Principles of Information Security 5th Edition Whitman Solutions Manual
Principles of Information Security 5th Edition Whitman Solutions Manual
Principles of Information Security 5th Edition Whitman Solutions Manual
Principles of Information Security 5th Edition Whitman Solutions Manual
1. Visit https://testbankfan.com to download the full version and
explore more testbank or solution manual
Principles of Information Security 5th Edition
Whitman Solutions Manual
_____ Click the link below to download _____
https://testbankfan.com/product/principles-of-
information-security-5th-edition-whitman-solutions-
manual/
Explore and download more testbank at testbankfan.com
2. Here are some suggested products you might be interested in.
Click the link to download
Principles of Information Security 5th Edition Whitman
Test Bank
https://testbankfan.com/product/principles-of-information-
security-5th-edition-whitman-test-bank/
Principles of Information Security 6th Edition Whitman
Solutions Manual
https://testbankfan.com/product/principles-of-information-
security-6th-edition-whitman-solutions-manual/
Management of Information Security 5th Edition Whitman
Solutions Manual
https://testbankfan.com/product/management-of-information-
security-5th-edition-whitman-solutions-manual/
Probability Statistics and Random Processes for Engineers
4th Edition Stark Solutions Manual
https://testbankfan.com/product/probability-statistics-and-random-
processes-for-engineers-4th-edition-stark-solutions-manual/
3. Fundamentals of Management 8th Edition Ricky Griffin
Solutions Manual
https://testbankfan.com/product/fundamentals-of-management-8th-
edition-ricky-griffin-solutions-manual/
Calculus Hybrid Early Transcendental Functions 6th Edition
Larson Test Bank
https://testbankfan.com/product/calculus-hybrid-early-transcendental-
functions-6th-edition-larson-test-bank/
Cell and Molecular Biology Concepts and Experiments 7th
Edition Karp Solutions Manual
https://testbankfan.com/product/cell-and-molecular-biology-concepts-
and-experiments-7th-edition-karp-solutions-manual/
Workbook for Radiographic Image Analysis 4th Edition
Martensen Test Bank
https://testbankfan.com/product/workbook-for-radiographic-image-
analysis-4th-edition-martensen-test-bank/
Marketing of High Technology Products and Innovations 3rd
Edition Mohr Solutions Manual
https://testbankfan.com/product/marketing-of-high-technology-products-
and-innovations-3rd-edition-mohr-solutions-manual/
4. Invitation to the Life Span 2nd Edition Berger Test Bank
https://testbankfan.com/product/invitation-to-the-life-span-2nd-
edition-berger-test-bank/
5. Principles of Information Security, 5th
Edition 6-1
Chapter 6
Security Technology: Firewalls and VPNs
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
• Class Discussion Topics
• Additional Projects
• Additional Resources
• Key Terms
6. Principles of Information Security, 5th
Edition 6-2
Lecture Notes
Overview
This chapter discusses various authentication and access control methods. The chapter also
discusses the various approaches to firewall technologies and content filtering. The
emphasis of this chapter is on technical controls for both network and system access
control.
Chapter Objectives
In this chapter, your students will learn to:
• Discuss the important role of access control in computer-based information systems,
and identify and discuss widely used authentication factors
• Describe firewall technology and the various approaches to firewall implementation
• Identify the various approaches to control remote and dial-up access by authenticating
and authorizing users
• Discuss content filtering technology
• Describe virtual private networks and discuss the technology that enables them
Teaching Tips
Introduction
1. Explain how technical controls are essential in enforcing policy for many IT functions
that do not involve direct human control.
2. Discuss technical control solutions, which when properly implemented, can improve an
organization’s ability to balance the often conflicting objectives of making information
more readily and widely available against increasing the information’s levels of
confidentiality and integrity.
Access Control
1. Explain that access control is the method by which systems determine whether and how
to admit a user into a trusted area of the organization.
2. Remind students that there are two general types of access control systems:
discretionary and nondiscretionary.
3. Remind students that discretionary access controls (DACs) implement access control at
the discretion of the data user, and the most common example is Microsoft Windows.
7. Principles of Information Security, 5th
Edition 6-3
4. Explain that nondiscretionary access controls (NDACs) are managed by a central
authority and access is based on either the individual’s role (role-based controls) or a set
of tasks (task-based controls).
5. Discuss lattice-based access controls (LBACs). Explain that LBACs specify the level of
access each subject has to each object, as implemented in access control lists (ACLs)
and capability tables.
6. Describe the Mandatory Access Control scheme’s use of data classification schemes for
granting access to data. Also, mention that MACs are a form of lattice-based,
nondiscretionary access controls.
7. Introduce students to attribute-based access controls (ABACs), which is a newer
approach to lattice-based access controls promoted by NIST.
Access Control Mechanisms
1. Introduce students to the four fundamental functions of access control systems:
• Identification
• Authentication
• Authorization
• Accountability
2. Define identification as a mechanism whereby an unverified entities—called
supplicants—who seek access to a resource proposes a label by which they are known
to the system.
3. Ensure that students understand that the label applied to the supplicant must be mapped
to one and only one entity within the security domain.
4. Explain how authentication is the validation of a supplicant’s identity. There are four
general forms of authentication to consider:
• What a supplicant knows
• What a supplicant has
• What a supplicant is
5. Discuss the concept of what a supplicant knows.
• A password is a private word or combination of characters that only the user should
know.
• One of the biggest debates in the information security industry concerns the
complexity of passwords.
• A password should be difficult to guess but must be something the user can easily
remember.
• A passphrase is a series of characters, typically longer than a password, from which
a virtual password is derived.
8. Principles of Information Security, 5th
Edition 6-4
6. Discuss the concept of what a supplicant has.
• Addresses something the supplicant carries in his or her possession—that is,
something they have.
• These include dumb cards, such as ID cards or ATM cards with magnetic stripes
that contain the digital (and often encrypted) user personal identification number
(PIN), against which the number a user inputs is compared.
• An improved version of the dumb card is the smart card, which contains a computer
chip that can verify and validate a number of pieces of information instead of just a
PIN.
• Another device often used is the token, a card or key fob with a computer chip and a
liquid crystal display that shows a computer-generated number used to support
remote login authentication.
• Tokens are synchronous or asynchronous.
• Once synchronous tokens are synchronized with a server, both devices (server and
token) use the same time or a time-based database to generate a number that is
displayed and entered during the user login phase.
• Asynchronous tokens use a challenge-response system, in which the server
challenges the supplicant during login with a numerical sequence.
7. Describe the concept of who a supplicant is or something they can produce.
• The process of using body measurements is known as biometrics and includes:
• Relies on individual characteristics, such as: fingerprints, palm prints, hand
topography, hand geometry, or retina/iris scans
• Also may rely on something a supplicant can produce on demand, such as: voice
patterns, signatures, or keyboard kinetic measurements.
• Strong authentication requires at least two authentication mechanisms drawn from
two different factors of authentication.
8. Define authorization as the matching of an authenticated entity to a list of information
assets and corresponding access levels, which can happen in one of three ways.
• Authorization for each authenticated user, in which the system performs an
authentication process to verify each entity and then grants access to resources for
only that entity. This quickly becomes a complex and resource-intensive process in
a computer system.
• Authorization for members of a group, in which the system matches authenticated
entities to a list of group memberships, and then grants access to resources based on
the group’s access rights. This is the most common authorization method.
• Authorization across multiple systems, in which a central authentication and
authorization system verifies entity identity and grants it a set of credentials.
9. Explain that accountability or auditability is a system that directly attributes the actions
on a system with an authenticated entity.
Teaching
Tip
It may be helpful to have students read an explanation of MAC, such as the one
provided by FreeBSD, http://www.freebsd.org/doc/handbook/mac.html.
9. Principles of Information Security, 5th
Edition 6-5
Biometrics
1. Explain that biometric access control relies on recognition. This type of authentication
is expected to have a significant impact in the future.
2. Discuss the types of biometric authentication technologies:
• Fingerprint comparison of the supplicant’s actual fingerprint to a stored fingerprint
• Palm print comparison of the supplicant’s actual palm print to a stored palm print
• Hand geometry comparison of the supplicant’s actual hand to a stored measurement
• Facial recognition using a photographic ID card, in which a human security guard
compares the supplicant’s face to a photo
• Facial recognition using a digital camera, in which a supplicant’s face is compared
to a stored image
• Retinal print comparison of the supplicant’s actual retina to a stored image
• Iris pattern comparison of the supplicant’s actual iris to a stored image
3. Point out that among all possible biometrics, only three human characteristics are
usually considered truly unique:
▪ Fingerprints
▪ Retina of the eye (blood vessel pattern)
▪ Iris of the eye (random pattern of features in the iris: freckles, pits, striations,
vasculature, coronas, and crypts)
• Most of the technologies that scan human characteristics convert these images to
some form of minutiae, which are unique points of reference that are digitized and
stored in an encrypted format when the user’s system access credentials are created.
4. Discuss the fact that signature and voice recognition technologies are also considered to
be biometric access control measures.
• Retail stores use signature recognition, or at least signature capture, for
authentication during a purchase. Currently, the technology for signature capturing
is much more widely accepted than that for signature comparison, because
signatures change due to a number of factors, including age, fatigue, and the speed
with which the signature is written.
• In voice recognition, an initial voiceprint of the user reciting a phrase is captured
and stored. Later, when the user attempts to access the system, the authentication
process will require the user to speak this same phrase so that the technology can
compare the current voiceprint against the stored value.
5. Explain the three basic criteria that biometric technologies are evaluated on:
• False reject rate
• False accept rate
• Crossover error rate (CER)
6. Use Table 6-1 to discuss the acceptability of biometrics.
10. Principles of Information Security, 5th
Edition 6-6
Access Control Architecture Models
1. Explain that security access control architecture models illustrate access control
implementations and can help organizations quickly make improvements through
adaptation.
2. Introduce students to the Trusted Computer System Evaluation Criteria (TCSEC). Point
out that it is an older DoD standard that defines the criteria for assessing the access
controls in a computer system.
3. Explain that TCSEC uses the concept of the trusted computing base (TCB) to enforce
security policy.
• TCB is made up of the hardware and software that has been implemented to
provide security for a particular information system (usually includes the
operating system kernel and a specified set of security utilities).
4. Point out that one of the biggest challenges in TCB is the existence of covert channels.
Mention that TCSEC defines two kinds of covert channels: storage channels and timing
channels.
5. Discuss the levels of protection assigned to products evaluated under TCSEC:
• D: Minimal protection
• C: Discretionary protection
• B: Mandatory protection
• A: Verified protection
6. Discuss the Information Technology System Evaluation Criteria (ITSEC), which is an
international set of criteria for evaluating computer systems.
7. Introduce students to the Common Criteria for Information Technology Security
Evaluation, often called the Common Criteria or just CC. Mention that it is an
international standard for computer security certification.
8. Discuss the following CC terminology:
• Target of Evaluation (ToE)
• Protection Profile (PP)
• Security Target (ST)
• Security Functional Requirements (SFRs)
• Evaluation Assurance Levels (EALs)
9. Explain that the Bell-LaPadula (BLP) model ensures the confidentiality of the modeled
system by using MACs, data classification, and security clearances.
10. Discuss with students how the Biba integrity model is similar to BLP. Point out that it is
based on the premise that higher levels of integrity are more worthy of trust than lower
ones.
11. Principles of Information Security, 5th
Edition 6-7
11. Introduce students to the Clark-Wilson integrity model, which is built upon principles
of change control rather than integrity levels. The model’s change control principles
are:
• No changes by unauthorized subjects
• No unauthorized changes by authorized subjects
• The maintenance of internal and external consistency
12. Discuss the elements of the Clark-Wilson model:
• Constrained data item (CDI)
• Unconstrained data item
• Integrity verification procedure (IVP)
• Transformation procedure (TP)
13. Explain that the Graham-Denning access control model has three parts: a set of objects,
a set of subjects, and a set of rights. Further explain the model describes eight primitive
protection rights, called commands:
• Create object
• Create subject
• Delete object
• Delete subject
• Read access right
• Grant access right
• Delete access right
• Transfer access right
14. Introduce students to the Harrison-Ruzzo-Ullman (HRU) model that defines a method
to allow changes to access rights and the addition and removal of subjects and objects.
Mention that the Bell-LaPadula model does not allow changes.
15. Discuss the Brewer-Nash Model which is designed to prevent a conflict of interest
between two parties. Point out that this model is sometimes known as a Chinese Wall.
Quick Quiz 1
1. The method by which systems determine whether and how to admit a user into a trusted
area of the organization is known as _____.
Answer: access control
2. ____ is the process of validating a supplicant’s purported identity.
Answer: Authentication
3. True or False: The authentication factor “something a supplicant has” relies upon
individual characteristics, such as fingerprints, palm prints, hand topography, hand
geometry, or retina and iris scans.
Answer: False
12. Principles of Information Security, 5th
Edition 6-8
4. The biometric technology criteria that describes the number of legitimate users who are
denied access because of a failure in the biometric device in known as _____.
Answer: false reject rate
5. Within TCB is an object known as the _____, which is the piece of the system that
manages access controls.
Answer: reference monitor
Firewalls
1. Explain how a firewall prevents specific types of information from moving between an
external network, known as the untrusted network, and an internal network, known as
the trusted network.
2. Discuss how the firewall may be a separate computer system, a software service
running on an existing router or server, or a separate network containing a number of
supporting devices.
Firewall Processing Modes
1. Point out to students that firewalls fall into four major categories of processing modes:
packet filtering, application gateways, MAC layer firewalls, and hybrids.
2. Explain that packet filtering firewalls examine the header information of data packets
that come into a network. The restrictions most commonly implemented are based on a
combination of:
• IP source and destination address
• Direction (inbound or outbound)
• Protocol, for firewalls capable of examining the IP protocol layer
• Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) source and
destination port requests
3. Describe simple firewall models, which examine one aspect of the packet header: the
destination and source address. Emphasize that they enforce address restrictions, rules
designed to prohibit packets with certain addresses or partial addresses from passing
through the device.
4. Explain that they accomplish this through access control lists (ACLs), which are created
and modified by the firewall administrators.
5. Identify the three subsets of packet filtering firewalls:
• Static filtering
• Dynamic filtering
• Stateful packet inspection (SPI)
6. Explain how static filtering requires that the filtering rules be developed and installed
with the firewall.
13. Principles of Information Security, 5th
Edition 6-9
7. Describe dynamic filtering, which allows the firewall to react to an emergent event and
update or create rules to deal with the event. Note that while static filtering firewalls
allow entire sets of one type of packet to enter in response to authorized requests, the
dynamic packet filtering firewall allows only a particular packet with a particular
source, destination, and port address to enter through the firewall.
8. Explain how stateful inspection firewalls, or stateful firewalls, keep track of each
network connection between internal and external systems using a state table, which
tracks the state and context of each packet in the conversation by recording which
station sent which packet and when.
9. Discuss the difference between simple packet filtering firewalls and stateful firewalls.
Whereas simple packet filtering firewalls only allow or deny certain packets based on
their address, a stateful firewall can block incoming packets that are not responses to
internal requests.
10. Explain how the primary disadvantage of a stateful firewall is the additional processing
required to manage and verify packets against the state table, which can leave the
system vulnerable to a DoS or DDoS attack.
11. Emphasize that the application layer firewall or application firewall, is frequently
installed on a dedicated computer, separate from the filtering router, but is commonly
used in conjunction with a filtering router.
12. Explain how the application firewall is also known as a proxy server, since it runs
special software that acts as a proxy for a service request.
13. Emphasize that since the proxy server is often placed in an unsecured area of the
network or in the DMZ, it—rather than the Web server—is exposed to the higher levels
of risk from the less trusted networks.
14. Discuss how MAC layer firewalls are designed to operate at the media access control
layer of the OSI network model. Point out that this type of firewall is not as well known
or widely referenced.
15. Explain how using this approach, the MAC addresses of specific host computers are
linked to ACL entries that identify the specific types of packets that can be sent to each
host, and all other traffic is blocked.
16. Note that hybrid firewalls combine the elements of other types of firewalls—that is, the
elements of packet filtering and proxy services, or of packet filtering and circuit
gateways.
17. Explain how alternately, a hybrid firewall system can consist of two separate firewall
devices; each is a separate firewall system, but they are connected so that they work in
tandem.
14. Principles of Information Security, 5th
Edition 6-10
18. Introduce students to the most recent generation of firewall, known as Unified Threat
Management (UTM). Point out that these devices are categorized by their ability to
perform the work of an SPI firewall, network intrusion detection and prevention system,
content filter, spam filter, and malware scanner and filter.
Firewall Architectures
1. Emphasize that each of the firewall devices noted earlier can be configured in a number
of network connection architectures.
2. Emphasize that the firewall configuration that works best for a particular organization
depends on three factors: the objectives of the network, the organization’s ability to
develop and implement the architectures, and the budget available for the function.
3. Describe the four common architectural implementations of firewalls:
• Packet filtering routers
• Dual-homed host firewalls (also known as bastion hosts)
• Screened host firewalls
• Screened subnet firewalls
4. Emphasize that most organizations with an Internet connection have a router as the
interface to the Internet at the perimeter between the organization’s internal networks
and the external service provider. Mention that many of these routers can be configured
to reject packets that the organization does not allow into the network.
5. Discuss the drawbacks to this type of system including a lack of auditing and strong
authentication, and the complexity of the access control lists used to filter the packets
can grow and degrade network performance.
6. Explain that with dual-homed firewalls, the bastion host contains two NICs. One NIC is
connected to the external network, and one is connected to the internal network,
providing an additional layer of protection.
7. Explain how with two NICs, all traffic must go through the firewall in order to move
between the internal and external networks.
8. Discuss the implementation of this architecture, which often makes use of Network
Address Translation (NAT). NAT is a method of mapping assigned IP addresses to
special ranges of nonroutable internal IP addresses, thereby creating yet another barrier
to intrusion from external attackers.
9. Introduce students to Port Address Translation (PAT), which is a variation of NAT.
10. Explain how this architecture combines the packet filtering router with a separate,
dedicated firewall, such as an application proxy server, allowing the router to prescreen
packets to minimize the network traffic and load on the internal proxy.
15. Principles of Information Security, 5th
Edition 6-11
11. Describe how the application proxy examines an application layer protocol and
performs the proxy services. Use Figure 6-17 in your discussion.
12. Emphasize that the dominant architecture used today, the screened subnet firewall
provides a DMZ.
13. Explain how the DMZ can be a dedicated port on the firewall device linking a single
bastion host, or it can be connected to a screened subnet.
14. Note that a common arrangement finds the subnet firewall consisting of two or more
internal bastion hosts behind a packet filtering router, with each host protecting the
trusted network:
• Connections from the outside or untrusted network are routed through an external
filtering router.
• Connections from the outside or untrusted network are routed into—and then out
of—a routing firewall to the separate network segment known as the DMZ.
• Connections into the trusted internal network are allowed only from the DMZ
bastion host servers.
15. Explain how the screened subnet is an entire network segment that performs two
functions:
• It protects the DMZ systems and information from outside threats by providing a
network of intermediate security.
• It protects the internal networks by limiting how external connections can gain
access to internal systems.
16. Emphasize that DMZs can also create extranets, segments of the DMZ where additional
authentication and authorization controls are put into place to provide services that are
not available to the general public.
17. Note that SOCKS is the protocol for handling TCP traffic via a proxy server.
18. Explain how the general approach is to place the filtering requirements on the
individual workstation rather than on a single point of defense (and thus point of
failure).
19. Discuss how this frees the entry router from filtering responsibilities, but it requires that
each workstation be managed as a firewall detection and protection device.
16. Principles of Information Security, 5th
Edition 6-12
Selecting the Right Firewall
1. Explain how when selecting the best firewall for an organization, you should consider a
number of factors. The most important of these is the extent to which the firewall design
provides the desired protection.
• Which type of firewall technology offers the right balance between protection and
cost for the needs of the organization?
• What features are included in the base price? What features are available at extra
cost? Are all cost factors known?
• How easy is it to set up and configure the firewall? How accessible are the staff
technicians who can competently configure the firewall?
• Can the candidate firewall adapt to the growing network in the target organization?
2. Emphasize that the second most important issue is cost.
Configuring and Managing Firewalls
1. Discuss good policy and practice, which dictate that each firewall device, whether a
filtering router, bastion host, or other firewall implementation, must have its own set of
configuration rules that regulate its actions.
2. Emphasize that the configuration of firewall policies can be complex and difficult.
Explain how each configuration rule must be carefully crafted, debugged, tested, and
sorted.
3. Emphasize that when configuring firewalls, keep one thing in mind: when security rules
conflict with the performance of business, security often loses.
4. Discuss best practices for firewalls. The following are some of the best practices for
firewall use:
• All traffic from the trusted network is allowed out
• The firewall device is never directly accessible from the public network.
• SMTP data is allowed to pass through the firewall, but it should be routed to a well-
configured SMTP gateway to filter and route messaging traffic securely.
• All ICMP data should be denied.
• Telnet access to all internal servers from the public networks should be blocked.
• When Web services are offered outside the firewall, HTTP traffic should be denied
from reaching your internal networks through the use of some form of proxy access
or DMZ architecture.
• All data that is not verifiably authentic should be denied.
5. Explain how firewalls operate by examining a data packet and performing a comparison
with some predetermined logical rules.
6. Discuss the logic, which is based on a set of guidelines programmed in by a firewall
administrator, or created dynamically and based on outgoing requests for information.
7. Note that this logical set is most commonly referred to as firewall rules, rule base, or
firewall logic.
17. Principles of Information Security, 5th
Edition 6-13
8. Explain how most firewalls use packet header information to determine whether a
specific packet should be allowed to pass through or should be dropped.
9. Discuss the rule sets given in the textbook, starting on page 334. Be sure to use Tables
6-5 through 6-19 in your discussion.
Content Filters
1. Describe a content filter, which is a software filter—technically not a firewall—that
allows administrators to restrict access to content from within a network. It is a set of
scripts or programs that restricts user access to certain networking protocols and
Internet locations, or restricts users from receiving general types or specific examples of
Internet content.
2. Note that some refer to content filters as reverse firewalls, as their primary focus is to
restrict internal access to external material.
3. Explain to students that in most common implementation models, the content filter has
two components: rating and filtering.
4. Emphasize that the rating is like a set of firewall rules for Web sites, and it is common
in residential content filters.
5. Explain how the filtering is a method used to restrict specific access requests to the
identified resources, which may be Web sites, servers, or whatever resources the
content filter administrator configures.
6. Discuss the most common content filters, which restrict users from accessing Web sites
with obvious non-business related material, such as pornography, or deny incoming
spam e-mail.
Teaching
Tip
Explain to students that the line between these various devices blurs with each
new product introduction as more and more vendors are attempting to broaden
their coverage with a single device rather than a suite of devices.
Quick Quiz 2
1. What type of firewall examines every incoming packet header and can selectively filter
packets based on header information, such as destination address, source address,
packet type, and other key information?
Answer: Packet filtering
2. Which type of firewall filtering allows the firewall to react to an emergent event and
update or create rules to deal with the event?
Answer: Dynamic
18. Principles of Information Security, 5th
Edition 6-14
3. True or False: The commonly used name for an intermediate area between a trusted
network and an untrusted network is the DMZ.
Answer: True
4. True or False: All traffic exiting from the trusted network should be filtered.
Answer: False
5. A network filter that allows administrators to restrict access to external content from
within a network is known as a _____.
Answer: content filter or reverse firewall
Protecting Remote Connections
1. Discuss installing Internetwork connections, which requires using leased lines or other
data channels provided by common carriers, and therefore these connections are usually
permanent and secured under the requirements of a formal service agreement.
2. Explain how in the past, organizations provided remote connections exclusively through
dial-up services like Remote Authentication Service (RAS). Since the Internet has
become more widespread in recent years, other options, such as Virtual Private
Networks (VPNs), have become more popular.
Remote Access
1. Explain how it is a widely held view that these unsecured, dial-up connection points
represent a substantial exposure to attack.
2. Note that an attacker who suspects that an organization has dial-up lines can use a
device called a war dialer to locate the connection points.
3. Explain how a war dialer is an automatic phone-dialing program that dials every
number in a configured range and checks to see if a person, answering machine, or
modem picks up.
4. Discuss how some technologies, such as RADIUS systems, TACACS, and CHAP
password systems, have improved the authentication process.
RADIUS, Diameter, and TACACS
1. Explain how RADIUS and TACACS are systems that authenticate the credentials of
users who are trying to access an organization’s network via a dial-up connection.
2. Explain how Remote Authentication Dial-In User Service systems place the
responsibility for authenticating each user in the central RADIUS server.
19. Principles of Information Security, 5th
Edition 6-15
3. Note that when a remote access server (NAS) receives a request for a network
connection from a dial-up client, it passes the request along with the user’s credentials
to the RADIUS server, which then validates the credentials and passes the resulting
decision (accept or deny) back to the accepting RAS.
4. Explain how the Diameter protocol defines the minimum requirements for a system that
provides Authentication, Authorization and Accounting (AAA) services and can go
beyond these basics and add commands and/or object attributes.
5. Discuss diameter security, which uses respected encryption standards including IPSEC
or TLS, and its cryptographic capabilities are extensible and will be able to use future
encryption protocols as they are implemented.
6. Describe how the RADIUS system is similar in function to the Terminal Access
Controller Access Control System (TACACS).
7. Note that like RADIUS, it is a centralized database, and it validates the user’s
credentials at the TACACS server.
Securing Authentication with Kerberos
1. Emphasize that Kerberos uses symmetric key encryption to validate an individual user
to various network resources.
2. Explain that Kerberos keeps a database containing the private keys of clients and
servers. Note that in the case of a client, this key is simply the client’s encrypted
password.
3. Explain how the Kerberos system knows these private keys and how it can authenticate
one network node (client or server) to another. Kerberos consists of the following
interacting services, all of which use a database library:
• Authentication server (AS), which is a Kerberos server that authenticates clients
and servers
• Key Distribution Center (KDC), which generates and issues session keys
• Kerberos ticket granting service (TGS), which provides tickets to clients who
request services
4. Point out that Kerberos is based on the following principles:
• The KDC knows the secret keys of all clients and servers on the network
• The KDC initially exchanges information with the client and server by using
these secret keys
• Kerberos authenticates a client to a requested service on a server through TGS
and by issuing temporary session keys for communications between the client
and KDC, the server and KDC, and the client and server
• Communications then take place between the client and server using these
temporary session keys
20. Principles of Information Security, 5th
Edition 6-16
Sesame
1. Discuss how the Secure European System for Applications in a Multivendor
Environment (SESAME) is similar to Kerberos in that the user is first authenticated to
an authentication server and receives a token.
2. Explain how the token is then presented to a privilege attribute server (instead of a
ticket granting service as in Kerberos) as proof of identity to gain a privilege attribute
certificate (PAC).
3. Note that SESAME also builds on the Kerberos model by adding additional and more
sophisticated access control features, more scalable encryption systems, as well as
improved manageability, auditing features, and the delegation of responsibility for
allowing access.
Virtual Private Networks (VPNs)
1. Define VPN as a private and secure network connection between systems that uses the
data communication capability of an unsecured and public network. VPNs are
commonly used to extend securely an organization’s internal network connections to
remote locations beyond the trusted network.
2. Discuss the three VPN technologies that the VPNC defines:
• A trusted VPN, or legacy VPN, uses leased circuits from a service provider and
conducts packet switching over these leased circuits.
• A secure VPN uses security protocols and encrypts traffic transmitted across
unsecured public networks like the Internet.
• A hybrid VPN combines the two, providing encrypted transmissions (as in secure
VPN) over some or all of a trusted VPN network.
3. Note that a VPN that proposes to offer a secure and reliable capability while relying on
public networks must address:
• Encapsulation of incoming and outgoing data, wherein the native protocol of the
client is embedded within the frames of a protocol that can be routed over the public
network as well as be usable by the server network environment.
• Encryption of incoming and outgoing data to keep the data contents private while in
transit over the public network, but usable by the client and server computers and/or
the local networks on both ends of the VPN connection.
• Authentication of the remote computer and, perhaps, the remote user.
Authentication and the subsequent authorization of the user to perform specific
actions are predicated on accurate and reliable identification of the remote system
and/or user.
Transport Mode
1. Explain how in transport mode, the data within an IP packet is encrypted, but the
header information is not.
21. Principles of Information Security, 5th
Edition 6-17
2. Note that this allows the user to establish a secure link directly with the remote host,
encrypting only the data contents of the packet.
3. Describe the two popular uses for transport mode VPNs:
• The end-to-end transport of encrypted data.
• A remote access worker or teleworker connects to an office network over the
Internet by connecting to a VPN server on the perimeter.
Tunnel Mode
1. Explain how in tunnel mode, the organization establishes two perimeter tunnel
servers. These servers serve as the encryption points, encrypting all traffic that will
traverse an unsecured network.
2. Note that in tunnel mode, the entire client packet is encrypted and added as the data
portion of a packet that is addressed from one tunneling server and to another. The
receiving server decrypts the packet and sends it to the final address.
3. Discuss the primary benefit to this model, which is that an intercepted packet
reveals nothing about the true destination system.
Teaching
Tip
Remind students that a VPN technology is simply a method for providing
network-based access to resources with varying levels of security, and that a
VPN connection does not necessarily imply an application delivery method.
VPN technology is becoming very common in use cases beyond the WAN.
Quick Quiz 3
1. What is the system most often used to authenticate the credentials of users who are
trying to access an organization’s network via a dial-up connection?
Answer: RADIUS
2. In which mode of IPSEC is the data within an IP packet encrypted, while the header
information is not?
Answer: Transport mode
3. A _____ dials every number in a configured range and checks to see if a person,
answering machine, or modem picks up.
Answer: war dialer
4. Which authentication system is a result of a European research and development project
and is similar to Kerberos?
Answer: SESAME
22. Principles of Information Security, 5th
Edition 6-18
5. Which VPN technology uses leased circuits from a service provider and conducts
packet switching over these leased circuits?
Answer: trusted VPN
Class Discussion Topics
1. Which architecture for deploying a firewall is most commonly used in businesses
today? Why?
2. What are the reasons that VPN technology has become the dominant method for remote
workers to connect to the organizational network?
Additional Projects
1. A hands-on exercise or even a classroom demonstration can go a long way to cementing
the learning objectives of this chapter. A simple SOHO or residential router with NAT
and limited firewall reporting can be brought into the classroom with two or three
portable computers and used to show how a simple NAT firewall approach can be used.
2. If a more elaborate firewall environment is needed, a field trip to your organization’s
main network operations center may be in order.
Additional Resources
1. Virtual Private Network Consortium
http://www.vpnc.org/vpn-standards.html
2. Exposing the Underground: Adventures of an Open Proxy
http://www.secureworks.com/research/articles/proxies
3. Firewall
http://www.pcmag.com/encyclopedia_term/0,2542,t%3Dfirewall&i%3D43218,00.asp
4. ICSA labs IPSec Testing
http://www.icsa.net/technology-program/ipsec
5. Network Policy and Access Services
http://technet.microsoft.com/en-us/network/bb643123.aspx
Key Terms
➢ Access control: the selective method by which systems specify who may use a
particular resource and how they may use it.
➢ Access control list (ACL): a specification of an organization’s information asset, the
users who may access and use it, and their rights and privileges for using the asset.
23. Principles of Information Security, 5th
Edition 6-19
➢ Access control matrix: an integration of access control lists (focusing on assets) and
capability tables (focusing on users) that results in a matrix with organizational assets
listed in the column headings and users listed in the row headings. The matrix contains
ACLs in columns for a particular device or asset and capability tables in rows for a
particular person.
➢ Accountability: the access control mechanism that ensures all actions on a system—
authorized or unauthorized—can be attributed to an authenticated identity. Also known
as auditability.
➢ Address restrictions: firewall rules designed to prohibit packets with certain addresses
or partial addresses from passing through the device.
➢ Application firewall: see application layer firewall.
➢ Application layer firewall: a firewall type capable of performing filtering at the
application layer of the OSI model, most commonly based on the type of service (for
example, HTTP, SMTP, or FTP). Also known as an application firewall. See also proxy
server.
➢ Asynchronous token: an authentication component in the form of a token—a card or
key fob that contains a computer chip and a liquid crystal display and shows a
computer-generated number used to support remote login authentication. This token
does not require calibration of the central authentication server; instead, it uses a
challenge/response system.
➢ Attribute: a characteristic of a subject (user or system) that can be used to restrict
access to an object. Also known as a subject attribute.
➢ Attribute-based access control (ABAC): An access control approach whereby the
organization specifies the use of objects based on some attribute of the user or system.
➢ Auditability: See accountability.
➢ Authentication: the access control mechanism that requires the validation and
verification of a supplicant’s purported identity.
➢ Authentication factors: three mechanisms that provide authentication based on
something a supplicant knows, something a supplicant has, and something a supplicant
is.
➢ Authorization: the access control mechanism that represents the matching of an
authenticated entity to a list of information assets and corresponding access levels.
➢ Bastion host: a firewall implementation strategy in which the device is connected
directly to the untrusted area of the organization’s network rather than being placed in a
screened area. Also known as a sacrificial host.
➢ Biometric access control: An access control approach based on the use of a
measurable human characteristic or trait to authenticate the identity of a proposed
systems user (a supplicant).
➢ Capability table: a specification of an organization’s users, the information assets that
users may access, and their rights and privileges for using the assets. Also known as
user profiles or user policies.
➢ Configuration rules: the instructions a system administrator codes into a server,
networking device, or security device to specify how it operates.
➢ Content filter: a network filter that allows administrators to restrict access to external
content from within a network. Also known as a reverse firewall.
➢ Covert channel: Unauthorized or unintended methods of communications hidden
inside a computer system.
24. Principles of Information Security, 5th
Edition 6-20
➢ Crossover error rate (CER): in biometric access controls, the level at which the
number of false rejections equals the false acceptance. Also known as the equal error
rate.
➢ Demilitarized zone (DMZ): an intermediate area between two networks designed to
provide servers and firewall filtering between a trusted internal network and the outside,
untrusted network. Traffic on the outside network carries a higher level of risk.
➢ Discretionary access controls (DACs): controls that are implemented at the discretion
or option of the data user.
➢ Dumb card: an authentication card that contains digital user data, such as a personal
identification number (PIN), against which user input is compared.
➢ Dynamic filtering: a firewall type that can react to an adverse event and update or
create its configuration rules to deal with that event.
➢ Extranet: a segment of the DMZ where additional authentication and authorization
controls are put into place to provide services that are not available to the general
public.
➢ False accept rate: In biometric access controls, the percentage of identification
instances in which unauthorized users are allowed access. Also known as a Type II
error.
➢ False reject rate: In biometric access controls, the percentage of identification
instances in which authorized users are denied access. Also known as a Type I error.
➢ Firewall: in information security, a combination of hardware and software that filters or
prevents specific information from moving between the outside network and the inside
network. Each organization defines its own firewall.
➢ Hybrid VPN: a combination of trusted and secure VPN implementations.
➢ Identification: the access control mechanism whereby unverified entities or supplicants
who seek access to a resource provide a label by which they are known to the system.
➢ Kerberos: a remote authentication system that uses symmetric key encryption-based
tickets managed in a central database to validate an individual user to various network
resources.
➢ Lattice-based access control (LBAC): an access control approach that uses a matrix or
lattice of subjects (users and systems needing access) and objects (resources) to assign
privileges. LBAC is an example of an NDAC.
➢ MAC layer firewall: a firewall designed to operate at the media access control
sublayer of the network’s data link layer (Layer 2).
➢ Mandatory access control (MAC): an access control approach whereby the
organization specifies use of resources based on the assignment of data classification
schemes to resources and clearance levels to users. MAC is an example of an LBAC
approach.
➢ Minutiae: in biometric access controls, unique points of reference that are digitized and
stored in an encrypted format when the user’s system access credentials are created.
➢ Network Address Translation (NAT): a method of mapping valid external IP
addresses to special ranges of nonroutable internal IP addresses, known as private
addresses, on a one-to-one basis.
➢ Nondiscretionary access controls (NDACs): a strictly enforced version of MACs that
are managed by a central authority in the organization and can be based on an
individual user’s role or a specified set of tasks.
25. Principles of Information Security, 5th
Edition 6-21
➢ Packet-filtering firewall: also referred to as a filtering firewall, a networking device
that examines the header information of data packets that come into a network and
determines whether to drop them (deny) or forward them to the next network
connection (allow), based on its configuration rules.
➢ Passphrase: an authentication component that consists of an expression known only to
the user, from which a virtual password is derived. See also virtual password.
➢ Password: An authentication component that consists of a private word or combination
of characters that only the user should know.
➢ Port Address Translation (PAT): A method of mapping a single valid external IP
address to special ranges of nonroutable internal IP addresses, known as private
addresses, on a one-to-many basis, using port addresses to facilitate the mapping.
➢ Proxy server: a server or firewall device capable of serving as an intermediary by
retrieving information from one network segment and providing it to a requesting user
on another..
➢ Reference monitor: the piece of the system that mediates all access to objects by
subjects.
➢ Remote Authentication Dial-In User Service (RADIUS): A computer connection
system that centralizes the management of user authentication by placing the
responsibility for authenticating each user on a central authentication server.
➢ Reverse firewalls: see content filter.
➢ Reverse proxy: a proxy server that most commonly retrieves information from inside
an organization and provides it to a requesting user or system outside the organization.
➢ Role-based access control (RBAC): an example of a nondiscretionary control where
privileges are tied to the role a user performs in an organization, and are inherited when
a user is assigned to that role. Roles are considered more persistent than tasks. RBAC is
an example of an LDAC.
➢ Sacrificial host: see bastion host.
➢ Screened host firewall: a single firewall or system designed to be externally accessible
and protected by placement behind a filtering firewall.
➢ Screened subnet: an entire network segment that protects externally accessible systems
by placing them in a demilitarized zone behind a filtering firewall and protects the
internal networks by limiting how external connections can gain access to them..
➢ Secure VPN: a VPN implementation that uses security protocols to encrypt traffic
transmitted across unsecured public networks.
➢ Smart card: an authentication component similar to a dumb card that contains a
computer chip to verify and validate several pieces of information instead of just a PIN.
➢ State table: a tabular database of the state and context of each packet in a conversation
between an internal and external user or system. A state table is used to expedite
firewall filtering.
➢ Stateful packet inspection (SPI): a firewall type that keeps track of each network
connection between internal and external systems using a state table and that expedites
the filtering of those communications. Also known as a stateful inspection firewall.
➢ Static filtering: a firewall type that requires the configuration rules to be manually
created, sequenced, and modified within the firewall.
➢ Storage channel: A covert channel that communicates by modifying a stored object.
➢ Strong authentication: in access control, the use of at least two different authentication
mechanisms drawn from two different factors of authentication.
➢ Subject attribute: See attribute.
26. Principles of Information Security, 5th
Edition 6-22
➢ Synchronous token: an authentication component in the form of a token—a card or
key fob that contains a computer chip and a liquid crystal display and shows a
computer-generated number used to support remote login authentication. This token
must be calibrated with the corresponding software on the central authentication server.
➢ Task-based access control (TBAC): an example of a nondiscretionary control where
privileges are tied to a task a user performs in an organization and are inherited when a
user is assigned to that task. Tasks are considered more temporary than roles. TBAC is
an example of an LDAC
➢ Timing channel: a covert channel that transmits information by managing the relative
timing of events.
➢ Trusted computing base (TCB): according to the TCSEC, the combination of all
hardware, firmware, and software responsible for enforcing the security policy.
➢ Trusted network: the system of networks inside the organization that contains its
information assets and is under the organization’s control.
➢ Trusted VPN: also known as a legacy VPN, a VPN implementation that uses leased
circuits from a service provider who gives contractual assurance that no one else is
allowed to use these circuits and that they are properly maintained and protected.
➢ Unified Threat Management (UTM): a security approach that seeks a comprehensive
solution for identifying and responding to network-based threats from a variety of
sources. UTM brings together firewall and IDPS technology with antimalware, load
balancing, content filtering, and data loss prevention. UTM integrates these tools with
management, control, and reporting functions.
➢ Untrusted network: the system of networks outside the organization over which the
organization has not control. The Internet is an example of an untrusted network.
➢ Virtual password: a password composed of a seemingly meaningless series of
characters derived from a passphrase.
➢ Virtual private network (VPN): a private and secure network connection between
systems that uses the data communication capability of an unsecured and public
network.
➢ War dialer: an automatic phone-dialing program that dials every number in a
configured range to determine if one of the numbers belongs to a computer connection
such as a dial-up line.
29. CRITICAL APPENDIX.
Dedication. In 1590 the Dedication runs simply:—‘To the most
mightie and magnificent empresse Elizabeth, by the grace of God
Queene of England, France and Ireland Defender of the Faith &c.
Her most humble Seruant: Ed. Spenser.’ The words ‘and of Virginia’
and ‘to liue with the eternitie of her fame’, added in 1596, give
evidence of the growing importance of the colony and of the
increased self-confidence of the poet.
I. i. Arg. 3. entrappe] entrape 1596. In the matter of double letters I
attach little weight to the evidence of either quarto. I cannot believe
(e.g.) that a scholar like Spenser could have written ‘oportunitie’ (I. ii.
41 l. 7); so with ‘entrape’ here, and ‘mishapen’ at I. vi. 8 l. 7.
I. i. 2 l. 1. But] And 1590. The reading of 1596 brings out finely the
contrast between the ‘jolly’ appearance of the Knight and his
dedicated purpose.
I. i. 5 l. 1. So pure an innocent] and innocent 1590: an Innocent
1609. 1596 makes ‘innocent’ substantive: and so 1609 took it, as the
capital shows.
I. i. 9 l. 6. sweete bleeding] sweet, bleeding 1609. But Morris is
probably right in regarding ‘sweete’ as an adverb to ‘bleeding’.
I. i. 15 l. 6. poisonous] poisnous 1590. 1596 is less shy of trisyllabic
feet than 1590, and both than F. E.; and the second part of F. Q. than
the first. Other trisyllabic feet left full in 1596 but elided or contracted
in 1590 will be found at I. iv. 37 l. 6; II. ix. 17 l. 4; II. x. 34 l. 1; III. viii.
46 l. 9; cf. also III. ix. 48 l. 6. (Per contra III. viii. 49 l. 1; III. xi. 28 l. 8.)
Elisions are proposed by F. E. but ignored by 1596 at I. xii. 32 l. 5, II.
vii. 54 l. 8.
1609 elides vowels left open in the quartos, e.g. at II. ix. 52 l. 9; III. v.
50 l. 8; III. vii. 5 l. I. Cf. also II. viii. 3 l. 8; II. xii. 27 l. 4, for its
avoidance of trisyllabic feet.
30. I. i. 15 l. 7. shapes] Morris reports ‘shape 1596’: not so in Bodl. or B.
M. copies. But ‘shape,’ in 1609.
I. i. 20 l. 4. vildly] vilely 1609. The omission of ‘d’ marks the
seventeenth-century editor.
I. i. 21 l. 5. spring] ebbe 1590 &c.: corr. F. E. to auale] t’auale 1590:
corr. F. E. A good example of the relation of 1596 to F. E. The first
correction is ignored, the second accepted. But the second
correction is obvious, being required by the metre; it must have been
made independently. And this is generally the case when 1596 and
F. E. agree. For the significance of this ignoring of F. E. see
Introduction, p. xvii. Excluding ambiguous instances, I have noted
forty-eight places in which 1596 thus ignores F. E.; fifty-four in which
they agree. But of these fifty-four only six at most are significant, the
rest being obvious corrections. These are I. vi. 26 l. 5; I. vii. 37 l. 8; I.
vii. 43 l. 5; I. vii. 47 l. 3; I. ix. Arg. 2; I. ix. 9 l. 5. Whatever be the
explanation in these instances—and it will be noted that they all
come close together—they do not invalidate the conclusion
maintained in the Introduction, p. xvii, which is based on the negative
instances.
I. i. 31 l. 6. you] thee 1590. The plural pronoun is more courteous
than the singular. There is a similar change of ‘thy’ to ‘your’ in I. ii. 22
l. 5.
I. i. 48 l. 9. with om. 1596, 1609. One of the instances that show how
little use 1609 made of 1590. See further on I. ii. 29 l. 2.
I. ii. 11 ll. 3 and 4. One of several instances in which the punctuation
of 1609 brings out the true meaning or construction. See
Introduction, p. xvii.
I. ii. 27 l. 9. so dainty] so, Dainty 1609. The editor of 1609 wishes to
show that Spenser is quoting the proverb ‘Quae rara, cara’. The
quartos probably intend the same meaning.
I. ii. 29 l. 2. shade him] shade 1596: shadow 1609. On the
significance of this for the relations of 1590 and 1609 see
Introduction, p. xviii. Other instances in which 1609 ignores 1590,
supplying by conjecture a word or syllable that has been omitted in
31. 1596, are I. vi. 26 l. 9 as a tyrans law 1590, as tyrans law 1596, as
proud tyrans law 1609; II. v. 8 l. 7 hurtle 1590, hurle 1596, hurlen
1609; II. vi. 29 l. 2 importune 1590, importance 1596, important
1609; II. x. 51 l. 7 Both in his armes, and crowne 1590, Both in
armes, and crowne 1596, In armes, and eke in crowne 1609; II. xii.
52 l. 9 Or Eden selfe, if ought 1590, Of Eden, if ought 1596, Or
Eden, if that ought 1609; III. iii. 44 l. 5 foure hundreth yeares shalbe
supplide 1590, foure hundreth shalbe supplide 1596, foure hundreth
shall be full supplide 1609; III. vii. 45 l. 1 the good Sir Satyrane gan
wake 1590, good Sir Satyrane gan wake 1596, good Sir Satyrane
gan awake 1609; III. ix. 13 l. 9 And so defide them each 1590, And
defide them each 1596, And them defied each 1609; III. xi. 26 l. 7
and with imperious sway 1590, and imperious sway 1596, and his
imperious sway 1609.
1609 ignores not only the text of 1590, but F. E., in favour of
conjecture, as at II. viii. 25 l. 1 Which those same foes, that stand
hereby 1590, 1596, same corr. to his cruell F. E., Which those same
foes that doen awaite hereby 1609.
I. iii. 32 l. 9. Who told her all that fell in iourney as she went] told,
1609. The meaning wanted is, ‘Who told all that befell her’; and so
1609 takes the line, as its punctuation shows. It is not impossible to
get this meaning out of the line as it stands; but the order is
excessively contorted, and I have suggested ‘all that her fell’.
I. iii. 36 l. 7. morning] mourning 1590. The words are, of course, the
same; and I now prefer 1590, for though Spenser uses ‘morne’ he
would scarcely employ so ambiguous a spelling in the participle.
I. iii. 38 l. 7. the] that F. E. referring probably to this line. As the
references in F. E. are to pages only, it is sometimes impossible to
identify them with certainty when they concern words like ‘the’ and
‘that’. See again on II. xii. 1 l. 6.
I. iii. 41 l. 9. swerd] sword 1609. It is ‘swerd’ in all our copies of 1590,
1596.
I. iv. 16 l. 3. hurtlen] hurlen 1609. 1609 makes the same change at I.
iv. 40 l. 1 and II. v. 8 l. 7, as if ‘hurtle’ were unfamiliar. Yet it has
32. ‘hurtling’ in I. viii. 17, IV. iv. 29; and ‘hurtle’ in II. vii. 42.
I. iv. 23 l. 5. seldome] seeldome 1590, sildom 1609. See
Introduction, p. v.
I. iv. 23 l. 7. dry dropsie. Upton’s conjecture, ‘dire dropsie’ (‘dirus
hydrops’), is worth noticing.
I. v. 7 l. 9. helmets hewen] hewen helmets 1590. This is one of those
slight changes of order, made here for the sake of grammar, but
more often for the sake of rhythm, which reveal the poet’s own hand
in 1596 more conclusively than more conspicuous alterations.
Others are recorded at II. i. 18 l. 6; II. iii. 38 l. 4; II. v. 5 l. 9; II. vi. 3 l.
6; II. vi. 12 l. 9; III. ii. 8 l. 5; III. ii. 30 l. 5; III. iv. 59 l. 5; III. v. 40 l. 4; III.
xi. 4 ll. 4 and 9; III. xi. 22 l. 8.
I. v. 10 l. 6. Doest] Doost 1609 passim. See Introduction, p. v.
I. v. 17 l. 5. can] gan 1590. ‘Can’ (in the sense of ‘did’) and ‘gan’ are
easily confused, and difficult to pronounce between.
I. v. 23 l. 8. Nightes children] Nights drad children 1609. On the
significance of this variant see Introduction, p. xviii. Other instances
in which 1609 fails to recognize syllabic -es are I. x. 34 l. 8; III. vi. 6 l.
5; III. x. 46 l. 6.
I. v. 26 l. 6. am] ame 1590. This is the one eye-rhyme of 1590 that is
generally avoided in 1596. Otherwise, so far as I have compared
them in this respect, there is little or no difference; both are
excessively addicted to eye-rhyme. The current heresy on this
subject is expressed by Puttenham (1589):—‘It is somewhat more
tollerable to help the rime by false orthographie then to leaue an
vnpleasant dissonance to the eare by keeping trewe orthographie
and loosing the rime.’ (The Arte of English Poesie, Bk. II. ch. ix.)
I. v. 38 l. 6. cliffs] clifts 1590 &c.: corr. F. E. There is the same
correction in I. ix. 34 l. 6. Together they suggest that Spenser meant
at first to change ‘clift’ to ‘cliff’ throughout; but found that it would
impair the rhyme, e.g. in I. viii. 22 l. 5.
I. v. 45 l. 4. On the 1609 ‘woundez’ see Introduction, p. xviii.
33. I. vi. 23 l. 8. noursled] nousled 1590. This change is systematically
made in 1596, which uses ‘nousle’ in a different senses = nuzzle; cf.
IV. xi. 32 l. 8. There is the same difference between the first quarto of
S. C. and later quartos.
I. vi. 26 l. 5. fierce and fell] swifte and cruell 1590: corr. F. E. In
Malone 615 these words are on a slip of paper, probably cut (says
Mr. Bliss) from 1596 and pasted over the original copy.
I. vi. 37 l. 9. hath] had Grosart: not so in any of our copies.
I. vi. 47 l. 8. to] two 1596, 1609. Morris assigns ‘two’ to 1611; but it is
in all our copies of 1596 and 1609.
I. vii. 37 l. 7. trample] amble 1590. One of those changes of words
which reveal Spenser’s hand clearly in 1596. A steed so spirited
would not amble.
I. viii. 11 ll. 5-9. Closely imitated in 2 Tamburlaine iv. 3. Cf.
Introduction, p. xi.
I. viii. 21 l. 5. their] his Grosart, adopting a suggestion by Church. But
‘their’ may mean ‘Orgoglio’s and Duessa’s’.
I. viii. 33 l. 5. sits] fits 1596, 1609. But ‘sits’ = sied, as in I. i. 30 l. 9.
I. viii. 44 l. 4. delight] dislike conj. J. Jortin. As ‘delight’ is repeated by
parablepsy from l. 3, the form of the word is not much of a guide in
emendation. Others suggest ‘despight’.
I. ix. 32 l. 7. nor for gold nor glee] nor for gold nor fee conj. Church;
cf. I. x. 43 l. 6. But the alliteration, if not the sense, favours ‘glee’. Cf.
VI. v. 39 l. 3; VI. vii. 49 l. 9.
I. ix. 42 l. 7. Morris reports ‘hold’ as in 1590: not so in any of our
copies.
I. ix. 53 l. 1. feeble] seely 1596: silly 1609. I do not think that Spenser
would have tolerated a combination like ‘seely, fleshly’; and
comparison with I. vii. 6 l. 5 and I. vii. 11 l. 8, where ‘fraile’ and
‘feeble’ occur together in lines which this line was meant to recall,
convinces me that ‘seely’ (= feelie) is a misprint for ‘feeble’.
I. x. 7 l. 8. simple true] simple, trew Morris. But see note on I. i. 9 l. 6.
34. I. x. 20 l. 5. See Introduction, p. xviii.
I. x. 27 l. 6. The correction in 1596 (v. footnote) was apparently made
to avoid the ambiguity of ‘salt water sore’.
I. x. 52 l. 1. since] sith 1609. See Introduction, p. vi.
I. x. 62 l. 9. As for loose loues are vaine] As for loose loues they are
vaine 1590. The reading of 1596 eases the metre, and V. iii. 22 ll. 5
and 6 shows an exactly parallel construction. But the main reason for
preferring 1596 is the proximity of 62 l. 4 and 62 l. 8, which are
certainly author’s corrections. See Introduction, p. xvii.
I. xi. 3. See Introduction, p. xvi.
I. xi. 26 l. 6. swinged] singed 1609. The quartos are right. The form
‘swinge’ is wide-spread in modern dialect. Webster quotes the noun
‘swinge’ (= a singe) from Beaumont and Fletcher.
I. xi. 37 l. 2. yelded] yelled 1609. Though I have hesitated to change
the reading of the quartos, it is probably a misprint. Spenser
elsewhere has ‘yell’. The nearest parallel to ‘yeld’ is ‘befeld’ =
befallen, IV. iii. 50 l. 3. The true reading may, after all, be ‘yelped’.
I. xi. 41 l. 4. Nor 1609: For 1590, 1596. I am no longer sure that
Spenser did not write ‘For’. There is a very similar confusion in V. vi.
26 ll. 5 and 6.
I. xi. 51 ll. 7 and 8. The original punctuation makes l. 8 refer to the
lark.
I. xii. 7 l. 3. sung] song 1590. Here 1596 forgoes the eye-rhyme to
avoid ambiguity.
I. xii. 17 l. 1. that] the 1596, 1609. The change may be Spenser’s,
but cf. 21 l. 7 where ‘the’ of 1596 is probably wrong and occurs in the
same line with a word in which 1596 is certainly wrong.
I. xii. 17 l. 4. note] no’te 1609, 1611. Morris reports ‘no’te 1596’: not
so in Bodl. or B. M. copies.
I. xii. 28 l. 7. her] his 1596, 1609. The change may be Spenser’s.
Having personified truth as Una, he may have felt an objection to
personifying it here. But the misprint is not uncommon: cf. 40 l. 9.
35. I. xii. 34 l. 3. improuided] vnprouided Todd &c.: not so in any of the
copies examined.
I. xii. 38 l. 3. frankincense] frankencense 1596, 1609. The spelling
‘encens’ was not yet quite extinct, and I now incline to think that the
more archaic form was deliberately introduced in 1596. Cf. note on
‘vpsidowne’ at II. vii. 4 l. 8.
II. i. 1 l. 7. caytiues hands] caytiue 1609. ‘Caytiue bands’ has been
conjectured, but perhaps needlessly.
II. i. 18 l. 6. did he] he did 1590. See note on I. v. 7 l. 9. This
transposition seems designed to get another alliteration in ‘d’.
II. i. 34 l. 6. Grosart reports ‘steady 1590’: not so in our copies.
II. i. 58 l. 4. fry] fryze sugg. Church. As a contrast is wanted to ‘melt’
in l. 3, there is much to be said for Church’s ‘fryze’ (i.e. freeze). (The
spelling actually suggested by Church is ‘frieze’, as in II. i. 42 l. 3, or
‘frize’, as in VI. x. 33 l. 9; but neither of these would so readily be
corrupted.)
II. ii. 7 l. 7. chace] pray sugg. Collier. This is the first of those
substitutions discussed in Introduction, p. viii.
II. ii. 21 l. 1. cald] calth 1596, 1609. Changes of tense like this are
not uncommon in 1596, but here ‘calth’ seems an error due to the
following ‘forth’.
II. i. 34 l. 9. thought their] though ther 1590. 1590 seems to be simply
a wrong division of ‘thought her’, which we should perhaps read.
II. ii. 42 l. 6. make] hold conj. edd. See Introduction, p. viii.
II. ii. 44 l. 4. introld] entrold 1590: enrold conj. edd. ‘Enrold’ is more
obvious than convincing: it is typographically improbable, and it
makes poor sense. The problem is complicated by the ambiguous
rhyme with ‘world’ and ‘told’, for which, however, cf. I. xi. 27 ll. 1, 3
‘world’ = ‘extold’. I am not convinced that Spenser did not coin
‘introld’, though I do not know what he meant by it.
II. iii. 4 l. 5. A pleasing vaine of glory vaine did find] A pleasing vaine
of glory he did find 1590. It is natural to regard the second ‘vaine’ as
36. a mere printer’s repetition of the first. But the collocation of ‘glory’
and ‘vaine’ appears in two other descriptions of Braggadocchio, viz.
III. viii. 11 ll. 8 and 9; IV. iv. 14 l. 5. And the play on words is quite
Spenserian; cf. I. iv. 6 l. 6 array ... arras; II. i. 37 l. 9 leaue ... leaue; II.
ii. 12 l. 3 fairely fare.
II. iii. 10 l. 1. On the spelling of Braggadocchio see Introduction, p. vi.
In the second volume of 1596 we find cc in IV. ii. 4; IV. iv. 14; IV. iv.
20; c in IV. iv. 8; IV. iv. 10; IV. v. 23; IV. v. 26; and always in V. iii.
II. iii. 20 l. 5. their haire on end does reare] does vnto them affeare
1590: vnto corr. to greatly F. E. It seems as if Spenser originally
wrote ‘appeare’, forgot this when he made F. E., and in turn forgot F.
E. when he corrected the copy for 1596; or knowingly changed his
mind twice.
II. iii. 28 l. 7. play] sport conj. ed. See Introduction, p. viii. I do not
wish to read ‘sport’ in the text, as the form of the footnote might
imply. This substitution does not seem to have been noticed by
previous editors.
II. iii. 38 l. 4. haue I] I haue 1590. See note on I. v. 7 l. 9.
II. iii. 45 l. 4. one] on 1590, 1596. For the converse misprint cf. II. i.
31 l. 4.
II. iii. 46 l. 9. erne] yerne 1609. These two words are regularly
interchanged in 1609, in accordance with modern usage. Cf. VI. vii.
15 l. 9.
II. iv. 17 ll. 6, 8, 9. A striking instance of author’s correction in 1596.
Spenser seems to have shrunk from the forms ‘trech’, ‘ketch.’
II. iv. 35. This is the stanza quoted by Fraunce in 1588. See
Introduction, p. xi.
II. iv. 41 l. 8. A hexameter in the eighth line. It might be corrected by
omitting ‘is sonne’; but for this there is no authority. See Introduction,
p. vii.
II. v. 5 l. 9. do not much me faile] doe me not much fayl 1590. See
note on I. v. 7 l. 9.
37. II. v. 8 l. 7. hurtle] hurle, 1596; hurlen 1609. See notes on I. ii. 29 l. 2
and I. iv. 16 l. 3.
II. v. 12 ll. 8 and 9. A very difficult passage. The meaning wanted
seems to be, ‘Do not think that it is thy force but the unjust doom of
fortune that has thus laid me low.’ This meaning comes more easily if
we read ‘but’ for ‘by’: a conjecture in which I find that I was
anticipated by a friend of Jortin’s. But no good meaning can be got
out of ‘maugre her spight’ without taking ‘maugre’ in the sense of
‘curse on’, or the like, which it never bears outside F. Q., if there. The
nearest parallels are III. iv. 39 l. 8; III. v. 7 l. 5; VI. iv. 40 l. 3. See
Introduction, p. ix.
II. v. 19 l. 7. do] garre 1590. A very interesting change. Had it been
objected to ‘garre’ that it was peculiar to Northern dialect? I believe
that several changes in 1596 were made to meet such criticisms.
Spenser uses ‘garre’ in S. C., but not elsewhere in F. Q.
II. v. 29 l. 5. pricking] prickling 1590. The quartos differ repeatedly
over this particular letter—cf. II. i. 31 l. 2; II. vi. 18 l. 7; II. xi. 13 l. 5; II.
xii. 30 l. 6 (where 1590 is certainly right). Here usage favours 1596,
but sound 1590.
II. v. 31 l. 5. See note on II. iii. 20 l. 5.
II. vi. 3 l. 4. that nigh her breth was gone,] as merry as Pope Ione,
1590. The earlier reading was apparently thought too colloquial.
II. vi. 3 l. 6. might to her] to her might 1590. See note on I. v. 7 l. 9.
The authenticity of the transposition here is made probable by the
proximity of l. 4.
II. vi. 5 l. 6. cut away. We should perhaps read ‘cut a way’; cf. II. viii.
5 l. 9.
II. vi. 12 l. 9. See note on I. v. 7 l. 9.
II. vi. 14 l. 9. loud] loue 1590. The reading of 1596 is supported by
the proximity of II. vi. 12 l. 9.
II. vi. 18 l. 7. griesly] griesy 1590. On the variants see note on II. v.
29 l. 5. ‘Griesy’ is here explained as ‘sluggish’. But we find griesie’, I.
ix. 35 l. 4 (but ‘griesly’ 1611); ‘grysie’, II. xi. 12 l. 3 and III. xii. 19 l. 2;
38. ‘gryesy’, III. i. 67 l. 7. These are all one word, and the meaning is
always ‘squalid’, ‘hideous’.
II. vi. 29 l. 2. importune] importance 1596: important 1609. See note
on I. ii. 29 l. 2.
II. vi. 42 l. 4. steept] stept 1590 should have been recorded in
footnote.
II. vii. 4 l. 8. vpsidowne] vpside downe 1590. The original form, as I
learn from Sir James Murray, was ‘upsodown’ or ‘upsadown’;
‘upsidown’ became current in the second quarter of the sixteenth
century; ‘upside-down’ appears first in Coverdale. By the last decade
of the century ‘upsodown’ was obsolete, ‘upsidown’ archaic, ‘upside-
down’ or ‘upset-down’ current. There is little doubt that here, as at I.
xii. 38 l. 3, Spenser deliberately returned in 1596 to the more archaic
form.
II. vii. 40 l. 5. that] the 1590 &c.: corr. F. E. F. E. might refer to 43 l. 2.
See note on I. iii. 38 l. 7. The earlier stanza is quoted with ‘the’ in
England’s Parnassus (1600). But the quotation is full of mistakes and
has no authority.
II. vii. 52 l. 6. With which] Which with 1590, 1596: Which-with 1609.
At IV. vii. 25 l. 1 ‘Which’ is ‘With’ in 1596.
II. viii. 3 l. 8. Come hither, come hither] Come hither, hither 1609. But
the trisyllabic foot is probably genuine, and expresses agitation. See
note on I. i. 15 l.
II. viii. 25 l. 1. See note on I. ii. 29 l. 2.
II. viii. 29 l. 7. vpreare] vpheaue MS. corr. in Malone 615. See
Introduction, p. viii. Kitchin speaks of these MS. corrections as ‘co-
temporary’; and a note in the Bodleian catalogue ascribes them to
Lord Burleigh. But most of them are in a hand much later than 1600.
II. viii. 40 l. 4. so wisely as it ought] so well, as he it ought 1590. 1596
means, ‘As wisely as it ought to be used.’ For the construction cf. II.
viii. 32 l. 4; VII. vii. 9 l. 8. But 1590 gives an excellent meaning, ‘As
well as he who owned it’; and it is hard to see why Spenser changed
it. This is one of the few corrections that I suspect of being editorial.
39. Cf. II. x. 49 l. 8. A converse confusion of the two meanings of ‘ought’
is shown by the variants on VI. viii. 50 l. 4.
II. viii. 44 l. 8. no more] not thore 1590. ‘Thore’, if not a misprint (and
it does not look like one), was probably meant for ‘there’, as ‘tho’ =
then, rather than for ‘through’ (‘thorough’). In either case Spenser felt
it licentious.
II. viii. 48 l. 8. Prince Arthur 1609: Sir Guyon 1590, 1596. See
Introduction, p. xviii.
II. ix. 7 ll. 5 and 6. The time is shortened to agree with I. ix. 15. Cf.
also II. ix. 38.
II. ix. 9 l. 1. weete] wote 1590 &c. Not an imperfect rhyme, but a
misprint; for the form is wrong.
II. ix. 17 l. 4. perilous] perlous 1590. See note on I. i. 15 l. 6.
II. ix. 21 l. 1. them] him 1590. It is ‘them’ in England’s Parnassus.
See note on II. vii. 40 l. 5.
II. ix. 35 l. 3. idly] idle 1609 should have been recorded in the
footnote.
II. ix. 38 l. 2. mood] word 1590 &c. Collier credits Drayton with the
emendation (see on 49 l. 4 below); but Morris seems to have first
adopted it. There is a similar misprint of ‘word’ for ‘wood’ in 1590 at
III. xii. 7 l. 8.
II. ix. 38 l. 9. twelue moneths] three years 1590. See note on II. ix. 7
above.
II. ix. 49 l. 4. reason] season Drayton (teste Collier). Collier
professed to have a copy of the 1611 folio that had belonged to
Drayton and had corrections in his hand. On questions of this nature
no weight can be attached to Collier’s unverified statements, and I
am not aware that this statement has been verified. The corrections
with which he credits Drayton are often ingenious, but not more
ingenious than those which he puts forward as his own.
II. ix. 52 l. 9. the house] th’house 1609. See note on I. i. 15 l. 6.
40. II. x. 6 l. 6. safeties sake] safety 1590. 7 l. 7. liued then] liueden
1590. Either of these corrections might be editorial; but by their
proximity they support each other.
II. x. 15 l. 9. munifience] munificence 1590, 1609. Spenser certainly
means ‘fortification’, and has either coined a noun from munify +
ence, or applied ‘munificence’ in this unexampled sense. The
reading ‘munifience’ is found only in 1596.
II. x. 24 l. 9. F. E. shows that Seuith was printed in some copies of
1590. Church, Upton, and Todd all had copies in which the missing
words were supplied.
II. x. 34 l. 1. Riuallo] Riuall’ 1590. See note on I. i. 15 l. 6.
II. x. 43 l. 1. Sisillus] Sifillus 1590 &c. We should perhaps read
Sisilius with Geoffrey of Monmouth (Historia Britonum, Lib. III, § 13:
in § 14 he spells it Sisillius).
II. x. 67 l. 2. Ambrose] Ambrise 1596, 1609. Geoffrey of Monmouth
(Historia Britonum, Lib. VI) supports 1590.
II. x. 49 1. 8. defrayd] did defray 1596, 1609. Here at least the printer
of 1596 is seen to have assumed the editor. He betrays himself by
losing the rhyme-scheme, rhyming line 8 with lines 2, 4, 5, 7 instead
of 6, 9. See note on II. viii. 40 l. 4.
II. x. 51 l. 7. See note on I. ii. 29 l. 2.
II. x. 67 l. 2. Ambrose] Ambrise 1596, 1609. Geoffrey of Monmouth
(Historia Britonum, Lib. VI) supports 1590.
II. xi. 10 l. 2. dessignment] assignment 1590. It is the proximity of the
indubitable author’s correction in 9 l. 9 that decides in favour of
1596.
II. xi. 11 l. 4. dismayd] mismayd conj. Jortin. Jortin’s ‘mismayd’ (i. e.
mismade, miscreated) gives a good meaning, and the misprint is
paralleled at III. ix. 7 l. 3 disdonne 1590, misdonne 1596. Others
think that ‘dismayd’ may bear the same meaning.
II. xi. 13 l. 5. assayled] assayed 1590. See note on II. v. 29 l. 5.
41. II. xi. 21 l. 8. their] there 1609. I should now prefer to read ‘there’ in
all such cases.
II. xii. 1 l. 4. Formerly] ‘Formally’ is a conjecture of my own, and
should have been indicated as such in the footnote. It was
suggested by II. xii. 81 l. 5, where ‘formally’ = secundum artem.
‘Firmëly’ has been proposed; but that is impossible. The text may be
sound.
II. xii. 1 l. 6. Others take F. E. to refer to l. 1. See note on I. iii. 38 l. 7.
II. xii. 23 l. 9. Upton, Todd, &c., keep Monoceros, scanning
‘immeasúrëd’, which is without example. The reading adopted by
Child was originally suggested by Jortin.
II. xii. 27 l. 4. sea the resounding] sea resounding 1609. See note on
I. i. 15 l. 6.
II. xii. 30 l. 6. pleasaunt] peasaunt 1596. See note on II. v. 29 l. 5.
II. xii. 39 l. 8. vpstarting] vpstaring 1590. I. ix. 22 l. 3 and VI. xi. 27 l. 4
favour 1590.
II. xii. 43 l. 5. Nought feard their force] they conj. ed. This correction
gives the desired meaning, ‘They had no fear of force.’ Those who
defend the text take ‘feard’ to mean ‘frightened’, and ‘their’ to refer to
the beasts. (I find that my conjecture has been anticipated by Church
and others.)
II. xii. 52 l. 9. See note on I. ii. 29 l. 2.
III. i. 47 l. 7. which] that 1590. The correction is due to ‘that’ in l. 8.
III. i. 56 l. 8. Basciomani] Bascimano 1590. In Spenser’s day the
correct form was basciamano or basciamani, the latter not being
plural of the former, but an independent formation of verb stem +
plural noun, like Fr. porte-montres. Ordinarily it would be fair to credit
Spenser with a knowledge of the right Italian form. Yet in this place
the Bascimano of 1590 has clearly been corrected: a fresh
corruption in an author’s correction is not highly probable; and I am
accordingly disposed to think that Spenser really coined Basciomani
as a substantival use of the phrase bascio le mani. Cf. the familiar
Spanish bezo los manos.
42. III. ii. 4 l. 1. Guyon] Redcrosse MS. corr. in Malone 615. See
Introduction, p. vii.
III. ii. 8 l. 5. Which I to proue] Which to proue, I 1590. See note on I.
v. 7 l. 9.
III. ii. 30 l. 5. in her warme bed her dight] her in her warme bed
dighte 1590. See note on I. v. 7 l. 9.
III. ii. 49 l. 7. a earthen] an earthen 1609. Spenser may have
intended to pronounce ‘yearthen’. N. E. D. describes the y-form of
‘earth’ as going down to the sixteenth century, though no y-forms are
quoted under ‘earthen’. In Northern dialect, with which Spenser was
familiar, ‘a’ takes the place of ‘an’ even before a vowel. If the quartos
are right, this is another archaism unfamiliar to 1609.
III. iii. 6 l. 1. auisd] aduis’d 1609. See note on IV. ii. 22.
III. iii. 15 l. 3. 1609 makes ‘businesse’ three syllables, and then
seeks to avoid the trisyllabic foot. See note on I. i. 15 l. 6.
III. iii. 44 l. 5. See note on I. ii. 29 l. 2.
III. iii. 50 l. 9. See Introduction, p. xviii.
III. iii. 53 l. 3. Evidently an author’s correction; but the reason for the
change is obscure.
III. iv. 39 l. 9. sith we no more shall meet] till we againe may meet
1590. Spenser has remembered, or been reminded, that Cymoent is
a heathen goddess.
III. iv. 40 l. 6. 1611 modernizes to ‘ielly’d blood’.
III. iv. 59 l. 5. See note on I. v. 7 l. 9.
III. v. Arg. 4. sownd] swound 1609. ‘Sownd’ is one of the rarer
spellings of the multiform ‘swound’, ‘swoune’, &c. At VI. i. 34 l. 2 we
find ‘sound’ (= swound) in both 1596 and 1609.
III. v. 5 l. 5. A] And 1596, 1609. ‘And’, though defensible, is probably
due to ‘And’ in l. 6.
III. v. 37 l. 6. follow] followd 1590 should have been recorded in
footnote.
43. III. v. 40 l. 4. their loues sweet teene] their sweet loues teene 1590.
Spenser transposed, either for rhythm, or to bring out the oxymoron
‘sweet teene’. Cf. note on I. v. 7 l. 9.
III. v. 50 l. 8. To him, and to all] To him and all 1609. See note on I. i.
15 l. 6.
III. V. 51 l. 9. to] it 1611.
III. v. 52 l. 6. The punctuation of the quartos connects ‘admire’ with
‘In gentle Ladies brest’; but this leaves ‘and bounteous race’ without
construction.
III. v. 53 l. 3. Realmes] Reames 1590. So in V. vii. 23 ll. 6, 8, 9
‘realme’ rhymes with ‘extreame’ and ‘dreame’.
III. vi. 6 l. 5. his beames] his hot beames 1609. See on I. v. 23 l. 8
and Introduction, p. xvii.
III. vi. 12 l. 2. The rhyme is imperfect, but I find no authority for
reading ‘aspect’.
III. vi. 26 l. 4. both farre and nere om. 1590. 1596 here completes a
line left imperfect in 1590, which makes it possible than Spenser
may have intended to complete other broken lines, such as II. iii. 26
l. 9; II. viii. 55 l. 9.
III. vi. 39 l. 1. 1611 reads ‘and all’, to avoid the trisyllabic foot. See
note on I. i. 15 l. 6.
III. vi. 40 l. 6. See Introduction, p. viii.
III. vi. 45 l. 4. See Introduction, p. xviii.
III. vii. 5 l. I. the tops] th’tops 1609. See note on I. i. 15 l. 6.
III. vii. 9 l. 3. two] to conj. Hughes. Morris reports ‘to’ from 1596: not
so in copies examined. See also I. vi. 47 l. 8 and note there.
III. vii. 13 l. 6. had] hath 1590. The notes of Todd and Morris imply
that some copies of 1596 also read ‘hath’. If so, it should be adopted
as the better reading.
III. vii. 22 l. 4. Monstrous mishapt] Monstrous, mishapt 1590. Cf. I. i.
9 l. 6; 1. x. 7 l. 8.
44. III. vii. 32 l. 7. muchell] much ill 1611, puzzled by the archaism.
III. vii. 34 l. 2. See Introduction, p. vii.
III. vii. 45 l. I. See note on I. ii. 29 l. 2.
III. vii. 48 l. 4. Spenser has remembered, or been reminded, that
Ollyphant reappears in III. xi.
III. viii. 30 l. 3. frory] frowy 1590, 1596. The reading of 1609 is
established by comparison with III. viii. 35 l. 2. ‘Frowie’ occurs in S.
C. (July III); but it means ‘musty’.
III. viii. 46 l. 9. vnworthy] vnworthy’ 1590. 49 l. 2 T’haue] To haue
1590. See note on I. i. 15 l. 6.
III. ix. 13 l. 9. See note on I. ii. 29 l. 2.
III. ix. 20 l. 9. persant] persent 1609: present 1611.
III. ix. 48 l. 6. to sea] to the sea 1596—perhaps rightly: cf. note on I. i.
15 l. 6.
III. x. 41 l. 7. Morris reports ‘wild forest 1609’: not so in any of the
copies examined.
III. x. 46 l. 6. th’Earthes] the Earthes 1609. See note on I. v. 23 l. 8
and Introduction, p. xviii.
III. xi. 4 ll. 4 and 9. These two transpositions support each other, the
first being made for grammar, the second for rhythm. See note on I.
v. 7 l. 9.
III. xi. 12 l. 1. singultes] singulfes 1590, 1596. This word occurs again
in F. Q. V. vi. 13, Colin Clout 168, Tears of the Muses 232; and in all
four places is spelt with ‘f’ in the original editions. We must suppose,
either that the printers made the same mistake four times, or that
Spenser misspelt a word with whose Latin form he must have been
quite familiar. Neither alternative is acceptable; but I find the second
incredible.
III. xi. 19 l. 9. death] life conj. Jortin. Jortin’s emendation gives the
sense required; yet Spenser was capable of writing ‘death’. Cf.
Introduction, p. ix.
45. III. xi 22 l. 8. See note on I. v. 7 l. 9.
III. xi. 23 l. 2. Inglorious, beastlike 1611, to avoid the trisyllabic foot.
See note on I. i. 15 l. 6.
III. xi. 26 1. 7. See note on I. ii. 29 l. 2.
III. xi. 39 l. 8. Stag conj. Jortin: Hag 1590 &c. In support of Jortin’s
emendation Upton quotes Natalis Comes, Mythologia, iv. 10 ‘Fertur
hic deus [i.e. Apollo] in varias formas ob amores fuisse mutatus, in
leonem, in cervum, in accipitrem’. As the chapter deals with Apollo,
and mentions Hyacinth, Coronis, &c., it is clear that Spenser had
been reading it, and Jortin’s emendation is irresistible. (Spenser
would have written ‘an Hag’, not ‘a Hag’.)
III. xi. 47 l. 9. heauen bright] heauens hight conj. Church. But
identical rhymes are not infrequent in this particular place in a
stanza. Yet the possibility of parablepsy lowers the authority of the
quartos in such cases. The printers would be peculiarly liable to this
error in this place if, in Spenser’s manuscript, the Alexandrine
overflowed into the eighth line of the stanza. (Church spells ‘heuens’,
following 1590).
III. xii. 12 l. 6. wingyheeld] winged heeld 1590. The change seems to
have been made for euphony. See note on I. v. 7 l. 9.
III. xii. 18 l. 8. hony-lady. ‘Hony-laden’ is a tempting suggestion of
Upton’s, and Morris adopts it.
III. xii. 26 l. 7. with that Damozell] by the Damozell 1590. According
to 1596 the Damozell is Amoret, according to 1590 Britomart.
III. xii. 27 l. 3. and bore all away] nothing did remaine 1590. A striking
change, designed to remove the imperfect rhyme. l. 8. It] In 1611.
III. xii. 29 l. 1. wandering] wondering 1611.
III. xii. 34 l. 4. her] him 1590, 1596. Comparison with the variants in
stanza 42 suggests some oblivion in Spenser’s mind of the sex of his
Championess.
III. xii. 43 to 45. On these stanzas see Introduction, p. xvi.
46. IV. ii. 22 l. 7. aduizing] auising 1609. For ‘aduize’ = observe cf. II. ix.
38 l. 3. Similarly we find ‘adward’ 1596, but ‘award’ 1609; conversely
‘dis-auentrous’ 1596, ‘disaduentrous’ 1609. Todd quotes from Sir T.
More, ‘Whoso well aduise her visage, &c.’
IV. iii. 43 l. 5. quite age] quiet-age Morris. Morris’s reading (originally
suggested to Jortin by a friend) is very plausible, though the word
does not occur elsewhere in F. Q.
IV. iv. 1 l. 4. minds] lines 16(11)-12-13. Morris reports ‘liues 1609’:
not so in genuine copies examined. See Bibliographical Note.
IV. iv. 2 l. 3. als] els 1596. I now think that 1596 is right. The
proposition illustrated is twofold:—(1) ‘For enmitie, that of no ill
proceeds, But of occasion, with th’occasion ends’; (2) ‘And
friendship, which a faint affection breeds Without regard of good,
dyes like ill grounded seeds’. Reading ‘As als’ we have two
illustrations of this twofold proposition. Reading ‘As els’ we have an
independent illustration of each of its parts. For ‘As els’ cf. the
second letter to Harvey:—‘For, why a Gods name, may not we, as
else the Greeks, &c.’
IV. iv. 8 l. 2. Ferrau] Ferrat 1596. Called Ferraugh in IV. ii. 4; Ferraù
in Ariosto, O. F. i. 14. Spenser mentions Ferragh as an Irish name in
the ‘Vue’.
IV. iv. 17 l. 4. maiden-headed] satyr-headed conj. Church, referring to
III. vii. 30 l. 6. In the Bodleian copy of Church’s edition is a note by
Mr. G. L. Way, the former owner: ‘Perhaps Maidenheaded Shield
may mean “the shield of him who was one of the Knights of
Maidenhead”—see st. 22.’
IV. iv. 24 l. 1. beamlike] Upton reports that one of his quartos had
‘brauelike’, the other ‘beamlike’.
IV. v. 4 l. 4. Lemno] Lemnos 16(11)-12-13.
IV. v. 5 l. 5; 6 l. 1. According to Upton and Todd some copies of 1596
here err with 1609.
IV. v. 35 l. 4. vnpared] prepared 16(11)-12-13.
IV. v. 40 l. 7. wheresoeuer] whersoere 16(11)-12-13.
47. IV. vi. 24 l. 8. his om. 1609. But see note on I. i. 15 l. 6.
IV. vi. 33 l. 6. ranging] raging 16(11)-12-13.
IV. vi. 46 l. 5. who] whom 16(11)-12-13. Morris reports ‘whom 1609’:
not so in genuine copies examined.
IV. vii. 12 I. l. caytiue] captiue conj. Collier. But Spenser used the adj.
‘caytiue’ in this sense in I. vii. 19 l. 3; I. ix. 11 l. 9.
IV. vii. 32 l. 7. oft] eft conj. Hughes, to improve the rhyme.
IV. viii. 1 l. 9. infixed] infected 16(11)-12-13.
IV. viii. 64 l. 1. this] his 16(11)-12-13. Morris reports ‘his 1609’: not so
in genuine copies examined.
IV. ix. 11 l. 9. The conjecture ‘them’, approved by Church, was
originally made by Hughes.
IV. ix. 17 l 7. bequest] request 16(11)-12-13.
IV. x. 8 l. 8. Upton reports that one of his quartos had ‘his’, the other
‘this’.
IV. x. 23 ll. 2, 8. The words ‘ghesse’ and ‘bee’ are transposed in all
copies examined except 4o Art. Seld. S. 22 in the Bodleian and C.
12. h. 17, 18 in the British Museum. The correction was evidently
made as the sheets went through the press. See Introduction, p. xix.
16(11)-12-13 reads ‘I ghesse’.
IV. x. 27 l. 1. Hyllus 1596: Hylus 1609. Spenser evidently means
Hylas. There was a Hyllus, son of Hercules and Deianeira; but it is
unlikely that Spenser confused the two, for he has Hylas rightly in a
similar context, III. xii. 7.
IV. x. 35 ll. 5, 6.
Else would the waters ouerflow the lands,
And fire deuoure the ayre, and hell them quight.
In this difficult passage two lines of interpretation are offered:—(1)
taking ‘hell’ as sb. and ‘quight’ as vb., ‘And hell requite them,’ i.e.
punish the elements by reducing all to chaos: (2) taking ‘hell’ as vb.
48. Welcome to our website – the ideal destination for book lovers and
knowledge seekers. With a mission to inspire endlessly, we offer a
vast collection of books, ranging from classic literary works to
specialized publications, self-development books, and children's
literature. Each book is a new journey of discovery, expanding
knowledge and enriching the soul of the reade
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
Let us accompany you on the journey of exploring knowledge and
personal growth!
testbankfan.com