Official (ISC)2 Guide to the CISSP Exam ((ISC)2 Press)

zAU1707__A03.pdf......Page 0
Information Security Management......Page 1
Concepts: Availability, Integrity, Confidentiality......Page 3
Information Protection Requirements......Page 8
Information Protection Environment......Page 15
Security Technology and Tools......Page 20
Assurance, Trust, and Confidence Mechanisms......Page 29
Information Protection and Management Services......Page 30
Information Protection Requirements......Page 31
Information Protection Environment......Page 32
Security Technology and Tools......Page 33
Assurance, Trust, and Confidence Mechanisms......Page 38
Information Protection and Management Services......Page 40
Information Protection Requirements......Page 46
Information Protection Environment......Page 47
Security Technology and Tools......Page 48
Information Protection Requirements......Page 54
1.5 Setting the Goal......Page 55
Information Protection Environment......Page 56
1.6 Social Engineering......Page 57
Security Technology and Tools......Page 68
Assurance, Trust, and Confidence Mechanisms......Page 69
Information Protection and Management Services......Page 70
Components......Page 72
Examples......Page 73
1.9 Sample Questions for the CISSP Exam......Page 75
Security Architecture and Models......Page 78
Introduction......Page 79
2.2 Information Protection Environment......Page 80
Platform Architecture......Page 81
)......Page 91
Network Environment......Page 96
Enterprise Architecture......Page 100
Security Models......Page 102
2.3 Security Technology and Tools......Page 113
Network Protection......Page 124
2.4 Assurance, Trust, and Confidence Mechanisms......Page 126
Trusted Computer Security Evaluation Criteria (TCSEC)......Page 128
Information Technology Security Evaluation Criteria (ITSEC)......Page 130
The Common Criteria (CC)......Page 133
Certification and Accreditation......Page 135
2.5 Information Protection and Management Services......Page 136
Summary......Page 137
2.6 Common Body of Knowledge (CBK)......Page 138
2.7 Sample Questions for the CISSP Exam......Page 141
Web Sites......Page 144
Prohibition and Access Controls?......Page 145
3.1 Information Protection Requirements......Page 146
Separation of Duties......Page 147
3.2 Information Protection Environment......Page 148
Confidentiality......Page 149
Ali Baba and the 40 Thieves......Page 161
3.3 Security Technology and Tools......Page 162
History of Passwords......Page 167
Account Lockout Example......Page 169
History: An Attack That Forced the Use of OTP......Page 171
3.4 Assurance, Trust, and Confidence Mechanisms......Page 203
3.5 Information Protection and Management Services......Page 212
3.6 Common Body of Knowledge (CBK)......Page 214
3.7 Sample Questions for the CISSP Exam......Page 217
References......Page 220
Web Sites......Page 221
Introduction......Page 222
The A-I-C Triad......Page 224
4.2 Information Protection Environment......Page 225
Open Source Code and Closed Source Code......Page 226
Software Environment......Page 227
DBMS Architecture......Page 236
Database Interface Languages......Page 244
Data Warehousing......Page 248
Database Vulnerabilities and Threats......Page 252
System Life Cycle and Systems Development......Page 254
System (Software) Development Methods......Page 255
Including Security in a Systems Development Method......Page 262
Programming Languages......Page 270
Assemblers, Compilers, and Interpreters......Page 271
Programming Language and Security......Page 286
Software Protection Mechanisms......Page 287
DBMS Controls......Page 301
4.4 Assurance, Trust, and Confidence Mechanisms......Page 309
Information Auditing......Page 310
Configuration Management......Page 311
4.6 Common Body of Knowledge (CBK)......Page 312
4.7 Sample Questions for the CISSP Exam......Page 315
References......Page 319
Web Sites......Page 321
Introduction......Page 322
5.1 Information Protection Requirements......Page 323
5.2 Information Protection Environment......Page 327
5.3 Security Technology and Tools......Page 337
5.4 Assurance, Trust, and Confidence Mechanisms......Page 354
5.5 Information Protection and Management Services......Page 360
5.6 Common Body of Knowledge (CBK)......Page 363
5.7 Sample Questions for the CISSP Exam......Page 369
References......Page 371
Web sites......Page 372
Introduction......Page 373
The A-I-C Triad......Page 374
Definitions......Page 375
Cryptanalysis and Attacks......Page 385
Import/Export Issues......Page 389
Basic Concepts of Cryptography......Page 392
Encryption Systems......Page 399
Symmetric Key Cryptography Algorithms......Page 404
Asymmetric Key Cryptography Algorithms......Page 410
Message Integrity Controls......Page 419
Digital Signatures and Certificate Authorities......Page 422
Public Key Infrastructure (PKI)......Page 427
Key Management1......Page 430
Distribution......Page 431
Change......Page 432
Modern Key Management......Page 433
Principles of Key Management......Page 435
Components......Page 437
Examples......Page 438
6.7 Sample Questions for the CISSP Exam......Page 440
References......Page 443
Physical Security......Page 444
Introduction......Page 446
The A-I-C Triad......Page 447
7.2 Information Protection Environment......Page 449
Crime Prevention through Environmental Design (CPTED)......Page 450
7.3 Security Technology and Tools......Page 459
Perimeter and Building Grounds Boundary Protection......Page 461
Building Entry Points......Page 476
Inside the Building: Building Floors, Office Suites, Offices......Page 484
Penetration (Intrusion) Detection Systems......Page 491
Maintenance and Service......Page 500
Awareness and Training......Page 501
7.6 Common Body of Knowledge (CBK)......Page 502
Examples......Page 503
7.7 Sample Questions for the CISSP Exam......Page 504
References......Page 507
Web Sites......Page 508
Telecommunications, Network, and Internet Security......Page 509
Data Networks......Page 510
Remote Access Services......Page 544
Network Protocols......Page 545
Network Threats and Attacks......Page 572
8.3 Security Technology and Tools......Page 587
Content Filtering and Inspection......Page 620
Intrusion Detection......Page 621
8.4 Assurance, Trust, and Confidence Mechanisms......Page 644
8.5 Information Protection and Management Services......Page 648
8.6 Common Body of Knowledge (CBK)......Page 649
8.7 Sample Questions for the CISSP Exam......Page 652
References......Page 655
Introduction......Page 657
Defining a Disaster......Page 660
9.1 Information Protection Requirements......Page 661
9.2 Information Protection Environment......Page 662
9.3 Security Technology and Tools......Page 663
Phase I: Project Management and Initiation......Page 664
Phase II: Business Impact Analysis (BIA)......Page 666
Phase III: Recovery Strategies......Page 673
Phase IV: Plan Development and Implementation......Page 685
9.4 Assurance, Trust, and Confidence Mechanisms......Page 692
9.5 Information Protection and Management Services......Page 695
Summary......Page 696
9.6 Common Body of Knowledge (CBK)......Page 697
9.7 Sample Questions for the CISSP Exam......Page 699
References......Page 700
Web Sites......Page 701
Law, Investigations and Ethics......Page 702
Information Protection Requirements......Page 704
Information Protection Environment......Page 706
Privacy......Page 718
Recommended Course of Action......Page 723
Security Technology and Tools......Page 724
Information Protection Requirements......Page 725
Information Protection Environment......Page 726
Security Technology and Tools......Page 727
Information Protection and Management Services......Page 747
Information Protection Requirements......Page 748
Computer Ethics......Page 749
Information Protection Environment......Page 750
Security Technology and Tools......Page 758
Summary......Page 759
10.4 Common Body of Knowledge (CBK)......Page 760
10.5 Sample Questions for the CISSP Exam......Page 762
References......Page 764
Accountability:......Page 765
Administrative Security:......Page 766
Application Layer:......Page 767
Audit:......Page 768
Bit:......Page 769
Browsing:......Page 770
Cache:......Page 771
Chain of Evidence:......Page 772
Cloning:......Page 773
Compromising Emanations:......Page 774
Computer Fraud and Abuse Act PL 99-474:......Page 775
Connectionless:......Page 776
CPU:......Page 777
Data Encryption Standard (DES):......Page 778
Datagram:......Page 779
Denial-of-Service (DoS):......Page 780
Disk Mirroring:......Page 781
Earth Stations:......Page 782
Encryption Algorithm:......Page 783
Expert System:......Page 784
File Transfer Protocol (FTP):......Page 785
Formal Review:......Page 786
Gateway:......Page 787
HDSL:......Page 788
Hypertext:......Page 789
Inheritance:......Page 790
Internet Architecture Board (IAB):......Page 791
ISO 9000:......Page 792
LAN:......Page 793
Least Recently Used (LRU):......Page 794
Megabyte (Mbyte, MB):......Page 795
Mirror Image Backup:......Page 796
Network Access Points (NAPs):......Page 797
OLE:......Page 798
Packet Switching:......Page 799
Physical Layer:......Page 800
Pretty Good Privacy (PGP):......Page 801
Programmable Read-Only Memory (PROM):......Page 802
RAID (Redundant Arrays of Inexpensive Disks):......Page 803
Replication:......Page 804
Scripts:......Page 805
Session:......Page 806
Spoofing:......Page 807
Synchronous Optical NETwork (SONET):......Page 808
Teleprocessing Security:......Page 809
Transaction:......Page 810
User Datagram Protocol (UDP):......Page 811
X.400:......Page 812
XDSL:......Page 813
Annotated Bibliography......Page 814
Information Security Management......Page 817
Applications and Systems Development......Page 818
Cryptography......Page 819
Telecommunications and Networking......Page 820
Law, Investigation and Ethics......Page 821
Domain 1: Information Security Management......Page 822
Domain 2: Security Architecture and Models......Page 826
Domain 3: Access Control Systems and Methodology......Page 830
Domain 4: Applications and Systems Development......Page 835
Domain 5: Operations Security......Page 840
Domain 6: Cryptography......Page 844
Domain 7: Physical Security......Page 849
Domain 8: Telecommunications, Network, and Internet Security......Page 853
Domain 9: Business Continuity Planning (BCP)......Page 858
Domain 10: Law, Investigations, and Ethics......Page 861