|Title: Internet Besieged: Countering Cyberspace Scofflaws
Editors: Dorothy Denning and Peter Denning
Publisher: ACM Press (Addison-Wesley)
Although the title conjures up visions of tabloid-style hype, Internet Besieged is actually a serious, wide-ranging, and informative collection of original essays and previously published articles relating to Internet security issues. Chapter auth ors include Dorothy Denning, Peter Denning, Eugene Spafford, Steven Levy, Stephen Kent, Peter Neumann, Janet Reno, and Bruce Sterling.
Internet Besieged examines five important aspects of Internet security:
There is a fair amount of overlap among some of the book's chapters, but not so much as to make any of the individual units redundant.
Two chapters from the first part, which is intended as an introduction to Internet security issues, stand out. The first, Dorothy Denning's survey of Internet security issues, provides a useful taxonomy of attacks and defenses. While this chapter might have worked better as the opener for Part II, the book's modular design makes its placement less relevant than it would be in a book meant to be read cover-to-cover. Eugene Spafford's chapter on computer viruses is also particularly well done.
The book's remaining chapters provide detailed looks at issues such as SYN flooding, packet sniffing, user authentication (Woo and Lam's discussion of authentication for distributed systems is especially good), Java security, Tripwire (a program that chec ks system files for modifications), SATAN (the Internet host security scanning program), and key escrow systems.
Dorothy Denning, a noted proponent of programs assuring law enforcement access to encryption keys (given appropriate procedural safeguards), contributed two chapters on key escrow systems to Internet Besieged. One chapter, a taxonomy of key escrow systems, is co-authored by Dennis Branstad; the other chapter, entitled "Encryption Policy and Market Trends", looks at the economic impact of US encryption-related export controls and the international spread of cryptographic technology. While the latt er chapter reflects Dorothy Denning's support for government-managed key escrow systems, the editors take care to treat the issue in a balanced manner. Denning's chapter is paired with a speech by US Attorney General Janet Reno, while the opposition to k ey escrow is represented by two speeches by Bruce Sterling, science fiction writer and author of The Hacker Crackdown.
One element of Internet security I would have liked to have seen covered in more detail is risk management. Other books, such as Ira Winkler's Corporate Espionage and Icove, Seger, and VonStorch's Computer Crime, place a great deal of empha sis on scaling security measures to the value and time-sensitivity of the data in question. A future edition of Internet Besieged would certainly benefit from such a chapter.
Despite the lack of a chapter on risk management, Internet Besieged provides a solid overview of Internet security issues. In my opinion the book is a good choice for classroom use or for the general reader who wants to learn the technical details of the major Internet security and policy challenges of the day.
-- Curtis D. Frye, Editor of Technology and Society
Return to the Commerce, Security, and the Law reviews page.