Author: Charles P. Pfleeger, Shari Lawrence Pfleeger and Lizzie Coles-Kemp
Publisher: Addison-Wesley
Pages: 1040
ISBN: 978-0137891214
Print: 0137891210
Kindle: B00S88TJV2
Audience: General
Rating: 4
Reviewer: Kay Ewbank

This is an updated version of a classic text on security in computing. It would be a good read for a student starting a course on computer security, but is it as useful for the rest of us?

The tricky thing for such a general title is how wide the topic is; this is a big book but it's difficult to be comprehensive.

The book opens with an introduction laying out the basics of computer security - what the threats are and the vulnerabilities. This is followed by a chapter on the security 'toolbox' that provides protection - authentication, access control and cryptography.  

Having set out the basics, the authors look at programs and programming and how they can cause security problems eitherthrough programming oversights, or by programs used to attack such as viruses, worms and trojan horses. A chapter on security from the user viewpoint on the Internet comes next, looking at browser attacks, attacks targeting users, mobile apps and attacks in emails and messages.

More traditional areas are looked at next with chapters on operating systems and networks. The authors consider attack types such as rootkits for operating systems. The chapter on network security is split into two parts, one part looking at network security attacks such as denial of service, the second half looking at countermeasures such as cryptography, firewalls, and intrusion detection and prevention systems. 

A chapter on data and databases starts with what the security requirements are, how to manage reliability and integrity, and database disclosure before ending with a new section on data mining and big data. 

A new chapter om cloud computing and the Internet of Things considers topics such as cloud security, embedded devices, securing smart homes, and big security topics such as managing the security of online healthcare and utilities such as electricity and water. 

Privacy is the next area to be considered, including areas such as identity theft, the online environment, email and message security, and newer technologies such as electronic voting.

A chapter on management and incidents looks at security planning, handling incidents, risk analysis and physical threats. The authors then move on to legal issues and ethics, considering topics such as information and the law, rights of employers and employees, and redress when things go wrong. This chapter also looks at the ethics of computer security and the use of AI. The chapter ends with a look at a number of situations from the viewpoint of ethics - privacy rights, denial of service, fraud, accuracy and so on. 

There's a useful chapter on cryptography that includes cryptology, symmetric and asymmetric encryption, digital signatures and quantum key distribution.

The book ends with a look at 'emerging topics' including AI and cybersecurity, blockchains and cryptocurrencies, cyberwarfare, and quantum computing and security.

 

This is a good general and wide-ranging introduction to security, and I'd recommend it to anyone who wants an overview-level grasp of the topic. However, each area considered is so wide that it needs a whole book of its own, so you're going to have to read and learn a lot more to really get to grips with security as a whole.