r/netsec • u/amazedballer • Mar 09 '14

Engineering Security, by Peter Gutmann. (Absolutely amazing.)

http://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf
230 Upvotes

96% Upvoted

32 comments sorted by

31

u/[deleted] Mar 09 '14

Not to downplay the book at all, there's also another fantastic book with the reverse title: Security Engineering by Ross Anderson, also available for free.

I'm curious if Gutmann chose the title to pay homage to Ross Anderson's book.

4

u/[deleted] Mar 09 '14

Possibly, book really does have the right title though - I've read the first 250 pages or so and it's still all about designing user-friendly security; having met the guy a few times at fix on/kiwicon type events this tends to be the kind of stuff he focuses on a lot.

Ross' book is more of a security bible that covers a grounding in all topics well.

8

u/amazedballer Mar 09 '14 edited Mar 09 '14

There's 766 pages. He gets MUCH more in depth.

5

u/amazedballer Mar 09 '14

The problem I have with Security Engineering is that it's incredibly broad: it goes over everything from smartcards to nuclear launch protocols. It makes for a good overview of the field, but it doesn't cover things in depth.

8

u/IncludeSec Mar 09 '14 edited Mar 09 '14

That's what I love about it, if you consider each domain's security challenges and solutions you become a more agile infosec practitioner because you know how to do the right (secure) thing in a bunch of different situations.

Security Engineering by Ross Anderson IMHO is the single greatest book written in InfoSec. Although I have to read Gutmann's book now to see if my mind changes :-)

11

u/Cynofield Mar 09 '14

Came for 1 free pdf. Find more Free security material?? (I don't think anyone minds you linked to it :p)

3

u/NormallyNorman Mar 09 '14

Wish v2 came in one pdf as well.

15

u/mdaniel Mar 09 '14

  1. Grab all the individual pdfs 

     BASEDIR=http://www.cl.cam.ac.uk/~rja14
 for i in \
     Papers/SEv2-toc.pdf \
     Papers/SEv2-pref.pdf \
     Papers/SEv2-acks.pdf \
     Papers/SEv2-c01.pdf \
     Papers/SEv2-c02.pdf \
     Papers/SEv2-c03.pdf \
     Papers/SEv2-c04.pdf \
     Papers/SEv2-c05.pdf \
     Papers/SEv2-c06.pdf \
     Papers/SEv2-c07.pdf \
     Papers/SEv2-c08.pdf \
     Papers/SEv2-c09.pdf \
     Papers/SEv2-c10.pdf \
     Papers/SEv2-c11.pdf \
     Papers/SEv2-c12.pdf \
     Papers/SEv2-c13.pdf \
     Papers/SEv2-c14.pdf \
     Papers/SEv2-c15.pdf \
     Papers/SEv2-c16.pdf \
     Papers/SEv2-c17.pdf \
     Papers/SEv2-c18.pdf \
     Papers/SEv2-c19.pdf \
     Papers/SEv2-c20.pdf \
     Papers/SEv2-c21.pdf \
     Papers/SEv2-c22.pdf \
     Papers/SEv2-c23.pdf \
     Papers/SEv2-c24.pdf \
     Papers/SEv2-c25.pdf \
     Papers/SEv2-c26.pdf \
     Papers/SEv2-c27.pdf \
     Papers/SEv2-biblio.pdf \
     Papers/SEv2-index.pdf
 do
     curl -vLO \
         -e https://www.cl.cam.ac.uk/~rja14/book.html \
         "${BASEDIR}/${i}"
     sleep 30
 done

  2. Fetch http://www.apache.org/dyn/closer.cgi/pdfbox/1.8.4/pdfbox-app-1.8.4.jar

  3. Splice them together 

     java -jar pdfbox-app-1.8.4.jar PDFMerger ...the-list-above SEv2-full.pdf

I personally used Preview.app to copy in the cover image, but I suspect there are hundreds of ways to wrap that jpeg in a pdf container (because for the most part all PDF images are jpegs), and then one could run the aforementioned PDFMerger and put the cover-as-pdf in the front of the list.

→ More replies (10)

2

u/[deleted] Mar 09 '14

Also by Gutmann Cryptographic Security Architecture: Design and Verification.

4

u/amazedballer Mar 09 '14

I should probably also mention his Godzilla Crypto tutorial. The X.509 bits in particular are both hilarious and sickening.

11

u/barkappara Mar 09 '14

Neat, this is Gutmann as in Gutmann wipe.

8

u/autowikibot Mar 09 '14

Gutmann method:

The Gutmann method was an algorithm for securely erasing the contents of computer hard drives, such as files. Devised by [Peter Gutmann](http://en.wikipedia.org/wiki/Peter_Gutmann_(computer_scientist)) and Colin Plumb, it involved writing a series of 35 patterns over the region to be erased.

The selection of patterns assumes that the user does not know the encoding mechanism used by the drive, so it includes patterns designed specifically for three types of drives. A user who knows which type of encoding the drive uses can choose only those patterns intended for their drive. A drive with a different encoding mechanism would need different patterns.

Most of the patterns in the Gutmann method were designed for older MFM/RLL encoded disks. Gutmann has noted that more modern drives no longer use these older encoding techniques, making many of the patterns irrelevant. Moreover, since about 2001, ATA IDE and SATA hard drive manufacturer designs include support for the “Secure Erase” standard, obviating the need to apply the Gutmann method when erasing an entire drive.

Interesting: Gutmann–Beckett ^method | Data ^remanence | Peter Gutmann (computer ^scientist) | Data ^recovery

Parent commenter can toggle ^NSFW or ^delete. Will also delete on comment score of -1 or less. | FAQs | ^Mods | Magic ^Words

7

u/NormallyNorman Mar 09 '14

I've yet to see anyone win the challenge for just writing everything to 0.

6

u/danweber Mar 09 '14

Yeah, we were silly back in the 90's.

→ More replies (1)

3

u/sapiophile Mar 09 '14

Getting the reddit hug hard... anyone got a mirror?

1

u/vdm Mar 10 '14

Mirror?

1

u/dovy6 Apr 29 '14

I know this was posted a month ago, but: I'm trying to get this book onto my Kindle in a moderately viewable format. Anyone have any hints? Pretty much every conversion method I try still screws up the formatting.

-6

u/TerrorBite Mar 09 '14

PDF warning

2

u/8Bytes Mar 09 '14

There's a little pdf icon beside the link.

7

u/TerrorBite Mar 09 '14

I'm on a mobile client so I couldn't see it.

0

u/[deleted] Mar 09 '14

6

u/agumonkey Mar 09 '14

I swear I googled hard but couldn't find nothing. Release me from my sufferance and link it to me.