Read more
Informationen zum Autor Markus Schumacher , SAP AG, Germany. Eduardo Fernandez-Buglioni , Florida Atlantic University, USA. Duane Hybertson , The MITRE Corp, USA. Frank Buschmann , Siemens AG, Germany. Peter Sommerlad , Hochschule für Technik Rapperswil, Germany. Klappentext International security experts explain the full spectrum of security in systems designSecurity can be an intimidating subject area, but this need not be the case. Although time constraints may prevent systems engineers from becoming security specialists, guarding systems against attack is essential. With the growing success of the Internet, computer and software systems have become more and more networked. Written from the heart of the patterns community, the authors address key questions and present corresponding proven solutions, clearly showing you how to build secure systems.In a time where systems are constantly at risk, it is essential that you arm yourself with the knowledge of different security measures. This pioneering title breaks down security at various levels of the system: the enterprise, architectural and operational layers. It acts as an extension to the larger enterprise contexts and shows you how to integrate security in the broader engineering process.Essential security topics include:Enterprise level security - security management, principles, institutional policies (such as need-to-know) and enterprise needs (including confidentiality, integrity, availability, accountability, I&A, access control and audit).Architectural level security - system level solutions responding to enterprise level policies - and the most important level for facilitating building security into a system.User level security - concerned with achieving security in operational contexts Zusammenfassung Most security books are targeted at security engineers and specialists. Few show how build security into software. None breakdown the different concerns facing security at different levels of the system: the enterprise, architectural and operational layers. Inhaltsverzeichnis Chapter 1 The Pattern Approach 1 Patterns at a Glance 2 No Pattern is an Island 4 Patterns Everywhere 4 Humans are the Target 5 Patterns Resolve Problems and Shape Environments 6 Towards Pattern Languages 7 Documenting Patterns 9 A Brief Note on The History of Patterns 11 The Pattern Community and its Culture 12 Chapter 2 Security Foundations 15 Overview 16 Security Taxonomy 17 General Security Resources 26 Chapter 3 Security Patterns 29 The History of Security Patterns 30 Characteristics of Security Patterns 31 Why Security Patterns? 34 Sources for Security Pattern Mining 37 Chapter 4 Patterns Scope and Enterprise Security 47 The Scope of Patterns in the Book 48 Organization Factors 49 Resulting Organization 51 Mapping to the Taxonomy 53 Organization in the Context of an Enterprise Framework 53 Chapter 5 The Security Pattern Landscape 59 Enterprise Security and Risk Management Patterns 59 Identification & Authentication (I&A) Patterns 62 Access Control Model Patterns 67 System Access Control Architecture Patterns 69 Operating System Access Control Patterns 71 Accounting Patterns 73 Firewall Architecture Patterns 77 Secure Internet Applications Patterns 78 Cryptographic Key Management Patterns 80 Related Security Pattern Repositories Patterns 83 Chapter 6 Enterprise Security and Risk Management 85 Security Needs Identification for Enterprise Assets 89 Asset Valuation 103 Threat Assessment 113 Vulnerability Assessment 125 Risk Determination 137 Enterprise S...
List of contents
Chapter 1 The Pattern Approach.
Patterns at a Glance.
No Pattern is an Island.
Patterns Everywhere.
Humans are the Target.
Patterns Resolve Problems and Shape Environments.
Towards Pattern Languages.
Documenting Patterns.
A Brief Note on The History of Patterns.
The Pattern Community and its Culture.
Chapter 2 Security Foundations.
Overview.
Security Taxonomy.
General Security Resources.
Chapter 3 Security Patterns.
The History of Security Patterns.
Characteristics of Security Patterns.
Why Security Patterns?.
Sources for Security Pattern Mining.
Chapter 4 Patterns Scope and Enterprise Security.
The Scope of Patterns in the Book.
Organization Factors.
Resulting Organization.
Mapping to the Taxonomy.
Organization in the Context of an Enterprise Framework.
Chapter 5 The Security Pattern Landscape.
Enterprise Security and Risk Management Patterns.
Identification & Authentication (I&A) Patterns.
Access Control Model Patterns.
System Access Control Architecture Patterns.
Operating System Access Control Patterns.
Audit and Accounting Patterns.
Secure Internet Applications Patterns.
Firewall Architecture Patterns.
Cryptographic Key Management Patterns.
Related Security Pattern Repositories Patterns.
Chapter 6 Enterprise Security and Risk Management.
Security Needs Identification for Enterprise Assets.
Asset Valuation.
Threat Assessment.
Vulnerability Assessment.
Risk Determination.
Enterprise Security Approaches.
Enterprise Security Services.
Enterprise Partner Communication.
Chapter 7 Identification and Authentication (I&A).
I&A Requirements.
Automated I&A Design Alternatives.
Password Design and Use.
Biometrics Design Alternatives.
Chapter 8 Access Control Models.
Authorization.
Role-Based Access Control.
Multilevel Security.
Reference Monitor.
Role Rights Definition.
Chapter 9 System Access Control Architecture.
Access Control Requirements.
Single Access Point.
Check Point.
Security Session.
Full Access with Errors
Limited Access
Chapter 10 Operating System Access Control.
Authenticator.
Controlled Process Creator.
Controlled Object Factory.
Controlled Object Monitor.
Controlled Virtual Address Space.
Execution Domain.
Controlled Execution Environment.
File Authorization.
Chapter 11 Accounting.
Security Accounting Requirements.
Audit Requirements.
Audit Trails and Logging Requirements.
Intrusion Detection Requirements.
Non-Repudiation Requirements.
Chapter 12 Firewall Architectures.
Packet Filter Firewall.
Proxy-Based Firewall.
Stateful Firewall.
Chapter 13 Secure Internet Applications.
Information Obscurity.
Secure Channels.
Known Partners.
Demilitarized Zone.
Protection Reverse Proxy.
Integration Reverse Proxy.
Front Door.
Chapter 14 Case Study: IP Telephony.
IP Telephony at a Glance.
The Fundamentals of IP Telephony.
Vulnerabilities of IP Tel
