O_Reilly_Web_Security_Commerce.pdf

Web Security & Commerce

Simson Garfinkel & Eugene H. Spafford

First Edition, June 1997

ISBN: 1-56592-269-7, 506 pages

Learn how to minimize the risks of the Web with this comprehensive guide.

It covers browser vulnerabilities, privacy concerns, issues with Java, JavaScript, ActiveX, and plug-

ins, digital certificates, cryptography, Web server security, blocking software, censorship

technology, and relevant civil and criminal issues.

Preface

The Web: Promises and Threats

Conventions Used in This Book

Comments and Questions

Acknowledgments

i Introduction

1.1 Web Security in a Nutshell

1.2 The Web Security Problem

1.3 Credit Cards, Encryption, and the Web

1.4 Firewalls: Part of the Solution

1.5 Risk Management

ii UserSafety

2.1 Browser History

2.2 Data-Driven Attacks

2.3 Implementation Flaws: A Litany of Bugs

3.1 Java

3.2 JavaScript

3.3 Denial-of-Service Attacks

3.4 JavaScript-Enabled Spoofing Attacks

3.5 Conclusion

4 Downloading Machine Code with ActiveX and Plug-Ins

4.1 When Good Browsers Go Bad

4.2 Netscape Plug-Ins

4.3 ActiveX and Authenticode

4.4 The Risks of Downloaded Code

4.5 Is Authenticode a Solution?

4.6 Improving the Security of Downloaded Code

5.1 Log Files

5.2 Cookies

5.3 Personally Identifiable Information

5.4 Anonymizers

5.5 Unanticipated Disclosure

iii DigitalCertificates

6.1 Identification

6.2 Public Key Infrastructure

6.3 Problems Building a Public Key Infrastructure

6.4 Ten Policy Questions

7.1 Certificates Today

7.2 Certification Authority Certificates

7.3 Server Certificates

7.4 Conclusion

8 Client-Side Digital Certificates

111

8.1 Client Certificates

8.2 A Tour of the VeriSign Digital ID Center

9 Code Signing and Microsoft's Authenticode

123

9.1 Why Code Signing?

9.2 Microsoft's Authenticode Technology

9.3 Obtaining a Software Publisher's Certificate

9.4 Other Code Signing Methods

About This Book

1 The Web Security Landscape

2 The Buggy Browser: Evolution of Risk

3 Java and JavaScript

5 Privacy

6 Digital Identification Techniques

7 Certification Authorities and Server Certificates

iv Cryptography

134

10 Cryptography Basics

135

10.1 Understanding Cryptography

10.2 Symmetric Key Algorithms

10.3 Public Key Algorithms

10.4 Message Digest Functions

10.5 Public Key Infrastructure

11 Cryptography and the Web

150

11.1 Cryptography and Web Security

11.2 Today's Working Encryption Systems

11.3 U.S. Restrictions on Cryptography

11.4 Foreign Restrictions on Cryptography

12 Understanding SSL and TLS

166

12.1 What Is SSL?

12.2 TLS Standards Activities

12.3 SSL: The User's Point of View

v Web Server Security

181

13.1 Historically Unsecure Hosts

13.2 Current Major Host Security Problems

13.3 Minimizing Risk by Minimizing Services

13.4 Secure Content Updating

13.5 Back-End Databases

13.6 Physical Security

182

14.1 Access Control Strategies

14.2 Implementing Access Controls with <Limit> Blocks

14.3 A Simple User Management System

196

15.1 The Danger of Extensibility

15.2 Rules To Code By

15.3 Specific Rules for Specific Programming Languages

15.4 Tips on Writing CGI Scripts That Run with Additional Privileges

15.5 Conclusion

209

vi CommerceandSociety

222

16.1 Charga-Plates, Diners Club, and Credit Cards

16.2 Internet-Based Payment Systems

16.3 How to Evaluate a Credit Card Payment System

223

17.1 Blocking Software

17.2 PICS

17.3 RSACi

237

18 Legal Issues: Civil

248

18.1 Intellectual Property

18.2 Torts

19.1 Your Legal Options After a Break-In

19.2 Criminal Hazards That May Await You

19.3 Criminal Subject Matter

19.4 Play it Safe . . .

19.5 Laws and Activism

256

13 Host and Site Security

14 Controlling Access to Your Web Server

15 Secure CGI/API Programming

16 Digital Payments

17 Blocking Software and Censorship Technology

19 Legal Issues: Criminal

vii Appendixes

264

A Lessons from Vineyard.NET

265

A.1 Planning and Preparation

A.2 IP Connectivity

A.3 Commercial Start-Up

A.4 Ongoing Operations

A.5 Conclusion

B Creating and Installing WebServer Certificates

278

B.1 Downloading and Installing Your Web Server

B.2 Apache-SSL

C The SSL 3.0 Protocol

288

C.1 History

C.2 SSL 3.0 Record Layer

C.3 SSL 3.0 Protocols

C.4 SSL 3.0 Handshake

C.5 SSLeay

D The PICS Specification

306

D.1 Rating Services

D.2 PICS Labels

E References

313

E.1 Electronic References

E.2 Paper References

Colophon

326

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: