193 lines
9.0 KiB
Plaintext
193 lines
9.0 KiB
Plaintext
A Suggested Readings List for Computer Viruses and Related Problems:
|
||
|
||
Prepared by: John Wack
|
||
National Institute of Standards and Technology
|
||
|
||
September 22, 1989
|
||
|
||
|
||
ABSTRACT
|
||
|
||
|
||
This document provides a list of suggested readings for obtaining information
|
||
about computer viruses and other related threats to computer security. The
|
||
primary intended audience is management as well as other technically-oriented
|
||
individuals who wish to learn more about the nature of computer viruses and
|
||
techniques that can be used to reduce their potential threat. The suggested
|
||
readings may range from general discussions on the nature of viruses and
|
||
related threats, to technical articles which explore the details of various
|
||
viruses, the mechanisms they attack, and methods for controlling these threats
|
||
to computer security.
|
||
|
||
BASIC TERMS
|
||
|
||
|
||
The following list provides general definitions for basic terms that are
|
||
commonly used throughout the applicable literature. Some of the terms are
|
||
relatively new and their definitions are not widely agreed upon, thus they may
|
||
be used differently elsewhere.
|
||
|
||
|
||
Computer Virus: A name for a class of programs that contain software that
|
||
has been written to cause some form(s) of damage to a computing system's
|
||
integrity, confidentiality, or availability. Computer viruses typically copy their
|
||
instructions to other programs; the other programs may continue to copy the
|
||
instructions to more programs. Depending on the author's motives, the
|
||
instructions may cause many different forms of damage, such as deleting files
|
||
or crashing the system. Computer viruses are so named because of their
|
||
functional similarity to biological viruses, in that they can spread rapidly
|
||
throughout a system. The term is sometimes used in a general sense to cover
|
||
many different types of harmful software, such as trojan horses or network
|
||
worms.
|
||
|
||
Network Worm: A name for a program or command file that uses a computer
|
||
network as a means for adversely affecting a system's integrity, reliability, or
|
||
availability. From one system, a network worm may attack a second system by
|
||
first establishing a network connection with the second system. The worm
|
||
may then spread to other systems in the same manner. A network worm is
|
||
similar to a computer virus in that its instructions can cause many different
|
||
forms of damage. However a worm is generally a self-contained program that
|
||
spreads to other systems, as opposed to other files.
|
||
|
||
Malicious Software: A general term for computer viruses, network worms,
|
||
trojan horses, and other software designed to deliberately circumvent
|
||
established security mechanisms or codes of ethical conduct or both, to
|
||
adversely affect the confidentiality, integrity, and availability of computer
|
||
systems and networks. The software may be composed of machine-language
|
||
executable instructions, or could be in the form of command files.
|
||
|
||
Unauthorized User(s): A user who knowingly uses a system in a non-legitimate
|
||
manner. The user may or may not be an authorized user of the system.
|
||
The actions of the user violate established security mechanisms or policies, or
|
||
codes of ethical conduct, or both.
|
||
|
||
|
||
|
||
Trojan Horse: A name for a program that disguises its harmful intent by
|
||
purporting to accomplish some harmless and possibly useful function. For
|
||
example, a trojan horse program could be advertised as a calculator, but it
|
||
may actually perform some other function when executed such as modifying
|
||
files or security mechanisms. A computer virus could be one form of a trojan
|
||
horse.
|
||
|
||
Back Door: An entry point to a program or system that is hidden or
|
||
disguised, often created by the software's author for maintenance or other
|
||
convenience reasons. For example, an operating system's password mechanism
|
||
may contain a back door such that a certain sequence of control characters
|
||
may permit access to the system manager account. Once a back door becomes
|
||
known, it can be used by unauthorized users or malicious software to gain
|
||
entry and cause damage.
|
||
|
||
Time Bomb, Logic Bomb: Mechanisms used by some examples of malicious
|
||
software to cause damage after a predetermined event. In the case of a time
|
||
bomb, the event is a certain system date, whereas for a logic bomb, the event
|
||
may vary. For example, a computer virus may infect other programs, yet
|
||
cause no other immediate damage. If the virus contains a time bomb
|
||
mechanism, the infected programs would routinely check the system date or
|
||
time and compare it with a preset value. When the actual date or time
|
||
matches the preset value, the destructive aspects of the virus code would be
|
||
executed. If the virus contains a logic bomb, the triggering event may be a
|
||
certain sequence of key strokes, or the value of a counter.
|
||
|
||
Anti-Virus Software: Software designed to detect the occurrence of a virus.
|
||
Often sold as commercial products, anti-virus programs generally monitor a
|
||
system's behavior and raise alarms when activity occurs that is typical of
|
||
certain types of computer viruses.
|
||
|
||
Isolated System: A system that has been specially configured for determining
|
||
whether applicable programs contain viruses or other types of malicious
|
||
software. The system is generally disconnected from any computer networks
|
||
or linked systems, and contains test data or data that can be restored if
|
||
damaged. The system may use anti-virus or other monitoring software to
|
||
detect the presence of malicious software.
|
||
|
||
Computer Security: The technological safeguards and management procedures
|
||
that can be applied to computer hardware, programs, data, and facilities to
|
||
assure the availability, integrity, and confidentiality of computer based
|
||
resources and to assure that intended functions are performed without harmful
|
||
side effects.
|
||
|
||
SUGGESTED READINGS
|
||
|
||
|
||
|
||
Brenner, Aaron; LAN Security; LAN Magazine, Aug 1989.
|
||
|
||
Bunzel, Rick; Flu Season; Connect, Summer 1988.
|
||
|
||
Cohen, Fred; Computer Viruses, Theory and Experiments; 7th Security
|
||
Conference, DOD/NBS Sept 1984.
|
||
|
||
Computer Viruses - Proceedings of an Invitational Symposium, Oct 10/11, 1988;
|
||
Deloitte, Haskins, and Sells; 1989
|
||
|
||
Denning, Peter J.; Computer Viruses; American Scientist, Vol 76, May-June,
|
||
1988.
|
||
|
||
Denning, Peter J.; The Internet Worm; American Scientist, Vol 77, March-April,
|
||
1989.
|
||
|
||
Dvorak, John; Virus Wars: A Serious Warning; PC Magazine; Feb 29, 1988.
|
||
|
||
Federal Information Processing Standards Publication 83, Guideline on User
|
||
Authentication Techniques for Computer Network Access Control; National
|
||
Bureau of Standards, Sept, 1980.
|
||
|
||
Federal Information Processing Standards Publication 73, Guidelines for
|
||
Security of Computer Applications; National Bureau of Standards, June, 1980.
|
||
|
||
Federal Information Processing Standards Publication 112, Password Usage;
|
||
National Bureau of Standards, May, 1985.
|
||
|
||
Federal Information Processing Standards Publication 87, Guidelines for ADP
|
||
Contingency Planning; National Bureau of Standards, March, 1981.
|
||
|
||
Fiedler, David and Hunter, Bruce M.; Unix System Administration; Hayden
|
||
Books, 1987
|
||
|
||
Fitzgerald, Jerry; Business Data Communications: Basic Concepts, Security, and
|
||
Design; John Wiley and Sons, Inc., 1984
|
||
|
||
Gasser, Morrie; Building a Secure Computer System; Van Nostrand Reinhold,
|
||
New York, 1988.
|
||
|
||
Grampp, F. T. and Morris, R. H.; UNIX Operating System Security; AT&T Bell
|
||
Laboratories Technical Journal, Oct 1984.
|
||
|
||
|
||
Highland, Harold J.; From the Editor -- Computer Viruses; Computers &
|
||
Security; Aug 1987.
|
||
|
||
Longley, Dennis and Shain, Michael; Data and Computer Security
|
||
|
||
McAfee, John; The Virus Cure; Datamation, Feb 15, 1989.
|
||
|
||
NBS Special Publication 500-120; Security of Personal Computer Systems: A
|
||
Management Guide; National Bureau of Standards, Jan 1985.
|
||
|
||
NIST Special Publication 500-166; Computer Viruses and Related Threats: A
|
||
Management Guide; National Institute of Standards and Technology, Aug 1989.
|
||
|
||
Parker, T.; Public domain software review: Trojans revisited, CROBOTS, and
|
||
ATC; Computer Language; April 1987.
|
||
|
||
Schnaidt, Patricia; Fasten Your Safety Belt; LAN Magazine, Oct 1987.
|
||
|
||
Shoch, J. F. and Hupp, J. A.; The Worm Programs: Early Experience with a
|
||
Distributed Computation; Comm of ACM, Mar 1982.
|
||
|
||
Spafford, Eugene H.; The Internet Worm Program: An Analysis; Purdue
|
||
Technical Report CSD-TR-823, Nov 28, 1988.
|
||
|
||
Thompson, Ken; Reflections on Trusting Trust (Deliberate Software Bugs);
|
||
Communications of the ACM, Vol 27, Aug 1984.
|
||
|
||
Tinto, Mario; Computer Viruses: Prevention, Detection, and Treatment; National
|
||
Computer Security Center C1 Tech. Rpt. C1-001-89, June 1989.
|
||
|
||
White, Stephen and Chess, David; Coping with Computer Viruses and Related
|
||
Problems; IBM Research Report RC 14405 (#64367), Jan 1989.
|
||
|
||
Witten, I. H.; Computer (In)security: infiltrating open systems; Abacus (USA)
|
||
Summer 1987.
|
||
|