a more in-depth understanding of the area. Another excellent resource is the "Handbook of Applied Cryptography," by Menezes, Oorschot, and Vanstone. It has often been considered "the bible of cryptography" and offers a detailed and technical view.
The first several chapters of the book focus on the basics. It gives an overview and history of cryptography and follows with an explanation of the mathematics necessary to understand the algorithms. Midway through the book, it gives detailed information to help the reader understand
stream ciphers, block ciphers, and finally public key encryption. After the reader has an understanding of the algorithms, the book moves to explain how they can be used in key establishment protocols. It also offers chapters on key management and tips for efficient implementation.
For the long time manager, this book may be slightly on the technical side. However, there are clear benefits for management having an understanding of technical subjects. Cryptography today offers a very strong level of protection. It only fails in implementation. For
example, keys are not properly protected or managed. For those of you wishing to learn a little more about the fascinating subject of cryptography, I highly recommend this book.
Perhaps the best part is that the book is available fully for free on the Web:
Hard-copies of the book can also be purchased through Amazon or any other large bookseller.
When any company decides to take on a in-house software development project, it is essential to include cryptographic mechanisms. Books such as this, can give programmers the proper knowledge necessary
to understand how cryptography works and how to avoid problems.
Until next time, cheers!
Benjamin D. Thomas
Linux Security Effectively in 2004
- This article examines the process of proper Linux security management in
2004. First, a system should be hardened and patched. Next, a security routine
should be established to ensure that all new vulnerabilities are addressed.
Linux security should be treated as an evolving process.
OSVDB - An Independent and Open Source Vulnerability Database
- This article outlines the origins, purpose, and future of the Open Source
Vulnerability Database project. Also, we talk to with Tyler Owen, a major
Linux Advisory Watch
is a comprehensive newsletter that outlines the security vulnerabilities that
have been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.
Improper remote execution and SQL code injection issues.
Escal. additional patches
Since DSA 417-1 lacked fixed kernel image files for the alpha architecture
Allows an attacker to execute arbitary commands on server hosting bug database.
Account expiration not enforced
In this Apache module, expiration status of the user's account and password
Anyone who could modify the CVSROOT/passwd could gain access to all local
Many backported vuln fixes
The IA-64 maintainers fixed several security related bugs in the Linux kernel
A critical security vulnerability has been found in recent Linux kernels
Two vulnerabilities can be exploited to make Ethereal crash.
This vulnerability allows for a carefully crafted .VCF file to enable a
cvs can attempt to create files and directories in the root file system
Updated kdepim packages are now available that fix a local buffer overflow
of service vulnerability
Crafted remote packets can result in a denial of service, or possibly execute
Escal. patch for 8.1
There is a bounds-checking problem in the kernel's mremap() call which could
Upgrade to inn-2.4.1 to fix a potentially exploitable buffer overflow.
A carefully crafted .VCF file enables local attackers to execute arbitrary
of service vulnerability
There is a remote DoS condition in tcpdumps ISAKMP handling.
| Many vulnerabilities
fixed for 64bit
Fixes vulnerabilities that can be used to gain root privilages.
of Service vulnerability
A problem in tcpdump was discovered, where it was possible to crash the