Much debate has been given as to whether computer security is improved through the full disclosure of security vulnerabilities versus keeping the problems private and unspoken. Although there is still tension between those who feel strongly about the subject, a middle ground of responsible disclosure seems to have emerged. Unfortunately, just as we’ve moved into an era with more responsible disclosure, it would seem that a market has emerged for security vulnerabilities and zero day exploits. Disclosure of Security Vulnerabilities: Legal and Ethical Issues considers both the ethical and legal issues involved with the disclosure of vulnerabilities and explores the ways in which law might respond to these challenges.
The present volume aims to provide an overview of the current understanding of the so-called Critical Infrastructure (CI), and particularly the Critical Information Infrastructure (CII), which not only forms one of the constituent sectors of the overall CI, but also is unique in providing an element of interconnection between sectors as well as often also intra-sectoral control mechanisms. The 14 papers of this book present a collection of pieces of scientific work in the areas of critical infrastructure protection. In combining elementary concepts and models with policy-related issues on one hand and placing an emphasis on the timely area of control systems, the book aims to highlight some of the key issues facing the research community.
Learn everything you need to know to become a professional security and penetration tester. It simplifies hands-on security and penetration testing by breaking down each step of the process so that finding vulnerabilities and misconfigurations becomes easy. The book explains how to methodically locate, exploit, and professionally report security weaknesses using techniques such as SQL-injection, denial-of-service attacks, and password hacking.
Although From Hacking to Report Writing will give you the technical know-how needed to carry out advanced security tests, it also offers insight into crafting professional looking reports describing your work and how your customers can benefit from it. The book will give you the tools you need to clearly communicate the benefits of high-quality security and penetration testing to IT-management, executives and other stakeholders. Embedded in the book are a number of on-the-job stories that will give you a good understanding of how you can apply what you have learned to real-world situations.
Continue reading “From Hacking to Report Writing: An Introduction to Security and Penetration Testing”
The Raspberry Pi is deceptively simple. Plug it in, boot it up, and use it as a personal computer, or attach a million gizmos and modules and invent something new and amazing. Either way, what it can actually do is not simple, and you should know exactly what the Raspberry Pi hardware is all about. Raspberry Pi Hardware Reference, from Mastering the Raspberry Pi, is the hardware guide you need on your desk or workbench.
Every detail is covered: from power to memory, from the CPU to working with USB. You'll find all the details about working with both wired and wireless Ethernet, SD cards, and the UART interface. The GPIO chapter is invaluable, covering power budgeting, access, and even small but important details like the correct usage of sudo when working with GPIO pins. You'll also find details about the 1-Wire driver, the I2C bus, and the SPI bus. If you need to know anything about your Raspberry Pi's hardware, you will find it here, in Raspberry Pi Hardware Reference.
Continue reading “Raspberry Pi Hardware Reference”
In den letzten Jahren hat sich das Internet schnell zu einem massiven wirtschaftlichen Betätigungsfeld entwickelt, leider auch für illegale Unternehmungen. Das Ausnutzen von Schwachstellen in IKT-Systemen ist inzwischen ein profitables Geschäftsmodell. Das staatlich geförderte Forschungsprojekt CAIS beschäftigte sich deshalb mit der Implementierung eines Cyber Attack Information Systems auf nationaler Ebene mit dem Ziel, die Widerstandsfähigkeit der heutigen vernetzten Systeme zu stärken und ihre Verfügbarkeit und Vertrauenswürdigkeit zu erhöhen. Hauptziele dieses Projektes waren die Identifizierung der künftigen Cyber-Risiken und -Bedrohungen, die Untersuchung neuartiger Techniken zur Anomalieerkennung, die Entwicklung modularer Infrastrukturmodelle und agentenbasierter Simulationen zur Risiko- und Bedrohungsanalyse, und schließlich die Analyse und mögliche Umsetzung eines nationalen Cyber Attack Information Systems.