(ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide, 9th Edition (Sybex Study Guide)

Cover
Title Page
Copyright Page
Acknowledgments
About the Authors
About the Technical Editors
Contents at a Glance
Contents
Foreword
Introduction
	Overview of the CISSP Exam
	The Elements of This Study Guide
	Interactive Online Learning Environment and TestBank
	Study Guide Exam Objectives
	Objective Map
	Reader Support for This Book
	Assessment Test
	Answers to Assessment Test
Chapter 1 Security Governance Through Principles and Policies
	Security 101
	Understand and Apply Security Concepts
		Confidentiality
		Integrity
		Availability
		DAD, Overprotection, Authenticity, Non-repudiation, and AAA Services
		Protection Mechanisms
	Security Boundaries
	Evaluate and Apply Security Governance Principles
		Third-Party Governance
		Documentation Review
	Manage the Security Function
		Alignment of Security Function to Business Strategy, Goals, Mission, and Objectives
		Organizational Processes
		Organizational Roles and Responsibilities
		Security Control Frameworks
		Due Diligence and Due Care
	Security Policy, Standards, Procedures, and Guidelines
		Security Policies
		Security Standards, Baselines, and Guidelines
		Security Procedures
	Threat Modeling
		Identifying Threats
		Determining and Diagramming Potential Attacks
		Performing Reduction Analysis
		Prioritization and Response
	Supply Chain Risk Management
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 2 Personnel Security and Risk Management Concepts
	Personnel Security Policies and Procedures
		Job Descriptions and Responsibilities
		Candidate Screening and Hiring
		Onboarding: Employment Agreements and Policies
		Employee Oversight
		Offboarding, Transfers, and Termination Processes
		Vendor, Consultant, and Contractor Agreements and Controls
		Compliance Policy Requirements
		Privacy Policy Requirements
	Understand and Apply Risk Management Concepts
		Risk Terminology and Concepts
		Asset Valuation
		Identify Threats and Vulnerabilities
		Risk Assessment/Analysis
		Risk Responses
		Cost vs. Benefit of Security Controls
		Countermeasure Selection and Implementation
		Applicable Types of Controls
		Security Control Assessment
		Monitoring and Measurement
		Risk Reporting and Documentation
		Continuous Improvement
		Risk Frameworks
	Social Engineering
		Social Engineering Principles
		Eliciting Information
		Prepending
		Phishing
		Spear Phishing
		Whaling
		Smishing
		Vishing
		Spam
		Shoulder Surfing
		Invoice Scams
		Hoax
		Impersonation and Masquerading
		Tailgating and Piggybacking
		Dumpster Diving
		Identity Fraud
		Typo Squatting
		Influence Campaigns
	Establish and Maintain a Security Awareness, Education, and Training Program
		Awareness
		Training
		Education
		Improvements
		Effectiveness Evaluation
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 3 Business Continuity Planning
	Planning for Business Continuity
	Project Scope and Planning
		Organizational Review
		BCP Team Selection
		Resource Requirements
		Legal and Regulatory Requirements
	Business Impact Analysis
		Identifying Priorities
		Risk Identification
		Likelihood Assessment
		Impact Analysis
		Resource Prioritization
	Continuity Planning
		Strategy Development
		Provisions and Processes
	Plan Approval and Implementation
		Plan Approval
		Plan Implementation
		Training and Education
		BCP Documentation
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 4 Laws, Regulations, and Compliance
	Categories of Laws
		Criminal Law
		Civil Law
		Administrative Law
	Laws
		Computer Crime
		Intellectual Property (IP)
		Licensing
		Import/Export
		Privacy
	State Privacy Laws
	Compliance
	Contracting and Procurement
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 5 Protecting Security of Assets
	Identifying and Classifying Information and Assets
		Defining Sensitive Data
		Defining Data Classifications
		Defining Asset Classifications
		Understanding Data States
		Determining Compliance Requirements
		Determining Data Security Controls
	Establishing Information and Asset Handling Requirements
		Data Maintenance
		Data Loss Prevention
		Marking Sensitive Data and Assets
		Handling Sensitive Information and Assets
		Data Collection Limitation
		Data Location
		Storing Sensitive Data
		Data Destruction
		Ensuring Appropriate Data and Asset Retention
	Data Protection Methods
		Digital Rights Management
		Cloud Access Security Broker
		Pseudonymization
		Tokenization
		Anonymization
	Understanding Data Roles
		Data Owners
		Asset Owners
		Business/Mission Owners
		Data Processors and Data Controllers
		Data Custodians
		Administrators
		Users and Subjects
	Using Security Baselines
		Comparing Tailoring and Scoping
		Standards Selection
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 6 Cryptography and Symmetric Key Algorithms
	Cryptographic Foundations
		Goals of Cryptography
		Cryptography Concepts
		Cryptographic Mathematics
		Ciphers
	Modern Cryptography
		Cryptographic Keys
		Symmetric Key Algorithms
		Asymmetric Key Algorithms
		Hashing Algorithms
	Symmetric Cryptography
		Cryptographic Modes of Operation
		Data Encryption Standard
		Triple DES
		International Data Encryption Algorithm
		Blowfish
		Skipjack
		Rivest Ciphers
		Advanced Encryption Standard
		CAST
		Comparison of Symmetric Encryption Algorithms
		Symmetric Key Management
	Cryptographic Lifecycle
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 7 PKI and Cryptographic Applications
	Asymmetric Cryptography
		Public and Private Keys
		RSA
		ElGamal
		Elliptic Curve
		Diffie–Hellman Key Exchange
		Quantum Cryptography
	Hash Functions
		SHA
		MD5
		RIPEMD
		Comparison of Hash Algorithm Value Lengths
	Digital Signatures
		HMAC
		Digital Signature Standard
	Public Key Infrastructure
		Certificates
		Certificate Authorities
		Certificate Lifecycle
		Certificate Formats
	Asymmetric Key Management
	Hybrid Cryptography
	Applied Cryptography
		Portable Devices
		Email
		Web Applications
		Steganography and Watermarking
		Networking
		Emerging Applications
	Cryptographic Attacks
		Salting Saves Passwords
		Ultra vs. Enigma
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 8 Principles of Security Models, Design, and Capabilities
	Secure Design Principles
		Objects and Subjects
		Closed and Open Systems
		Secure Defaults
		Fail Securely
		Keep It Simple
		Zero Trust
		Privacy by Design
		Trust but Verify
	Techniques for Ensuring CIA
		Confinement
		Bounds
		Isolation
		Access Controls
		Trust and Assurance
	Understand the Fundamental Concepts of Security Models
		Trusted Computing Base
		State Machine Model
		Information Flow Model
		Noninterference Model
		Take-Grant Model
		Access Control Matrix
		Bell–LaPadula Model
		Biba Model
		Clark–Wilson Model
		Brewer and Nash Model
		Goguen–Meseguer Model
		Sutherland Model
		Graham–Denning Model
		Harrison–Ruzzo–Ullman Model
	Select Controls Based on Systems Security Requirements
		Common Criteria
		Authorization to Operate
	Understand Security Capabilities of Information Systems
		Memory Protection
		Virtualization
		Trusted Platform Module
		Interfaces
		Fault Tolerance
		Encryption/Decryption
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 9 Security Vulnerabilities, Threats, and Countermeasures
	Shared Responsibility
	Assess and Mitigate the Vulnerabilities of Security Architectures, Designs, and Solution Elements
		Hardware
		Firmware
	Client-Based Systems
		Mobile Code
		Local Caches
	Server-Based Systems
		Large-Scale Parallel Data Systems
		Grid Computing
		Peer to Peer
	Industrial Control Systems
	Distributed Systems
	High-Performance Computing (HPC) Systems
	Internet of Things
	Edge and Fog Computing
	Embedded Devices and Cyber-Physical Systems
		Static Systems
		Network-Enabled Devices
		Cyber-Physical Systems
		Elements Related to Embedded and Static Systems
		Security Concerns of Embedded and Static Systems
	Specialized Devices
	Microservices
	Infrastructure as Code
	Virtualized Systems
		Virtual Software
		Virtualized Networking
		Software-Defined Everything
		Virtualization Security Management
	Containerization
	Serverless Architecture
	Mobile Devices
		Mobile Device Security Features
		Mobile Device Deployment Policies
	Essential Security Protection Mechanisms
		Process Isolation
		Hardware Segmentation
		System Security Policy
	Common Security Architecture Flaws and Issues
		Covert Channels
		Attacks Based on Design or Coding Flaws
		Rootkits
		Incremental Attacks
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 10 Physical Security Requirements
	Apply Security Principles to Site and Facility Design
		Secure Facility Plan
		Site Selection
		Facility Design
	Implement Site and Facility Security Controls
		Equipment Failure
		Wiring Closets
		Server Rooms/Data Centers
		Intrusion Detection Systems
		Cameras
		Access Abuses
		Media Storage Facilities
		Evidence Storage
		Restricted and Work Area Security
		Utility Considerations
		Fire Prevention, Detection, and Suppression
	Implement and Manage Physical Security
		Perimeter Security Controls
		Internal Security Controls
		Key Performance Indicators of Physical Security
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 11 Secure Network Architecture and Components
	OSI Model
		History of the OSI Model
		OSI Functionality
		Encapsulation/Deencapsulation
		OSI Layers
	TCP/IP Model
	Analyzing Network Traffic
	Common Application Layer Protocols
		SNMPv3
	Transport Layer Protocols
	Domain Name System
		DNS Poisoning
		Domain Hijacking
	Internet Protocol (IP) Networking
		IPv4 vs. IPv6
		IP Classes
		ICMP
		IGMP
	ARP Concerns
	Secure Communication Protocols
	Implications of Multilayer Protocols
		Converged Protocols
		Voice over Internet Protocol (VoIP)
		Software-Defined Networking
	Microsegmentation
	Wireless Networks
		Securing the SSID
		Wireless Channels
		Conducting a Site Survey
		Wireless Security
		Wi-Fi Protected Setup (WPS)
		Wireless MAC Filter
		Wireless Antenna Management
		Using Captive Portals
		General Wi-Fi Security Procedure
		Wireless Communications
		Wireless Attacks
	Other Communication Protocols
	Cellular Networks
	Content Distribution Networks (CDNs)
	Secure Network Components
		Secure Operation of Hardware
		Common Network Equipment
		Network Access Control
		Firewalls
		Endpoint Security
		Cabling, Topology, and Transmission Media Technology
		Transmission Media
		Network Topologies
		Ethernet
		Sub-Technologies
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 12 Secure Communications and Network Attacks
	Protocol Security Mechanisms
		Authentication Protocols
		Port Security
		Quality of Service (QoS)
	Secure Voice Communications
		Public Switched Telephone Network
		Voice over Internet Protocol (VoIP)
		Vishing and Phreaking
		PBX Fraud and Abuse
	Remote Access Security Management
		Remote Access and Telecommuting Techniques
		Remote Connection Security
		Plan a Remote Access Security Policy
	Multimedia Collaboration
		Remote Meeting
		Instant Messaging and Chat
	Load Balancing
		Virtual IPs and Load Persistence
		Active-Active vs. Active-Passive
	Manage Email Security
		Email Security Goals
		Understand Email Security Issues
		Email Security Solutions
	Virtual Private Network
		Tunneling
		How VPNs Work
		Always-On
		Split Tunnel vs. Full Tunnel
		Common VPN Protocols
	Switching and Virtual LANs
		Switch Eavesdropping
	Network Address Translation
		Are You Using NAT?
		Private IP Addresses
		Stateful NAT
		Automatic Private IP Addressing
	Third-Party Connectivity
	Switching Technologies
		Circuit Switching
		Packet Switching
		Virtual Circuits
	WAN Technologies
	Fiber-Optic Links
	Security Control Characteristics
		Transparency
		Transmission Management Mechanisms
	Prevent or Mitigate Network Attacks
		Eavesdropping
		Modification Attacks
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 13 Managing Identity and Authentication
	Controlling Access to Assets
		Controlling Physical and Logical Access
		The CIA Triad and Access Controls
	Managing Identification and Authentication
		Comparing Subjects and Objects
		Registration, Proofing, and Establishment of Identity
		Authorization and Accountability
		Authentication Factors Overview
		Something You Know
		Something You Have
		Something You Are
		Multifactor Authentication (MFA)
		Two-Factor Authentication with Authenticator Apps
		Passwordless Authentication
		Device Authentication
		Service Authentication
		Mutual Authentication
	Implementing Identity Management
		Single Sign-On
		SSO and Federated Identities
		Credential Management Systems
		Credential Manager Apps
		Scripted Access
		Session Management
	Managing the Identity and Access Provisioning Lifecycle
		Provisioning and Onboarding
		Deprovisioning and Offboarding
		Defining New Roles
		Account Maintenance
		Account Access Review
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 14 Controlling and Monitoring Access
	Comparing Access Control Models
		Comparing Permissions, Rights, and Privileges
		Understanding Authorization Mechanisms
		Defining Requirements with a Security Policy
		Introducing Access Control Models
		Discretionary Access Control
		Nondiscretionary Access Control
	Implementing Authentication Systems
		Implementing SSO on the Internet
		Implementing SSO on Internal Networks
	Understanding Access Control Attacks
		Crackers, Hackers, and Attackers
		Risk Elements
		Common Access Control Attacks
		Core Protection Methods
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 15 Security Assessment and Testing
	Building a Security Assessment and Testing Program
		Security Testing
		Security Assessments
		Security Audits
	Performing Vulnerability Assessments
		Describing Vulnerabilities
		Vulnerability Scans
		Penetration Testing
		Compliance Checks
	Testing Your Software
		Code Review and Testing
		Interface Testing
		Misuse Case Testing
		Test Coverage Analysis
		Website Monitoring
	Implementing Security Management Processes
		Log Reviews
		Account Management
		Disaster Recovery and Business Continuity
		Training and Awareness
		Key Performance and Risk Indicators
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 16 Managing Security Operations
	Apply Foundational Security Operations Concepts
		Need to Know and Least Privilege
		Separation of Duties (SoD) and Responsibilities
		Two-Person Control
		Job Rotation
		Mandatory Vacations
		Privileged Account Management
		Service Level Agreements (SLAs)
	Addressing Personnel Safety and Security
		Duress
		Travel
		Emergency Management
		Security Training and Awareness
	Provision Resources Securely
		Information and Asset Ownership
		Asset Management
	Apply Resource Protection
		Media Management
		Media Protection Techniques
	Managed Services in the Cloud
		Shared Responsibility with Cloud Service Models
		Scalability and Elasticity
	Perform Configuration Management (CM)
		Provisioning
		Baselining
		Using Images for Baselining
		Automation
	Managing Change
		Change Management
		Versioning
		Configuration Documentation
	Managing Patches and Reducing Vulnerabilities
		Systems to Manage
		Patch Management
		Vulnerability Management
		Vulnerability Scans
		Common Vulnerabilities and Exposures
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 17 Preventing and Responding to Incidents
	Conducting Incident Management
		Defining an Incident
		Incident Management Steps
	Implementing Detective and Preventive Measures
		Basic Preventive Measures
		Understanding Attacks
		Intrusion Detection and Prevention Systems
		Specific Preventive Measures
	Logging and Monitoring
		Logging Techniques
		The Role of Monitoring
		Monitoring Techniques
		Log Management
		Egress Monitoring
	Automating Incident Response
		Understanding SOAR
		Machine Learning and AI Tools
		Threat Intelligence
		The Intersection of SOAR, Machine Learning, AI, and Threat Feeds
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 18 Disaster Recovery Planning
	The Nature of Disaster
		Natural Disasters
		Human-Made Disasters
	Understand System Resilience, High Availability, and Fault Tolerance
		Protecting Hard Drives
		Protecting Servers
		Protecting Power Sources
		Trusted Recovery
		Quality of Service
	Recovery Strategy
		Business Unit and Functional Priorities
		Crisis Management
		Emergency Communications
		Workgroup Recovery
		Alternate Processing Sites
		Database Recovery
	Recovery Plan Development
		Emergency Response
		Personnel and Communications
		Assessment
		Backups and Off-site Storage
		Software Escrow Arrangements
		Utilities
		Logistics and Supplies
		Recovery vs. Restoration
	Training, Awareness, and Documentation
	Testing and Maintenance
		Read-Through Test
		Structured Walk-Through
		Simulation Test
		Parallel Test
		Full-Interruption Test
		Lessons Learned
		Maintenance
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 19 Investigations and Ethics
	Investigations
		Investigation Types
		Evidence
		Investigation Process
	Major Categories of Computer Crime
		Military and Intelligence Attacks
		Business Attacks
		Financial Attacks
		Terrorist Attacks
		Grudge Attacks
		Thrill Attacks
		Hacktivists
	Ethics
		Organizational Code of Ethics
		(ISC)2 Code of Ethics
		Ethics and the Internet
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 20 Software Development Security
	Introducing Systems Development Controls
		Software Development
		Systems Development Lifecycle
		Lifecycle Models
		Gantt Charts and PERT
		Change and Configuration Management
		The DevOps Approach
		Application Programming Interfaces
		Software Testing
		Code Repositories
		Service-Level Agreements
		Third-Party Software Acquisition
	Establishing Databases and Data Warehousing
		Database Management System Architecture
		Database Transactions
		Security for Multilevel Databases
		Open Database Connectivity
		NoSQL
	Storage Threats
	Understanding Knowledge-Based Systems
		Expert Systems
		Machine Learning
		Neural Networks
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Chapter 21 Malicious Code and Application Attacks
	Malware
		Sources of Malicious Code
		Viruses
		Logic Bombs
		Trojan Horses
		Worms
		Spyware and Adware
		Ransomware
		Malicious Scripts
		Zero-Day Attacks
	Malware Prevention
		Platforms Vulnerable to Malware
		Antimalware Software
		Integrity Monitoring
		Advanced Threat Protection
	Application Attacks
		Buffer Overflows
		Time of Check to Time of Use
		Backdoors
		Privilege Escalation and Rootkits
	Injection Vulnerabilities
		SQL Injection Attacks
		Code Injection Attacks
		Command Injection Attacks
	Exploiting Authorization Vulnerabilities
		Insecure Direct Object References
		Directory Traversal
		File Inclusion
	Exploiting Web Application Vulnerabilities
		Cross-Site Scripting (XSS)
		Request Forgery
		Session Hijacking
	Application Security Controls
		Input Validation
		Web Application Firewalls
		Database Security
		Code Security
	Secure Coding Practices
		Source Code Comments
		Error Handling
		Hard-Coded Credentials
		Memory Management
	Summary
	Exam Essentials
	Written Lab
	Review Questions
Appendix A Answers to Review Questions
	Chapter 1: Security Governance Through Principles and Policies
	Chapter 2: Personnel Security and Risk Management Concepts
	Chapter 3: Business Continuity Planning
	Chapter 4: Laws, Regulations, and Compliance
	Chapter 5: Protecting Security of Assets
	Chapter 6: Cryptography and Symmetric Key Algorithms
	Chapter 7: PKI and Cryptographic Applications
	Chapter 8: Principles of Security Models, Design, and Capabilities
	Chapter 9: Security Vulnerabilities, Threats, and Countermeasures
	Chapter 10: Physical Security Requirements
	Chapter 11: Secure Network Architecture and Components
	Chapter 12: Secure Communications and Network Attacks
	Chapter 13: Managing Identity and Authentication
	Chapter 14: Controlling and Monitoring Access
	Chapter 15: Security Assessment and Testing
	Chapter 16: Managing Security Operations
	Chapter 17: Preventing and Responding to Incidents
	Chapter 18: Disaster Recovery Planning
	Chapter 19: Investigations and Ethics
	Chapter 20: Software Development Security
	Chapter 21: Malicious Code and Application Attacks
Appendix B Answers to Written Labs
	Chapter 1: Security Governance Through Principles and Policies
	Chapter 2: Personnel Security and Risk Management Concepts
	Chapter 3: Business Continuity Planning
	Chapter 4: Laws, Regulations, and Compliance
	Chapter 5: Protecting Security of Assets
	Chapter 6: Cryptography and Symmetric Key Algorithms
	Chapter 7: PKI and Cryptographic Applications
	Chapter 8: Principles of Security Models, Design, and Capabilities
	Chapter 9: Security Vulnerabilities, Threats, and Countermeasures
	Chapter 10: Physical Security Requirements
	Chapter 11: Secure Network Architecture and Components
	Chapter 12: Secure Communications and Network Attacks
	Chapter 13: Managing Identity and Authentication
	Chapter 14: Controlling and Monitoring Access
	Chapter 15: Security Assessment and Testing
	Chapter 16: Managing Security Operations
	Chapter 17: Preventing and Responding to Incidents
	Chapter 18: Disaster Recovery Planning
	Chapter 19: Investigations and Ethics
	Chapter 20: Software Development Security
	Chapter 21: Malicious Code and Application Attacks
Index
EULA