Eleventh Hour CISSP, 3rd Edition

Ch. 1 Domain 1: Security Risk Management --
Introduction --
Cornerstone Information Security Concepts --
Confidentiality, Integrity, and Availability --
Identity and Authentication, Authorization, and Accountability --
Nonrepudiation --
Least Privilege and Need to Know --
Subjects and Objects --
Defense in Depth --
Legal and Regulatory Issues --
Compliance With Laws and Regulations --
Major Legal Systems --
Criminal, Civil, and Administrative Law --
Liability --
Due Care and Due Diligence --
Legal Aspects of Investigations --
Computer Crime --
Intellectual Property --
Privacy --
International Cooperation --
Import/Export Restrictions --
Security and Third Parties --
Service Provider Contractual Security --
Procurement --
Vendor Governance --
Acquisitions --
Divestitures --
Ethics --
The (ISC)2® Code of Ethics --
Computer Ethics Institute --
IAB's Ethics and the Internet --
Information Security Governance --
Security Policy and Related Documents Personnel Security --
Access Control Defensive Categories and Types --
Preventive --
Detective --
Corrective --
Recovery --
Deterrent --
Compensating --
Risk Analysis --
Assets --
Threats and Vulnerabilities --
Risk = Threat X Vulnerability --
Impact --
Risk Analysis Matrix --
Calculating Annualized Loss Expectancy --
Total Cost of Ownership --
Return on Investment --
Budget and Metrics --
Risk Choices --
Quantitative and Qualitative Risk Analysis --
The Risk Management Process --
Types of Attackers --
Hackers --
Outsiders --
Insiders --
Bots and BotNets --
Phishers and Spear Phishers --
Summary of Exam Objectives --
Top Five Toughest Questions --
Answers --
Endnotes --
ch. 2 Domain 2: Asset Security --
Introduction --
Classifying Data --
Labels --
Clearance --
Formal Access Approval --
Need to Know --
Sensitive Information/Media Security --
Ownership --
Business or Mission Owners --
Data Owners --
System Owner --
Custodian --
Users Data Controllers and Data Processors --
Data Collection Limitation --
Memory and Remanence --
Data Remanence --
Memory --
Data Destruction --
Overwriting --
Degaussing --
Destruction --
Shredding --
Determining Data Security Controls --
Certification and Accreditation --
Standards and Control Frameworks --
Scoping and Tailoring --
Protecting Data in Motion and Data at Rest --
Summary of Exam Objectives --
Top Five Toughest Questions --
Answers --
Endnotes --
ch. 3 Domain 3: Security Engineering --
Introduction --
Security Models --
Reading Down and Writing Up --
Bell-LaPadula Model --
Lattice-Based Access Controls --
Integrity Models --
Chinese Wall Model --
Access Control Matrix --
Secure System Design Concepts --
Layering --
Abstraction --
Security Domains --
The Ring Model --
Open and Closed Systems --
Secure Hardware Architecture --
The System Unit and Motherboard --
The Computer Bus --
The CPU --
Memory Protection --
Trusted Platform Module Data Execution Prevention and Address Space Layout Randomization --
Secure Operating System and Software Architecture --
The Kernel --
Virtualization and Distributed Computing --
Virtualization --
Cloud Computing --
Grid Computing --
Large-Scale Parallel Data Systems --
Peer-to-Peer Networks --
Thin Clients --
System Vulnerabilities, Threats, and Countermeasures --
Covert Channels --
Backdoors --
Malicious Code (Malware) --
Server-Side Attacks --
Client-Side Attacks --
Web Architecture and Attacks --
Database Security --
Mobile Device Attacks --
Cornerstone Cryptographic Concepts --
Key Terms --
Confidentiality, Integrity, Authentication, and Nonrepudiation --
Confusion, Diffusion, Substitution, and Permutation --
Cryptographic Strength --
Monoalphabetic and Polyalphabetic Ciphers --
Exclusive OR --
Data at Rest and Data in Motion --
Protocol Governance --
Types of Cryptography --
Symmetric Encryption --
Asymmetric Encryption --
Hash Functions Cryptographic Attacks --
Brute Force --
Social Engineering --
Known Plaintext --
Chosen Plaintext and Adaptive Chosen Plaintext --
Chosen Ciphertext and Adaptive Chosen Ciphertext --
Known Key --
Differential Cryptanalysis --
Linear Cryptanalysis --
Side-Channel Attacks --
Implementing Cryptography --
Digital Signatures --
Public Key Infrastructure --
SSL and TLS --
IPsec --
PGP --
S/MIME --
Escrowed Encryption --
Perimeter Defenses --
Fences --
Gates --
Lights --
CCTV --
Locks --
Smart Cards and Magnetic Stripe Cards --
Tailgating/Piggybacking --
Mantraps and Turnstiles --
Contraband Checks --
Motion Detectors and Other Perimeter Alarms --
Doors and Windows --
Walls, Floors, and Ceilings --
Guards --
Dogs --
Site Selection, Design, and Configuration --
Site Selection Issues --
Site Design and Configuration Issues --
System Defenses --
Asset Tracking --
Port Controls --
Environmental Controls --
Electricity --
Heating, Ventilation, and Air Conditioning Heat, Flame, and Smoke Detectors --
Personnel Safety, Training, and Awareness --
ABCDK Fires and Suppression --
Types of Fire Suppression Agents --
Summary of Exam Objectives --
Top Five Toughest Questions --
Answers --
Endnotes --
ch. 4 Domain 4: Communication and Network Security --
Introduction --
Network Architecture and Design --
Fundamental Network Concepts --
The OSI Model --
The TCP/IP Model --
Application-Layer TCP/IP Protocols and Concepts --
LAN Technologies and Protocols --
WAN Technologies and Protocols --
Converged Protocols --
Software-Defined Networks --
Wireless Local-Area Networks --
RFID --
Secure Network Devices and Protocols --
Repeaters and Hubs --
Bridges --
Switches --
Routers --
Firewalls --
Modem --
Secure Communications --
Authentication Protocols and Frameworks --
VPN --
Remote Access --
Summary of Exam Objectives --
Top Five Toughest Questions --
Answers --
Endnote Ch. 5 Domain 5: Identity and Access Management (controlling access and managing identity) --
Introduction --
Authentication Methods --
Type 1 Authentication: Something You Know --
Type 2 Authentication: Something You Have --
Type 3 Authentication: Something You Are --
Someplace You Are --
Access Control Technologies --
Centralized Access Control --
Decentralized Access Control --
Single Sign-On --
User Entitlement, Access Review, and Audit --
Federated Identity Management --
Identity as a Service --
LDAP --
Kerberos --
SESAME --
Access Control Protocols and Frameworks --
Access Control Models --
Discretionary Access Controls --
Mandatory Access Controls --
Nondiscretionary Access Control --
Rule-Based Access Controls --
Content-Dependent and Context-Dependent Access Controls --
Summary of Exam Objectives --
Top Five Toughest Questions --
Answers --
Endnotes --
ch. 6 Domain 6: Security Assessment and Testing --
Introduction --
Assessing Access Control Penetration Testing --
Vulnerability Testing --
Security Audits --
Security Assessments --
Log Reviews --
Software Testing Methods --
Static and Dynamic Testing --
Traceability Matrix --
Synthetic Transactions --
Software Testing Levels --
Fuzzing --
Combinatorial Software Testing --
Misuse Case Testing --
Test Coverage Analysis --
Interface Testing --
Summary of Exam Objectives --
Top Five Toughest Questions --
Answers --
Endnote --
ch. 7 Domain 7: Security Operations --
Introduction --
Administrative Security --
Administrative Personnel Controls --
Forensics --
Forensic Media Analysis --
Network Forensics --
Embedded Device Forensics --
Electronic Discovery (eDiscovery) --
Incident Response Management --
Methodology --
Root-Cause Analysis --
Operational Preventive and Detective Controls --
Intrusion Detection Systems and Intrusion Prevention Systems --
Security Information and Event Management --
Data Loss Prevention --
Endpoint Security Asset Management --
Configuration Management --
Change Management --
Continuity of Operations --
Service Level Agreements --
Fault Tolerance --
BCP and DRP overview and process --
Business Continuity Planning --
Disaster Recovery Planning --
Relationship Between BCP and DRP --
Disasters or Disruptive Events --
The Disaster Recovery Process --
Developing a BCP/DRP --
Project Initiation --
Assessing the Critical State --
Conduct BIA --
Identify Preventive Controls --
Recovery Strategy --
Related Plans --
Call Trees --
Emergency Operations Center --
Backups and Availability --
Hardcopy Data --
Electronic Backups --
DRP Testing, Training, and Awareness --
DRP Testing --
Continued BCP/DRP Maintenance --
Change Management --
BCP/DRP Mistakes --
Specific BCP/DRP Frameworks --
NIST SP 800-34 --
ISO/IEC-27031 --
BS-25999 and ISO 22301 --
BCI --
Summary of Exam Objectives --
Top Five Toughest Questions --
Answers --
Endnotes Ch. 8 Domain 8: Software Development Security --
Introduction --
Programming Concepts --
Machine Code, Source Code, and Assemblers --
Compilers, Interpreters, and Bytecode --
Computer-Aided Software Engineering --
Types of Publicly Released Software --
Application Development Methods --
Waterfall Model --
Sashimi Model --
Agile Software Development --
Spiral --
Rapid Application Development --
SDLC --
Integrated Product Teams --
Software Escrow --
Code Repository Security --
Security of Application Programming Interfaces --
Software Change and Configuration Management --
DevOps --
Databases --
Relational Databases --
Database Normalization --
Database Views --
Database Query Languages --
Hierarchical Databases --
Object-Oriented Databases --
Database Integrity --
Database Replication and Shadowing --
Data Warehousing and Data Mining --
Object-Oriented Programming --
Cornerstone Object-Oriented Programming Concepts --
Object Request Brokers Assessing the Effectiveness of Software Security --
Software Vulnerabilities --
Disclosure --
Software Capability Maturity Model --
Acceptance Testing --
Commercial Off-the-Shelf Software --
Custom-Developed Third-Party Products --
Summary of Exam Objectives --
Top Five Toughest Questions --
Answers --
Endnotes.