There's a lot more consciousness of security today, but not a lot of understanding of what it means and how far it should go. No one loves security, but most people---managers, system administrators and users alike---are starting to feel that they'd better accept it, or at least try to understand it.
For example, most U.S. Government equipment acquisitions now require "Orange Book" (Trusted Computer System Evaluation Criteria) certification. A lot of people have a vague feeling that they ought to know about the Orange Book, but few make the effort to track it down and read it. Computer Security Basics contains a more readable introduction to the Orange Book---why it exists, what it contains, and what the different security levels are all about---than any other book or government publication.
This handbook describes complicated concepts such as trusted systems, encryption, and mandatory access control in simple terms. It tells you what you need to know to understand the basics of computer security, and it will help you persuade your employees to practice safe computing.
Contents include:
- Introduction (basic computer security concepts, security breaches such as the Internet worm).
- Computer security and requirements of the Orange Book.
- Communications and network security.
- Peripheral types of security (including biometric devices, physical controls, and TEMPEST).
- Appendices: terms, sources, user groups, and other reference material.
Deborah Russell is an acquisitions editor for O'Reilly & Associates and also manages documentation consulting services for a joint venture of O'Reilly & Associates and Cambridge Computer Associates. In recent years, the focus of her consulting work has been computer security. Her consulting projects include work on the development of a secure UNIX kernel, several trusted operating systems, and a secure compartmented mode workstation. Ms. Russell has worked closely with a number of vendors during the "Orange Book" trusted system evaluation process. She has a degree from Harvard University and is currently developing additional books for O'Reilly & Associates on security and database topics. G.T. Gangemi, Sr., is Director of Wang Laboratories' Secure Systems Program. The Wang organization mirrors the structure of the U.S. government's Information Security (INFOSEC) program, encompassing computer security (COMPUSEC), communications security (COMSEC), TEMPEST, and physical access. Mr. Gangemi is responsible for all Wang security-related products designed for government and commercial use. He has previously held management positions at Wang in a variety of areas, including research and development, product management and marketing, account management, and business planning. He attended La Salle College and the Program for Senior Executives at Harvard University's Kennedy School of Government. He served in the U.S. Army and is a private pilot.
