CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide

1561 Pages·2016·7.23 MB·English

by  James M. Stewart

®
CISSP
Certified Information Systems
Security Professional Study Guide
Seventh Edition
James Michael Stewart
Mike Chapple
Darril Gibson
2
3
Development Editor: Alexa Murphy Book Designers: Judy Fung and Bill
Gibson
Technical Editors: David Seidl, Brian Proofreaders: Josh Chase, Sarah
O'Hara, Paul Calatayud Kaikini and Louise
Watson, Word One New York
Production Editor: Rebecca Anderson
Copy Editors: Elizabeth Welch, Linda Indexer: J & J Indexing
Recktenwald
Editorial Manager: Mary Beth Wakefield Project Coordinator, Cover: Brent
Savage
Production Manager: Kathleen Wisor Cover Designer: Wiley
Associate Publisher: Jim Minatel Cover Image: ©Getty Images
Inc./Jeremy Woodhouse
Media Supervising Producer: Richard Graves
Copyright © 2015 by John Wiley & Sons, Inc., Indianapolis, Indiana
Published simultaneously in Canada
ISBN: 978-1-119-04271-6
ISBN: 978-1-119-04272-3 (ebk.)
ISBN: 978-1-119-04275-4 (ebk.)
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any
form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise,
except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without
either the prior written permission of the Publisher, or authorization through payment of the
appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA
01923, [phone], fax [phone]. Requests to the Publisher for permission should be
addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ
07030, [phone], fax [phone], or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations
or warranties with respect to the accuracy or completeness of the contents of this work and
specifically disclaim all warranties, including without limitation warranties of fitness for a
particular purpose. No warranty may be created or extended by sales or promotional materials.
The advice and strategies contained herein may not be suitable for every situation. This work is
sold with the understanding that the publisher is not engaged in rendering legal, accounting, or
other professional services. If professional assistance is required, the services of a competent
professional person should be sought. Neither the publisher nor the author shall be liable for
damages arising herefrom. The fact that an organization or Web site is referred to in this work as a
citation and/or a potential source of further information does not mean that the author or the
publisher endorses the information the organization or Web site may provide or recommendations
4
it may make. Further, readers should be aware that Internet Web sites listed in this work may
have changed or disappeared between when this work was written and when it is read.
For general information on our other products and services or to obtain technical support, please
contact our Customer Care Department within the U.S. at [phone], outside the U.S. at
[phone] or fax [phone].
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some
material included with standard print versions of this book may not be included in e-books or in
print-on-demand. If this book refers to media such as a CD or DVD that is not included in the
version you purchased, you may download this material at http://booksupport.wiley.com For more
information about Wiley products, visit www.wiley.com.
Library of Congress Control Number: 2015948797
TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered
trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other
countries, and may not be used without written permission. CISSP is a registered certification
mark of (ISC)², Inc. All other trademarks are the property of their respective owners. John Wiley
& Sons, Inc. is not associated with any product or vendor mentioned in this book.
2
Disclaimer: John Wiley and Sons, Inc., in association with (ISC) , has prepared this study guide
2 ® ®
for general information and for use as training for the Official (ISC) CISSP CBK and not as
legal or operational advice. This is a study guide only, and does not imply that any questions or
2 ®
topics from this study guide will appear on the actual (ISC) CISSP certification examination.
2
The study guide was not prepared with writers or editors associated with developing the (ISC)
2
CISSP certification examination. The study guide may contain errors and omissions. (ISC) does
not guarantee a passing score on the exam or provide any assurance or guarantee relating to the
2 ®
use of this study guide and preparing for the (ISC) CISSP certification examination.
The users of the Official CISSP: Certified Information Systems Security Professional Study Guide,
2
Seventh Edition agree that John Wiley and Sons, Inc.. and (ISC) are not liable for any indirect,
special, incidental, or consequential damages up to and including negligence that may arise from
use of these materials. Under no circumstances, including negligence, shall John Wiley and Sons,
2
Inc.or (ISC) , its officers, directors, agents, author or anyone else involved in creating, producing
or distributing these materials be liable for any direct, indirect, incidental, special or consequential
damages that may result from the use of this study guide.
5
Whenever we look toward the future, we have to first look back and think
2
about where we came from. Back in 1989, (ISC) was established by a
handful of passionate volunteers who wanted to create a set of standards
for a new concept, not yet a full-fledged career field, called information
security. In the minds of those volunteers, having the initial 500
applicants sign up to take the Certified Information Systems Security
®
Professional (CISSP ) exam was considered quite a success. Little did
they imagine that 26 years later, not only would those 500 applicants
grow to a cadre of 100,000 CISSP credential holders across more than
160 countries, the CISSP would also become recognized as the standard
certification for the information security industry.
Advancements in technology bring about the need for updates, and we
work tirelessly to ensure that our content is always relevant to the
industry. As the information security industry continues to transition,
and cybersecurity becomes a global focus, the CISSP Common Body of
Knowledge (CBK) is even more relevant to today's challenges.
The new (ISC)² CISSP Study Guide is part of a concerted effort to
enhance and increase our education and training offerings. The CISSP
Study Guide reflects the most relevant topics in our ever-changing field
and is a learning tool for (ISC)² certification exam candidates. It provides
a comprehensive study guide to the eight CISSP domains and the most
current topics in the industry.
If you are on the path to getting certified, you have no doubt heard of the
2
(ISC) Official Guides to the CBK. While our Official Guides to the CBK
are the authoritative references to the Common Body of Knowledge, the
6
new study guides are learning tools focused on educating the reader in
preparation for exams. As an ANSI accredited certification body under
the ISO/IEC 17024 standard, (ISC)² does not teach the CISSP exam.
Rather, we strive to generate or endorse content that teaches the CISSP's
CBK. Candidates who have a strong understanding of the CBK are best
prepared for success with the exam and within the profession.
2
(ISC) is also breaking new ground by partnering with Wiley, a
recognized industry leading brand. Developing a partnership with
2
renowned content provider Wiley allows (ISC) to grow its offerings on
the scale required to keep our content fresh and aligned with the
constantly changing environment. The power of combining the expertise
of our two organizations benefits certification candidates and the
industry alike.
2
I look forward to your feedback on the (ISC) CISSP Study Guide.
Congratulations on taking the first step toward earning the certification
that SC Magazine named “Best Professional Certification Program.”
Good luck with your studies!
Best Regards,
David P. Shearer, CISSP, PMP
CEO
2
(ISC)
7
To Cathy, your perspective on the world and life often surprises me,
challenges me, and makes me love you even more.
—James Michael Stewart
To Dewitt Latimer, my mentor, friend, and colleague. I miss you dearly.
—Mike Chapple
To Nimfa: Thanks for sharing your life with me for the past 23 years
and letting me share mine with you.
—Darril Gibson
8
Acknowledgments
I’d like to express my thanks to Sybex for continuing to support this
project. Thanks to Mike Chapple and Darril Gibson for continuing to
contribute to this project. Thanks also to all my CISSP course students
who have provided their insight and input to improve my training
courseware and ultimately this tome. Extra thanks to the seventh edition
developmental editor, Alexa Murphy, and technical editor, David Seidl,
who performed amazing feats in guiding us to improve this book. Thanks
as well to my agent, Carole Jelen, for continuing to assist in nailing down
these projects.
To my adoring wife, Cathy: Building a life and a family together has been
more wonderful than I could have ever imagined. To Slayde and Remi:
You are growing up so fast and learning at an outstanding pace, and you
continue to delight and impress me daily. You are both growing into
amazing individuals. To my mom, Johnnie: It is wonderful to have you
close by. To Mark: No matter how much time has passed or how little we
see each other, I have been and always will be your friend. And finally, as
always, to Elvis: You were way ahead of the current bacon obsession,
with your peanut butter-banana-bacon sandwich; I think that’s proof you
traveled through time!
—James Michael Stewart
Special thanks go to the information security team at the University of
Notre Dame, who provided hours of interesting conversation and debate
on security issues that inspired and informed much of the material in
this book.
I would like to thank the team at Wiley who provided invaluable
assistance throughout the book development process. I also owe a debt of
9
gratitude to my literary agent, Carole Jelen of Waterside Productions. My
coauthors, James Michael Stewart and Darril Gibson, were great
collaborators. David Seidl, our diligent and knowledgeable technical
editor, provided valuable insight as we brought this edition to press.
I’d also like to thank the many people who participated in the production
of this book but whom I never had the chance to meet: the graphics
team, the production staff, and all of those involved in bringing this book
to press.
—Mike Chapple
Thanks to Carol Long and Carole Jelen for helping get this update in
2
place before (ISC) released the objectives. This helped us get a head
start on this new edition and we appreciate your efforts. It’s been a
pleasure working with talented people like James Michael Stewart and
Mike Chapple. Thanks to both of you for all your work and collaborative
efforts on this project. The technical editor, Dave Seidl, provided us with
some outstanding feedback and this book is better because of his efforts.
Thanks again, David. Last, thanks to the team at Sybex (including project
managers, editors, and graphics artists) for all the work you did helping
us get this book to print.
—Darril Gibson
10