Acknowledgments |
|
xvii | |
About the authors |
|
xix | |
|
|
1 | (8) |
|
How to Prepare for the Exam |
|
|
2 | (2) |
|
The CISSP exam is a management exam |
|
|
2 | (1) |
|
|
2 | (1) |
|
|
3 | (1) |
|
|
3 | (1) |
|
|
3 | (1) |
|
|
4 | (3) |
|
Steps to becoming a CISSP |
|
|
4 | (1) |
|
Computer-based testing (CBT) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
7 | (2) |
|
Chapter 2 Domain 1: Access Control |
|
|
9 | (54) |
|
Unique Terms and Definitions |
|
|
9 | (1) |
|
|
9 | (1) |
|
Cornerstone Information Security Concepts |
|
|
10 | (7) |
|
Confidentiality, integrity, and availability |
|
|
11 | (2) |
|
Identity and authentication, authorization, and accountability (AAA) |
|
|
13 | (2) |
|
|
15 | (1) |
|
Least privilege and need to know |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (7) |
|
Discretionary Access Control (DAC) |
|
|
17 | (1) |
|
Mandatory Access Control (MAC) |
|
|
18 | (1) |
|
Non-discretionary access control |
|
|
18 | (1) |
|
Content- and context-dependent access controls |
|
|
19 | (1) |
|
Centralized access control |
|
|
20 | (1) |
|
Decentralized access control |
|
|
20 | (1) |
|
Access provisioning lifecycle |
|
|
21 | (1) |
|
Access control protocols and frameworks |
|
|
22 | (2) |
|
Procedural Issues for Access Control |
|
|
24 | (3) |
|
Labels, clearance, formal access approval, and need to know |
|
|
24 | (2) |
|
Rule-based access controls |
|
|
26 | (1) |
|
|
27 | (1) |
|
Access Control Defensive Categories and Types |
|
|
27 | (2) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
Comparing access controls |
|
|
29 | (1) |
|
|
29 | (13) |
|
Type 1 authentication: something you know |
|
|
30 | (5) |
|
Type 2 authentication: something you have |
|
|
35 | (1) |
|
Type 3 authentication: something you are |
|
|
36 | (1) |
|
Biometric fairness, psychological comfort, and safety |
|
|
37 | (5) |
|
Access Control Technologies |
|
|
42 | (6) |
|
|
42 | (1) |
|
Federated identity management |
|
|
43 | (1) |
|
|
43 | (4) |
|
|
47 | (1) |
|
|
47 | (1) |
|
|
48 | (6) |
|
|
48 | (1) |
|
Black hats and white hats |
|
|
49 | (1) |
|
|
49 | (1) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
|
52 | (1) |
|
Phishers and spear phishers |
|
|
53 | (1) |
|
|
54 | (3) |
|
|
54 | (2) |
|
|
56 | (1) |
|
|
57 | (1) |
|
|
57 | (1) |
|
Summary of Exam Objectives |
|
|
57 | (1) |
|
|
58 | (2) |
|
Self-Test Quick Answer Key |
|
|
60 | (3) |
|
Chapter 3 Domain 2: Telecommunications and Network Security |
|
|
63 | (80) |
|
Unique Terms and Definitions |
|
|
63 | (1) |
|
|
63 | (1) |
|
Network Architecture and Design |
|
|
64 | (36) |
|
|
64 | (1) |
|
Fundamental network concepts |
|
|
64 | (3) |
|
|
67 | (2) |
|
|
69 | (1) |
|
|
70 | (1) |
|
Network Access, Internet and Transport Layer Protocols, and Concepts |
|
|
71 | (14) |
|
Application layer TCP/IP protocols and concepts |
|
|
85 | (4) |
|
|
89 | (3) |
|
LAN technologies and protocols |
|
|
92 | (2) |
|
LAN Physical Network Topologies |
|
|
94 | (2) |
|
WAN technologies and protocols |
|
|
96 | (4) |
|
Network Devices and Protocols |
|
|
100 | (23) |
|
|
100 | (1) |
|
|
100 | (1) |
|
|
101 | (2) |
|
|
103 | (1) |
|
|
103 | (5) |
|
|
108 | (6) |
|
|
114 | (1) |
|
Intrusion detection systems and intrusion prevention systems |
|
|
115 | (3) |
|
|
118 | (2) |
|
|
120 | (1) |
|
|
121 | (1) |
|
|
122 | (1) |
|
|
123 | (14) |
|
Authentication protocols and frameworks |
|
|
123 | (3) |
|
|
126 | (2) |
|
|
128 | (1) |
|
Wireless Local Area Networks |
|
|
129 | (5) |
|
|
134 | (3) |
|
Summary of Exam Objectives |
|
|
137 | (1) |
|
|
138 | (2) |
|
Self Test Quick Answer Key |
|
|
140 | (3) |
|
Chapter 4 Domain 3: Information Security Governance and Risk Management |
|
|
143 | (26) |
|
Unique Terms and Definitions |
|
|
143 | (1) |
|
|
143 | (1) |
|
|
144 | (10) |
|
|
144 | (1) |
|
Threats and vulnerabilities |
|
|
144 | (1) |
|
Risk = Threat × Vulnerability |
|
|
145 | (2) |
|
Calculating Annualized Loss Expectancy |
|
|
147 | (1) |
|
|
148 | (1) |
|
|
149 | (1) |
|
|
150 | (1) |
|
|
151 | (2) |
|
The Risk Management Process |
|
|
153 | (1) |
|
Information Security Governance |
|
|
154 | (11) |
|
Security policy and related documents |
|
|
154 | (3) |
|
Roles and responsibilities |
|
|
157 | (1) |
|
|
158 | (2) |
|
Compliance with laws and regulations |
|
|
160 | (1) |
|
Due care and due diligence |
|
|
161 | (1) |
|
|
161 | (1) |
|
Auditing and control frameworks |
|
|
162 | (2) |
|
Certification and Accreditation |
|
|
164 | (1) |
|
Summary of Exam Objectives |
|
|
165 | (1) |
|
|
165 | (2) |
|
Self Test Quick Answer Key |
|
|
167 | (2) |
|
Chapter 5 Domain 4: Software Development Security |
|
|
169 | (44) |
|
Unique Terms and Definitions |
|
|
169 | (1) |
|
|
169 | (1) |
|
|
170 | (5) |
|
Machine code, source code, and assemblers |
|
|
170 | (1) |
|
Compilers, interpreters, and bytecode |
|
|
171 | (1) |
|
Procedural and object-oriented languages |
|
|
171 | (2) |
|
Fourth-generation programming language |
|
|
173 | (1) |
|
Computer-aided software engineering (CASE) |
|
|
173 | (1) |
|
Top-down versus bottom-up programming |
|
|
173 | (1) |
|
Types of publicly released software |
|
|
174 | (1) |
|
Application Development Methods |
|
|
175 | (11) |
|
|
176 | (1) |
|
|
177 | (2) |
|
Agile software development |
|
|
179 | (1) |
|
|
180 | (1) |
|
Rapid application development (RAD) |
|
|
181 | (1) |
|
|
181 | (1) |
|
|
182 | (4) |
|
|
186 | (1) |
|
Object-Orientated Design and Programming |
|
|
186 | (6) |
|
Object-oriented programming (OOP) |
|
|
186 | (5) |
|
Object-oriented analysis (OOA) and object-oriented design (OOD) |
|
|
191 | (1) |
|
Software Vulnerabilities, Testing, and Assurance |
|
|
192 | (5) |
|
|
192 | (2) |
|
|
194 | (1) |
|
|
195 | (1) |
|
Software Capability Maturity Model (CMM) |
|
|
196 | (1) |
|
Software Change and Configuration Management |
|
|
196 | (1) |
|
|
197 | (6) |
|
|
198 | (4) |
|
|
202 | (1) |
|
Database replication and shadowing |
|
|
202 | (1) |
|
Data warehousing and data mining |
|
|
203 | (1) |
|
|
203 | (3) |
|
|
203 | (1) |
|
Artificial neural networks |
|
|
204 | (1) |
|
|
205 | (1) |
|
Genetic algorithms and programming |
|
|
206 | (1) |
|
Summary of Exam Objectives |
|
|
206 | (1) |
|
|
207 | (2) |
|
Self Test Quick Answer Key |
|
|
209 | (4) |
|
Chapter 6 Domain 5: Cryptography |
|
|
213 | (44) |
|
Unique Terms and Definitions |
|
|
213 | (1) |
|
|
213 | (1) |
|
Cornerstone Cryptographic Concepts |
|
|
213 | (5) |
|
|
214 | (1) |
|
Confidentiality, integrity, authentication, and non-repudiation |
|
|
214 | (1) |
|
Confusion, diffusion, substitution, and permutation |
|
|
214 | (1) |
|
|
215 | (1) |
|
Monoalphabetic and polyalphabetic ciphers |
|
|
215 | (1) |
|
|
216 | (1) |
|
|
216 | (1) |
|
|
217 | (1) |
|
Data at rest and data in motion |
|
|
217 | (1) |
|
|
218 | (10) |
|
|
218 | (1) |
|
|
218 | (1) |
|
Caesar cipher and other rotation ciphers |
|
|
218 | (1) |
|
|
219 | (1) |
|
|
219 | (1) |
|
|
220 | (2) |
|
Book cipher and running-key cipher |
|
|
222 | (1) |
|
|
223 | (1) |
|
|
224 | (3) |
|
|
227 | (1) |
|
|
228 | (8) |
|
|
228 | (1) |
|
Initialization vectors and chaining |
|
|
228 | (1) |
|
|
229 | (4) |
|
International Data Encryption Algorithm |
|
|
233 | (1) |
|
Advanced Encryption Standard |
|
|
233 | (3) |
|
|
236 | (1) |
|
|
236 | (1) |
|
|
236 | (2) |
|
|
236 | (2) |
|
|
238 | (1) |
|
|
238 | (1) |
|
|
239 | (1) |
|
|
239 | (1) |
|
|
239 | (1) |
|
|
239 | (5) |
|
|
239 | (1) |
|
|
240 | (1) |
|
|
240 | (1) |
|
|
241 | (1) |
|
Chosen plaintext and adaptive chosen plaintext |
|
|
241 | (1) |
|
Chosen ciphertext and adaptive chosen ciphertext |
|
|
242 | (1) |
|
Meet-in-the-middle attack |
|
|
242 | (1) |
|
|
242 | (1) |
|
Differential cryptanalysis |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
244 | (1) |
|
Implementing Cryptography |
|
|
244 | (7) |
|
|
244 | (1) |
|
Message Authenticate Code |
|
|
245 | (1) |
|
Public key infrastructure |
|
|
246 | (1) |
|
|
247 | (1) |
|
|
247 | (1) |
|
|
248 | (1) |
|
|
249 | (1) |
|
|
249 | (1) |
|
|
249 | (1) |
|
|
249 | (1) |
|
|
250 | (1) |
|
|
251 | (1) |
|
Summary of Exam Objectives |
|
|
251 | (1) |
|
|
252 | (2) |
|
Self Test Quick Answer Key |
|
|
254 | (3) |
|
Chapter 7 Domain 6: Security Architecture and Design |
|
|
257 | (50) |
|
Unique Terms and Definitions |
|
|
257 | (1) |
|
|
257 | (1) |
|
Secure System Design Concepts |
|
|
258 | (3) |
|
|
258 | (1) |
|
|
258 | (1) |
|
|
259 | (1) |
|
|
259 | (1) |
|
|
260 | (1) |
|
Secure Hardware Architecture |
|
|
261 | (9) |
|
The system unit and motherboard |
|
|
261 | (1) |
|
|
261 | (1) |
|
|
261 | (3) |
|
|
264 | (2) |
|
|
266 | (4) |
|
Secure Operating System and Software Architecture |
|
|
270 | (3) |
|
|
270 | (1) |
|
Users and file permissions |
|
|
270 | (3) |
|
Virtualization and Distributed Computing |
|
|
273 | (5) |
|
|
273 | (2) |
|
|
275 | (1) |
|
|
276 | (1) |
|
|
276 | (1) |
|
|
277 | (1) |
|
System Vulnerabilities, Threats, and Countermeasures |
|
|
278 | (12) |
|
|
278 | (1) |
|
|
278 | (1) |
|
|
279 | (1) |
|
|
280 | (1) |
|
|
280 | (1) |
|
|
281 | (1) |
|
|
282 | (1) |
|
|
283 | (1) |
|
Web architecture and attacks |
|
|
284 | (2) |
|
|
286 | (1) |
|
|
287 | (2) |
|
|
289 | (1) |
|
|
290 | (9) |
|
Reading down and writing up |
|
|
290 | (1) |
|
|
291 | (1) |
|
|
291 | (1) |
|
Lattice-based access controls |
|
|
292 | (1) |
|
|
292 | (2) |
|
|
294 | (1) |
|
|
294 | (1) |
|
|
295 | (1) |
|
|
295 | (1) |
|
|
295 | (1) |
|
Zachman Framework for Enterprise Architecture |
|
|
296 | (1) |
|
|
297 | (1) |
|
Harrison-Ruzzo-Ullman Model |
|
|
297 | (1) |
|
|
298 | (1) |
|
Evaluation Methods, Certification, and Accreditation |
|
|
299 | (3) |
|
|
299 | (1) |
|
|
300 | (1) |
|
The International Common Criteria |
|
|
301 | (1) |
|
|
302 | (1) |
|
Certification and accreditation |
|
|
302 | (1) |
|
Summary of Exam Objectives |
|
|
302 | (1) |
|
|
303 | (2) |
|
Self Test Quick Answer Key |
|
|
305 | (2) |
|
Chapter 8 Domain 7: Operations Security |
|
|
307 | (36) |
|
Unique Terms and Definitions |
|
|
307 | (1) |
|
|
307 | (1) |
|
|
308 | (4) |
|
Administrative Personnel Controls |
|
|
308 | (3) |
|
|
311 | (1) |
|
Sensitive Information and Media Security |
|
|
312 | (2) |
|
|
312 | (2) |
|
|
314 | (5) |
|
|
315 | (3) |
|
|
318 | (1) |
|
|
319 | (8) |
|
Service Level Agreements (SLAs) |
|
|
319 | (1) |
|
|
320 | (7) |
|
Incident Response Management |
|
|
327 | (10) |
|
|
328 | (4) |
|
|
332 | (5) |
|
Summary of Exam Objectives |
|
|
337 | (3) |
|
|
340 | (2) |
|
Self Test Quick Answer Key |
|
|
342 | (1) |
|
Chapter 9 Domain 8: Business Continuity and Disaster Recovery Planning |
|
|
343 | (46) |
|
Unique Terms and Definitions |
|
|
343 | (1) |
|
|
343 | (1) |
|
BCP and DRP Overview and Process |
|
|
344 | (11) |
|
Business continuity planning (BCP) |
|
|
344 | (1) |
|
Disaster recovery planning (DRP) |
|
|
345 | (1) |
|
Relationship between BCP and DRP |
|
|
345 | (1) |
|
Disasters or disruptive events |
|
|
346 | (7) |
|
The disaster recovery process |
|
|
353 | (2) |
|
|
355 | (18) |
|
|
355 | (3) |
|
|
358 | (1) |
|
Assessing the critical state |
|
|
359 | (1) |
|
Conduct Business Impact Analysis (BIA) |
|
|
359 | (5) |
|
Identify preventive controls |
|
|
364 | (1) |
|
|
364 | (4) |
|
|
368 | (5) |
|
|
373 | (1) |
|
|
373 | (4) |
|
|
374 | (1) |
|
|
374 | (3) |
|
|
377 | (1) |
|
DRP Testing, Training, and Awareness |
|
|
377 | (3) |
|
|
377 | (2) |
|
|
379 | (1) |
|
|
380 | (1) |
|
|
380 | (1) |
|
|
380 | (1) |
|
|
381 | (1) |
|
Specific BCP/DRP Frameworks |
|
|
381 | (2) |
|
|
381 | (1) |
|
|
381 | (1) |
|
|
382 | (1) |
|
|
382 | (1) |
|
Summary of Exam Objectives |
|
|
383 | (1) |
|
|
383 | (2) |
|
Self Test Quick Answer Key |
|
|
385 | (4) |
|
Chapter 10 Domain 9: Legal, Regulations, Investigations, and Compliance |
|
|
389 | (40) |
|
Unique Terms and Definitions |
|
|
389 | (1) |
|
|
390 | (1) |
|
|
390 | (1) |
|
|
390 | (1) |
|
|
390 | (1) |
|
|
391 | (1) |
|
|
391 | (1) |
|
Criminal, Civil, and Administrative Law |
|
|
391 | (2) |
|
|
392 | (1) |
|
|
392 | (1) |
|
|
393 | (1) |
|
Information Security Aspects of Law |
|
|
393 | (11) |
|
|
394 | (1) |
|
|
395 | (4) |
|
Import and export restrictions |
|
|
399 | (1) |
|
|
400 | (3) |
|
|
403 | (1) |
|
|
403 | (1) |
|
|
404 | (5) |
|
|
405 | (2) |
|
|
407 | (1) |
|
Forensic software analysis |
|
|
408 | (1) |
|
Embedded device forensics |
|
|
408 | (1) |
|
|
408 | (1) |
|
Legal Aspects of Investigations |
|
|
409 | (5) |
|
|
409 | (2) |
|
|
411 | (1) |
|
|
411 | (1) |
|
|
412 | (2) |
|
Entrapment and enticement |
|
|
414 | (1) |
|
Important Laws and Regulations |
|
|
414 | (4) |
|
U.S. Computer Fraud and Abuse Act |
|
|
414 | (3) |
|
|
417 | (1) |
|
|
417 | (1) |
|
U.S. breach notification laws |
|
|
418 | (1) |
|
Security and Third Parties |
|
|
418 | (2) |
|
Service provider contractual security |
|
|
418 | (1) |
|
|
419 | (1) |
|
|
420 | (1) |
|
|
420 | (3) |
|
The (ISC)2® Code of Ethics |
|
|
420 | (2) |
|
Computer Ethics Institute |
|
|
422 | (1) |
|
IAB's Ethics and the Internet |
|
|
422 | (1) |
|
Summary of Exam Objectives |
|
|
423 | (1) |
|
|
424 | (2) |
|
Self Test Quick Answer Key |
|
|
426 | (3) |
|
Chapter 11 Domain 10: Physical (Environmental) Security |
|
|
429 | (34) |
|
Unique Terms and Definitions |
|
|
429 | (1) |
|
|
429 | (1) |
|
|
430 | (12) |
|
|
430 | (1) |
|
|
430 | (1) |
|
|
430 | (1) |
|
|
431 | (1) |
|
|
432 | (1) |
|
|
433 | (4) |
|
Smart cards and magnetic stripe cards |
|
|
437 | (1) |
|
|
438 | (1) |
|
|
439 | (1) |
|
|
439 | (1) |
|
Motion detectors and other perimeter alarms |
|
|
439 | (1) |
|
|
440 | (1) |
|
Walls, floors, and ceilings |
|
|
441 | (1) |
|
|
441 | (1) |
|
|
442 | (1) |
|
Restricted areas and escorts |
|
|
442 | (1) |
|
Site Selection, Design, and Configuration |
|
|
442 | (2) |
|
|
443 | (1) |
|
Site design and configuration issues |
|
|
443 | (1) |
|
|
444 | (4) |
|
|
445 | (1) |
|
|
445 | (1) |
|
Drive and tape encryption |
|
|
445 | (1) |
|
Media storage and transportation |
|
|
446 | (1) |
|
Media cleaning and destruction |
|
|
446 | (2) |
|
|
448 | (11) |
|
|
448 | (2) |
|
|
450 | (1) |
|
Heat, flame, and smoke detectors |
|
|
451 | (1) |
|
Personnel safety, training, and awareness |
|
|
452 | (1) |
|
ABCD fires and suppression |
|
|
453 | (2) |
|
Types of fire suppression agents |
|
|
455 | (4) |
|
Summary of Exam Objectives |
|
|
459 | (1) |
|
|
460 | (2) |
|
Self Test Quick Answer Key |
|
|
462 | (1) |
Appendix: Self Test |
|
463 | (50) |
Glossary |
|
513 | (36) |
Index |
|
549 | |