دانلود کتاب اصول و تمرین امنیت کامپیوتر

Since the fourth edition of this book was published, the field has seen continued innovations and improvements. In this new edition, we try to capture these changes while maintaining a broad and comprehensive coverage of the entire field. There have been a number of refinements to improve pedagogy and user-friendliness, updated references, and mention of recent security incidents, along with a number of more substantive changes throughout the book. The most noteworthy of these changes include: • Multi-factor authentication and mobile authentication: Chapter 3 includes a new discussion on multi-factor authentication (MFA) in which the user presents two or more pieces of evidence (or factors) to verify their identity. This is increasingly used to address the known problems with just using a password for authentication. This is commonly done using either a hardware authentication token, or using SMS text messages or an authentication app on mobile devices, as we discuss. • Mandatory access control (MAC): Chapter 4 includes some revised discussion on mandatory access controls that was previously included in the online Chapter 27. These controls are now included as part of the underlying security enhancements in recent releases of some Linux, macOS, and Windows systems. • Social engineering and ransomware attacks: The discussion in Chapters 6 and 8 on social engineering, and its use in enabling ransomware attacks have been updated, reflecting the growing incidence of such attacks, and the need to defend against them. These defenses include improved security awareness training, as we discuss in Chapter 17. • Supply-chain and business email compromise attacks: Chapter 8 includes new discussion on the growth of supply-chain and business email compromise (BEC) attacks, including the recent SolarWinds attack, which have been used to compromise many commercial and government organizations in recent years. • Updated list of the most dangerous software errors: Chapter 11 includes an updated list of the Top 25 Most Dangerous Software Errors. It also discusses the recent widely exploited code injection attack on the Apache Log4j package. • Updated list of essential controls: Chapter 12 includes updated lists of essential controls, including the Australian Signals Directorate’s “Essential Eight” that should be used by all organizations to improve the security of their operating systems. • Trusted computer systems: Chapter 12 includes some revised discussion on trusted computer systems that was previously included in the online Chapter 27, which is relevant to the use of secure systems in some government organizations. • Updated list of security controls: Chapter 15 includes a significantly updated list of the NIST security controls that should be considered when addressing identified security risks in organizations. • Security awareness and training: Chapter 17 includes a significantly revised section on security awareness and training for personnel, which is of increasing importance given the rise in security incidents that result from deliberate or accidental personnel actions. • European Union (EU) General Data Protection Regulation (GDPR): Chapter 19 includes a new section on the EU’s 2016 GDPR that is effectively the global standard for the protection of personal data, its collection, access, and use. • The ChaCha20 stream cipher: Chapter 20 includes a new section with details of the ChaCha20 stream cipher, replacing details of the now depreciated RC4 cipher. • Galois Counter Mode: Appendix E now includes details of the new Galois Counter authenticated encryption mode of use for block ciphers.