___

• Barrett, N., “Penetration testing and social
• engineering: Hacking the weakest link”,
• Information Security Technical Report,
• (4):56-58, 2003.
• Arce, I., “The weakest link revisited” IEEE
• Security & Privacy Magazine, 1(2):72-74, 2003.
• İnternet: Computer Incident Advisory Capability
• “PDF XSS Vulnerability” http://www.ciac.org/ciac/bulletins/r-096.shtml,
• 07.2007.
• Dodge, C. R., Carver, C., Ferguson, J. A.,
• “Phishing for user security awareness”
• Computers & Security, 26(1): 73, 2007.
• İnternet: Netcraft “Phishing By The Numbers:
• ,000 Blocked Sites in 2006”
• http://news.netcraft.com/archives/2007/01/15/phi
• shing_by_the_numbers_609000_blocked_sites_i
• n_2006.html, 07.07.2007.
• İnternet: Message Labs “2006: The Year Spam
• Raised Its Game and Threats Got Personal”
• http://www.messagelabs.com/portal/server.pt/gat
• eway/PTARGS
• _0_5885_404_443_670_43/http%3B/0120-0176-
• CT01/publishedcontent/publish/about_us_dotcom
• _en / news
• events/press_releases/DA_174397.html,
• 07.2007.
• Kudat, B., “Kötü adamların hızına yetişen daha
• güvenli”, BThaber, 604:15, 2007.
• Vural, Y., “Kurumsal Bilgi Güvenliği ve Sızma
• Testleri” Yüksek Lisans Tezi, Gazi Üniversitesi
• Fen Bilimleri Enstitüsü, 40, 2007.
• İnternet: Wikipedia, “ISO/IEC 27001”,
• http://en.wikipedia.org/wiki/ISO_27001,
• 08.2007.
• Thow-Chang, L., Siew-Mun, K., and Foo, A.,
• “Information Security Management Systems and
• Standards” Synthesis Journal, 2(2):5,8, 2001.
• Kalman, S., “Web Security Field Guide”, Cisco
• Press, Indianapolis, sf.36, 37, 2003.
• İnternet: Wikipedia “BS-7799”
• http://en.wikipedia.org/wiki/BS_7799,
• 07.2007.
• Osborne, M., “How to Cheat at Managing
• Information Security”, Syngress Publishing Inc.,
• Rockland, 90, 2006.
• British Standards Institute, “Information
• Technology — Security Techniques — Code of
• Practice for Information Security Management”,
• BSI BS 7799-1:2005, Bristol ,
• ,5,7,9,19,23,29,37 2005.
• İnternet: BSI “Information Security Management
• Systems Guidelines for Information Security
• Risk Management” http://www.bsiglobal.
• com/en/Shop/PublicationDetail/?pid=0000
• &recid=2557, 08.07.2007.
• İnternet: International Organization for
• Standardization-ISO “JTC 1 / SC 27”
• http://www.iso.org/iso/en/stdsdevelopment/tc/tcli
• st/TechnicalCommitteeDetailPage.TechnicalCom
• mitteeDetail?COMMID=143, 09.07.2007.
• Saint-Germain, R., “Information Security
• Management Best Practice Based on ISO/IEC
• ”, The Information Management
• Journal, 39:61-62, 2005.
• İnternet: BSI Eurasia “ISO/IEC 17799:2005
• Nedir?” http://www.bsiturkey.
• com/BilgiGuvenligi/Genelbakis/
• BS7799nedir.xalter, 09.07.2007.
• İnternet: Wikipedia “ISO 27000 Series”
• http://en.wikipedia.org/wiki/ISO_17799,
• 07.2007.
• Türk Standardları Enstitüsü, “Bilgi Teknolojisi–
• Güvenlik Teknikleri-Bilgi Güvenliği Yönetim
• Sistemleri-Gereksinimler”, TSE- TS ISO/IEC
• , Ankara, 3-13, 2006.
• İnternet: ISO 27001 Security “ISO/IEC-
• &ISO/IEC-27002”
• http://www.iso27001security.com/html/iso17799.
• html, 09.07.2007.
• İnternet: ISO 27001 Security “ISO/IEC 27003”
• http://www.iso27001security.com/html/iso27003.
• html , 09.07.2007.
• İnternet: ISO 27001 Security “ISO/IEC 27004”
• http://www.iso27001security.com/html/iso27004.
• html (09.07.2007).
• İnternet: ISO 27001 Security “ISO/IEC 27005”
• http://www.iso27001security.com/html/iso27005.
• html, 09.07.2007.
• İnternet: ISO 27001 Security “ISO/IEC 27006”
• http://www.iso27001security.com/html/iso27006.
• html, 09.07.2007.
• İnternet: ISO 27001 Security “ISO/IEC 27007”
• http://www.iso27001security.com/html/iso27007.
• html, 09.07.2007.
• İnternet: ISO 27001 Security “ISO/IEC 27031”
• http://www.iso27001security.com/html/iso27031.
• html, 09.07.2007.
• Türkiye Bilişim Derneği, “E-Devlet
• Uygulamalarında Güvenlik ve Güvenilirlik
• Yaklaşımları 4. Çalışma Grubu Sonuç Raporu”,
• TBD Kamu-BİB IV, Ankara, 9, 11, 17, 2005.
• İnternet: BSI Eurasia “BSI Belgelendirme
• Yöntemi” http://www.bsiturkey.
• com/BilgiGuvenligi/ISMStescil/BSItescily
• ontemi.xalter?print_only=1, 24.01.2008.
• İnternet: BSI Eurasia “Bilgi Güvenliği Yönetim
• Sisteminin Belgelendirilmesi” http://www.bsiturkey.
• com/BilgiGuvenligi/ISMStescil/index.xalt
• er, 24.01.2008.
• İnternet: OWASP “About The Open Web
• Application Security Project”
• http://www.owasp.org/index.php/About_The_Op
• en_Web_Application_Security_Project,
• 01.2008.
• İnternet: Web Application Security Consortium
• “About Us”
• http://www.webappsec.org/aboutus.shtml ,
• 01.2008.
• Hansche, S., “Official (ISC2) Guide to the CISSP
• Exam”, Auerbach Publications, New York, 12,
• -
• İnternet: Web Application Security Consortium
• “Weak Password Recovery Validation”
• http://www.webappsec.org/projects/threat/classes
• /weak_password _recovery_validation.shtml
• 01.2008.
• İnternet: Web Application Security Consortium
• “Cross-site Scripting”
• http://www.webappsec.org/projects/threat/classes
• /cross-site_scripting.shtml, 24.01.2008.
• İnternet: Amit Klein “DOM Based Cross Site
• Scripting or XSS of the Third Kind”
• http://www.webappsec.org/projects/articles/0711
• shtml, 24.01.2008.
• İnternet: The World Wide Web Consortium
• (W3C) “Document Object Model FAQ"
• http://www.w3.org/DOM/faq.html#what,
• 01.2008.
• Chapela, V., “Advanced SQL Injection”
• http://www.owasp.org/images/7/74/Advanced_S
• QL_Injection.ppt, 24.01.2008.
• Anley, C., “Advanced SQL Injection In SQL
• Server Applications”, Next Generation Security
• Software Publication, Surrey, 18- 21, 2002.