REVIEW: "Network Security Essentials", William Stallings

BKNTSCES.RVW 20031210

"Network Security Essentials", William Stallings, 2000, 0-13-016093-8,
U$48.00/C$75.81
%A William Stallings ws.RemoveThis@shore.net
%C One Lake St., Upper Saddle River, NJ 07458
%D 2000
%G 0-13-016093-8
%I Prentice Hall
%O U$48.00/C$75.81 201-236-7139 fax: 201-236-7131
%O http://www.amazon.com/exec/obidos/ASIN/0130160938/robsladesinterne
http://www.amazon.co.uk/exec/obidos/ASIN/0130160938/robsladesinte-21
%O http://www.amazon.ca/exec/obidos/ASIN/0130160938/robsladesin03-20
%P 366 p.
%T "Network Security Essentials: Applications and Standards"

The existence of this book is a bit odd, particularly in view of the
fact that it shares so much material with Stallings' "Cryptography and
Network Security." The (clear and structured) preface, however,
states that the intent is to provide a practical survey of network
security applications and standards, particularly those in widespread
use. As with the earlier work, this book is intended to serve both as
a textbook for an academic course of study, and as a self-study and
reference guide for practicing professionals. There is reduced detail
in regard to cryptography.

Chapter one is an introduction, and provides a good list of basic
concepts and vocabulary. It may not be completely apparent to all
readers that the emphasis is on threats to data transmissions and
there is limited review of attacks on functioning systems.

Part one deals with cryptography. Chapter two covers symmetric block
ciphers in fundamental but sound terms, illustrated by an explanation
of DES (Data Encryption Standard). The logic is heavily symbolic at
times, but that should not be an impediment to the reader. It is
interesting that chapter three views asymmetric cryptography as an
extension of message authentication codes, but the explanations are
articulate, including both algebraic and numeric examples, although
the numeric illustrations could be fuller.

Part two deals with network security applications. Chapter four looks
at authentication applications, concentrating on Kerberos and X.509.
The examples of email security systems given in chapter five are PGP
(Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail
Extension). Security provisions for the Internet Protocol (IP) itself
are reviewed in chapter six. Web security, in chapter seven,
discusses SET (Secure Electronic Transaction) and SSL (Secure Sockets
Layer). Chapter eight reviews SNMP (Simple Network Management
Protocol) both in terms of network management for security purposes,
and in regard to cryptography for authentication of the application
itself.

Part four outlines general system security. Intruders and malicious
software are lumped together in chapter nine, with a reasonable
outline of the types of malware, but not dealing as well with viruses
themselves. (Activity Monitors are referred to as "third generation"
tools, when they actually predate both signature scanners ["first
generation"] and heuristics ["second generation"].) Chapter ten
finishes off the book with a description of firewalls, but has a
rather odd inclusion of basic access control and trusted systems.

Each chapter ends with a set of recommended readings and problems.
Many chapters also have appendices giving additional details of
specific topics related to the subject just discussed.

A very reasonable guide, although possibly less practical than it
intended to be.

copyright Robert M. Slade, 2003 BKNTSCES.RVW 20031210

--
======================
rslade.RemoveThis@vcn.bc.ca slade.RemoveThis@victoria.tc.ca rslade.RemoveThis@sun.soci.niu.edu
"If you do buy a computer, don't turn it on." - Richards' 2nd Law
============= for back issues:
[Base URL] site http://victoria.tc.ca/techrev/
or mirror http://sun.soci.niu.edu/~rslade/
CISSP refs: [Base URL]mnbksccd.htm
Security Dict.: [Base URL]secgloss.htm
Security Educ.: [Base URL]comseced.htm
Book reviews: [Base URL]mnbk.htm
[Base URL]review.htm
Partial/recent: http://groups.yahoo.com/group/techbooks/
Security Educ.: http://groups.yahoo.com/group/comseced/
Review mailing list: send mail to techbooks-subscribe.RemoveThis@egroups.com
or techbooks-subscribe.RemoveThis@topica.com

In other words the book is "academic" in nature, and
not realistic in terms of providing actual security on a
network. A new book is being written collectively on
the Internet .. which I would like to recommed to
everybody. It has no title, yet, .. but basically, I can
only describe it in terms of "acceptable losses". Don't
quote me on these figures .. I've been reading too
many sites to be accurate: last year, ebay did 2 billion
dollars in sales. Roughly 21 million was stolen by
spoofing URLs and stealing buyer / seller identities.
Meaning what? Meaning that so-called Internet security
regards financial dealings is a joke !!!!!!!!!!!!!!!!!!!!
For example: If you try to make a VISA payment
through 2Checkout.com, you are likely to get an "address
error - authorization failed: TRY AGAIN" error
message. If you "try again", the error will repeat as
many times as you "try again". Unknown to you, those
VISA payments are actually going through to VISA,
and potentially to an off-shore client. If you don't catch
it in time either: VISA eats it. You get your card canceled.
Ebay does a "charge back" to a seller who is not in-
country ( fat chance ). Or, possibly, it was a spoof site,
and the crook is gone ... many possibilities. This kind
of Social Engineering is ingenious, and all this academic
talk about network security is just silly. Oh .. and if you
call the FEDS about getting ripped off ... there will be
this great silence coming back in the form of a canned
reply suggesting that you "try again". HTML is not spoof
proof at all. Web pages that look like legit sites are
easy to create .. including all the crap about "secure"
connections, and anybody can fall for the con ... including
professionals working inside a so-called secure network
who respond to a link in an email from "the boss" ... the
link sending them to the "bosses" web page where they
give up the shop. The Courts and the big companies
are moving fast to "weasel word" what they do, and
run from potentially about 200,000 lawsuits against
ebay alone ( that is how many hits I got when I googled
"ebay fraud" ). Ebay now claims that they are not
"auctioneers", so it is not their fault

johns