Author biography |
|
xv | |
|
Chapter 1 Domain 1: Access Control |
|
|
1 | (22) |
|
|
1 | (1) |
|
Cornerstone information security concepts |
|
|
1 | (1) |
|
Confidentiality, integrity, and availability |
|
|
1 | (1) |
|
Identity and authentication, authorization, and accountability |
|
|
2 | (1) |
|
|
3 | (1) |
|
Least privilege and need to know |
|
|
3 | (1) |
|
|
3 | (1) |
|
|
4 | (1) |
|
|
4 | (1) |
|
Discretionary access controls |
|
|
4 | (1) |
|
Mandatory access controls |
|
|
4 | (1) |
|
Nondiscretionary access control |
|
|
4 | (1) |
|
Rule-based access controls |
|
|
5 | (1) |
|
Centralized access control |
|
|
5 | (1) |
|
|
5 | (1) |
|
Access provisioning lifecycle |
|
|
5 | (1) |
|
Access control protocols and frameworks |
|
|
6 | (1) |
|
Access control defensive categories and types |
|
|
7 | (1) |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
8 | (7) |
|
Type 1 Authentication: something you know |
|
|
9 | (2) |
|
Type 2 Authentication: something you have |
|
|
11 | (1) |
|
Type 3 Authentication: something you are |
|
|
11 | (4) |
|
|
15 | (1) |
|
Access control technologies |
|
|
16 | (1) |
|
|
16 | (1) |
|
Federated identity management |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
18 | (1) |
|
|
19 | (1) |
|
Summary of exam objectives |
|
|
19 | (1) |
|
Top five toughest questions |
|
|
19 | (1) |
|
Self-Test quick answer key |
|
|
20 | (1) |
|
|
21 | (2) |
|
Chapter 2 Domain 2: Telecommunications and Network Security |
|
|
23 | (22) |
|
|
23 | (1) |
|
Network architecture and design |
|
|
23 | (1) |
|
Fundamental network concepts |
|
|
23 | (1) |
|
|
24 | (2) |
|
|
26 | (2) |
|
Application-Layer TCP/IP protocols and concepts |
|
|
28 | (1) |
|
LAN technologies and protocols |
|
|
29 | (1) |
|
WAN technologies and protocols |
|
|
30 | (1) |
|
Network devices and protocols |
|
|
30 | (1) |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
33 | (1) |
|
Intrusion Detection Systems and Intrusion Prevention Systems |
|
|
34 | (1) |
|
|
34 | (1) |
|
|
35 | (1) |
|
Authentication protocols and frameworks |
|
|
35 | (1) |
|
|
36 | (1) |
|
|
37 | (1) |
|
Wireless Local Area Networks |
|
|
37 | (2) |
|
|
39 | (1) |
|
|
39 | (2) |
|
Summary of exam objectives |
|
|
41 | (1) |
|
Top five toughest questions |
|
|
41 | (1) |
|
Self-Test quick answer key |
|
|
42 | (3) |
|
Chapter 3 Domain 3: Information Security Governance and Risk Management |
|
|
45 | (18) |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
45 | (1) |
|
Threats and vulnerabilities |
|
|
46 | (1) |
|
Risk = threat x vulnerability |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
46 | (1) |
|
Calculating Annualized Loss Expectancy |
|
|
47 | (1) |
|
|
48 | (1) |
|
|
49 | (1) |
|
|
50 | (1) |
|
|
50 | (1) |
|
Qualitative and Quantitative Risk Analysis |
|
|
51 | (1) |
|
The Risk Management process |
|
|
51 | (1) |
|
Information Security Governance |
|
|
52 | (1) |
|
Security policy and related documents |
|
|
52 | (2) |
|
Roles and responsibilities |
|
|
54 | (1) |
|
|
55 | (1) |
|
|
56 | (1) |
|
Due care and due diligence |
|
|
57 | (1) |
|
|
57 | (1) |
|
Auditing and control frameworks |
|
|
57 | (2) |
|
Certification and Accreditation |
|
|
59 | (1) |
|
Summary of exam objectives |
|
|
59 | (1) |
|
Top five toughest questions |
|
|
60 | (1) |
|
|
61 | (1) |
|
|
61 | (2) |
|
Chapter 4 Domain 4: Software Development Security |
|
|
63 | (14) |
|
|
63 | (1) |
|
|
63 | (1) |
|
Machine code, source code, and assemblers |
|
|
63 | (1) |
|
Compilers, interpreters, and bytecode |
|
|
64 | (1) |
|
Types of publicly released software |
|
|
64 | (1) |
|
Application development methods |
|
|
64 | (1) |
|
|
65 | (1) |
|
|
65 | (1) |
|
Agile Software Development |
|
|
65 | (1) |
|
Rapid Application Development |
|
|
65 | (1) |
|
|
65 | (1) |
|
Object-Oriented Programming |
|
|
66 | (2) |
|
|
68 | (1) |
|
Software vulnerabilities, testing, and assurance |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
70 | (1) |
|
Software Capability Maturity Model |
|
|
70 | (1) |
|
|
71 | (3) |
|
|
74 | (1) |
|
Database replication and shadowing |
|
|
74 | (1) |
|
Summary of exam objectives |
|
|
74 | (1) |
|
Top five toughest questions |
|
|
75 | (1) |
|
Self-Test quick answer key |
|
|
75 | (1) |
|
|
76 | (1) |
|
Chapter 5 Domain 5: Cryptography |
|
|
77 | (18) |
|
|
77 | (1) |
|
Cornerstone cryptographic concepts |
|
|
77 | (1) |
|
|
77 | (1) |
|
Confidentiality, integrity, authentication, and nonrepudiation |
|
|
78 | (1) |
|
Substitution and permutation |
|
|
78 | (1) |
|
|
78 | (1) |
|
Monoalphabetic and polyalphabetic ciphers |
|
|
78 | (1) |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
80 | (1) |
|
Initialization vectors and chaining |
|
|
80 | (1) |
|
|
80 | (2) |
|
International Data Encryption Algorithm |
|
|
82 | (1) |
|
Advanced Encryption Standard |
|
|
83 | (1) |
|
|
83 | (1) |
|
|
83 | (1) |
|
|
84 | (1) |
|
|
84 | (1) |
|
|
85 | (1) |
|
|
85 | (1) |
|
|
85 | (1) |
|
|
86 | (1) |
|
|
86 | (1) |
|
|
86 | (1) |
|
|
86 | (1) |
|
Chosen plaintext and adaptive-chosen plaintext |
|
|
86 | (1) |
|
Chosen ciphertext and adaptive-chosen ciphertext |
|
|
86 | (1) |
|
Meet-in-the-middle attack |
|
|
87 | (1) |
|
|
87 | (1) |
|
Differential cryptanalysis |
|
|
87 | (1) |
|
|
87 | (1) |
|
|
87 | (1) |
|
Implementing cryptography |
|
|
87 | (1) |
|
|
88 | (1) |
|
Public Key Infrastructure |
|
|
89 | (1) |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
91 | (1) |
|
|
91 | (1) |
|
|
91 | (1) |
|
Summary of exam objectives |
|
|
91 | (1) |
|
Top five toughest questions |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
93 | (2) |
|
Chapter 6 Domain 6: Security Architecture and Design |
|
|
95 | (22) |
|
|
95 | (1) |
|
Secure system design concepts |
|
|
95 | (1) |
|
|
95 | (1) |
|
|
96 | (1) |
|
|
96 | (1) |
|
|
96 | (1) |
|
Secure Hardware Architecture |
|
|
97 | (1) |
|
The system unit and motherboard |
|
|
97 | (1) |
|
|
97 | (1) |
|
|
98 | (2) |
|
|
100 | (1) |
|
|
101 | (1) |
|
Secure operating system and software architecture |
|
|
102 | (1) |
|
|
102 | (1) |
|
|
103 | (1) |
|
|
103 | (1) |
|
|
104 | (1) |
|
|
105 | (1) |
|
|
105 | (1) |
|
System vulnerabilities, threats, and countermeasures |
|
|
105 | (1) |
|
|
105 | (1) |
|
|
105 | (1) |
|
|
105 | (1) |
|
|
106 | (1) |
|
|
106 | (1) |
|
Web architecture and attacks |
|
|
107 | (1) |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
109 | (1) |
|
|
109 | (1) |
|
Lattice-based access controls |
|
|
110 | (1) |
|
|
110 | (1) |
|
|
111 | (1) |
|
|
111 | (1) |
|
Evaluation methods, Certification, and Accreditation |
|
|
111 | (1) |
|
|
112 | (1) |
|
|
112 | (1) |
|
The International Common Criteria |
|
|
113 | (1) |
|
|
113 | (1) |
|
Certification and Accreditation |
|
|
113 | (1) |
|
Summary of exam objectives |
|
|
114 | (1) |
|
Top five toughest questions |
|
|
114 | (1) |
|
|
115 | (1) |
|
|
116 | (1) |
|
Chapter 7 Domain 7: Operations Security |
|
|
117 | (18) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
Mandatory leave/forced vacation |
|
|
118 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
Sensitive information/media security |
|
|
119 | (1) |
|
|
119 | (2) |
|
|
121 | (1) |
|
|
121 | (1) |
|
|
122 | (1) |
|
|
123 | (1) |
|
|
123 | (1) |
|
|
123 | (4) |
|
Incident response management |
|
|
127 | (1) |
|
|
127 | (2) |
|
|
129 | (2) |
|
Summary of exam objectives |
|
|
131 | (1) |
|
Top five toughest questions |
|
|
131 | (1) |
|
|
132 | (1) |
|
|
133 | (2) |
|
Chapter 8 Domain 8: Business Continuity and Disaster Recovery Planning |
|
|
135 | (20) |
|
|
135 | (1) |
|
BCP and DRP overview and process |
|
|
135 | (1) |
|
Business Continuity Planning |
|
|
135 | (1) |
|
Disaster Recovery Planning |
|
|
136 | (1) |
|
Relationship between BCP and DRP |
|
|
136 | (1) |
|
Disasters or disruptive events |
|
|
137 | (1) |
|
The Disaster Recovery Process |
|
|
138 | (1) |
|
|
139 | (1) |
|
|
140 | (1) |
|
Assessing the critical state |
|
|
140 | (1) |
|
Conduct Business Impact Analysis |
|
|
140 | (2) |
|
Identify Preventive Controls |
|
|
142 | (1) |
|
|
143 | (1) |
|
|
144 | (1) |
|
|
144 | (1) |
|
|
145 | (1) |
|
|
146 | (2) |
|
|
148 | (1) |
|
Continued BCP/DRP maintenance |
|
|
148 | (1) |
|
|
148 | (1) |
|
|
149 | (1) |
|
Specific BCP/DRP frameworks |
|
|
149 | (1) |
|
|
149 | (1) |
|
|
149 | (1) |
|
|
150 | (1) |
|
Summary of exam objectives |
|
|
150 | (1) |
|
Top five toughest questions |
|
|
151 | (1) |
|
|
151 | (2) |
|
|
153 | (2) |
|
Chapter 9 Domain 9: Legal, Regulations, Investigations, and Compliance |
|
|
155 | (16) |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
156 | (1) |
|
Religious and customary law |
|
|
156 | (1) |
|
Criminal, civil, and administrative law |
|
|
156 | (1) |
|
|
156 | (1) |
|
|
157 | (1) |
|
|
157 | (1) |
|
Information security aspects of law |
|
|
158 | (1) |
|
|
158 | (1) |
|
|
158 | (2) |
|
Import/export restrictions |
|
|
160 | (1) |
|
Legal aspects of investigations |
|
|
160 | (1) |
|
|
161 | (1) |
|
|
161 | (1) |
|
Entrapment and enticement |
|
|
161 | (1) |
|
Privacy, important laws, and regulations |
|
|
162 | (1) |
|
|
162 | (1) |
|
US Computer Fraud and Abuse Act |
|
|
163 | (1) |
|
|
163 | (1) |
|
|
164 | (1) |
|
|
164 | (1) |
|
|
164 | (1) |
|
Embedded device forensics |
|
|
165 | (1) |
|
Security and third parties |
|
|
165 | (1) |
|
Service provider contractual security |
|
|
165 | (1) |
|
|
166 | (1) |
|
|
166 | (1) |
|
The (ISC)2 © Code of Ethics |
|
|
166 | (1) |
|
Computer Ethics Institute |
|
|
167 | (1) |
|
IAB's Ethics and the Internet |
|
|
168 | (1) |
|
Summary of exam objectives |
|
|
168 | (1) |
|
Top five toughest questions |
|
|
168 | (1) |
|
|
169 | (1) |
|
|
170 | (1) |
|
Chapter 10 Domain 10: Physical (Environmental) Security |
|
|
171 | (16) |
|
|
171 | (1) |
|
|
171 | (1) |
|
|
171 | (1) |
|
|
171 | (1) |
|
|
172 | (1) |
|
|
172 | (1) |
|
|
172 | (1) |
|
|
172 | (1) |
|
Smart cards and magnetic stripe cards |
|
|
173 | (1) |
|
|
173 | (1) |
|
|
173 | (1) |
|
|
174 | (1) |
|
Motion detectors and other perimeter alarms |
|
|
174 | (1) |
|
|
174 | (1) |
|
Walls, floors, and ceilings |
|
|
174 | (1) |
|
|
175 | (1) |
|
|
175 | (1) |
|
Site selection, design, and configuration |
|
|
175 | (1) |
|
|
175 | (1) |
|
Site design and configuration issues |
|
|
175 | (1) |
|
|
176 | (1) |
|
|
176 | (1) |
|
|
176 | (1) |
|
Drive and tape encryption |
|
|
177 | (1) |
|
Media storage and transportation |
|
|
177 | (1) |
|
Media cleaning and destruction |
|
|
177 | (1) |
|
|
178 | (1) |
|
|
178 | (1) |
|
|
178 | (1) |
|
Heat, flame, and smoke detectors |
|
|
179 | (1) |
|
Personnel safety, training, and awareness |
|
|
179 | (1) |
|
ABCD fires and suppression |
|
|
180 | (1) |
|
Types of fire suppression agents |
|
|
180 | (3) |
|
Summary of Exam Objectives |
|
|
183 | (1) |
|
Top five toughest questions |
|
|
183 | (1) |
|
|
184 | (3) |
Index |
|
187 | |