Contents
Introduction
Chapter 1: Accountability and Access Control
Access Control Overview
Identification and Authentication Techniques
Access Control Techniques
Access Control Methodologies and Implementation
Access Control Administration
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 2: Attacks and Monitoring
Monitoring
Intrusion Detection
IDS-Related Tools
Penetration Testing
Methods of Attack
Access Control Compensations
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 3: ISO Model, Protocols, Network Security, and Network Infrastructure
OSI Model
Communications and Network Security
Internet/Intranet/Extranet Components
Remote Access Security Management
Network and Protocol Security Mechanisms
Avoiding Single Points of Failure
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 4: Communications Security and Countermeasures
Virtual Private Network (VPN)
Network Address Translation
Switching Technologies
WAN Technologies
Miscellaneous Security Control Characteristics
Managing Email Security
Securing Voice Communications
Security Boundaries
Network Attacks and Countermeasures
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 5: Security Management Concepts and Principles
Security Management Concepts and Principles
Protection Mechanisms
Change Control/Management
Data Classification
Planning to Plan
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 6: Asset Value, Policies, and Roles
Employment Policies and Practices
Security Roles
Security Management Planning
Policies, Standards, Baselines, Guidelines, and Procedures
Risk Management
Security Awareness Training
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 7: Data and Application Security Issues
Application Issues
Databases and Data Warehousing
Data/Information Storage
Knowledge-Based Systems
Systems Development Controls
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 8: Malicious Code and Application Attacks
Malicious Code
Password Attacks
Denial-of-Service Attacks
Application Attacks
Web Application Security
Reconnaissance Attacks
Masquerading Attacks
Decoy Techniques
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 9: Cryptography and Symmetric Key Algorithms
Historical Milestones in Cryptography
Cryptographic Basics
Modern Cryptography
Symmetric Cryptography
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 10: PKI and Cryptographic Applications
Asymmetric Cryptography
Hash Functions
Digital Signatures
Public Key Infrastructure
Applied Cryptography
Cryptographic Attacks
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 11: Principles of Computer Design
Computer Architecture
Security Protection Mechanisms
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 12: Principles of Security Models
Security Models
Objects and Subjects
Understanding System Security Evaluation
Common Flaws and Security Issues
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 13: Administrative Management
Operations Security Concepts
Personnel Controls
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 14: Auditing and Monitoring
Auditing
Monitoring
Monitoring Tools and Techniques
Penetration-Testing Techniques
Inappropriate Activities
Indistinct Threats and Countermeasures
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 15: Business Continuity Planning
Business Continuity Planning
Project Scope and Planning
Business Impact Assessment
Continuity Planning
BCP Documentation
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 16: Disaster Recovery Planning
The Nature of Disaster
Recovery Strategy
Recovery Plan Development
Training and Documentation
Testing and Maintenance
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 17: Law and Investigations
Categories of Laws
Laws
Investigations
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 18: Incidents and Ethics
Major Categories of Computer Crime
Incident Handling
Ethics
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Chapter 19: Physical Security Requirements
Facility Requirements
Forms of Physical Access Controls
Technical Controls
Environment and Life Safety
Equipment Failure
Summary
Exam Essentials
Written Lab
Answers to Written Lab
Review Questions
Answers to Review Questions
Appendix: About the Companion CD
Index
Advertisement
Perf Card & Objectives Map
Glossary
Acquisitions Editor: Jeff Kellum
Development Editor: Rob Truhn
Technical Editor: Darril Gibson
Production Editor: Eric Charbonneau
Copy Editor: Judy Flynn
Editorial Manager: Pete Gaughan
Production Manager: Tim Tate
Vice President and Executive Group Publisher: Richard Swadley
Vice President and Publisher: Neil Edde
Media Project Manager 1: Laura Moss-Hollister
Media Associate Producer: Shawn Patrick
Media Quality Assurance: Marilyn Hummel
Book Designer: Judy Fung
Proofreader: Nancy Bell
Indexer: Nancy Guenther
Project Coordinator, Cover: Katie Crocker
Cover Designer: Ryan Sneed
Copyright © 2011 by Wiley Publishing, Inc., Indianapolis, Indiana
Published simultaneously in Canada
ISBN: 978-0-470-94498-1
ISBN: 978-1-118-02825-4 (ebk)
ISBN: 978-1-118-02827-8 (ebk)
ISBN: 978-1-118-02826-1 (ebk)
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.
For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.
Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.
Library of Congress Cataloging-in-Publication Data is available from the publisher.
TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CISSP is a registered trademark of International Information Systems Security Certification Consortium, Inc. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.
Dear Reader,
Thank you for choosing CISSP: Certified Information Systems Security Professional Study Guide. This book is part of a family of premium-quality Sybex books, all of which are written by outstanding authors who combine practical experience with a gift for teaching.
Sybex was founded in 1976. More than 30 years later, we’re still committed to producing consistently exceptional books. With each of our titles, we’re working hard to set a new standard for the industry. From the paper we print on, to the authors we work with, our goal is to bring you the best books available.
I hope you see all that reflected in these pages. I’d be very interested to hear your comments and get your feedback on how we’re doing. Feel free to let me know what you think about this or any other Sybex book by sending me an email at nedde@wiley.com. If you think you’ve found a technical error in this book, please visit http://sybex.custhelp.com. Customer feedback is critical to our efforts at Sybex.
Best regards,
Neil Edde
Vice President and Publisher
Sybex, an Imprint of Wiley
To Cathy, whenever there is trouble, just remember “Some beach, somewhere . . .”
—James Michael Stewart
To my Mom, Cecilia Katherine: the world is not as bright without you in it anymore, and we all still miss you every day.
—Ed Tittel
To my family: Renee, Richard, Matthew, and Christopher, who lovingly put up with me during the hours I spent buried in my laptop writing this book.
—Mike Chapple
Acknowledgments
I hope our efforts to improve this study guide will lend themselves handily to your understanding and comprehension of the wide berth of CISSP concepts. I’d like to express my thanks to Sybex for continuing to support this project. Thanks to Ed Tittel and Mike Chapple for continuing to contribute to this project. Also thanks to all my CISSP course students who have provided their insight and input to improve my training courseware and ultimately this tome. Extra thanks to the 5th Edition Technical Editor, Darril Gibson, who performed amazing feats in guiding us to improve this book.
To my wonderful wife, Cathy, our life together is just getting started. To my son, Xzavier Slayde, and daughter, Remington Annaliese, may you grow to be more than we could imagine. To my parents, Dave and Sue, thanks for your love and consistent support. To Mark, as best friends go, it could’ve been worse. And finally, as always, to Elvis—all hail the King!
—James Michael Stewart
Thanks to both Michael Stewart and Mike Chapple for continuing to keep me involved in this project. Michael continues to teach CISSP courses with amazing frequency, which provides us with a lifeline to the hard-working professionals in the trenches for whom this credential means so much. Congrats again to Michael on another addition to his family; my son, Gregory, is now in first grade and the time just keeps flying by. May the months and years slip by as pleasantly and painlessly for you as they have for us. Next, thanks to the folks at Sybex, especially Jeff Kellum for rounding us all up and keeping us headed in the same direction and for his excellent view of where we need to take this book. Finally, I’d like to thank my loving and lovely wife, Dina, for all the great things she does to make family life so comfortable, clean, interesting and fun.
—Ed Tittel
Special thanks go to the information security team at the University of Notre Dame. Gary Dobbins, Bob Winding, David Seidl, and Robert Riley provided hours of interesting conversation and debate on security issues that inspired and informed much of the material in this book.
I would like to thank the team at Wiley who provided invaluable assistance throughout the book development process. I also owe a debt of gratitude to my literary agent, Carole Jelen of Waterside Productions. My coauthors, Ed Tittel and James Michael Stewart, have worked with me ever since we published the first edition of this book together eight years ago. I’d also like to thank the many people who participated in the production of this book but whom I never had the chance to meet: the graphics team, the production staff, and all of those involved in bringing this book to press.
—Mike Chapple
About the Authors
James Michael Stewart,CISSP, has been writing and training for more than 16 years, with a current focus on security. He has been teaching CISSP training courses since 2002, not to mention other courses on Windows security and ethical hacking/penetration testing. He is the author of several books and courseware sets on security certification, Microsoft topics, and network administration. More information about Michael can be found at his website: www.impactonline.com.
Ed Tittel is a full-time freelance writer, trainer, and consultant specializing in matters related to information security, markup languages, and networking technologies. He is a regular contributor to numerous TechTarget websites (and keeps updating his security certification survey for SearchSecurity.com), teaches online security and technology courses for HP, and enjoys his occasional gigs as an expert witness on Web technologies from the mid-1990s when he was lucky enough to write a raft of books in that arena. Ed’s professional bio and other information are available at www.edtittel.com.
Mike Chapple,CISSP, PhD, is an IT professional with the University of Notre Dame. In the past, he was chief information officer of Brand Institute and an information security researcher with the National Security Agency and the U.S. Air Force. His primary areas of expertise include network intrusion detection and access controls. Mike is a frequent contributor to TechTarget’s SearchSecurity site and the author of several information security titles including The GSEC Prep Guide from Wiley and Information Security Illuminated from Jones and Bartlett Publishers.
