Attacks on government Web sites, break-ins at Internet service providers, electronic credit card fraud, invasion of personal privacy by merchants as well as hackers--is this what the World Wide Web is really all about?Web Security & Commerce cuts through the hype and the front page stories. It tells you what the real risks are and explains how you can minimize them. Whether you're a casual (but concerned) Web surfer or a system administrator responsible for the security of a critical Web server, this book will tell you what you need to know. Entertaining as well as illuminating, it looks behind the headlines at the technologies, risks, and benefits of the Web. Whatever browser or server you are using, you and your system will benefit from this book.Topics include:
Digital certificates--what they are, how they assure identity in a networked environment, how certification authorities and server certificates work, and what code signing all about.
Cryptography--an overview of how encryption works on the Internet and how different algorithms and programs are being used today.
Web server security--detailed technical information about SSL (Secure Socket Layer), TLS (Transport Layer Security), host security, server access methods, and secure CGI/API programming.
Commerce and society--how digital payments work, what blocking software and censorship technology (e.g., PICS and RSACi) is about, and what civil and criminal issues you need to understand.
Chapter 1 The Web Security Landscape
Web Security in a Nutshell
The Web Security Problem
Credit Cards, Encryption, and the Web
Firewalls: Part of the Solution
Chapter 2 The Buggy Browser: Evolution of Risk
Implementation Flaws: A Litany of Bugs
Chapter 4 Downloading Machine Code with ActiveX and Plug-Ins
When Good Browsers Go Bad
ActiveX and Authenticode
The Risks of Downloaded Code
Is Authenticode a Solution?
Improving the Security of Downloaded Code
Chapter 5 Privacy
Personally Identifiable Information
Chapter 6 Digital Identification Techniques
Public Key Infrastructure
Problems Building a Public Key Infrastructure
Ten Policy Questions
Chapter 7 Certification Authorities and Server Certificates
Certification Authority Certificates
Chapter 8 Client-Side Digital Certificates
A Tour of the VeriSign Digital ID Center
Chapter 9 Code Signing and Microsoft’s Authenticode
Why Code Signing?
Microsoft’s Authenticode Technology
Obtaining a Software Publisher’s Certificate
Other Code Signing Methods
Chapter 10 Cryptography Basics
Symmetric Key Algorithms
Public Key Algorithms
Message Digest Functions
Public Key Infrastructure
Chapter 11 Cryptography and the Web
Cryptography and Web Security
Today’s Working Encryption Systems
U.S. Restrictions on Cryptography
Foreign Restrictions on Cryptography
Chapter 12 Understanding SSL and TLS
What Is SSL?
TLS Standards Activities
SSL: The User’s Point of View
Web Server Security
Chapter 13 Host and Site Security
Historically Unsecure Hosts
Current Major Host Security Problems
Minimizing Risk by Minimizing Services
Secure Content Updating
Chapter 14 Controlling Access to Your Web Server
Access Control Strategies
Implementing Access Controls with <Limit> Blocks
A Simple User Management System
Chapter 15 Secure CGI/API Programming
The Danger of Extensibility
Rules To Code By
Specific Rules for Specific Programming Languages
Tips on Writing CGI Scripts That Run with Additional Privileges
Commerce and Society
Chapter 16 Digital Payments
Charga-Plates, Diners Club, and Credit Cards
Internet-Based Payment Systems
How to Evaluate a Credit Card Payment System
Chapter 17 Blocking Software and Censorship Technology
Chapter 18 Legal Issues: Civil
Chapter 19 Legal Issues: Criminal
Your Legal Options After a Break-In
Criminal Hazards That May Await You
Criminal Subject Matter
Play it Safe . . .
Laws and Activism
Appendix Lessons from Vineyard.NET
Planning and Preparation
Appendix Creating and Installing WebServer Certificates
Simson Garfinkel, CISSP, is a journalist, entrepreneur, and international authority on computer security. Garfinkel is chief technology officer at Sandstorm Enterprises, a Boston-based firm that develops state-of-the-art computer security tools. Garfinkel is also a columnist for Technology Review Magazine and has written for more than 50 publications, including Computerworld, Forbes, and The New York Times. He is also the author of Database Nation; Web Security, Privacy, and Commerce; PGP: Pretty Good Privacy; and seven other books. Garfinkel earned a master's degree in journalism at Columbia University in 1988 and holds three undergraduate degrees from MIT. He is currently working on his doctorate at MIT's Laboratory for Computer Science.
Gene Spafford, Ph.D., CISSP, is an internationally renowned scientist and educator who has been working in information security, policy, cybercrime, and software engineering for nearly two decades. He is a professor at Purdue University and is the director of CERIAS, the world's premier multidisciplinary academic center for information security and assurance. Professor Spafford and his students have pioneered a number of technologies and concepts well-known in security today, including the COPS and Tripwire tools, two-stage firewalls, and vulnerability databases. Spaf, as he is widely known, has achieved numerous professional honors recognizing his teaching, his research, and his professional service. These include being named a fellow of the AAAS, the ACM, and the IEEE; receiving the National Computer Systems Security Award; receiving the William Hugh Murray Medal of the NCISSE; election to the ISSA Hall of Fame; and receiving the Charles Murphy Award at Purdue. He was named a CISSP, honoris causa in 2000. In addition to over 100 technical reports and articles on his research, Spaf is also the coauthor of Web Security, Privacy, and Commerce, and was the consulting editor for Computer Crime: A Crimefighters Handbook (both from O'Reilly).
Our look is the result of reader comments, our own experimentation, and feedback from distribution channels. Distinctive covers complement our distinctive approach to technical topics, breathing personality and life into potentially dry subjects. The fish featured on the cover of Web Security & Commerce is a whale shark. Sharks have lived on the Earth for over 300 million years, and populate all the oceans of the world (as well as some freshwater lakes and rivers). They are related to skates and rays, differing from ordinary bony fish in having a cartilaginous skeleton that makes their bodies unusually flexible. Unlike bony fish, sharks give birth to live young, in small litters.A common misconception about sharks is that they need to keep swimming at all times. While they do need to move their fins constantly in order to stay afloat, many species of sharks like to rest on the bottom of the ocean floor.Sharks make excellent predators because of their well-developed sensory system (not to mention their big, sharp teeth). They have excellent eyesight and an unusually keen sense of smell; they are known to be able to locate prey from a single drop of blood. Sharks can also sense electrical currents in the water indicating the presence of other fish. They retain several rows of teeth, which roll outward to replace those that are lost.The whale shark, on the other hand, is a kinder, gentler shark. Whale sharks (Rhinocodon typus) have a large flat head, a wide mouth, and tiny teeth. As a filter feeder, they feed primarily on plankton and small fish. They have distinctive spotted markings on their fins and dorsal sides. Whale sharks are so named because of their size: they may weigh more than 18 metric tons and measure up to 60 feet long. They are the largest species of fish alive today.Whale sharks live in tropical and temperate seas. They pose little or no risk to humans. In fact, whale sharks are considered a particular treat to divers, since they are impressive in size but are slow-moving and not aggressive. Edie Freedman designed the cover of this book, using a 19th-century engraving from the Dover Pictorial Archive. The cover layout was produced with Quark XPress 3.3 using the ITC Garamond font.The inside layout was designed by Edie Freedman and Nancy Priest and implemented in FrameMaker 5.0 by Mike Sierra. The text and heading fonts are ITC Garamond Light and Garamond Book. The illustrations that appear in the book were created in Macromedia Freehand 5.0 by Chris Reilley. This colophon was written by Linda Mui.