Computer Security: Art and Science

Citation

Bishop, M. (2018). Computer Security: Art and Science (2nd ed.). Addison-Wesley.

Chapter Summary

The second edition runs to about 1,440 pages: 31 chapters in eight parts, then a ninth part of eight appendices. Every chapter ends with a summary, a "Research Issues" section, further reading and exercises. The publisher describes the book as both a comprehensive text and a detailed reference.

Part I, Chapter 1: An Overview of Computer Security

The opening chapter introduces the basic components (confidentiality, integrity, availability), threats, the difference between policy and mechanism, assumptions and trust, assurance, operational issues such as cost–benefit and risk analysis, and human issues. It is the vocabulary chapter for the rest of the book, and the author offers it as a free sample.

Part II, Chapters 2–3: Access Control Matrix; Foundational Results

Chapter 2 formalises protection state with the access control matrix model, state transitions, and copying, owning and attenuation of privilege. Chapter 3 asks the general question of whether a system can be proved safe, then covers basic results, the Take-Grant and Schematic Protection models, and comparisons of the expressive power of models.

Part III, Chapters 4–9: Policy

Chapter 4 describes the nature and types of security policies, trust, types of access control and policy languages. Chapters 5 and 6 treat confidentiality (the Bell–LaPadula model, tranquility and the controversy over it) and integrity (Biba, Lipner, Clark–Wilson, trust models). Chapter 7, new in this edition, treats availability policies: deadlock, denial-of-service models and network flooding. Chapter 8 covers hybrid policies (Chinese Wall, clinical information systems, originator control, role-based access control, break-the-glass), and Chapter 9 covers noninterference, nondeducibility, restrictiveness, side channels and policy composition.

Part IV, Chapters 10–13: Implementation I: Cryptography

Basic Cryptography, Key Management, Cipher Techniques and Authentication. These chapters cover symmetric and public-key cryptosystems, checksums and signatures, key exchange and infrastructures, stream and block ciphers, authenticated encryption and example protocols, and then passwords, challenge–response, biometrics, location and multifactor authentication.

Part V, Chapters 14–18: Implementation II: Systems

Chapter 14, "Design Principles", presents eight principles of secure design (least privilege, fail-safe defaults, economy of mechanism, complete mediation, open design, separation of privilege, least common mechanism, least astonishment). Chapters 15–18 cover representing identity, access control mechanisms (ACLs, capabilities, locks and keys, rings), information flow and the confinement problem with isolation and covert channels.

Part VI, Chapters 19–22: Assurance

Introduction to Assurance, Building Systems with Assurance, Formal Methods and Evaluating Systems. The last of these traces evaluation schemes from the TCSEC through the ITSEC and Federal Criteria to FIPS 140, the Common Criteria and SSE-CMM. The part is credited to contributors Elisabeth Sullivan and Michelle Ruppel.

Part VII, Chapters 23–27: Special Topics

Malware (Trojan horses, viruses, worms, bots, defences and the theory of computer viruses), Vulnerability Analysis (penetration studies, classification, frameworks), Auditing, Intrusion Detection and, new in this edition, Attacks and Responses (representing attacks, intrusion response, digital forensics).

Part VIII, Chapters 28–31: Practicum

Network Security, System Security, User Security and Program Security. The first three apply the earlier policy and mechanism material to concrete networks, hosts and user environments; Chapter 31 follows the secure-programming process from requirements through design, implementation, testing and distribution, with a section on common security-related programming problems.

Part IX: Appendices

Lattices, the extended Euclidean algorithm, entropy and uncertainty, virtual machines, symbolic logic, the encryption standards (DES and AES), an example academic security policy and programming rules.

Key Concepts

Chapters 1–3: Foundations

• Confidentiality, integrity, availability: the three aspects of security from which policies are built.
• Policy versus mechanism: a policy states what is allowed; a mechanism enforces it, and trust is the assumption that links them.
• Safety question: whether a protection system can reach an unsafe state, the question addressed by the foundational results of Chapter 3.

Chapters 4–9: Policy

• Security models: Bell–LaPadula (confidentiality), Biba, Lipner and Clark–Wilson (integrity), Chinese Wall and role-based access control (hybrid).
• Noninterference: a policy-composition property stating that high-level actions must not affect what low-level users observe.

Chapters 10–18: Implementation

• Secure design principles: the eight design principles of Chapter 14.
• Information flow and confinement: controlling where information may travel, and the covert channels that evade the controls.

Chapters 19–31: Assurance and practice

• Assurance and evaluation: building and evaluating systems against stated requirements.
• Malware, vulnerability analysis, auditing and intrusion detection: the detect-and-respond side of security.

Critical Analysis

Strengths

• Theory tied to practice. The publisher stresses the "deep links between theory and practice", and the structure delivers it: formal models in Parts II–III, mechanisms in Parts IV–V, then evaluation, attack analysis and practical chapters.
• Updated for the second edition. The publisher lists new chapters on availability policy models and attack analysis, more recent examples and newer technologies. Each chapter closes with research issues and further reading, which suit a graduate course or independent project.
• Scope. The book spans cryptography, authentication, identity, assurance, malware, forensics and secure programming in one framework, and the appendices supply the lattice, logic, entropy and virtual-machine background that the models need.
• Policy models in depth. Parts II and III are unusually detailed, covering the Take-Grant and Schematic Protection models, noninterference and nondeducibility, and the Bell–LaPadula controversy.

Limitations

• Size. At roughly 1,440 pages it is far too large for one course; the book is better treated as a reference from which an instructor or reader selects.
• Cryptography is a component. Basic Cryptography occupies about forty pages (Chapter 10 runs pp. 289–330), so readers who need cryptographic rigour should pair it with a dedicated text.
• Formal vocabulary. The foundational results, policy models and formal-methods chapters draw on lattices and symbolic logic (Appendices A and E), so readers without discrete mathematics should expect to work to follow them.

Where It Fits in the Course

Bishop is the most formal and policy-oriented book on this course's list. Easttom's Computer Security Fundamentals is a one-volume introduction for students with no security background, and Stallings and Brown's Computer Security: Principles and Practice is an undergraduate text linking principles to the design and operation of systems. Anderson's Security Engineering approaches the subject through case studies and the economics and psychology of security. Katz and Lindell's Introduction to Modern Cryptography and Paar and Pelzl's Understanding Cryptography go much deeper into cryptography than Bishop's Part IV does.

Read an introductory text first, then use Bishop for the models, assurance and evaluation material that those books treat briefly.

How to Use This Book

The publisher addresses advanced undergraduates, graduate students and IT professionals. Operating systems and discrete mathematics are the natural background, with some programming experience.

A practical plan:

• Core: Chapter 1, then Chapters 2, 4, 5 and 6 for access control and the main policy models, Chapter 14 for design principles, and Chapters 15–16 for identity and access control mechanisms.
• Theory-oriented extension: Chapters 3, 9, 17 and 18 (safety results, noninterference, information flow, confinement), and Chapters 19–22 for assurance and evaluation.
• Practice-oriented extension: Chapters 23–27 on malware, vulnerabilities, auditing, intrusion detection and attacks, then the practicum chapters 28–31.
• Cryptography: read Chapters 10–13 as an overview and consult a dedicated text for depth.

Work the exercises at the end of each chapter; those on models reward writing out the state transitions by hand.