Risk management 14—IT Security Management

Coverage of CISSP Subject Areas

• Security and risk management: Confidentiality, integrity, and availability concepts;

Support for NCAE-C Certification

• Cybersecurity foundations: Provides students with a basic understanding of the

Plan of the Text

• Computer Security Technology and Principles

The Companion Website contains the following support materials:

• Homework problems and solutions: In addition to the homework problems in the

Instructor Support Materials

Projects and Other Student Exercises

Private key of user A

Public key of user A

H Hash function of message X

Logical AND: x AND y

Logical NOT: NOT x

C A characteristic formula, consisting of a logical

Magnitude of : the number of records in

Set intersection: the number of records in both

During his career, he has presented courses on cryptography, cybersecurity, data

1. 1.1 Computer Security Concepts

1. A Definition of Computer Security

1. Threats and Attacks

• Describe the key security requirements of confidentiality, integrity, and availability.

• Confidentiality: This term covers two related concepts:

• Integrity: This term covers two related concepts:

• Confidentiality: Preserving authorized restrictions on information access and

Figure 1.1 Essential Network and Computer Security Requirements

Student grade information is an asset whose confidentiality is considered to be highly

An example of an asset that may be assigned a moderate level of integrity requirement is a

An example of a low-integrity requirement is an anonymous online poll. Many websites, such