Official Study Guide

(ISC)2 CISSP® Official Study Guide......Page 2
Acknowledgments......Page 8
About the Authors......Page 10
About the Technical Editors......Page 12
Contents at a Glance......Page 14
Contents......Page 16
Introduction......Page 34
Assessment Test......Page 43
Answers to Assessment Test......Page 50
Chapter 1 Security Governance Through Principles and Policies......Page 54
Understand and Apply Concepts of Confidentiality, Integrity, and Availability......Page 55
Confidentiality......Page 56
Integrity......Page 57
Availability......Page 59
Other Security Concepts......Page 61
Layering......Page 65
Data Hiding......Page 66
Evaluate and Apply Security Governance Principles......Page 67
Alignment of Security Function to Business Strategy, Goals, Mission, and Objectives......Page 68
Organizational Processes......Page 70
Organizational Roles and Responsibilities......Page 76
Security Control Frameworks......Page 78
Security Policies......Page 79
Security Procedures......Page 81
Understand and Apply Threat Modeling Concepts and Methodologies......Page 83
Identifying Threats......Page 84
Determining and Diagramming Potential Attacks......Page 88
Performing Reduction Analysis......Page 89
Prioritization and Response......Page 90
Apply Risk-Based Management Concepts to the Supply Chain......Page 91
Summary......Page 93
Exam Essentials......Page 95
Written Lab......Page 97
Review Questions......Page 98
Chapter 2 Personnel Security and Risk Management Concepts......Page 102
Personnel Security Policies and Procedures......Page 104
Employment Agreements and Policies......Page 108
Onboarding and Termination Processes......Page 110
Compliance Policy Requirements......Page 113
Privacy Policy Requirements......Page 114
Security Governance......Page 115
Understand and Apply Risk Management Concepts......Page 116
Risk Terminology......Page 117
Identify Threats and Vulnerabilities......Page 120
Risk Assessment/Analysis......Page 121
Risk Responses......Page 129
Countermeasure Selection and Implementation......Page 130
Applicable Types of Controls......Page 132
Monitoring and Measurement......Page 134
Asset Valuation and Reporting......Page 135
Risk Frameworks......Page 136
Establish and Maintain a Security Awareness, Education, and Training Program......Page 139
Manage the Security Function......Page 140
Summary......Page 141
Exam Essentials......Page 142
Written Lab......Page 145
Review Questions......Page 146
Chapter 3 Business Continuity Planning......Page 150
Planning for Business Continuity......Page 151
Project Scope and Planning......Page 152
Business Organization Analysis......Page 153
BCP Team Selection......Page 154
Resource Requirements......Page 156
Legal and Regulatory Requirements......Page 157
Business Impact Assessment......Page 158
Identify Priorities......Page 159
Risk Identification......Page 160
Likelihood Assessment......Page 161
Impact Assessment......Page 163
Continuity Planning......Page 164
Provisions and Processes......Page 165
Plan Implementation......Page 167
BCP Documentation......Page 168
Exam Essentials......Page 172
Written Lab......Page 173
Review Questions......Page 174
Chapter 4 Laws, Regulations, and Compliance......Page 178
Criminal Law......Page 179
Administrative Law......Page 181
Computer Crime......Page 182
Intellectual Property......Page 187
Licensing......Page 192
Import/Export......Page 193
Privacy......Page 194
Compliance......Page 202
Contracting and Procurement......Page 203
Summary......Page 204
Exam Essentials......Page 205
Written Lab......Page 206
Review Questions......Page 207
Chapter 5 Protecting Security of Assets......Page 212
Defining Sensitive Data......Page 213
Defining Data Classifications......Page 215
Determining Data Security Controls......Page 218
Understanding Data States......Page 221
Handling Information and Assets......Page 222
Data Protection Methods......Page 229
Determining Ownership......Page 231
Asset Owners......Page 232
Business/Mission Owners......Page 233
Data Processors......Page 234
Custodians......Page 237
Protecting Privacy......Page 238
Using Security Baselines......Page 239
Summary......Page 240
Exam Essentials......Page 241
Written Lab......Page 242
Review Questions......Page 243
Chapter 6 Cryptography and Symmetric Key Algorithms......Page 248
Caesar Cipher......Page 249
American Civil War......Page 250
Goals of Cryptography......Page 251
Cryptography Concepts......Page 253
Cryptographic Mathematics......Page 255
Ciphers......Page 260
Cryptographic Keys......Page 267
Symmetric Key Algorithms......Page 268
Asymmetric Key Algorithms......Page 269
Symmetric Cryptography......Page 272
Data Encryption Standard......Page 273
Triple DES......Page 275
Skipjack......Page 276
Advanced Encryption Standard......Page 277
Symmetric Key Management......Page 279
Cryptographic Lifecycle......Page 281
Exam Essentials......Page 282
Written Lab......Page 284
Review Questions......Page 285
Chapter 7 PKI and Cryptographic Applications......Page 290
Public and Private Keys......Page 291
RSA......Page 292
El Gamal......Page 294
Hash Functions......Page 295
MD2......Page 297
MD5......Page 298
Digital Signatures......Page 299
HMAC......Page 300
Digital Signature Standard......Page 301
Certificates......Page 302
Certificate Authorities......Page 303
Certificate Generation and Destruction......Page 304
Asymmetric Key Management......Page 306
Portable Devices......Page 307
Email......Page 308
Web Applications......Page 309
Digital Rights Management......Page 312
Networking......Page 315
Cryptographic Attacks......Page 318
Summary......Page 321
Exam Essentials......Page 322
Written Lab......Page 323
Review Questions......Page 324
Chapter 8 Principles of Security Models, Design, and Capabilities......Page 328
Implement and Manage Engineering Processes Using Secure Design Principles......Page 329
Closed and Open Systems......Page 330
Techniques for Ensuring Confidentiality, Integrity, and Availability......Page 332
Controls......Page 333
Understand the Fundamental Concepts of Security Models......Page 334
Trusted Computing Base......Page 335
State Machine Model......Page 337
Noninterference Model......Page 338
Access Control Matrix......Page 339
Bell-LaPadula Model......Page 341
Biba Model......Page 343
Clark-Wilson Model......Page 345
Brewer and Nash Model (aka Chinese Wall)......Page 346
Graham-Denning Model......Page 347
Select Controls Based On Systems Security Requirements......Page 348
Rainbow Series......Page 349
ITSEC Classes and Required Assurance and Functionality......Page 354
Common Criteria......Page 355
Industry and International Security Implementation Guidelines......Page 358
Certification and Accreditation......Page 359
Memory Protection......Page 362
Trusted Platform Module......Page 363
Summary......Page 364
Exam Essentials......Page 365
Written Lab......Page 366
Review Questions......Page 367
Chapter 9 Security Vulnerabilities, Threats, and Countermeasures......Page 372
Assess and Mitigate Security Vulnerabilities......Page 373
Hardware......Page 374
Firmware......Page 394
Applets......Page 395
Local Caches......Page 397
Server-Based Systems......Page 399
Aggregation......Page 400
Data Mining and Data Warehousing......Page 401
Data Analytics......Page 402
Distributed Systems and Endpoint Security......Page 403
Cloud-Based Systems and Cloud Computing......Page 406
Grid Computing......Page 410
Internet of Things......Page 411
Industrial Control Systems......Page 412
Assess and Mitigate Vulnerabilities in Web-Based Systems......Page 413
Assess and Mitigate Vulnerabilities in Mobile Systems......Page 418
Device Security......Page 419
Application Security......Page 423
BYOD Concerns......Page 425
Assess and Mitigate Vulnerabilities in Embedded Devices and Cyber-Physical Systems......Page 428
Examples of Embedded and Static Systems......Page 429
Methods of Securing Embedded and Static Systems......Page 430
Essential Security Protection Mechanisms......Page 432
Technical Mechanisms......Page 433
Policy Mechanisms......Page 436
Common Architecture Flaws and Security Issues......Page 437
Attacks Based on Design or Coding Flaws and Security Issues......Page 438
Programming......Page 441
Electromagnetic Radiation......Page 442
Summary......Page 443
Exam Essentials......Page 444
Written Lab......Page 447
Review Questions......Page 448
Chapter 10 Physical Security Requirements......Page 452
Apply Security Principles to Site and Facility Design......Page 453
Site Selection......Page 454
Facility Design......Page 455
Implement Site and Facility Security Controls......Page 456
Equipment Failure......Page 457
Wiring Closets......Page 458
Server Rooms/Data Centers......Page 460
Media Storage Facilities......Page 465
Restricted and Work Area Security......Page 466
Utilities and HVAC Considerations......Page 467
Fire Prevention, Detection, and Suppression......Page 470
Perimeter Security Controls......Page 475
Internal Security Controls......Page 478
Summary......Page 484
Exam Essentials......Page 485
Written Lab......Page 487
Review Questions......Page 488
Chapter 11 Secure Network Architecture and Securing Network Components......Page 492
OSI Model......Page 493
OSI Functionality......Page 494
Encapsulation/Deencapsulation......Page 495
OSI Layers......Page 497
TCP/IP Model......Page 504
TCP/IP Protocol Suite Overview......Page 505
Converged Protocols......Page 523
Wireless Networks......Page 525
Securing Wireless Access Points......Page 526
Securing the SSID......Page 528
Using Secure Encryption Protocols......Page 529
Determining Antenna Placement......Page 532
Adjusting Power Level Controls......Page 533
General Wi-Fi Security Procedure......Page 534
Wireless Attacks......Page 535
Secure Network Components......Page 539
Firewalls......Page 540
Endpoint Security......Page 544
Secure Operation of Hardware......Page 545
Cabling, Wireless, Topology, Communications, and Transmission Media Technology......Page 548
Transmission Media......Page 549
Network Topologies......Page 553
Wireless Communications and Security......Page 556
LAN Technologies......Page 562
Summary......Page 566
Exam Essentials......Page 567
Written Lab......Page 569
Review Questions......Page 570
Chapter 12 Secure Communications and Network Attacks......Page 574
Network and Protocol Security Mechanisms......Page 575
Secure Communications Protocols......Page 576
Authentication Protocols......Page 577
Voice over Internet Protocol (VoIP)......Page 578
Social Engineering......Page 579
Fraud and Abuse......Page 580
Remote Meeting......Page 582
Manage Email Security......Page 583
Email Security Goals......Page 584
Understand Email Security Issues......Page 585
Email Security Solutions......Page 586
Remote Access Security Management......Page 589
Plan Remote Access Security......Page 591
Dial-Up Protocols......Page 592
Virtual Private Network......Page 593
Tunneling......Page 594
How VPNs Work......Page 595
Common VPN Protocols......Page 596
Virtual LAN......Page 598
Virtualization......Page 599
Virtual Software......Page 600
Virtual Networking......Page 601
Network Address Translation......Page 602
Private IP Addresses......Page 603
Stateful NAT......Page 604
Automatic Private IP Addressing......Page 605
Switching Technologies......Page 606
Packet Switching......Page 607
Virtual Circuits......Page 608
WAN Technologies......Page 609
WAN Connection Technologies......Page 611
Transparency......Page 614
Transmission Mechanisms......Page 615
Security Boundaries......Page 616
DoS and DDoS......Page 617
Eavesdropping......Page 618
Impersonation/Masquerading......Page 619
Address Resolution Protocol Spoofing......Page 620
Hyperlink Spoofing......Page 621
Summary......Page 622
Exam Essentials......Page 624
Written Lab......Page 626
Review Questions......Page 627
Chapter 13 Managing Identity and Authentication......Page 632
Controlling Access to Assets......Page 633
The CIA Triad and Access Controls......Page 634
Types of Access Control......Page 635
Comparing Identification and Authentication......Page 637
Registration and Proofing of Identity......Page 638
Authorization and Accountability......Page 639
Authentication Factors......Page 640
Passwords......Page 641
Smartcards and Tokens......Page 645
Biometrics......Page 648
Multifactor Authentication......Page 652
Device Authentication......Page 653
Service Authentication......Page 654
Single Sign-On......Page 655
Credential Management Systems......Page 660
Managing Sessions......Page 661
AAA Protocols......Page 662
Provisioning......Page 664
Account Review......Page 665
Account Revocation......Page 666
Summary......Page 667
Exam Essentials......Page 668
Written Lab......Page 670
Review Questions......Page 671
Chapter 14 Controlling and Monitoring Access......Page 676
Comparing Permissions, Rights, and Privileges......Page 677
Understanding Authorization Mechanisms......Page 678
Defining Requirements with a Security Policy......Page 679
Implementing Defense in Depth......Page 680
Summarizing Access Control Models......Page 681
Discretionary Access Controls......Page 682
Nondiscretionary Access Controls......Page 683
Understanding Access Control Attacks......Page 688
Risk Elements......Page 689
Identifying Assets......Page 690
Identifying Threats......Page 691
Identifying Vulnerabilities......Page 693
Common Access Control Attacks......Page 694
Summary of Protection Methods......Page 705
Summary......Page 706
Exam Essentials......Page 707
Written Lab......Page 709
Review Questions......Page 710
Chapter 15 Security Assessment and Testing......Page 714
Security Testing......Page 715
Security Assessments......Page 717
Security Audits......Page 718
Vulnerability Scans......Page 721
Penetration Testing......Page 732
Testing Your Software......Page 734
Code Review and Testing......Page 735
Test Coverage Analysis......Page 739
Website Monitoring......Page 740
Log Reviews......Page 741
Backup Verification......Page 742
Summary......Page 743
Exam Essentials......Page 744
Written Lab......Page 745
Review Questions......Page 746
Chapter 16 Managing Security Operations......Page 750
Need-to-Know and Least Privilege......Page 751
Separation of Duties and Responsibilities......Page 753
Mandatory Vacations......Page 756
Privileged Account Management......Page 757
Managing the Information Lifecycle......Page 759
Service-Level Agreements......Page 760
Addressing Personnel Safety and Security......Page 761
Managing Hardware and Software Assets......Page 763
Protecting Physical Assets......Page 764
Managing Virtual Assets......Page 765
Managing Cloud-Based Assets......Page 766
Media Management......Page 767
Using Images for Baselining......Page 771
Managing Change......Page 772
Security Impact Analysis......Page 774
Versioning......Page 775
Systems to Manage......Page 776
Patch Management......Page 777
Vulnerability Management......Page 778
Summary......Page 781
Exam Essentials......Page 782
Written Lab......Page 784
Review Questions......Page 785
Chapter 17 Preventing and Responding to Incidents......Page 790
Defining an Incident......Page 791
Incident Response Steps......Page 792
Basic Preventive Measures......Page 798
Understanding Attacks......Page 799
Intrusion Detection and Prevention Systems......Page 809
Specific Preventive Measures......Page 816
Logging and Monitoring......Page 826
Egress Monitoring......Page 834
Auditing to Assess Effectiveness......Page 836
Security Audits and Reviews......Page 840
Reporting Audit Results......Page 841
Summary......Page 843
Exam Essentials......Page 845
Written Lab......Page 848
Review Questions......Page 849
Chapter 18 Disaster Recovery Planning......Page 854
The Nature of Disaster......Page 855
Natural Disasters......Page 856
Man-Made Disasters......Page 860
Understand System Resilience and Fault Tolerance......Page 865
Protecting Hard Drives......Page 866
Protecting Servers......Page 867
Protecting Power Sources......Page 868
Trusted Recovery......Page 869
Quality of Service......Page 870
Business Unit and Functional Priorities......Page 871
Crisis Management......Page 872
Alternate Processing Sites......Page 873
Database Recovery......Page 878
Recovery Plan Development......Page 880
Personnel and Communications......Page 881
Backups and Offsite Storage......Page 882
External Communications......Page 886
Recovery vs. Restoration......Page 887
Training, Awareness, and Documentation......Page 888
Read-Through Test......Page 889
Maintenance......Page 890
Exam Essentials......Page 891
Written Lab......Page 892
Review Questions......Page 893
Chapter 19 Investigations and Ethics......Page 898
Investigation Types......Page 899
Evidence......Page 902
Investigation Process......Page 906
Military and Intelligence Attacks......Page 910
Business Attacks......Page 911
Grudge Attacks......Page 912
Ethics......Page 914
Ethics and the Internet......Page 915
Exam Essentials......Page 917
Written Lab......Page 918
Review Questions......Page 919
Chapter 20 Software Development Security......Page 924
Software Development......Page 925
Systems Development Lifecycle......Page 931
Lifecycle Models......Page 934
Gantt Charts and PERT......Page 940
Change and Configuration Management......Page 941
The DevOps Approach......Page 942
Application Programming Interfaces......Page 943
Software Testing......Page 944
Code Repositories......Page 946
Software Acquisition......Page 947
Establishing Databases and Data Warehousing......Page 948
Database Management System Architecture......Page 949
Database Transactions......Page 952
Security for Multilevel Databases......Page 954
Open Database Connectivity......Page 956
Storing Data and Information......Page 957
Storage Threats......Page 958
Understanding Knowledge-Based Systems......Page 959
Expert Systems......Page 960
Neural Networks......Page 961
Exam Essentials......Page 962
Written Lab......Page 963
Review Questions......Page 964
Chapter 21 Malicious Code and Application Attacks......Page 968
Sources of Malicious Code......Page 969
Viruses......Page 970
Logic Bombs......Page 976
Trojan Horses......Page 977
Worms......Page 978
Zero-Day Attacks......Page 981
Password Guessing......Page 982
Dictionary Attacks......Page 983
Social Engineering......Page 984
Countermeasures......Page 985
Buffer Overflows......Page 986
Back Doors......Page 987
Cross-Site Scripting......Page 988
Cross-Site Request Forgery......Page 989
SQL Injection......Page 990
Port Scans......Page 993
Masquerading Attacks......Page 994
Summary......Page 995
Exam Essentials......Page 996
Written Lab......Page 997
Review Questions......Page 998
Appendix A Answers to Review Questions......Page 1002
Chapter 1: Security Governance Through Principles and Policies......Page 1003
Chapter 2: Personnel Security and Risk Management Concepts......Page 1004
Chapter 3: Business Continuity Planning......Page 1005
Chapter 4: Laws, Regulations, and Compliance......Page 1007
Chapter 5: Protecting Security of Assets......Page 1009
Chapter 6: Cryptography and Symmetric Key Algorithms......Page 1011
Chapter 7: PKI and Cryptographic Applications......Page 1013
Chapter 8: Principles of Security Models, Design, and Capabilities......Page 1014
Chapter 9: Security Vulnerabilities, Threats, and Countermeasures......Page 1016
Chapter 10: Physical Security Requirements......Page 1018
Chapter 11: Secure Network Architecture and Securing Network Components......Page 1019
Chapter 12: Secure Communications and Network Attacks......Page 1021
Chapter 13: Managing Identity and Authentication......Page 1022
Chapter 14: Controlling and Monitoring Access......Page 1024
Chapter 15: Security Assessment and Testing......Page 1026
Chapter 16: Managing Security Operations......Page 1028
Chapter 17: Preventing and Responding to Incidents......Page 1030
Chapter 18: Disaster Recovery Planning......Page 1033
Chapter 19: Investigations and Ethics......Page 1034
Chapter 20: Software Development Security......Page 1036
Chapter 21: Malicious Code and Application Attacks......Page 1037
Appendix B Answers to Written Labs......Page 1040
Chapter 2: Personnel Security and Risk Management Concepts......Page 1041
Chapter 3: Business Continuity Planning......Page 1042
Chapter 4: Laws, Regulations, and Compliance......Page 1043
Chapter 6: Cryptography and Symmetric Key Algorithms......Page 1044
Chapter 8: Principles of Security Models, Design, and Capabilities......Page 1045
Chapter 9: Security Vulnerabilities, Threats, and Countermeasures......Page 1046
Chapter 11: Secure Network Architecture and Securing Network Components......Page 1047
Chapter 12: Secure Communications and Network Attacks......Page 1048
Chapter 14: Controlling and Monitoring Access......Page 1049
Chapter 16: Managing Security Operations......Page 1050
Chapter 17: Preventing and Responding to Incidents......Page 1051
Chapter 19: Investigations and Ethics......Page 1052
Chapter 21: Malicious Code and Application Attacks......Page 1053
Index......Page 1054
EULA......Page 0