CORBA Security: An Introduction to Safe Computing with Objects (The Addison-Wesley Object Technology Series) - Softcover

Blakley, Bob; Blakely, Robert

Softcover

ISBN 10: 0201325659 ISBN 13: 9780201325652

Publisher: Addison-Wesley, 1999

Synopsis

The CORBAsecurity specification adopted by the Object Management Group (OMG) represents a major step forward in making object technology suitable for business application development. The specification document, however, is long, detailed, and complex; it is a time-consuming task for software developers to make their way through it, and it is inaccessible to CIOs and other technical managers who need to understand object security and its impact on their organizations.

CORBA Security provides a readable and less technical overview of the specification and a guide to the security of object systems. Written from a policy point of view, the book will help you decide what security policies are appropriate for your organization and evaluate the object-based security options that can help you manage those policies.

For those unfamiliar with basic security and object technology concepts, clear introductions to these topics will bring you up to speed. The book also provides a list of questions you can ask your secure object system vendor-questions that will get behind the jargon and acronyms and give you the information you need to determine just how safe the product really is.

Readers will get an in-depth look at each element of computer security and how the CORBAsecurity specification fulfills each of these security needs. Topics covered include identification, authentication, and privilege; access control; message protection; delegation and proxy problems; auditing; and, non-repudiation. The author also provides numerous real-world examples of how secure object systems can be used to enforce useful security policies.

About this title

About the Author

Bob Blakley is Chief Scientist at DASCOM, and before joining DASCOM, was IBM's Lead Security Architect. He was the principal designer of IBM's proposal to the OMG for an Object-Oriented Security Service, and he co-edited the CORBAsecurity standard adopted by the OMG in 1996. Bob is a frequent speaker at software industry and software security conferences such as the RSA Conference, Networld+Interop, GUIDE, the Burton Group Catalyst Conference, and Open Systems Security Symposium, and the Mergent Users' Conference. He has written or co-authored seven papers on cryptography, secret-sharing schemes, access control, and other aspects of computer security, and he holds eight patents on security-related technologies.

0201325659AB04062001

From the Back Cover

The CORBAsecurity specification adopted by the Object Management Group (OMG) represents a major step forward in making object technology suitable for business application development. The specification document, however, is long, detailed, and complex; it is a time-consuming task for software developers to make their way through it, and it is inaccessible to CIOs and other technical managers who need to understand object security and its impact on their organizations.

CORBA Security provides a readable and less technical overview of the specification and a guide to the security of object systems. Written from a policy point of view, the book will help you decide what security policies are appropriate for your organization and evaluate the object-based security options that can help you manage those policies.

For those unfamiliar with basic security and object technology concepts, clear introductions to these topics will bring you up to speed. The book also provides a list of questions you can ask your secure object system vendor-questions that will get behind the jargon and acronyms and give you the information you need to determine just how safe the product really is.

Readers will get an in-depth look at each element of computer security and how the CORBAsecurity specification fulfills each of these security needs. Topics covered include identification, authentication, and privilege; access control; message protection; delegation and proxy problems; auditing; and, non-repudiation. The author also provides numerous real-world examples of how secure object systems can be used to enforce useful security policies.

0201325659B04062001

Excerpt. © Reprinted by permission. All rights reserved.

This book will introduce you to security in object-oriented environments. It doesn't assume any background in security, and it assumes only a general familiarity with object-oriented systems.

There are a lot of books on computer security; some of the author's favorites are listed in the bibliography. Most of them are written by experts, for experts. They tend to contain lots of detailed explanations of encryption systems (like RSA) and security protocols (like Kerberos), or they focus on how to build secure operating system kernels or secure databases. Many of these books are very good; people who need to build secure systems couldn't, or at least shouldn't, live without them.

If you aren't a security expert, but you do need to understand and use secure systems, you have fewer resources to turn to.

There aren't a lot of books that tell you what a secure system which someone else has already built looks like "from the outside" or how to use such a system to protect yourself and your data. This book tries to do that. It approaches security from the viewpoint of policy-what you want your secure system to allow and to forbid-rather than from the viewpoint of the mechanisms which enforce the policy. Policy is what you see when you tell the system what the rules are, and it's what the bad guys see when they get the "access denied" message.

This book is not an in-depth study. It presents object security at a "concept" level and omits many of the details. There are no scary C++ programs; there aren't even any trendy Java programs! There are lots of pictures and real-world examples of how secure object systems can be used to enforce interesting and useful security policies. There's a minimum of jargon, and the jargon that just couldn't be eliminated is explained in the glossary. There is also a "running summary" in the outer margin of each page which you can read to get an overview of the main points in the book if you're in a hurry.

If you're a manager, this book will teach you what you need to know about security issues and options in object-oriented environments, without a lot of unnecessary technical detail.

If you're a security administrator, this book should help you figure out what policies are reasonable in object-oriented environments and how object security technology can help you define, manage, and enforce those policies.

If you're considering buying or implementing an object-oriented system and you want to know what the risks are and what you can do to protect yourself, this book will help you answer those questions.

Most programmers aren't security experts. If you're in this category and you need to get up to speed on object security, you should find the book very useful, because it approaches the problem at a conceptual level. If you are a security expert, but you aren't familiar with the unique security problems which arise in object-oriented environments, there's something here for you too.

Finally, if you're a CORBA programmer (keep reading if you don't know what this means), this book is a good introduction to the OMG CORBAsecurity specification, which is notoriously hard to read.

The object security model described in this book is based on CORBASecurity. CORBA is the OMG's Common Object Request Broker Architecture. It describes an "object bus" through which applications can talk to objects. An implementation of the CORBA object bus is called an Object Request Broker (or ORB).

CORBAsecurity defines a set of security services which can be used to protect objects (and messages sent to objects) in a CORBA environment. The CORBAsecurity specification was produced by a large group of the industry's top security experts. It's recently been revised to add new features and to clean up a few of the inevitable small defects which creep into the first release of a specification.

The author was one of the two editors of the CORBAsecurity spec-ification and is a member of the revision committee, so you're getting the inside story.

The CORBAsecurity model was designed to allow ORB vendors to build the model using any of a variety of existing security technologies, and different vendors are in fact using different technologies "under the covers" in their implementations.

The CORBAsecurity model could be used to protect almost any object-oriented system. For example, it could be used to protect Java objects, ActiveX objects, or Smalltalk objects, though it hasn't been implemented in any of these environments yet.

The book concludes with a useful list of questions to ask vendors who say their object systems are secure. The questions will help you figure out what protection an object-oriented system provides and how strong that protection is.

Edition details

• Publisher: Addison-Wesley
• Publication date: 1999
• ISBN 10: 0201325659
• ISBN 13: 9780201325652
• Binding: Paperback
• Language: English
• Edition number: 1
• Number of pages: 160