Follow the author

Matt Curtin

+ Follow

More books from this author

Developing Trust: Online Privacy and Security 1st ed. Edition

by Matt Curtin (Author), Peter G. Neumann (Author)

4.5 4 ratings

See all formats and editions

Although the harrowing number of Internet-based attacks in recent years has elevated the importance of maintaining secure electronic networks, many developers continue to employ passive security administration strategies, addressing issues by using patches in a non-systematic fashion. This counterproductive strategy can be largely attributed to a lack of knowledge regarding the general concepts required to effectively prevent the attack and potential compromise of networked systems.

Developing Trust: Online Privacy and Security is an indispensable resource for system administrators and application developers, providing a means to understand, create, and maintain secure Internet systems. Matt Curtin's instructional approach facilitates a comprehensive understanding of online security by separating the core material into three sections:

Understanding Security and Privacy introduces attack models, general privacy theory and policy, online privacy concepts, and provides a synopsis of the mechanics of threats to privacy.
Prevention delves into secure design principles and deployment environments, closing with several case studies of major security problems uncovered by the author himself.
The Cure investigates the mechanics of identifying and repairing flawed security design techniques before they are incorporated into the final product. Discussion regarding the failure of "opt-out" systems to protect privacy is also included in this section.

Editorial Reviews

Amazon.com Review

Suitable for the IP manager or developer seeking to improve Web privacy and security, Developing Trust: Online Privacy and Security provides an intriguing, though at times somewhat theoretical, guide to the issues surrounding privacy today.

Interestingly, this book straddles an expert-eye, theoretical overview of what privacy is and a more practical view of how it is often undermined on the Internet today. Early sections cover basic terms and concepts of privacy at a fairly high level. Mixing in sometimes erudite commentary (and an occasional rant), the author's expert-level view does a good job of explaining what privacy is and the larger principles used to protect it. From anonymity to "verinymity" (where sites know who you are), Curtin makes a good case that anonymity is often eventually undermined on today's Web sites. A good section early in the book outlines how a potential attacker might attack a hypothetical Web site for security holes. (We never see the attack carried out, perhaps because it would be irresponsible to do so, but this material establishes Curtin's expertise for the reader.)

Though the early sections largely avoid specific standards and real Internet software, the book soon delves into the nuts and bolts of the Web, for example HTTP, HTML, URLs, and cookies, with an eye to privacy. For most readers, the most fascinating sections of this text will be the author's five case studies on real privacy problems with some of today's leading Web sites and vendors (including Netscape and DoubleClick). He shows how certain features--like cookies--can undermine privacy (or even the ability to "opt out" successfully). A follow-up chapter cements the argument that if Web sites collect "anonymous" browsing behavior, it is all too easy to connect users' real identities to their supposedly anonymous profiles later on, putting privacy in jeopardy. Finally, the author makes a good argument that protecting privacy is good business sense.

The book concludes with more practical advice on implementing good security practices, including an excellent discussion of firewalls, DMZs, including their limitations, and a checklist for beefing up security in your organization. The text closes with a final case study of a hypothetical Web site (which serves up content from third parties) that arguably "does it right" regarding privacy, based on the author's earlier discussion.

While the mix of theoretical and practical here will not suit everyone, there's little doubt that the author's in-depth understanding of the issues surrounding privacy today can help your organization do better with privacy and security. While this title will not help you configure Internet Information Server, for instance, it will help you plan high-level strategies for improved security, as well as show you why protecting user and organizational privacy makes good business sense. --Richard Dragan

About the Author

Matt Curtin is the founder of Interhack Corporation and is responsible for the leadership of Interhack's research, development, and consulting efforts. His present focus is to understand how complex systems interact "in the large," and how that affects security, privacy, and reliability. Findings of this work have been widely covered in major news media around the world. A frequent lecturer and author, Matt also tries to help developers understand how they can avoid the mistakes that undermine the trustworthiness of the systems on which we depend. Some of his recent audiences have included Columbus ITEC, Columbus INFOSEC Forum, Privacy 2002, Columbus and Dayton chapters of InfraGard, the Northeast Ohio chapter of ISACA, and the Wellington School, in addition to local, national, and trade media. He holds the National Security Agency's INFOSEC Assessment Methodology (IAM) certification and is a certified information systems security professional (CISSP).

Product details

ASIN ‏ : ‎ 1893115720
Publisher ‏ : ‎ Apress; 1st ed. edition (December 4, 2001)
Language ‏ : ‎ English
Paperback ‏ : ‎ 312 pages
ISBN-10 ‏ : ‎ 9781893115729
ISBN-13 ‏ : ‎ 978-1893115729
Item Weight ‏ : ‎ 1.36 pounds
Dimensions ‏ : ‎ 7.25 x 0.75 x 9.25 inches

Best Sellers Rank: #7,883,872 in Books (See Top 100 in Books)
- #824 in CompTIA Certification Guides
- #3,356 in Software Design & Engineering
- #3,751 in Computer Networking (Books)

Customer Reviews:
4.5 4 ratings

Brief content visible, double tap to read full content.

Full content visible, double tap to read brief content.

Videos

Help others learn more about this product by uploading a video!

Upload your video

About the author

Follow authors to get new release updates, plus improved recommendations.

Matt Curtin

Brief content visible, double tap to read full content.

Full content visible, double tap to read brief content.

Matt Curtin is the founder of Interhack Corporation, a forensic computing and information assurance professional services firm based in Columbus, Ohio, as well as a Lecturer in the Department of Computer Science and Engineering at The Ohio State University. He is a frequent lecturer on computing and security as well as the author of 'Brute Force: Cracking the Data Encryption Standard' (Copernicus Books, 2005) and 'Developing Trust: Online Privacy and Security' (Apress, 2001).

Customer reviews

4.5 out of 5

4 global ratings

3 star

0%

2 star

0%

1 star

0%

How customer reviews and ratings work

Sort reviews by

Top reviews from the United States

There was a problem filtering reviews right now. Please try again later.

W Boudville

case studies are good expositions

Reviewed in the United States on March 23, 2005

Written in 2002 and with scarcely two years passing, Curtin's message is more timely this year. He warned of the perils of malware and of cracker attacks on corporate databases. Especially by social engineering.

He presents several case studies of insecure privacy applications. He analyzed the commercially deployed systems of Alexa, DoubleClick and others. Showing how cookies and server side bugs could lead to users being tracked. In some cases, as they perused many different websites that reported their activities to a central site. Other books have talked about how cookies could be misused in this way. But Curtin's analysis goes beyond a typical generic treatment and can be more instructive to you.

The malware of 2002 that he warned of has increased in sophistication and danger. No sign of abatement, so keeping the book's ideas in mind is a good idea.

4 people found this helpful

Helpful

Mike Tarrani

Definitive work

Reviewed in the United States on May 12, 2002

This book examines the social, legal and technical issues surrounding online privacy. Not only is the consumer side of privacy examined, but the business side from a marketing point of view is also discussed to present a balanced view of the key issues from both sides of the equation.
Mr. Curtin is an expert in privacy and security issues, as well as cryptography and security technology. The approach he takes in the book is to explain both the theory and concepts of privacy in social and legal contexts, and to examine the threats and exposures.
From there he leads you through the design of a solution that starts with principles, then a thorough examination of the underlying online technologies and how they work for and against you. An obvious example of one technical element that works for and against is the 'cookie' which can provide a major convenience (it remembers you and your preferences) and an invasion of your privacy (it remembers you and your preferences - and can also 'stalk' you in a manner of speaking). How to best balance the strengths and weaknesses of not only the technology, but the business imperatives driving commercial uses of the internet are addressed.
My personal vuiew is that this book blends the best of Bruce Schneier's Secrets and Lies and Richard Hunter's World Without Secrets. Schneier's book covered the full range of security issues, social and technical. Hunter's book is more focused on social aspects of privacy. What sets this book apart from those two are the focus on privacy and the multiple contexts in which the book addresses it: social, legal and technical. If the author keeps this book up to date it is destined to become a classic. The challenge is to remain abrest of emerging legal issues and technical breakthroughs - both of which are inevitable.

5 people found this helpful

Helpful

Josef Finsel

Making a dry subject palatable

Reviewed in the United States on July 11, 2002

Security and privacy are not "sexy" subjects and I was ready for a dry dissertation but this book was anything but.
Although the subject matter is serious and is treated seriously, Curtin has a light and deft touch that make the book a pleasure to read.
And while this book's target audience is programmers responsible for dealing with the issues of Privacy and Security, I would recommend this book to a much wider audience. Every top manager of a company that has a web site should read this book so they can understand how Online Privacy and Security could affect them and so they can ask the questions that someone needs to be asking the folks who are running and developing websites.
I would also recommend the internet savvy who are curious about these two buzzwords because this book will provide them a much better understanding of the stories that have and will appear in the news related to privacy and security. The real world examples are ones that we all can relate to.

8 people found this helpful

Helpful

Ben Rothke

Really Good book about privacy

Reviewed in the United States on May 21, 2002

Privacy means radically different things to different people as it is an abstract and often elusive term that is often difficult to effectively define.
In a nutshell, privacy is the ability of an individual or organization to decide whether, when, and to whom personal or organizational information is released.
While defining privacy is difficult, ensuring on-line privacy is even more challenging. Those required to ensure that their corporate systems and web sites are secure against prying hackers will find Developing Trust: Online Privacy and Security to be an important resource.
Curtain writes in an entertaining and easy to read style; especially when he introduces topics such as attack models, privacy concepts, and threats.
The book suggests prevention mechanisms and includes a few real-world case studies. If you have anything to do with electronic privacy, Developing Trust: Online Privacy and Security is a great book to read.

2 people found this helpful

Helpful