Threats: What Every Engineer Should Learn from Star Wars [1 ed.] 1119895162, 9781119895169

Table of contents :
Cover
Title Page
Copyright Page
Contents
Preface
Introduction
Who This Book Is For
What You’ll Gain from This Book
A Few Words for the Nonengineer
Security Terminology
How This Book Is Organized
Chapter 1 Spoofing and Authenticity
Identifiers and Authentication
Technical Identifiers
Human Identifiers
Authenticating People to People
Authenticating People to Computers
Authenticating Computers to People
Authenticating Computers to Computers
Spoofing Attacks
Spoofing Files
Spoofing Processes
Spoofing Machines
Spoofing in Specific Scenarios
Internet of Things
Mobile Phones
Cloud
Considerations in Authenticating to Organizations
Mechanisms for Spoofing Attacks
Misrepresentation
Attacks on Authentication Mechanisms
Threats Against Authentication Types
Defenses
Authenticating People
Authenticating Computers
Conclusion
Chapter 2 Tampering and Integrity
Introduction
Targets of Tampering
Tampering with Storage
Tampering with Communications
Tampering with Time
Process Tampering
Tampering in Specific Technologies
Mechanisms for Tampering
Location for Tampering
Tools for Tampering
Defenses
Cryptography
The Kernel
Detection
Conclusion
Chapter 3 Repudiation and Proof
Introduction
The Threat: Repudiation
Message Repudiation
Fraud
Account Takeover
Logging Threats
Repudiation in Specific Technologies
Internet of Things (Including Phones)
Cloud
AI/ML
Crypto and Blockchain
Repudiation Mechanisms
Defenses
Cryptography
Keeping Logs
Using Logs
Antifraud Tools
Conclusion
Chapter 4 Information Disclosure and Confidentiality
Threats to Confidentiality
Information Disclosure, at Rest
Information Disclosure, in Motion
Information Disclosure from a Process
Human Connections
Side Effects and Covert Channels
Information Disclosure Mechanisms
Information Disclosure with Specific Scenarios
Internet of Things
Mobile Phones
Cloud
AI/ML
Blockchain
Privacy
Defenses
Operating System Defenses
Defending Your Process
Cryptography
Conclusion
Chapter 5 Denial of Service and Availability
Resources Consumed by Denial-of-Service Threats
Compute
Storage
Networks
Electrical Power
Money
Other Resources
Denial-of-Service Properties
Bespoke or Generalized
Amplification
Authentication Targets
Ephemeral or Persistent
Direct or Emergent
Denial of Service in Specific Technologies
Authentication Services
Cloud
Protocol Design
IoT and Mobile
Defenses
Abundance and Quotas
Graceful Degradation
Resilience Testing
Conclusion
Chapter 6 Expansion of Authority and Isolation
Expansion Mechanisms and Effects
Authority in Specific Scenarios
Confused Deputies
Internet of Things
Mobile
Cloud
Defenses
Least Privilege and Separation of Privilege
Architecture as Barrier
Code as Barrier
Authority and Privilege
Access Control (Background)
Newer Approaches to Policy
Conclusion
Chapter 7 Predictability and Randomness
Predictability Threats
Guessing and Testing
Cryptographic Threats
Time and Timing Threats
Information Disclosure and Time
Tampering with Time
Predictability in Specific Scenarios
Network Traffic
Local System Threats
Business Processes
Defenses
Preventing Races
Defenses Against Guessing and Searching
Usability
Assume Transparency
Conclusion
Chapter 8 Parsing and Corruption
What Is Parsing?
How Parsers Work
A “Bit” of Context
All Data Is Tainted
Threats to Parsers
SQL Injection Example
Surprising Output
Overly Powerful Input
Denial-of-Service Threats to Parsers
Bad Advice
Chained Parsers
Specific Parsing Scenario Threats
Parsing Protocols + Document Formats
C Code + Memory Safety
Defenses
The Robustness Principle
Input Validation
Memory Safety
LangSec
Conclusion
Chapter 9 Kill Chains
Threats: Kill Chains
Server Kill Chain
Desktop Kill Chains
Acquire or Use Credentials
Kill Chains for Specific Scenarios
Cloud
IoT
Mobile (IoS, Android)
Weaponization as a Subchain
“No One Would Ever Do That”
Ransomware
Elements of Network Kill Chains
History
History of Kill Chains
Defenses
Types of Defenses
Defensive Scenarios
Conclusion
Epilogue
Glossary
Bibliography
Story Index
Episode I: The Phantom Menace
Episode III: Revenge of the Sith
Obi-Wan (Television Series)
Rogue One
Star Wars: A New Hope
The Empire Strikes Back
Return of the Jedi
Index
EULA

Polecaj historie

Threats: What Every Engineer Should Learn From Star Wars [1 ed.] 1119895162, 9781119895169

Secure your applications with help from your favorite Jedi masters In Threats: What Every Engineer Should Learn From St

242 57 1MB Read more

What Every Engineer Should Know about Software Engineering 0849372283, 9780849372285

Do you… Use a computer to perform analysis or simulations in your daily work? Write short scripts or record macros to pe

1,972 292 4MB Read more

Every Engineer Should Know This! 3682634466

Ever wonder why the guy who barely made it through engineering school is now your boss? Are you really cut out to be a g

861 131 2MB Read more

What Every Engineer Should Know About Career Management [1 ed.] 9781420076820, 9781420076837, 9781138423152, 9780429139307

Thanks to their education, experience, and general philosophical orientation, many engineers fail to notice critical iss

543 134 3MB Read more

What Every Engineer Should Know About Smart Cities [Team-IRA] [1 ed.] 103239093X, 9781032390932

Get ready to be at the forefront of the future of urban development! As cities continue to rapidly grow, the demand for

211 89 17MB Read more

What Every Engineer Should Know About Data-Driven Analytics 1032235403, 9781032235400

What Every Engineer Should Know About Data-Driven Analytics provides a comprehensive introduction to the theoretical con

303 100 26MB Read more

What Every Engineer Should Know about Accounting and Finance [1 ed.] 9780824792718, 9781482228014, 9780429183591

Presents the fundamental finance and accounting processes, methods, strategies and terminology necessary for engineers a

1,078 161 11MB Read more

97 Things Every Cloud Engineer Should Know 9781492076735

634 39 7MB Read more

What Every Engineer Should Know About Data-Driven Analytics 9781032235431, 9781032235400, 9781003278177

What Every Engineer Should Know About Data-Driven Analytics provides a comprehensive introduction to the theoretical con

266 33 5MB Read more

What Every Engineer Should Know About Risk Engineering and Management [2 ed.] 9781032442105, 9781032439822, 9781003371014

Completely updated, this new edition uniquely explains how to assess and handle technical risk, schedule risk, and cost

368 63 20MB Read more