Official (ISC)2 Guide to the CISSP CBK, Fourth Edition ((ISC)2 Press)

1667 Pages·2015·30.92 MB·English

by  Adam Gordon

Foreword
Introduction
Editors
Preface
Domain 1 — Security & Risk Management
Confidentiality, Integrity, and Availability
Confidentiality
Integrity
Availability
Security Governance
Goals, Mission, and Objectives of the Organization
Organizational Processes
Security Roles and Responsibilities
Information Security Strategies
The Complete and Effective Security Program
Oversight Committee Representation
Control Frameworks
Due Care
Due Diligence
Compliance
Governance, Risk Management, and Compliance (GRC)
Legislative and Regulatory Compliance
Privacy Requirements Compliance
Global Legal and Regulatory Issues
Computer/Cyber Crime
Licensing and Intellectual Property
Import/Export
Trans-Border Data Flow
Privacy
Data Breaches
Relevant Laws and Regulations
Understand Professional Ethics
Regulatory Requirements for Ethics Programs
Topics in Computer Ethics
Common Computer Ethics Fallacies
Hacking and Hacktivism
Ethics Codes of Conduct and Resources
(ISC)2 Code of Professional Ethics
Support Organization’s Code of Ethics
Develop and Implement Security Policy
Business Continuity (BC) & Disaster Recovery (DR) Requirements
Project Initiation and Management
Develop and Document Project Scope and Plan
Conducting the Business Impact Analysis (BIA)
Identify and Prioritize
Assess Exposure to Outages
Recovery Point Objectives (RPO)
Manage Personnel Security
Employment Candidate Screening
Employment Agreements and Policies
Employee Termination Processes
Vendor, Consultant, and Contractor Controls
Privacy
Risk Management Concepts
Organizational Risk Management Concepts
Risk Assessment Methodologies
Identify Threats and Vulnerabilities
Risk Assessment/Analysis
Countermeasure Selection
Implementation of Risk Countermeasures
Types of Controls
Access Control Types
Controls Assessment/Monitoring and Measuring
Tangible and Intangible Asset Valuation
Continuous Improvement
Risk Management Frameworks
Threat Modeling
Determining Potential Attacks and Reduction Analysis
Technologies & Processes to Remediate Threats
Acquisitions Strategy and Practice
Hardware, Software, and Services
Manage Third-Party Governance
Minimum Security and Service-Level Requirements
Security Education, Training, and Awareness
Formal Security Awareness Training
Awareness Activities and Methods – Creating the Culture of Awareness in the
Organization
Domain 2 — Asset Security
Data Management: Determine and Maintain Ownership
Data Policy
Roles and Responsibilities
Data Ownership
Data Custodianship
Data Quality
Data Documentation and Organization
Data Standards
Data Lifecycle Control
Data Specification and Modeling
Database Maintenance
Data Audit
Data Storage and Archiving
Longevity and Use
Data Security
Data Access, Sharing, and Dissemination
Data Publishing
Classify Information and Supporting Assets
Asset Management
Software Licensing
Equipment Lifecycle
Protect Privacy
Ensure Appropriate Retention
Media, Hardware, and Personnel
Company “X” Data Retention Policy
Determine Data Security Controls
Data at Rest
Data in Transit
Baselines
Scoping and Tailoring
Standards Selection
United States Resources
International Resources
National Cyber Security Framework Manual
Framework for Improving Critical Infrastructure Cybersecurity
Domain 3 — Security Engineering
The Engineering Lifecycle Using Security Design Principles
Fundamental Concepts of Security Models
Common System Components
How They Work Together
Enterprise Security Architecture
Common Architecture Frameworks
Zachman Framework
Capturing and Analyzing Requirements
Creating and Documenting Security Architecture
Information Systems Security Evaluation Models
Common Formal Security Models
Product Evaluation Models
Industry and International Security Implementation Guidelines
Security Capabilities of Information Systems
Access Control Mechanisms
Secure Memory Management
Vulnerabilities of Security Architectures
Systems
Technology and Process Integration
Single Point of Failure (SPOF)
Client-Based Vulnerabilities
Server-Based Vulnerabilities
Database Security
Large Scale Parallel Data Systems
Distributed Systems
Cryptographic Systems
Software and System Vulnerabilities and Threats
Web-Based
Vulnerabilities in Mobile Systems
Risks from Remote Computing
Risks from Mobile Workers
Vulnerabilities in Embedded Devices and Cyber-Physical Systems
The Application and Use of Cryptography
The History of Cryptography
Emerging Technology
Core Information Security Principles
Additional Features of Cryptographic Systems
The Cryptographic Lifecycle
Public Key Infrastructure (PKI)
Key Management Processes
Creation and Distribution of Keys
Digital Signatures
Digital Rights Management (DRM)
Non-Repudiation
Hashing
Simple Hash Functions
Methods of Cryptanalytic Attacks
Site and Facility Design Considerations
The Security Survey
Site Planning
Roadway Design
Crime Prevention through Environmental Design (CPTED)
Windows
Design and Implement Facility Security
Implementation and Operation of Facilities Security
Communications and Server Rooms
Restricted and Work Area Security
Data Center Security
Domain 4 — Communications & Network Security
Secure Network Architecture and Design
OSI and TCP/IP
IP Networking
Directory Services
Implications of Multi-Layer Protocols
Converged Protocols
Implementation
Voice over Internet Protocol (VoIP)
Wireless
Wireless Security Issues
Open System Authentication
Cryptography Used to Maintain Communications Security
Securing Network Components
Hardware
Transmission Media
Network Access Control Devices
End Point Security
Content Distribution Networks
Secure Communication Channels
Voice
Multimedia Collaboration
Open Protocols, Applications, and Services
Remote Access
Data Communications
Virtualized Networks
Network Attacks
The Network as an Enabler or Channel of Attack
The Network as a Bastion of Defense
Network Security Objectives and Attack Modes
Scanning Techniques
Security Event Management (SEM)
IP Fragmentation Attacks and Crafted Packets
Denial-of-Service (DoS) / Distributed-Denial-of Service (DDoS) Attacks
Spoofing
Session Highjack
Domain 5 — Identity & Access Management
Physical and Logical Access to Assets
Identification and Authentication of People and Devices
Identification, Authentication, and Authorization
Identity Management Implementation
Password Management
Account Management
Profile Management
Directory Management
Directory Technologies
Single/Multi-Factor Authentication
Accountability
Session Management
Registration and Proof of Identity
Credential Management Systems
Identity as a Service (IDaaS)
Integrate Third-Party Identity Services
Implement and Manage Authorization Mechanisms
Role-Based Access Control
Rule-Based Access Control
Mandatory Access Controls (MACs)
Discretionary Access Controls (DACs)
Prevent or Mitigate Access Control Attacks
Windows PowerShell Equivalent Commands
Identity and Access Provisioning Lifecycle
Provisioning
Review
Revocation
Domain 6 — Security Assessment & Testing
Assessment and Test Strategies
Software Development as Part of System Design
Log Reviews
Synthetic Transactions
Code Review and Testing
Negative Testing/Misuse Case Testing
Interface Testing
Collect Security Process Data
Internal and Third-Party Audits
SOC Reporting Options
Domain 7 — Security Operations
Investigations
The Crime Scene
Policy, Roles, and Responsibilities
Incident Handling and Response
Recovery Phase
Evidence Collection and Handling
Reporting and Documenting
Evidence Collection and Processing
Continuous and Egress Monitoring
Data Leak/Loss Prevention (DLP)
Provisioning of Resources through Configuration Management
Foundational Security Operations Concepts
Key Themes
Controlling Privileged Accounts
Managing Accounts Using Groups and Roles
Separation of Duties and Responsibilities
Monitor Special Privileges
Job Rotation
Manage the Information Lifecycle
Service Level Agreements (SLAs)
Resource Protection
Tangible versus Intangible Assets
Hardware
Media Management
Incident Response
Incident Management
Security Measurements, Metrics, and Reporting
Managing Security Technologies
Detection
Response
Reporting
Recovery
Remediation and Review (Lessons Learned)
Preventative Measures against Attacks
Unauthorized Disclosure
Network Intrusion Detection System Architecture
Whitelisting, Blacklisting, and Greylisting… Oh My!
Third-party Security Services, Sandboxing, Anti-malware, Honeypots and Honeynets
Patch and Vulnerability Management
Security and Patch Information Sources
Change and Configuration Management
Configuration Management
Recovery Site Strategies
Multiple Processing Sites
System Resilience and Fault Tolerance Requirements
The Disaster Recovery Process
Documenting the Plan
Response
Personnel
Communications
Employee Notification
Assessment
Restoration
Provide Training
Exercise, Assess, and Maintain the Plan
Test Plan Review
Tabletop Exercise/Structured Walk-Through Test
Walk-Through Drill/Simulation Test
Functional Drill/Parallel Test
Full-Interruption/Full-Scale Test
Update and Maintenance of the Plan
Business Continuity and Other Risk Areas
Implementation and Operation of Perimeter Security
Access Control
Card Types
Closed Circuit TV
Internal Security
Interior Intrusion Detection Systems
Building and Inside Security
Doors
Personnel Safety
Privacy
Travel
Duress
Domain 8 — Security in the Software Development Life Cycle
Software Development Security Outline
Development Life Cycle
Maturity Models
Operation and Maintenance
Change Management
Integrated Product Team (e.g., DevOps)
Environment and Security Controls
Software Development Methods
The Database and Data Warehousing Environment
Database Vulnerabilities and Threats
DBMS Controls
Knowledge Management
Web Application Environment
Security of the Software Environment
Applications Development and Programming Concepts
The Software Environment
Libraries & Toolsets
Security Issues in Source Code
Malicious Software (Malware)
Malware Protection
Software Protection Mechanisms
Security Kernels, Reference Monitors, and the TCB
Configuration Management
Security of Code Repositories
Security of Application Programming Interfaces (API)
Assess the Effectiveness of Software Security
Certification and Accreditation
Auditing and Logging of Changes
Risk Analysis and Mitigation