Computer Science

Copyright © 2016 by McGraw-Hill Education. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a data base or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication.

ISBN: 978-0-07-183597-8 MHID: 0-07-183597-0

The material in this eBook also appears in the print version of this title: ISBN: 978-0-07-183601-2, MHID: 0-07-183601-2.

eBook conversion by codeMantra Version 1.0

All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.

McGraw-Hill Education eBooks are available at special quantity discounts to use as premiums and sales promotions or for use in corporate training programs. To contact a representative, please visit the Contact Us page at

SANS Institute IT Code of Ethics reproduced with permission, © SANS Institute.

Information has been obtained by McGraw-Hill Education from sources believed to be reliable. However, because of the possibility of human or mechanical error by our sources, McGraw-Hill Education, or others,

McGraw-Hill Education does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such information.

McGraw-Hill Education is an independent entity from CompTIA®. This publication and digital content may be used in assisting students to prepare for the CompTIA Security+ exam. Neither CompTIA nor McGraw-Hill Education warrants that use of this publication and digital content will ensure passing any exam. CompTIA and CompTIA Security+ are trademarks or registered trademarks of CompTIA in the United States and/or other countries. All other trademarks are trademarks of their respective owners.


This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Education’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may be terminated if you fail to comply with these terms.


MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.

About the Authors Dr. Wm. Arthur Conklin is an associate professor and Director of the Center for Information Security Research and Education in the College of Technology at the University of Houston. He holds two terminal degrees, a Ph.D. in Business Administration (specializing in Information Security) from The University of Texas at San Antonio (UTSA) and the degree Electrical Engineer (specializing in Space Systems Engineering) from the Naval Postgraduate School in Monterey, CA. He holds CompTIA Security+, CISSP, CSSLP, CRISC, DFCP, GICSP, and CASP certifications. An ISSA Fellow, he is also a senior member of ASQ and a member of IEEE and ACM. His research interests include the use of systems theory to explore information security, specifically in cyber- physical systems. He has coauthored six security books and numerous academic articles associated with information security. He is active in the DHS-sponsored Industrial Control Systems Joint Working Group (ICSJWG) efforts associated with workforce development and cybersecurity aspects of industrial control systems. He has an extensive background in secure coding and is a former co-chair of the DHS/DoD Software Assurance Forum working group for workforce education, training, and development.

Dr. Gregory White has been involved in computer and network security since 1986. He spent 19 years on active duty with the U.S. Air Force and is currently in the Air Force Reserves assigned to the Pentagon. He obtained his Ph.D. in Computer Science from Texas A&M University in 1995. His dissertation topic was in the area of computer network intrusion detection, and he continues to conduct research in this area today. He is currently the Director for the Center for Infrastructure Assurance and Security and is an associate professor of computer science at The University of Texas at San Antonio. Dr. White has written and presented numerous articles and conference papers on security. He is also the coauthor for five textbooks on computer and network security and has written chapters for two other security books. Dr. White continues to be active in security research. His

current research initiatives include efforts in high-speed intrusion detection, community infrastructure protection, and visualization of community and organization security postures.

Dwayne Williams is Associate Director, Special Projects for the Center for Infrastructure Assurance and Security (CIAS) at the University of Texas at San Antonio and has more than 22 years of experience in information systems and network security. Mr. Williams’s experience includes six years of commissioned military service as a Communications- Computer Information Systems Officer in the U.S. Air Force, specializing in network security, corporate information protection, intrusion detection systems, incident response, and VPN technology. Prior to joining the CIAS, he served as Director of Consulting for SecureLogix Corporation, where he directed and provided security assessment and integration services to Fortune 100, government, public utility, oil and gas, financial, and technology clients. Mr. Williams graduated in 1993 from Baylor University with a Bachelor of Arts in Computer Science. Mr. Williams is a Certified Information Systems Security Professional (CISSP), CompTIA Advanced Security Practitioner (CASP), and coauthor of McGraw-Hill’s Voice and Data Security, CompTIA Security+ All-in-One Exam Guide, and CASP CompTIA Advanced Security Practitioner Certification Study Guide.

Roger L. Davis, CISSP, CISM, CISA, is an Account Manager for Microsoft. He has served as president of the Utah chapter of the Information Systems Security Association (ISSA) and various board positions for the Utah chapter of the Information Systems Audit and Control Association (ISACA). He is a retired Air Force lieutenant colonel with 35 years of military and information systems/security experience. Mr. Davis served on the faculty of Brigham Young University and the Air Force Institute of Technology. He coauthored McGraw-Hill’s CompTIA Security+ All-in-One Exam Guide and Voice and Data Security. He holds a Master’s degree in Computer Science from George Washington University, a Bachelor’s degree in Computer Science from Brigham

Young University, and performed post-graduate studies in electrical engineering and computer science at the University of Colorado.

Chuck Cothren, CISSP, is a Principal Solutions Specialist at Symantec Corporation applying a wide array of network security experience, including performing controlled penetration testing, incident response, and security management to assist a wide variety of clients in the protection of their critical data. He has also analyzed security methodologies for Voice over Internet Protocol (VoIP) systems and supervisory control and data acquisition (SCADA) systems. He is coauthor of the books Voice and Data Security, and CompTIA Security+ All-in-One Exam Guide.

About the Technical Editor Bobby E. Rogers is an Information Security Engineer working as a contractor for Department of Defense agencies, helping to secure, certify, and accredit their information systems. His duties include information system security engineering, risk management, and certification and accreditation efforts. He retired after 21 years in the United States Air Force, serving as a network security engineer and instructor, and has secured networks all over the world. Bobby has a Master’s degree in Information Assurance (IA), and is pursuing a doctoral degree in Cybersecurity from Capitol Technology University, Maryland. His many certifications include CRISC, CISSP-ISSEP, C|EH, and MCSE: Security as well as the CompTIA A+, Network+, Security+, and Mobility+ certifications.

Acknowledgments This book is dedicated to the many security professionals who daily

work to ensure the safety of our nation’s critical infrastructures. We want to recognize the thousands of dedicated individuals who strive to protect

our national assets but who seldom receive praise and often are only noticed when an incident occurs. To you, we say thank you for a job well


We, the authors of Principles of Computer Security, Fourth Edition, have many individuals who we need to acknowledge—individuals without whom this effort would not have been successful. This edition would not have been possible without Tim Green, whose support and faith in the authors made this edition possible. He brought together an all-star production team that made this book more than just a new edition, but a complete learning system. The list needs to start with those folks at McGraw-Hill Education who

worked tirelessly with the project’s multiple authors and contributors and led us successfully through the minefield that is a book schedule and who took our rough chapters and drawings and turned them into a final, professional product we can be proud of. We thank all the good people from the Acquisitions team, Tim Green and Amy Stonebraker; from the Editorial Services team, Jody McKenzie and Howie Severson; from the Illustration and Production teams, James Kussow and Amarjeet Kumar and the composition team at Cenveo Publisher Services. We also thank the technical editor, Bobby Rogers; the copy editor, Bill McManus; the proofreader, Paul Tyler; and the indexer, Jack Lewis; for all their attention to detail that made this a finer work after they finished with it. We also need to acknowledge our current employers who, to our great

delight, have seen fit to pay us to work in a career field that we all find exciting and rewarding. There is never a dull moment in security, because it is constantly changing. We would like to thank Art Conklin for herding the cats on this one.

Finally, we would each like to individually thank those people who—on a personal basis—have provided the core support for us individually. Without these special people in our lives, none of us could have put this work together.

—The Author Team

To Susan, your love and support is what enables me to do all the things I do.

—Art Conklin, Ph.D. I would like to thank my wife, Charlan, for the tremendous support she has always given me. It doesn’t matter how many times I have sworn that I’ll never get involved with another book project only to return within months to yet another one; through it all, she has remained supportive. I would also like to publicly thank the United States Air Force, which

provided me numerous opportunities since 1986 to learn more about security than I ever knew existed. To whoever it was who decided to send me as a young captain—fresh from completing my master’s degree in artificial intelligence—to my first assignment in computer security: thank you, it has been a great adventure!

—Gregory B. White, Ph.D. Josie, thank you for all the love and support. Macon, John, this is for you.

—Chuck Cothren Geena, thanks for being my best friend and my greatest support. Anything I am is because of you. Love to my kids and grandkids!

—Roger L. Davis To my wife and best friend, Leah, for your love, energy, and support— thank you for always being there. Here’s to many more years together.

—Dwayne Williams


Important Technology Skills Information technology (IT) offers many career paths, and information security is one of the fastest-growing tracks for IT professionals. This book provides coverage of the materials you need to begin your exploration of information security. In addition to covering all of the CompTIA Security+ exam objectives, additional material is included to help you build a solid introductory knowledge of information security.

Proven Learning Method Keeps You on Track Designed for classroom use and written by instructors for use in their own classes, Principles of Computer Security is structured to give you comprehensive knowledge of information security. The textbook’s active learning methodology guides you beyond mere recall and— through thought-provoking activities, labs, and sidebars—helps you develop critical-thinking, diagnostic, and communication skills.

Effective Learning Tools This feature-rich textbook is designed to make learning easy and enjoyable and to help you develop the skills and critical-thinking abilities that will enable you to adapt to different job situations and to troubleshoot problems. Written by instructors with decades of combined information security experience, this book conveys even the most complex issues in an accessible, easy-to understand format.

Each chapter includes

Learning Objectives that set measurable goals for chapter-by- chapter progress

Illustrations that give you a clear picture of the concepts and technologies

Try This!, Cross Check, and Tech Tip sidebars that encourage you to practice and apply concepts in real-world settings

Notes, Tips, and Warnings that guide you, and Exam Tips that give you advice or provide information specifically related to preparing for the exam

Chapter Summaries and Key Terms Lists that provide you with an easy way to review important concepts and vocabulary

Challenging End-of-Chapter Tests that include vocabulary- building exercises, multiple-choice questions, essay questions, and on-the-job lab projects


It Pays to Get Certified In a digital world, digital literacy is an essential survival skill. Certification demonstrates that you have the knowledge and skill to solve technical or business problems in virtually any business environment. CompTIA certifications are highly valued credentials that qualify you for jobs, increased compensation, and promotion.

CompTIA Security+ Certification Helps Your


Security is one of the highest demand job categories, growing in importance as the frequency and severity of security threats continues to be a major concern for organizations around the world.

Jobs for security administrators are expected to increase by 18% —the skill set required for these types of jobs maps to the CompTIA Security+ certification.

Network Security Administrators can earn as much as $106,000 per year.

CompTIA Security+ is the first step in starting your career as a Network Security Administrator or Systems Security Administrator.

More than 250,000 individuals worldwide are CompTIA Security+ certified.

CompTIA Security+ is regularly used in organizations such as Hitachi Systems, Fuji Xerox, HP, Dell, and a variety of major U.S. government contractors.

Approved by the U.S. Department of Defense (DoD) as one of the required certification options in the DoD 8570.01-M directive, for Information Assurance Technical Level II and Management Level I job roles.

Steps to Getting Certified and Staying Certified 1. Review the exam objectives. Review the certification objectives to

make sure you know what is covered in the exam:

2. Practice for the exam. After you have studied for the certification exam, review and answer sample questions to get an idea of what type of questions might be on the exam:

3. Purchase an exam voucher. You can purchase exam vouchers on the CompTIA Marketplace,

4. Take the test! Go to the Pearson VUE website,, and schedule a time to take your exam.

Order now and get 10% discount on all orders above $50 now!!The professional are ready and willing handle your assignment.