Computer Security Principles and Practice 3rd Edition William Stallings

Computer Security Principles and Practice 3rd
Edition William Stallings - PDF Download (2025)
https://ebookultra.com/download/computer-security-principles-and-
practice-3rd-edition-william-stallings/
Visit ebookultra.com today to download the complete set of
ebooks or textbooks

We believe these products will be a great fit for you. Click
the link to download now, or visit ebookultra.com
to discover even more!
Cryptography and Network Security Principles and Practice
5th Edition William Stallings
https://ebookultra.com/download/cryptography-and-network-security-
principles-and-practice-5th-edition-william-stallings/
Cryptography and Network Security Principles and Practice
7th edition William Stallings
https://ebookultra.com/download/cryptography-and-network-security-
principles-and-practice-7th-edition-william-stallings/
Data and Computer Communications 8th edition William
Stallings
https://ebookultra.com/download/data-and-computer-communications-8th-
edition-william-stallings/
Cryptography and Network Security 4th Edition William
Stallings
https://ebookultra.com/download/cryptography-and-network-security-4th-
edition-william-stallings/

Computer organization and architecture designing for
performance 7th Edition William Stallings
https://ebookultra.com/download/computer-organization-and-
architecture-designing-for-performance-7th-edition-william-stallings/
Homeland Security An Introduction to Principles and
Practice Second Edition Nemeth
https://ebookultra.com/download/homeland-security-an-introduction-to-
principles-and-practice-second-edition-nemeth/
CompTIA Security Practice Tests 3rd Edition David Seidl
https://ebookultra.com/download/comptia-security-practice-tests-3rd-
edition-david-seidl/
Digital signal compression principles and practice 1st
Edition William A Pearlman
https://ebookultra.com/download/digital-signal-compression-principles-
and-practice-1st-edition-william-a-pearlman/
Principles and Practice Of Pedodontics 3rd Edition Arathi
Rao
https://ebookultra.com/download/principles-and-practice-of-
pedodontics-3rd-edition-arathi-rao/

Computer Security Principles and Practice 3rd Edition
William Stallings Digital Instant Download
Author(s): WilliamStallings, Lawrie Brown
ISBN(s): 9780133773927, 0133773922
Edition: 3
File Details: PDF, 14.13 MB
Year: 2014
Language: english

Computer Security
Principles and Practice
Third Edition
William Stallings
Lawrie Brown
UNSW Canberra at the Australian Defence Force Academy
Boston Columbus Indianapolis NewYork San Francisco Upper Saddle River
Amsterdam CapeTown Dubai London Madrid Milan Munich Paris Montreal Toronto
Delhi Mexico City São Paulo Sydney Hong Kong Seoul Singapore Taipei Tokyo

Library of Congress Cataloging-in-Publication Data
Stallings,William, author.
Computer security : principles and practice / William Stallings, Lawrie Brown, University of New South Wales,
Australian Defence Force Academy. — Third edition.
pages cm
ISBN 978-0-13-377392-7 — ISBN 0-13-377392-2
1. Computer security. 2. Computer security—Examinations—Study guides. 3. Computer networks—Security
measures—Examinations—Study guides. 4. Electronic data processing personnel—Certification—Study guides.
I. Brown, Lawrie, author. II. Title.
QA76.9.A25S685 2014
005.8—dc23
2014012092
10 9 8 7 6 5 4 3 2 1
ISBN-10: 0-13-377392-2
ISBN-13: 978-0-13-377392-7
Editorial Director, ECS: Marcia Horton
Executive Editor: Tracy Johnson (Dunkelberger)
Editorial Assistant: Kelsey Loanes
Director of Marketing: Christy Lesko
Marketing Manager: Yez Alayan
Marketing Assistant: Jon Bryant
Director of Program Management: Erin Gregg
Program Management – Team Lead: Scott Disanno
Program Manager: Carole Snyder
Project Manager: Robert Engelhardt
Procurement Specialist: Linda Sager
Cover Designer: Marta Samsel
Managing Project Editor: Dr. Priyadharshini
Dhanagopal
Production Project Manager: Jennifer Sargunar
Permissions Supervisor: Rachel Youdelman
Permissions Administrator: William Opaluch
Cover Art: © Arnaud Chicurel/Hemis/Corbis
Associate Web Developer: Barry Offringa
Full-Service Project Management:
Mahalatchoumy Saravanan, Jouve India
Credits and acknowledgments borrowed from other sources and reproduced, with permission, in this textbook
appear on page 815.
Copyright © 2015, 2012, 2008 by Pearson Education, Inc. All rights reserved. Printed in the United States of
America.This publication is protected by copyright, and permission should be obtained from the publisher
prior to any prohibited reproduction, storage in a retrieval system, or transmission in any form or by any means,
electronic, mechanical, photocopying, recording, or likewise.To obtain permission(s) to use material from this
work, please submit a written request to Pearson Education, Inc., Permissions Department, One Lake Street,
Upper Saddle River, New Jersey 07458, or you may fax your request to 201-236-3290.
Many of the designations by manufacturers and sellers to distinguish their products are claimed as trademarks.
Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations
have been printed in initial caps or all caps.

For my loving wife,Tricia
—WS
To my extended family, who helped
make this all possible
—LB

This page intentionally left blank

Contents
v
Online Resources xi
Preface xii
Notation xviii
About the Authors xix
Chapter 0 Reader’s and Instructor’s Guide 1
0.1 Outline of this Book 2
0.2 A Roadmap for Readers and Instructors 2
0.3 Support for Cissp Certification 3
0.4 Support for NSA/DHS Certification 5
0.5 Support for ACM/IEEE Computer Society Computer Science Curricula 2013 6
0.6 Internet and Web Resources 8
0.7 Standards 9
Chapter 1 Overview 11
1.1 Computer Security Concepts 12
1.2 Threats, Attacks, and Assets 19
1.3 Security Functional Requirements 25
1.4 Fundamental Security Design Principles 27
1.5 Attack Surfaces and Attack Trees 31
1.6 Computer Security Strategy 34
1.7 Recommended Reading 36
1.8 Key Terms, Review Questions, and Problems 37
Part One Computer Security Technology and Principles 40
Chapter 2 Cryptographic Tools 40
2.1 Confidentiality with Symmetric Encryption 41
2.2 Message Authentication and Hash Functions 47
2.3 Public-Key Encryption 55
2.4 Digital Signatures and Key Management 60
2.5 Random and Pseudorandom Numbers 64
2.6 Practical Application: Encryption of Stored Data 66
Chapter 3 User Authentication 72
3.1 Electronic User Authentication Principles 74
3.2 Password-Based Authentication 78
3.3 Token-Based Authentication 90
3.4 Biometric Authentication 96
3.5 Remote User Authentication 100

vi Contents
3.6 Security Issues for User Authentication 103
3.7 Practical Application:An Iris Biometric System 105
3.8 Case Study: Security Problems for Atm Systems 107
Chapter 4 Access Control 113
4.1 Access Control Principles 114
4.2 Subjects, Objects, and Access Rights 117
4.3 Discretionary Access Control 118
4.4 Example: UNIX File Access Control 124
4.5 Role-Based Access Control 127
4.6 Attribute-Based Access Control 133
4.7 Identity, Credential, and Access Management 139
4.8 Trust Frameworks 143
4.9 Case Study: RBAC System for a Bank 147
Chapter 5 Database and Cloud Security 155
5.1 The Need for Database Security 156
5.2 Database Management Systems 157
5.3 Relational Databases 159
5.4 SQL Injection Attacks 163
5.5 Database Access Control 169
5.6 Inference 173
5.7 Database Encryption 176
5.8 Cloud Computing 180
5.9 Cloud Security Risks and Countermeasures 187
5.10 Data Protection in the Cloud 189
5.11 Cloud Security as a Service 189
Chapter 6 Malicious Software 199
6.1 Types of Malicious Software (Malware) 200
6.2 Advanced Persistent Threat 203
6.3 Propagation—Infected Content—Viruses 204
6.4 Propagation—Vulnerability Exploit—Worms 210
6.5 Propagation—Social Engineering—Spam E-Mail,Trojans 218
6.6 Payload—System Corruption 221
6.7 Payload—Attack Agent—Zombie, Bots 222
6.8 Payload—Information Theft—Keyloggers, Phishing, Spyware 224
6.9 Payload—Stealthing—Backdoors, Rootkits 226
6.10 Countermeasures 229

Contents vii
Chapter 7 Denial-of-Service Attacks 240
7.1 Denial-of-Service Attacks 241
7.2 Flooding Attacks 248
7.3 Distributed Denial-of-Service Attacks 250
7.4 Application-Based Bandwidth Attacks 252
7.5 Reflector and Amplifier Attacks 254
7.6 Defenses Against Denial-of-Service Attacks 259
7.7 Responding to a Denial-of-Service Attack 263
Chapter 8 Intrusion Detection 267
8.1 Intruders 268
8.2 Intrusion Detection 272
8.3 Analysis Approaches 275
8.4 Host-Based Intrusion Detection 278
8.5 Network-Based Intrusion Detection 283
8.6 Distributed or Hybrid Intrusion Detection 289
8.7 Intrusion Detection Exchange Format 291
8.8 Honeypots 294
8.9 Example System: Snort 296
Chapter 9 Firewalls and Intrusion Prevention Systems 304
9.1 The Need for Firewalls 305
9.2 Firewall Characteristics and Access Policy 306
9.3 Types of Firewalls 308
9.4 Firewall Basing 314
9.5 Firewall Location and Configurations 317
9.6 Intrusion Prevention Systems 322
9.7 Example: Unified Threat Management Products 326
Part Two Software Security and Trusted Systems 336
Chapter 10 Buffer Overflow 336
10.1 Stack Overflows 338
10.2 Defending Against Buffer Overflows 359
10.3 Other Forms of Overflow Attacks 365
Chapter 11 Software Security 375
11.1 Software Security Issues 376
11.2 Handling Program Input 380

viii Contents
11.3 Writing Safe Program Code 392
11.4 Interacting with the Operating System and Other Programs 396
11.5 Handling Program Output 409
Chapter 12 Operating System Security 416
12.1 Introduction to Operating System Security 418
12.2 System Security Planning 419
12.3 Operating Systems Hardening 419
12.4 Application Security 424
12.5 Security Maintenance 425
12.6 Linux/Unix Security 426
12.7 Windows Security 430
12.8 Virtualization Security 432
Chapter 13 Trusted Computing and Multilevel Security 439
13.1 The Bell-LaPadula Model for Computer Security 440
13.2 Other Formal Models for Computer Security 450
13.3 The Concept of Trusted Systems 456
13.4 Application of Multilevel Security 459
13.5 Trusted Computing and the Trusted Platform Module 465
13.6 Common Criteria for Information Technology Security Evaluation 469
13.7 Assurance and Evaluation 475
Part Three Management Issues 485
Chapter 14 IT Security Management and Risk Assessment 485
14.1 IT Security Management 486
14.2 Organizational Context and Security Policy 489
14.3 Security Risk Assessment 492
14.4 Detailed Security Risk Analysis 495
14.5 Case Study: Silver Star Mines 507
Chapter 15 IT Security Controls, Plans, and Procedures 515
15.1 IT Security Management Implementation 516
15.2 Security Controls or Safeguards 516
15.3 IT Security Plan 524
15.4 Implementation of Controls 525
15.5 Monitoring Risks 526
15.6 Case Study: Silver Star Mines 529

Contents ix
Chapter 16 Physical and Infrastructure Security 534
16.1 Overview 535
16.2 Physical Security Threats 536
16.3 Physical Security Prevention and Mitigation Measures 543
16.4 Recovery From Physical Security Breaches 546
16.5 Example:A Corporate Physical Security Policy 546
16.6 Integration of Physical and Logical Security 547
Chapter 17 Human Resources Security 556
17.1 Security Awareness,Training, and Education 557
17.2 Employment Practices and Policies 563
17.3 E-Mail and Internet Use Policies 566
17.4 Computer Security Incident Response Teams 567
Chapter 18 Security Auditing 577
18.1 Security Auditing Architecture 579
18.2 Security Audit Trail 584
18.3 Implementing the Logging Function 588
18.4 Audit Trail Analysis 600
18.5 Example:An Integrated Approach 604
Chapter 19 Legal and Ethical Aspects 610
19.1 Cybercrime and Computer Crime 611
19.2 Intellectual Property 615
19.3 Privacy 621
19.4 Ethical Issues 626
Part Four Cryptographic Algorithms 637
Chapter 20 Symmetric Encryption and Message Confidentiality 637
20.1 Symmetric Encryption Principles 638
20.2 Data Encryption Standard 643
20.3 Advanced Encryption Standard 645
20.4 Stream Ciphers and RC4 651
20.5 Cipher Block Modes of Operation 655
20.6 Location of Symmetric Encryption Devices 660
20.7 Key Distribution 662

x Contents
Chapter 21 Public-Key Cryptography and Message Authentication 669
21.1 Secure Hash Functions 670
21.2 HMAC 675
21.3 The RSA Public-Key Encryption Algorithm 679
21.4 Diffie-Hellman and Other Asymmetric Algorithms 684
Part Five Network Security 693
Chapter 22 Internet Security Protocols and Standards 693
22.1 Secure E-Mail and S/MIME 694
22.2 DomainKeys Identified Mail 697
22.3 Secure Sockets Layer (SSL) and Transport Layer Security (TLS) 700
22.4 HTTPS 707
22.5 IPv4 and IPv6 Security 708
Chapter 23 Internet Authentication Applications 717
23.1 Kerberos 718
23.2 X.509 724
23.3 Public-Key Infrastructure 727
Chapter 24 Wireless Network Security 733
24.1 Wireless Security 734
24.2 Mobile Device Security 737
24.3 IEEE 802.11 Wireless LAN Overview 741
24.4 IEEE 802.11i Wireless LAN Security 747
Appendix A Projects and Other Student Exercises for Teaching Computer Security 765
A.1 Hacking Project 765
A.2 Laboratory Exercises 766
A.3 Security Education (SEED) Projects 766
A.4 Research Projects 768
A.5 Programming Projects 769
A.6 Practical Security Assessments 769
A.7 Firewall Projects 769
A.8 Case Studies 770
A.9 Reading/Report Assignments 770
A.10 Writing Assignments 770
A.11 Webcasts for Teaching Computer Security 771
Acronyms 772
References 773
Index 791

Online Chapters and Appendices1
Chapter 25 Linux Security
25.1 Introduction
25.2 Linux’s Security Model
25.3 The Linux DAC in Depth: Filesystem Security
25.4 LinuxVulnerabilities
25.5 Linux System Hardening
25.6 Application Security
25.7 Mandatory Access Controls
25.8 Recommended Reading
25.9 Key Terms, Review Questions, and Problems
Chapter 26 Windows and Windows Vista Security
26.1 Windows Security Architecture
26.2 WindowsVulnerabilities
26.3 Windows Security Defenses
26.4 Browser Defenses
26.5 Cryptographic Services
26.6 Common Criteria
26.7 Recommended Reading
26.8 Key Terms, Review Questions, Problems, and Projects
Appendix B Some Aspects of Number Theory
Appendix C Standards and Standard-Setting Organizations
Appendix D Random and Pseudorandom Number Generation
Appendix E Message Authentication Codes Based on Block Ciphers
Appendix F TCP/IP Protocol Architecture
Appendix G Radix-64 Conversion
Appendix H Security Policy-Related Documents
Appendix I The Domain Name System
Appendix J The Base-Rate Fallacy
Appendix K SHA-3
Appendix L Glossary
1
Online chapters, appendices, and other documents are Premium Content, available via the access card at
the front of this book.
Contents xi

Preface
What’s New in the Third Edition
Since the second edition of this book was published, the field has seen continued innovations
and improvements. In this new edition, we try to capture these changes while maintaining a
broad and comprehensive coverage of the entire field. To begin the process of revision, the
second edition of this book was extensively reviewed by a number of professors who teach
the subject and by professionals working in the field. The result is that in many places the
narrative has been clarified and tightened, and illustrations have been improved.
Beyond these refinements to improve pedagogy and user-friendliness, there have
been major substantive changes throughout the book. The most noteworthy changes are as
follows:
• Fundamental security design principles: Chapter 1 includes a new section discussing the
security design principles listed as fundamental by the National Centers of Academic
Excellence in Information Assurance/Cyber Defense, which is jointly sponsored by the
U.S. National Security Agency and the U.S. Department of Homeland Security.
• Attack surfaces and attack trees: Chapter 1 includes a new section describing these two
concepts, which are useful in evaluating and classifying security threats.
• User authentication model: Chapter 3 includes a new description of a general model
for user authentication, which helps to unify the discussion of the various approaches
to user authentication.
• Attribute-based access control (ABAC): Chapter 4 has a new section devoted to
ABAC, which is becoming increasingly widespread.
• Identity, credential, and access management (ICAM): Chapter 4 includes a new sec-
tion on ICAM, which is a comprehensive approach to managing and implementing
digital identities (and associated attributes), credentials, and access control.
• Trust frameworks: Chapter 4 includes a new section on the Open Identity Trust
Framework, which is an open, standardized approach to trustworthy identity and attri-
bute exchange that is becoming increasingly widespread.
• SQL injection attacks: Chapter 5 includes a new section on the SQL injection attack,
which is one of the most prevalent and dangerous network-based security threats.
• Cloud security: The material on cloud security in Chapter 5 has been updated and
expanded to reflect its importance and recent developments.
• Malware: The material on Malware, and on categories of intruders, has been revised to
reflect the latest developments, including details of Advanced Persistent Threats, which
are most likely due to nation state actors.
• Intrusion detection/intrusion prevention systems: The material on IDS/IPS has been
updated to reflect new developments in the field, including the latest developments in
Host-Based Intrusion Detection Systems that assist in implementing a defense-in-depth
strategy.
xii

Preface xiii
• Human resources: Security lapses due to human factors and social engineering are of
increasing concern, including several recent cases of massive data exfiltration by insid-
ers. Addressing such lapses requires a complex mix of procedural and technical con-
trols, which we review in several significantly revised sections.
• Mobile device security: Mobile device security has become an essential aspect of enter-
prise network security, especially for devices in the category known as bring your own
device (BYOD).A new section in Chapter 24 covers this important topic.
• SHA-3: This recently adopted cryptographic hash standard is covered in a new
appendix.
Background
Interest in education in computer security and related topics has been growing at a dramatic rate
in recent years.This interest has been spurred by a number of factors, two of which stand out:
1. As information systems,databases,and Internet-based distributed systems and commu-
nication have become pervasive in the commercial world, coupled with the increased
intensity and sophistication of security-related attacks, organizations now recognize
the need for a comprehensive security strategy. This strategy encompasses the use of
specialized hardware and software and trained personnel to meet that need.
2. Computer security education, often termed information security education or informa-
tion assurance education, has emerged as a national goal in the United States and other
countries, with national defense and homeland security implications. The NSA/DHS
National Center of Academic Excellence in Information Assurance/Cyber Defense is
spearheading a government role in the development of standards for computer secu-
rity education.
Accordingly, the number of courses in universities, community colleges, and other insti-
tutions in computer security and related areas is growing.
Objectives
The objective of this book is to provide an up-to-date survey of developments in computer
security. Central problems that confront security designers and security administrators
include defining the threats to computer and network systems, evaluating the relative risks
of these threats, and developing cost-effective and user friendly countermeasures.
The following basic themes unify the discussion:
• Principles: Although the scope of this book is broad, there are a number of basic prin-
ciples that appear repeatedly as themes and that unify this field. Examples are issues
relating to authentication and access control. The book highlights these principles and
examines their application in specific areas of computer security.
• Design approaches: The book examines alternative approaches to meeting specific
computer security requirements.
• Standards: Standards have come to assume an increasingly important, indeed domi-
nant, role in this field. An understanding of the current status and future direction of
technology requires a comprehensive discussion of the related standards.

xiv Preface
• Real-world examples: A number of chapters include a section that shows the practical
application of that chapter’s principles in a real-world environment.

Support of ACM/IEEE Computer Science Curricula 2013
The book is intended for both an academic and a professional audience. As a textbook, it is
intended as a one- or two-semester undergraduate course for computer science, computer
engineering, and electrical engineering majors. This edition is designed to support the rec-
ommendations of the ACM/IEEE Computer Science Curricula 2013 (CS2013).The CS2013
curriculum recommendation includes, for the first time, Information Assurance and Security
(IAS) as one of the Knowledge Areas in the Computer Science Body of Knowledge. CS2013
divides all course work into three categories: Core-Tier 1 (all topics should be included in the
curriculum), Core-Tier 2 (all or almost all topics should be included), and Elective (desirable
to provide breadth and depth). In the IAS area, CS2013 includes three Tier 1 topics, five Tier
2 topics, and numerous Elective topics, each of which has a number of subtopics. This text
covers all of the Tier 1 and Tier 2 topics and subtopics listed by CS2013, as well as many of
the elective topics.
See Chapter 0 for details of this book’s coverage of CS2013.
Coverage of CISSP Subject Areas
This book provides coverage of all the subject areas specified for CISSP (Certified
Information Systems Security Professional) certification. The CISSP designation from
the International Information Systems Security Certification Consortium (ISC)2
is often
referred to as the ‘gold standard’ when it comes to information security certification. It is
the only universally recognized certification in the security industry. Many organizations,
including the U.S. Department of Defense and many financial institutions, now require that
cyber security personnel have the CISSP certification. In 2004, CISSP became the first IT
program to earn accreditation under the international standard ISO/IEC 17024 (General
Requirements for Bodies Operating Certification of Persons).
The CISSP examination is based on the Common Body of Knowledge (CBK), a com-
pendium of information security best practices developed and maintained by (ISC)2
, a
nonprofit organization.The CBK is made up of 10 domains that comprise the body of knowl
edge that is required for CISSP certification.See Chapter 0 for details of this book’s coverage
of CBK.
Plan of the Text
The book is divided into five parts (see Chapter 0):
• Computer Security Technology and Principles
• Software Security and Trusted Systems
• Management Issues
• Cryptographic Algorithms
• Network Security

The book is also accompanied by a number of online chapters and appendices that
provide more detail on selected topics.
The book includes an extensive glossary, a list of frequently used acronyms, and a bib-
liography. Each chapter includes homework problems, review questions, a list of key words,
and suggestions for further reading.
Instructor Support Materials
The major goal of this text is to make it as effective a teaching tool for this exciting and fast-moving
subject as possible.This goal is reflected both in the structure of the book and in the supporting
material.The text is accompanied by the following supplementary material to aid the instructor:
• Projects manual: Project resources including documents and portable software, plus sug-
gested project assignments for all of the project categories listed in the following section.
• Solutions manual: Solutions to end-of-chapter Review Questions and Problems.
• PowerPoint slides: A set of slides covering all chapters, suitable for use in lecturing.
• PDF files: Reproductions of all figures and tables from the book.
• Test bank: A chapter-by-chapter set of questions.
• Sample syllabuses: The text contains more material than can be conveniently covered
in one semester. Accordingly, instructors are provided with several sample syllabuses
that guide the use of the text within limited time. These samples are based on real-
world experience by professors with the first edition.
All of these support materials are available at the Instructor Resource Center (IRC) for
this textbook, which can be reached through the publisher’s Web site www.pearsonhighered
.com/stallings or by clicking on the link labeled Pearson Resources for Instructors at this book’s
Companion Web site at WilliamStallings.com/ComputerSecurity. To gain access to the IRC,
please contact your local Pearson sales representative via pearsonhighered.com/educator/
replocator/requestSalesRep.page or call Pearson Faculty Services at 1-800-526-0485.
The Companion Web Site, at WilliamStallings.com/ComputerSecurity (click on the
Instructor Resources link), includes the following:
• Links to Web sites for other courses being taught using this book.
• Sign-up information for an Internet mailing list for instructors using this book to
exchange information, suggestions, and questions with each other and with the author.
Student Resources
For this new edition, a tremendous amount of original supporting
material for students has been made available online, at two Web
locations. The Companion Web Site, at WilliamStallings.com/
ComputerSecurity (click on the Student Resources link), includes
a list of relevant links organized by chapter and an errata sheet
for the book.
Preface xv

Purchasing this textbook now grants the reader 12-months of
access to the Premium Content Site, which includes the following
materials:
•
Online chapters: To limit the size and cost of the book, two
chapters of the book are provided in PDF format.The chapters
are listed in this book’s table of contents.
• Online appendices: There are numerous interesting topics that
support material found in the text but whose inclusion is not
warranted in the printed text.A total of nine appendices cover
these topics for the interested student.The appendices are listed in this book’s table of
contents.
• Homework problems and solutions: To aid the student in understanding the material,
a separate set of homework problems with solutions is available.These enable the stu-
dents to test their understanding of the text.
To access the Premium Content site, click on the Premium Content link at the
Companion Web site or at pearsonhighered.com/stallings and enter the student access code
found on the card in the front of the book.
Projects and Other Student Exercises
For many instructors, an important component of a computer security course is a project
or set of projects by which the student gets hands-on experience to reinforce concepts from
the text.This book provides an unparalleled degree of support for including a projects com-
ponent in the course. The instructor’s support materials available through Pearson not only
include guidance on how to assign and structure the projects but also include a set of user’s
manuals for various project types plus specific assignments, all written especially for this
book. Instructors can assign work in the following areas:
• Hacking exercises: Two projects that enable students to gain an understanding of the
issues in intrusion detection and prevention.
• Laboratory exercises: A series of projects that involve programming and experiment-
ing with concepts from the book.
• Security education (SEED) projects: The SEED projects are a set of hands-on exer-
cises, or labs, covering a wide range of security topics.
• Research projects:A series of research assignments that instruct the student to research
a particular topic on the Internet and write a report.
• Programming projects: A series of programming projects that cover a broad range of
topics and that can be implemented in any suitable language on any platform.
• Practical security assessments: A set of exercises to examine current infrastructure and
practices of an existing organization.
• Firewall projects: A portable network firewall visualization simulator is provided,
together with exercises for teaching the fundamentals of firewalls.
• Case studies: A set of real-world case studies, including learning objectives, case
description, and a series of case discussion questions.
xvi Preface

• Reading/report assignments: A list of papers that can be assigned for reading and writ-
ing a report, plus suggested assignment wording.
• Writing assignments: A list of writing assignments to facilitate learning the material.
• Webcasts for teaching computer security: A catalog of webcast sites that can be used to
enhance the course.An effective way of using this catalog is to select,or allow the student
to select, one or a few videos to watch, and then to write a report/analysis of the video.
This diverse set of projects and other student exercises enables the instructor to use the
book as one component in a rich and varied learning experience and to tailor a course plan to
meet the specific needs of the instructor and students.SeeAppendixA in this book for details.
Acknowledgments
This new edition has benefited from review by a number of people, who gave generously of
their time and expertise.The following professors and instructors reviewed all or a large part
of the manuscript: Stefan Robila (Montclair State University), Weichao Wang (University
of North Carolina, Charlotte), Bob Brown (Southern Polytechnic State University), Leming
Zhou (University of Pittsburgh),Yosef Sherif (Mihaylo College of Business and Economics),
Nazrul Islam (Farmingdale State University), Qinghai Gao (Farmingdale State University),
Wei Li (Nova Southeastern University),Jeffrey Kane (Nova Southeastern University),Philip
John Lunsford II (East Carolina University),Jeffrey H.Peden (Longwood University),Ratan
Guha (University of Central Florida), Sven Dietrich (Stevens Institute of Technology), and
David Liu (Purdue University, Fort Wayne).
Thanks also to the many people who provided detailed technical reviews of one or
more chapters: Umair Manzoor (UmZ), Adewumi Olatunji (FAGOSI Systems, Nigeria),
Rob Meijer, Robin Goodchil, Greg Barnes (Inviolate Security LLC), Arturo Busleiman
(Buanzo Consulting), Ryan M. Speers (Dartmouth College), Wynand van Staden (School
of Computing, University of South Africa), Oh Sieng Chye, Michael Gromek, Samuel
Weisberger, Brian Smithson (Ricoh Americas Corp, CISSP), Josef B. Weiss (CISSP),
Robbert-Frank Ludwig (Veenendaal, ActStamp Information Security), William Perry,
Daniela Zamfiroiu (CISSP), Rodrigo Ristow Branco, George Chetcuti (Technical Editor,
TechGenix), Thomas Johnson (Director of Information Security at a banking holding com-
pany in Chicago, CISSP), Robert Yanus (CISSP), Rajiv Dasmohapatra (Wipro Ltd), Dirk
Kotze,Ya’akovYehudi,and StanleyWine (Adjunct Lecturer,Computer Information Systems
Department, Zicklin School of Business, Baruch College).
Dr. Lawrie Brown would first like to thank Bill Stallings for the pleasure of work-
ing with him to produce this text. I would also like to thank my colleagues in the School of
Engineering and Information Technology, UNSW Canberra at the Australian Defence Force
Academy for their encouragement and support.
Finally, we would like to thank the many people responsible for the publication of the
book, all of whom did their usual excellent job.This includes the staff at Pearson, particularly
our editor Tracy Dunkelberger, program manager Carole Snyder, and production manager
Bob Engelhardt.We also thank the production staff at Jouve India for another excellent and
rapid job.Thanks also to the marketing and sales staff at Pearson, without whose efforts this
book would not be in your hands.
Preface xvii

Notation
Symbol Expression Meaning
D, K D(K,Y) Symmetric decryption of ciphertext Y using secret key K
D, PRa D(PRa, Y) Asymmetric decryption of ciphertext Y using A’s private key PRa
D, PUa D(PUa, Y) Asymmetric decryption of ciphertext Y using A’s public key PUa
E, K E(K, X) Symmetric encryption of plaintext X using secret key K
E, PRa E(PRa, X) Asymmetric encryption of plaintext X using A’s private key PRa
E, PUa E(PUa, X) Asymmetric encryption of plaintext X using A’s public key PUa
K Secret key
PRa Private key of user A
PUa Public key of user A
H H(X) Hash function of message X
+ x + y Logical OR: x OR y
• x • y Logical AND: x AND y
~ ~ x Logical NOT: NOT x
C A characteristic formula, consisting of a logical formula over the
values of attributes in a database
X X(C) Query set of C, the set of records satisfying C
, X X(C) Magnitude of X(C): the number of records in X(C)
¨ X(C) ¨ X(D) Set intersection: the number of records in both X(C) and X(D)
xy x concatenated with y
xviii

About the Authors
Dr. William Stallings authored 18 textbooks, and, counting revised
editions, a total of 70 books on various aspects of these subjects.
His writings have appeared in numerous ACM and IEEE
publications, including the Proceedings of the IEEE and ACM
Computing Reviews. He has 11 times received the award for the
best Computer Science textbook of the year from the Text and
Academic Authors Association.
In over 30 years in the field, he has been a technical
contributor, technical manager, and an executive with several
high-technology firms. He has designed and implemented both
TCP/IP-based and OSI-based protocol suites on a variety of computers and operating
systems, ranging from microcomputers to mainframes. Currently he is an independent
consultant whose clients have included computer and networking manufacturers and
customers, software development firms, and leading-edge government research institutions.
He created and maintains the Computer Science Student Resource Site at Computer
ScienceStudent.com. This site provides documents and links on a variety of subjects of
general interest to computer science students (and professionals). He is a member of the
editorial board of Cryptologia, a scholarly journal devoted to all aspects of cryptology. His
articles appear regularly at http://www.networking.answers.com, where he is the Networking
Category Expert Writer.
Dr. Lawrie Brown is a senior lecturer in the School of Engineering
and Information Technology, UNSW Canberra at the Australian
Defence Force Academy.
His professional interests include communications and
computer systems security and cryptography, including research
on client authentication using proxy certificates, trust and security
in eCommerce andWeb environments,the design of secure remote
code execution environments using the functional language
Erlang, and on the design and implementation of the LOKI family
of block ciphers.
He currently teaches courses on cyber-security and data structures, and has previously
presented courses on cryptography, data communications, and programming in Java.
xix

Other documents randomly have
different content

OBS. 23. Of the terms in apposition, one is the subject, and the other the
predicate, of to be, understood (“They made him to be their ruler”). The rule
might, therefore, be worded thus: When, of two terms in apposition, one is
predicated of the other, no comma is required.
25. In a compound sentence, the comma is often inserted where
a verb is omitted.
In literature, our taste will be discovered by that which we give; our judgment,
by that which we withhold.
Wit consists in finding out resemblances; judgment, in discerning differences.
{p110}
In the pursuit of intellectual pleasure lies every virtue; of sensual, every vice.
Sheridan once observed of a certain speech, that all its facts were invention,
and all its wit, memory.
OBS. 24. But sometimes the comma is not inserted: especially when the style is
lively; when the clauses have a common relation to something that follows; or
when they are connected by a conjunction.
Could Johnson have had less prejudice, Addison more profundity, or Dryden
more time, they would have been well qualified for the arduous office of a critic.
The Germans do not appear so vivacious, nor the Turks so energetic, as to
afford triumphant demonstrations in behalf of the sacred weed.
The boat was tight, the day fine, the bait tempting, and the fishes hungry.
26. A short quotation, a remarkable expression, or a short
observation somewhat in manner of a quotation, is set off by the
comma.
Plutarch calls lying, the vice of slaves.
It hurts a man’s pride to say, I do not know.
Cicero observed to a degenerate patrician, “I am the first of my family, but you
are the last of yours.”
An upright minister asks, what recommends a man; a corrupt minister, who.
There is an old poet who has said, “No deity is absent, if prudence is with
thee.”
They tell me here, that people frequent the theater to be instructed as well as
amused.
The old proverb, “Too much freedery breeds despise,” is now rendered,
“Familiarity breeds contempt.”

OBS. 25. When the introductory clause is short, the comma may be omitted; as
“Charles Fox said that restorations are the most bloody of all
revolutions.”—“Madame de Staël admits that she discovered, as she grew old, the
men could not find out that wit in her at fifty, which she possessed at twenty-five.”
{p111}
27. Numbers are divided by the comma into periods of three
figures each.
The distance of the sun from the earth is usually stated at 95,000,000 miles.
OBS. 26. In a number expressing the year of an era, the comma is not used;
as, July 4, 1876. In tabular work it is very neat and convenient to omit the
comma, as in the following example:
The number of letters in 1600 lbs. of Pica is as follows:
a 17000
b 3200
c 6000
d 8800
e 24000, etc.
OBS. 27. In some offices the style requires all numbers less than 1,000 to be
expressed in words; 1,000 and upwards in figures. Some printers insert the
comma before hundreds, only when five figures or more occur.
28. Restrictive phrases or clauses are not set off by the comma.
He reviewed such regiments as were armed with Enfield rifles.
They flatter the vanities of those with whom they have to do.
Attend to the remarks which the preacher is about to make.
Bishop Watson most feelingly regrets the valuable time he was obliged to
squander away.
A false concord in words may be pardoned in him who has produced a true
concord between such momentous things as the purest faith and the profoundest
reason.
“He is known by his company” is a proverb that does not invariably apply.
Cattle which live in herds, are subject to various diseases. {p112}
OBS. 28. Adjective elements which are simply descriptive, and not restrictive,
should be set off by commas; thus:

Cattle, which live in herds, are subject to various diseases.
The first verse of the fourteenth chapter of Job, in the King James Bible, reads:
Man that is born of a woman is of few days, and full of trouble.
The Douay Bible reads:
Man born of a woman, living for a short time, is filled with many miseries.
The Protestant Episcopal Burial Service points correctly:
Man, that is born of a woman, hath but a short time to live, and is full of
misery.

V. THE NOTE OF INTERROGATION.
29. The note of Interrogation is placed at the end of a direct
question.
Can gold gain friendship?
Is that the best answer you can give to the fourteenth cross-interrogatory?
Is any among you afflicted?
Oh, lives there, Heaven, beneath thy dread expanse,
One hopeless, dark idolater of Chance?
OBS. 29. When several distinct questions occur in succession, the practice of
some writers is to separate them by commas or semicolons, placing the question-
mark at the close only; as:
“Where was Lane then; what was his situation?”—Trial of Selfridge.
“Am I Dromio, am I your man, am I myself?”
This we regard as incorrect. Each several question should have the in
ter
ro
ga
‐
tion point.
Dro. S. Do you know me, sir? am I Dromio? am I your man? am I myself?
{p113}
Rosalind. What did he when thou saw’st him? What said he? How looked he?
Wherein went he? What makes he here? Did he ask for me? Where remains he?
How parted he with thee? and when shalt thou see him again?
OBS. 30. If several questions in one sentence are joined by connectives, each
question takes the note of in
ter
ro
ga
tion. “Have I not all their letters to meet me in
arms by the ninth of the next month? and are they not, some of them, set forward
already?”
OBS. 31. When a sentence contains several interrogative clauses, having a
common relation to, or dependence on, one term, a single in
ter
ro
ga
tion point is
sufficient.
“Was I, for this, nigh wrecked upon the sea;
And twice by awkward wind from England’s bank
Drove back again unto my native clime?”
“By sensational preaching do you mean an incoherent raving about things in
general and nothing in particular; a perversion of every text; an insult of common

sense; a recital of anecdotes which are untrue, and a use of il
lus
tra
tions which are
unmeaning?”
Who will count the value to a man to be raised one remove higher above the
brute creation; to be able to look with the eye of intelligence, instead of vacant
ignorance, upon the world in which he lives; to penetrate as far as mortals may
into the mystery of his own existence, and to be made capable of enjoying the
rational delights of that existence; to be protected by his knowledge from every
species of quackery, fanaticism, and imposture; and to know how to estimate and
use the gifts which a beneficent Creator has spread around him?—Prof. L.
Stevens, Girard Coll.
“What can preserve my life, or what destroy?”
NOTE.—An assertion stating a question does not take the in
ter
ro
ga
tion point;
as, “The question is, what lenses have the greatest magnifying power.”

VI. THE NOTE OE EXCLAMATION.
30. The note of Exclamation is applied to expressions of sudden
or violent emotion; such as surprise, grief, joy, love, hatred, etc.
O piteous spectacle! O noble Cæsar! O woful day!
An old lady one day importuning Mahomet to know what {p114} she ought to
do, in order to gain Paradise,—“My good lady,” answered the Prophet, “old women
never get there.”—“What! never get to Paradise!” returned the matron in a fury.
“Never!” says he, “for they grow young by the way!”
Why was this heart of mine formed with so much sensibility! or why was not
my fortune adapted to its impulse! Poor houseless creatures! The world will give
you reproaches, but will not give you relief.
Ah! well of old the Psalmist prayed
“Thy hand, not man’s, on me be laid!”
Earth frowns below, Heaven weeps above,
And man is hate, but God is love!
31. The exclamation point is used in invocations.
Father of all! in every age adored.
Gentle spirit of sweetest humor who erst did sit upon the easy pen of my
beloved Cervantes!
Oh, my brothers! oh, my sisters!
Would to God that ye were near!
32. Several exclamation points are sometimes used together, to
express ridicule, or to intensify surprise, etc.
Malherbe observed, that a good poet was of no more service to the church or
the state, than a good player at ninepins!!

VII. THE DASH.
33. The Dash is used where a sentence breaks off abruptly.
Charles. You must invent some ingenious subterfuge—some—some kind of—
Project. I understand; not a suggestio falsi, but a mild suppressio veri. {p115}
Charles. Oh, is that what you call it? There is a shorter word—
Project. There is; but it is not professional.
I shall divide the subject into fifteen heads, and then I shall argue thus—but,
not to give you and myself the spleen, be contented at present with an Indian
tale.
34. The dash is used before and after a parenthetic clause, when
not closely enough connected to admit the comma.
But it remains—and the thought is not without its comforting significance,
however hardly it may bear on individual cases—that no bestowal of bounty, no
cultivation of the amenities of life, . . . can wipe out the remembrance of even
doubtful loyalty in the day of trial.
OBS. 32. If a parenthetic clause is inserted where a comma is required in the
principal sentence, a comma should be placed before each of the dashes inclosing
such clause. (See last paragraph on p. 90).
I should like to undertake the Stonyshire side of that estate,—it’s in a dismal
condition,—and set improvements on foot.
35. Several clauses having a common dependence, are separated
by a comma and a dash from the clause on which they depend.
To think that we have mastered the whole problem of existence; that we have
discovered the secret of creation; that we have solved the problem of evil, and
abolished mystery from nature and religion and life,—leads naturally to a
precipitation of action, a summary dealing with evils, etc. (See Example and Obs.
under Rule 7.)
36. The dash is used with the comma, the semicolon, and the
colon, which it lengthens, or renders more emphatic. {p116}

We read of “merry England”;—when England was not merry, things were not
going well with it. We hear of “the glory of hospitality,” England’s pre-eminent
boast,—by the rules of which all tables, from the table of the twenty-shilling
freeholder to the table in the baron’s hall and abbey refectory, were open at the
dinner-hour to all comers.—Froude.
Matricaria, n. A genus of plants, including the feverfew, or wild camomile;—
so called from the supposed value of some species as remedies for certain
disorders.—Webster’s Dictionary.
They did it without being at all influenced by the Anabaptists of the continent:
—the examples of some of these had rather kept them together.—D’Aubigne.
37. When words are too closely connected to admit a strictly
grammatical point, the dash is used to denote a pause.
My hopes and fears
Start up alarmed, and o’er life’s narrow verge
Look down—on what? A fathomless abyss.
The king of France, with twice ten thousand men,
Marched up the hill, and then—marched down again.
38. When a word or phrase is repeated emphatically, or echoed,
it is preceded by the dash.
The immediate question is upon the rejection of the President’s message. It
has been moved to reject it,—to reject it, not after it was considered, but before it
was considered!
The world continues to attach a peculiar significance to certain names,—a
significance which at once recurs to one on hearing the isolated name unapplied
to any individual.
39. An equivalent expression, or an idea repeated in different
words, is properly set off by the comma and dash. {p117}
These are detached thoughts,—memoranda for future use.
Wolsey’s return to power was discussed openly as a probability,—a result
which Anne Boleyn never ceased to fear.
There are three kinds of power,—wealth, strength, and talent.
The value of our actions will be confirmed and established by those two sure
and sateless destroyers of all other things,—Time and Death.
The present time has one advantage over every other,—it is our own.

Those who submit to encroachments to-day are only preparing for themselves
greater evils for to-morrow,—humiliation or resistance.
OBS. 33. In a portion of the examples under this rule, the dash appears to
supply the place of viz., or namely.
40. A dash placed between two numbers indicates that the
natural series between those numbers is understood.
OBS. 34. If a writer refer to “pp. 90, 95,” he means those two pages only; but
if he cite “pp. 90–95,” the reference is to pages 90, 91, 92, 93, 94, and 95.—In
dates of the same century, the figures denoting the century are omitted in the
second number: “He has the Farmer’s Almanac for 1810–70,—sixty-one years.” (It
will be observed, that, under this rule, the short or en dash is used.)
The style of the Government Printing Office, Washington, requires an
apostrophe to denote the elision of the centuries; as 1889–’90.
41. An Ellipsis of letters is denoted by a dash.
Ex-President J—ns—n.
King F—der—ck W——m.
42. When a sentence is abrupted (1) to form a heading, or (2)
for a signature, or (3) to admit a {p118} new paragraph, or for other
purposes, a dash is used at the break; as:
From the preceding tables we are now able to formulate in concise language
the—
GRAND RESULT.
1. The number of employees . . . is at least 1,250,000.—Mass. Labor Report.
It is useless for you to dissemble in the presence of—
Yours, etc.
JOHN SMITH.
The greatest cowards in our regiment were the greatest rascals in it. There
was Sergeant Kumber and Ensign—
We’ll talk of them, said my father, another time.—Sterne.

VIII. VARIOUS MARKS USED IN WRITING AND PRINTING.
The Hyphen is used to denote the division of a
word into syllables; as, in-ter-dict: it is placed at the
end of a line (usually at the close of a syllable),
when a word is not finished: and it connects the
parts of a compound word; as, “At Cambridge,
Cecil was present at the terrible and never-to-be-for-
gotten battle between Cheke and Gardiner on the
pronunciation of the Greek epsilon, which convulsed
the academic world.” (See p. 84, et seq.)
The Apostrophe is used to abbreviate a word; as, ’tis for it is, tho’
for though, don’t for do not. It denotes the possessive case; as,
“John’s hat,” “three years’ service,” “one hour’s work,” “two days’
notice,” “Smith Co.’s shops,” “Brook’s book,” “Brooks’s book.” It
appears in names; as, O’Brien; M’[Mac]Mahon. {p119}
In French, no space is put after an apostrophe denoting elision;
as, “d’or”: in Italian, a space is inserted, as, “n’ arrivi.”
A turned comma sometimes denotes the ac in Mac; as,
M Donough.
Two commas (usually turned) are often used instead of do.
(ditto).
Carving knives
Pocket
Case
Book of History.
,, ,, Chemistry.
,, ,, Algebra.

Quotation marks [“ ” or ”] are used to include a copied
passage. If the copied passage itself contains a quotation, the latter
is denoted by single marks [‘ ’ or ’]; as, “My father said in banter,
‘James, the notes are not correct.’ The farmer dryly answered, ‘I
dinna ken what they may be noo; but they were a’ richt afore ye had
your fingers in amang ’em.’”
In some publications a little labor is saved by using single marks
for the principal quotations, and double if there happen to be
inserted ones; as in a recent novel by Mrs. Humphrey Ward:
‘To plunge into the Christian period without having first cleared the mind as to
what is meant in history and literature by “the critical method” which in history
may be defined,’ etc.
The same neat style is used in Max Müller’s Translation of Kant:
What Kant felt in his heart of hearts we know from some remarks found after
his death among his papers. ‘It is {p120} dishonorable,’ he writes, ‘to retract or
deny one’s real convictions, but silence in a case like my own, is the duty of a
subject; and though all we say must be true, it is not our duty to declare publicly
all that is true.’—Preface.
Brackets are used to inclose words omitted by a writer or copyist;
as, “Were you [on the] deck of the steamer at the [time] of the
collision?” (In the Holy Scriptures, supplied words are put in italics:
“Because they sought it not by faith, but, as it were, by the works of
the law.”) Explanations inserted in text are usually inclosed in
brackets; as in the following instance, from “The Life of Dr.
Goldsmith”: “You see, my dear Dan, how long I have been talking
about myself. [Some mention of private family affairs is here
omitted.] My dear sir, these things give me real uneasiness,” etc.
Marks of Parenthesis are used to inclose a sentence, or part of a
sentence, which is inserted in another sentence: “One Sunday

morning, when her daughter (afterwards Lady Elton) went into the
kitchen, she was surprised to find a new jack (recently ordered, and
which was constructed on the principle of going constantly without
winding up) wholly paralyzed and useless.”
The Index [ ] is used to draw attention to some particular
passage. Sometimes an Asterism [ ] is used for the same purpose.
Where there are many footnotes on a page, the Index is a proper
reference mark. {p121}
The Caret [ ] is used in writing, to denote the point where an
interlineation is to be inserted. It is sometimes used in printing when
the exact character of a manuscript is to be represented,—as in
“exhibits” in law work.
The Brace [ ] is used to connect a number of words with
one common term; and sometimes in poetry, to connect three lines
which rhyme together:
Moore’s Works,
Saurin’s Sermons, $1.75 each.
Lewis’s Plays,
Injustice, swift, erect, and unconfined,
Sweeps the wide earth, and tramples o’er mankind,
While prayers, to heal her wrongs, move slow behind.
Marks of Ellipsis or Omission are the dash; as, “Col. Sm—h”: or
asterisks; as, “Col. Sm**h”: or, neatest of all, points; as, “Col.
Sm . . h.”
Leaders are dots which lead the eye from something on the left
of the page, to some connected matter on the right:
Globe Insurance Co. . . . . . London, Eng.
Mutual Life In. Co. . . . . . Hartford, Conn.

Accents are the Grave [`], the Acute [´], and the Circumflex [^]:
è is read by the copy-holder grave e; é, acute e; ê, circumflex e.
Marks of Quantity are the Long, as over o in “shōw”; the Short,
or Breve, as over o in “nŏt”; and the Diæresis, which denotes that
the latter of {p122} two vowels is not in the same syllable as the
former; as, “zoölogy,” “Antinoüs.”
The Cedilla is a curve line under the letter c, to denote that it has
the sound of s; as in “garçon,” “façade.” It appears in words from
the French language. Worcester uses it also to denote the soft
sounds of g, s, and x; as in “mişle,” “e aģģerate.” Webster uses it
only to denote the soft sound of c, as in “min-çing-ly.” We remark
here, by the way, that in dividing such words as “bra-cing,” “min-
cing,” “convin-cing,” etc., the c should be carried over, thereby
preserving its proper sound. For a similar reason divide “enga-ging,”
“ra-ging,” etc., on the a. Whether “ma-gis-trate” should follow this
rule is a matter of style. There are offices which so divide it, while
others divide on the g. We prefer to syllable the word as we have
written it,—on the a.
The Spanish ñ has the sound of n in onion; as, “Señor,” “cañon.”
Umlaut (pron. ōōmlowt), as defined by Webster, is the change or
modification of a vowel sound, peculiar to the Germanic languages;
as in German, Mann, man, Männer or Maenner, men. The name
Roelker may also be written Rölker.
¶ denotes the beginning of a paragraph, as may be noticed in the
Sacred Scriptures. In proof-reading and in manuscript, it is used to
denote where a paragraph or break should be made. {p123}

§ denotes a section; §§, sections; as, Gen. Stat., Chap. IX., § 19,
and Chap. X., §§ 20 and 21.
Reference to notes at the bottom of the page (commonly termed
footnotes) is usually made by the asterisk, *, the obelisk, or dagger,
†; the double obelisk, or double dagger, ‡; the section, §; the
parallels, ; the paragraph, ¶; and the index, ;—but a neater mode
is to use superiors; as, 1, 2, 3, or a, b, c, commencing with 1 or a on each
page where notes occur.
In concluding our chapter on punctuation, we venture to say to
our friends at the case, that, in our opinion, no system of pointing
can be of uniform and universal application. Men differ as much in
style of writing as in personal appearance, and we might as well
expect the same robe to fit all forms, as that one set of rules shall
nicely apply to the endless diversities of diction.
Other things being equal however, he who has paid most
attention to rule will punctuate with the nearest approximation to
correctness. With a clear understanding of an author’s meaning, the
compositor seldom need go far astray; and if, having done his best,
he finds any passage hopelessly involved, or the meaning too subtile
to be grasped, he has one safe resource,—and that is, to FOLLOW THE
COPY closely and mechanically. Could he have for reference a few
pages preceding a doubtful passage, the whole matter might
become perfectly clear; but, as that is out of the question, those
pages being scattered as {p124} “takes” in other hands, let the
compositor adopt the safe course,—FOLLOW COPY,—resting assured
that no person whose opinion he need value, could possibly think of

finding fault with him for leaving responsibility where it properly
belongs.

CHAPTER VI.
ORTHOGRAPHY.
Webster defines Orthography as “the art of writing words with the
proper letters, according to common usage”; Worcester, as “the art
or the mode of spelling words.” They agree in this: that there are
some words—two or three thousand, perhaps—whose orthography
common usage has not settled. Prefixed to either Dictionary is a list
showing in double column the most prevalent methods of spelling
words of doubtful orthography; thus:
Abettor Abetter
Escalade Scalade
Germane Germain, German
The first column in the Webster List “presents the orthography
recognized in the body of [the] Dictionary as the preferable one, or
that in general use.” But “when in this list the word in the first
column is followed by or, as ‘Abatis, or Abattis,’ it is implied that the
second form is nearly, often quite, in as good use as the first.” When
the word in the first column differs in meaning from that in the
second, the word in the first is followed by and, as ‘Lunet, and
Lunette,’ both words being in use, but applied to different things.
{p126}
The orthography in the first column of the Worcester List “is
deemed to be well authorized, and in most cases preferable; but

with respect to the authority of that in the right-hand column, there
is a great diversity. Both orthographies of some of the words are
right, the words being differently spelled when used in different
senses”; as, “Draught, or Draft,” “Subtle, or Subtile,” etc. Sometimes
and is used as the connective; as, “Canvas, and Canvass.” But these
double arrangements are of almost no service to the proof-reader or
compositor,—for the interchangeable words cannot both be inserted
in his work. If he could use the various spellings, it would save the
trouble of weighing authorities: we should then have such sentences
as these:
The hostler or ostler inveigled or enveigled the horses into the stockade or
stoccade. Meanwhile the infantry landed at the jettee or jetty or jetta or jutty, and
at once constructed an abatis or abattis or abbatis, as it behooved or behoved
them.
Of these various correct spellings, one must be selected to the
exclusion of the rest. But there being no common usage, no
academy to instruct, and the copy not being uniform, who or what is
to guide the printers and proof-readers in making the selection? “For
the last eighty years [or more], printers have exercised a general
control over English orthography,”—and we, to carry the general
control a little farther, propose to set forth for general use one list
from Webster’s first column, exhibiting only one single correct
spelling, to be used where the Webster style prevails; and a similar
list from Worcester’s {p127} first column, to be used where the
Worcester style has the precedence. Would there were a
Smithsonian Bureau of the English Language, to render two lists
unnecessary; and to give one style to Government work,—a style
which should have the approval of Congress, and to which all

printing done by or for the various Departments of the United States
Government should be conformed.

THE WEBSTER LIST.
[From the column which, he says, “presents the orthography recognized in the
body of this Dictionary (Wb. Unabridged) as the preferable one, or that in general
use.” But since he places in his first column various spellings of the same words,—
e. g. under A, Ædile; under E, Edile,—we have, in accordance with our plan,
omitted that spelling which we have observed to be neglected by readers who
profess to follow Webster. We have inserted in brackets some words from the
second column which have a different signification from their congeners in the
first; also in brackets, some words from the defining columns, and such remarks
and explanations as may be of service to printers and others.]
A.
Abatis
Abettor
[One who abets another to commit a crime.]
Abreuvoir
Abridgment
[Accessary
As used in law.]
Accessory
[“In its other senses” (than in law); as, “the accessories of a picture.”]
Account, -ant, etc.
Accouter, etc.
Acetimeter
Ache
Achieve
Acknowledgment
Addible
Adipocere
Admittable
Adopter (Chem.)
Adulterer, -ess
Adz
Ægis
Æolian
Aghast

Agriculturist
Aid-de-camp
Ajutage
Alcaid
Alchemy
Alcoran
Alkahest
Allege
Alleluia
[If written Halleluiah or Hallelujah, follow copy.]
Alloy
Alum
Almanac
Ambassador
Ambergris
Ambs-ace
Amend, -ment
Amice
Ammoniuret
Amortize, -ment
Amphitheater
Anapest
Ancient, -ly
Andiron
Angiotomy
Ankle
Annotto
Antechamber
Anterior
Anti-emetic
Antihypnotic
Apostasy
Aposteme
[If written Imposthume, follow copy.]
Apothegm
Appall
Appallment
[Appanage]
Appareled, -ing
Appraise, -ed, etc. {p128}
Apprise (to notify)

Apricot
Arbitrament
Arbor
Archæology
Ardor
Argol
Armor, -er, etc.
Arquebuse
Arrack
Artisan
Asafœtida
Asbestus
Ascendant
Ascendency
Askance
Askant
Assuage
Atheneum
[If written Athenæum, follow copy.]
Aught
Author, etc.
Autocracy
Autoptical
Awkward
Awm
Ax
Ay
[Expressing assent.]
Aye
[An affirmative vote.]
B.
Backshish
Bade (v.)
Baldric
Balister
Balk
Baluster
Bandana
Bandoleer

Banderole
Banyan (Bot.)
Bans
[Notice of proposed marriage.]
Barbacan
Barbecue
Barberry
Bark
Barouche
Barytone
Basin
Bass
Bass-viol
Bas-relief
Bastinade
Baton
Bateau
Battledoor
Bauble
Bazaar
Befall
Behavior
Behoove
Beldam
Belligerent
Benedict
Benumb
Bellfounder,
[And similar compounds.]
Bequeath
Bergamot
Berth (Nav.)
[Bestrown
p. p. of Bestrew.]
Betel
Beveled, -ing
Bevile (Her.)
Bezant
Biasing, -ed, -es, etc.
Bigoted
Bilge

Billiards
Billingsgate
Bin
Binnacle
Bister
Blende (Min.)
Blessed (a.)
Blithesome, -ly, etc.
Blomary
Blouse
Bodice
Boil (n.)
Bombazet
Bombazine
Bonnyclabber
Bourgeois
Bourse
Bouse
Bousy
Boweled, -ing, etc.
Bowlder
Bowsprit
Brahmin
Brake (Railways)
Brazen
Brazier
Brier
Brooch
Bryony
Buccaneer
Buddhism
Buffet
Buhrstone
Bun
Buncombe
Bur
[If written Burr, follow copy.]
Burden, -some
Burin
Burned (imp.)
Burganet

But-end
Butt
Byzantine
C.
Caboose
Cacique
Caddice {p129}
Cæsura
Cag
[If written Keg follow copy.]
Caique
Caisson
Calash
Caldron
Calendar
Calends
Caliber
Calipash
Calipee
Calipers
Caliph
Calk
Calligraphy
Caloyer
Caltrap
Calyx
Camlet
Camomile
[If written Chamomile, follow copy.]
Camphene
Camphor
Candor
Canceled, -ing, etc.
Cannel-coal
Cannoneer
Canny
Cañon (Sp.)
Canyon [Eng.]

[The Eng. form is the better if writing or printing English. Cañon in an English
book seems pedantic.]
Cantaloup
Cantalever
Carbine
Carbineer
Carapace
Carat
Caravansary
Carcass
[In the King James Bible, spelled carcase.]
Carnelian
Caroled, -ing, etc.
Cartography
Cask (a vessel)
Casque (helmet)
Cassava
Cassimere
[If written Kerseymere, follow copy.]
Caster
[One who casts; a cruet; a furniture-wheel.]
Castor
[A genus of animals; a hat; a drug; a heavy cloth.]
Catchup
Catechise, -er
Cauliflower
Causeway
Caviare
Caviler, -ed, etc.
Cayman
Ceil -ing, -ed
Center
Centered
Centimeter
Centiped
Ceroon
Cess-pool
Chalcedony
Chameleon
Chamois
Champaign
[Flat, open country.]

Champagne (wine)
Champerty
Channeled, -ing, etc.
Chant, -er, -ed, etc.
Chap
[Both Wb. and Wor. place chăp in the first column, and chop in the second.
This preference of chăp to chop harmonizes orthography and pronunciation in
three instances: (1) when chăp is v. t., signifying “to cleave or open
longitudinally, through the effect of heat, cold, dryness, etc.; as, ‘Heat chăps
the russet plain’”; (2) when v. i., as “The hands chăp”; (3) when n., as a cleft
in the earth’s surface, or in the hands or feet. Chăp (a youth) was never in
doubt; while chaps (the jaws) must continue to be pronounced with the a as
in what.]
Chase
Check (n.)
Checker, -ed, etc.
Chemist
Chemistry
Cherif
Chestnut
Chevron
Chilioliter
Chiliometer
Chine
Chintz
Chiseled, -ing
Chock-full
Choir
Chorister
Choke
Choose
Chore
Cigar
Cimeter
Cipher
Clamor, -ous, etc.
Clangor
Clarionet
Clew
Clinch
Clinique
Clinometer

Cloak
Clodpoll {p130}
Clothe, -ed, etc.
Clough
Clyster
Cockswain
Cœliac
Cognizor, -zee
Coif
Coiffure
Colander
Comb
[Unwatered part of valley, etc.]
Comfrey
Complete
Complexion
[Comptroller, -ship
There is an officer of the U. S. Government whose official title is “Comptroller
of the Currency.” The word appears in Wb. 2d column.]
Confectionery
Connection
Contemporary
Contra-dance
Controller, -ship
Control
Cony
Cooly
Coomb (4 bushels)
Copaiva
Copier
Copse
Coquette (n.)
Coranach
Corbel
Cosy
Cot (a hut)
Cot (a bed)
Cotillon
Councilor
[A member of a council.]
Counselor

[One who gives counsel.]
Count
Courtesan
Courtesy (Law)
Cozen, -age
Craunch
Cray-fish
Creak (v.)
Creosote
Critique
Crosslet
Cruet
Croup
[Behind the saddle.]
Crupper
Cruse (bottle)
Cucurbit
Cudgeled, -er, -ing
Cue
[Twist of back hair.]
Cuerpo
Cuneiform
Curb (of a well)
Cursed (imperf.)
Curtal-ax
Cutlass
Cyclopedia
Cymar
Cyst
Czar, -ina
D.
Dactyl
Damasken
Damson
Dandruff
Danegelt
Debarkation
Debonair, -ly, -ness
Decrepit

Defense, -less, etc.
Deflection
Deflour
Delf
Delphin
Deltoid
Demeanor
Demesne (Law)
Dentiroster
Dependent
Dependence
Deposit
Desert (n.)
Deshabille
Dessert
Detecter
Detortion
Deuce
Develop, -ment
Dexterous
[But if written Dextrous follow copy, to avoid subsequent change.]
Diæresis
Diarrhea
Diarrhetic
Dike
Diocese
Disheveled, -ing, etc.
Disk
Dispatch, -ed, -ing
Disseize, -in, -or
Distention
Distill
Distrainor
Diversely
Divest, -ed, etc.
[But in Law, Devest is commonly used; in law work, follow copy.]
Docket
Doctress
Dolor, -ous
Domicile
Doomsday-book

Dory
Dormer-window
Dote
Dotage
Doubloon
Dowry
Downfall {p131}
Dram
[A weight; a minute quantity; a potation.]
[Drachm
This word is in second column, connected to Dram by and. Its meaning seems
to be properly limited, however, to an ancient Greek coin, and a Greek weight
(Drachma).]
Draff
Draft
[1. The act of drawing or pulling as by beasts of burden. 2. Drawing of men
for a military corps. 3. An order for payment of money; a bill of exchange. 4.
An allowance in weighing. 5. A drawing of lines for a plan; a figure described
on paper; delineation; sketch; plan delineated; an outline to be filled in or
completed for composition. In any other sense than these five, use the original
spelling, Draught.]
[Draught
(See supra.)]
Dragoman
Dribblet
Drier
Driveler, -ing, etc.
Drought
Dryly
Duchy
Duchess
Dueler, -ing, -ist
Dullness
Dungeon
Dunghill
Duress
Dye, etc. (color)
E.
Eavesdropper
Eccentric, -al, etc.

Economy
Ecstasy
Ecstatic
Ecumenic, -al
Edematous
Edile, -ship
Eloign, -ment
Emarginate
Embalm, -ed, etc.
Embalmer, -ment
Embank, -ed, etc.
Embargo
Embark, -ed, etc.
Embarkation
Embassy
Embassage
Embed, -ded, etc.
Embezzle
Emblaze
Emblazon, -ed, etc.
Embody, -ied, etc.
Embolden, -ed, etc.
Emborder, etc.
Embosom
[If written Imbosom, follow copy.]
Emboss, -ed, etc.
Embowel, -ed, -ing
Emboweler, -ment
Embower, -ed, etc.
Embrace, -ed, etc.
Embracer, -ment
Embrasure
Embrocation
Embroil, -ed, etc.
Emerods
[The Biblical spelling; in ordinary work, Hemorrhoids.]
Emir
Empale, -ed, etc.
Emperor
Empoison
Empower, -ed, etc.

Emprise
Empurple
Emu
Enameled, -ing, etc.
Enamor, -ed, -ing
Encage, -ed, etc.
Encamp, -ed, etc.
Enchant
Enchiseled, -ing
Encloister
Encounter, etc.
Encroach, etc.
Encumber, -ed, etc.
Encyclopedia
Endear
Endeavor, -ed, etc.
Endow, etc.
Endue
Endure, -ance
Enforce, -ed, etc.
Engage, -ed, etc.
Engender
Engorge, -ed, etc.
Engross
Enhance
Enigma
Enjoin, etc.
Enkindle, -ed, etc.
Enlarge, etc.
Enlist
Enroll
Enrollment
Enshrine
Enshroud
Ensphere
Enstamp
Entail (Arch.)
Entangle, etc.
Enterprise
Enthrone, -ed, etc.
Entire, -ly, etc.

Entitle, -ed, etc.
Entrance, -ed, etc.
Entrap, -ped, etc.
Entreat, -ed, etc. {p132}
Entreaty
Entresol
Entwine, -ed, etc.
Envelop (v.)
Envelope (n.)
Envelopment
Envenom
Eolipile
Epaulet
Epauleted, -ing
Equaled, -ing
Equiangular
Equivoque
Era
Error, etc.
Escalade
Escapement
Escarp (Fort.)
[But if written Scarp, follow copy.]
Eschalot
Escheat
Escritoire
Escutcheon
Estafet
Esthetics
Estoppel
Estrich
Etiology
Étui
[A French word, anglicized as Etwee; follow copy.]
Exactor
Expense
Exsiccate, -ed, -ing, etc.
Exsiccation
Exsuccous
Exudation
Exude, etc.

Eyrie
F.
Fæces
Fagot, -ed, -ing
Fairy
Fakir
Falchion
Falcon, -er, -ry
Fantasy
Fantastic
Farthingale
Fattener
Favor, -er, -ed, etc.
Fecal
Fecula
Feldspar
Felly
Feoffor
Fervor
Fetal
Feticide
Fetor
Fetus
Feud, -al, -atory
Feudalize, -ism
Fie
Filbert
Filibuster
Filigree
Fillibeg
[But if written Filibeg or Phillibeg, follow copy.]
Finery (a forge)
Firman
Fishgig
Fives [Veterinary]
Flageolet
Flavor, -ed, etc.
Flier
Floatage (Law)

Flotsam
Flour (of grain)
Flower-de-luce
[If French is wanted,—Fleur-de-lis.]
Fluke (Naut.)
Fluke (Zoöl.)
Fogy
Font (Typog.)
Forbade
Foray
Fosse
Foundery
[Very few writers so spell: if written Foundry, follow copy.]
Franc (coin)
Frantic
Frenzy
Frieze (Arch.)
Frouzy
Frumenty
Frustum
Fueled, -ing
Fulfill, -ment
Fullness
Further
[Farther
When space or time is indicated.]
Furtherance
Furthermore
Furthest
[Farthest
When space or time is indicated.]
Fuse (n.)
[In U. S. Govt. work Fuze is the common usage, to distinguish it from the verb
to Fuse. Follow copy.]
Fusil (gun)
Fusileer
G.
Gabardine
Galiot

Welcome to our website – the ideal destination for book lovers and
knowledge seekers. With a mission to inspire endlessly, we offer a
vast collection of books, ranging from classic literary works to
specialized publications, self-development books, and children's
literature. Each book is a new journey of discovery, expanding
knowledge and enriching the soul of the reade
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
Let us accompany you on the journey of exploring knowledge and
personal growth!
ebookultra.com

Computer Security Principles and Practice 3rd Edition William Stallings

More Related Content

Similar to Computer Security Principles and Practice 3rd Edition William Stallings

Recently uploaded

Computer Security Principles and Practice 3rd Edition William Stallings