Contents -- Acknowledgments -- Part I: Overview -- 1 Security -- 1.1 Importance -- 1.2 Threat Models -- 1.3 Concepts -- 1.4 Common Mitigation Methods -- 1.5 People and Staff -- 1.6 Certifications -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 2 Ethics -- 2.1 Ethical Training -- 2.2 Ethical, Social, and Legal Considerations -- 2.3 Intellectual Property -- 2.4 Computer Crimes -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 3 Network Theory -- 3.1 Standards Bodies -- 3.2 Network Stacks -- 3.3 Multiple Stacks -- 3.4 Layers and Protocols -- 3.5 Common Tools -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 4 Basic Cryptography -- 4.1 Securing Information -- 4.2 Necessary Elements -- 4.3 Authentication and Keys -- 4.4 Cryptography and Randomness -- 4.5 Hashes -- 4.6 Ciphers -- 4.7 Encryption -- 4.8 Steganography -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- Part II: OSI Layer I -- 5 Physical Layer -- 5.1 Types of Physical Mediums -- 5.2 Physical Network Components -- 5.3 Physical Network Risks -- 5.4 Topologies -- 5.5 Physical Layer Security -- 5.6 Tracking Attacks -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 6 Physical LAN -- 6.1 Physical LAN Regions -- 6.2 Types of Attacks -- 6.3 Firewalls -- 6.4 Privileged Zones -- 6.5 LAN Connections -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 7 Wireless Networking -- 7.1 Wireless Spectrum -- 7.2 Wireless Protocols -- 7.3 Wireless Risks -- 7.4 Risk Mitigation Options -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- Part III: OSI Layer 2 -- 8 Data Link Layer -- 8.1 Data Flow -- 8.2 Common Uses -- 8.3 Layered Data Link Protocols -- 8.4 Uncommon Uses -- 8.5 Common Mitigation Options -- Summary.

Review Questions -- Discussion Topics -- Additional Resources -- 9 SLIP and PPP -- 9.1 Simplified Data Link Services -- 9.2 Point-to-Point Protocols -- 9.3 Common Risks -- 9.4 Similar Threats -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 10 MAC and ARP -- 10.1 Data Link Sublayers -- 10.2 ARP and RARP -- 10.3 Network Routing -- 10.4 Physical Layer Risks -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- Part IV: OSI Layer 3 -- 11 Network Layer -- 11.1 Routing -- 11.2 Routing Risks -- 11.3 Addressing -- 11.4 Risks to Address Schemes -- 11.5 Fragmentation -- 11.6 Fragmentation Risks -- 11.7 Quality of Service -- 11.8 Quality-of-Service Attacks -- 11.9 Security -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 12 Internet Protocol (IP) -- 12.1 IP Addressing -- 12.2 ICMP -- 12.3 General Risks -- 12.4 Security Options -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 13 Anonymity -- 13.1 Why Be Anonymous? -- 13.2 Privacy versus Anonymity -- 13.3 Network Anonymity -- 13.4 Common Limitations -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- Part V: OSI Layer 4 -- 14 Transport Layer -- 14.1 Common Protocols -- 14.2 Core Transport Layer Functions -- 14.3 Gateways -- 14.4 General Risks -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 15 TCP -- 15.1 Connection-Oriented Protocol -- 15.2 TCP Connections -- 15.3 TCP Reconnaissance -- 15.4 TCP Hijacking -- 15.5 TCP DoS -- 15.6 Mitigation Options -- 15.7 UDP -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- Part VI: OSI Layer 5 -- 16 Session Layer -- 16.1 Session Example: WAP -- 16.2 Session State Machine -- 16.3 Sessions and Stacks -- 16.4 Common Risks -- Summary -- Review Questions -- Discussion Topics.

Additional Resources -- 17 DNS -- 17.1 Common Uses -- 17.2 DNS Protocol -- 17.3 Distributed Architecture -- 17.4 Direct Risks -- 17.5 Technical Risks -- 17.6 Social Risks -- 17.7 Reconnaissance and Exploitation -- 17.8 Mitigation Options -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- Part VII: OSI Layer 6 -- 18 Presentation Layer -- 18.1 Common Usage -- 18.2 Session Management -- 18.3 VPN Technologies -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 19 SSL -- 19.1 Common SSL Usage -- 19.2 SSL Functionality -- 19.3 Certificates -- 19.4 Risks -- 19.5 HTTPS -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 20 SSH -- 20.1 SSH and Security -- 20.2 The SSH Protocol -- 20.3 Common SSH Uses -- 20.4 SSH Limitations -- 20.5 Risks -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- Part VIII: OSI Layer 7 -- 21 Application Layer -- 21.1 Common Formats -- 21.2 General Risks -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 22 SMTP -- 22.1 A Brief History of Email -- 22.2 Email Goals -- 22.3 Common Servers -- 22.4 Risks -- 22.5 Email Ethics -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 23 HTTP -- 23.1 HTTP Goals -- 23.2 URL -- 23.3 URL Exploitation -- 23.4 General HTTP Risks -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- Part IX: General Issues -- 24 Modularity and Security -- 24.1 Software Methodologies -- 24.2 Software Engineering Principles -- 24.3 Impact on Security -- 24.4 The Hacker Mentality -- 24.5 New Protocols -- Summary -- Review Questions -- Discussion Topics -- Additional Resources -- 25 Issues Summary -- 25.1 The OSI Model -- 25.2 Eight Common Security Oversights -- 25.3 Eight Common Mitigation Options.

25.4 Applying Security Example: Agobot -- Summary -- Review Questions -- Discussion Topics -- Appendix A: About the CD-ROM -- Appendix B: Answers to Review Questions -- Appendix C: RFC References -- Appendix D: References -- Glossary of Network Security Terms -- A -- B -- C -- D -- E -- F -- G -- H -- I -- K -- L -- M -- N -- O -- P -- R -- S -- T -- U -- V -- W -- X -- Z -- Index -- A -- B -- C -- D -- E -- F -- G -- H -- I -- J -- K -- L -- M -- N -- O -- P -- Q -- R -- S -- T -- U -- V -- W -- X -- Y -- Z.