CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide E-Book

James Michael Stewart

• Herausgeber: John Wiley & Sons
• Kategorie: Wissenschaft und neue Technologien
• Sprache: Englisch

Seitenzahl: 1873

Veröffentlichungsjahr: 2015

Beschreibung

CISSP Study Guide - fully updated for the 2015 CISSP Body of Knowledge CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide, 7th Edition has been completely updated for the latest 2015 CISSP Body of Knowledge. This bestselling Sybex study guide covers 100% of all exam objectives. You'll prepare for the exam smarter and faster with Sybex thanks to expert content, real-world examples, advice on passing each section of the exam, access to the Sybex online interactive learning environment, and much more. Reinforce what you've learned with key topic exam essentials and chapter review questions. Along with the book, you also get access to Sybex's superior online interactive learning environment that includes: * Four unique 250 question practice exams to help you identify where you need to study more. Get more than 90 percent of the answers correct, and you're ready to take the certification exam. * More than 650 Electronic Flashcards to reinforce your learning and give you last-minute test prep before the exam * A searchable glossary in PDF to give you instant access to the key terms you need to know for the exam Coverage of all of the exam topics in the book means you'll be ready for: * Security and Risk Management * Asset Security * Security Engineering * Communication and Network Security * Identity and Access Management * Security Assessment and Testing * Security Operations * Software Development Security

Leseprobe

CISSP®Certified Information Systems Security Professional Study Guide

Seventh Edition

James Michael Stewart

Mike Chapple

Darril Gibson

Development Editor: Alexa Murphy

Book Designers: Judy Fung and Bill Gibson

Technical Editors: David Seidl, Brian O'Hara, Paul Calatayud

Proofreaders: Josh Chase, Sarah Kaikini and Louise Watson, Word One New York

Production Editor: Rebecca Anderson

Copy Editors: Elizabeth Welch, Linda Recktenwald

Indexer: J & J Indexing

Editorial Manager: Mary Beth Wakefield

Project Coordinator, Cover: Brent Savage

Production Manager: Kathleen Wisor

Cover Designer: Wiley

Associate Publisher: Jim Minatel

Cover Image: ©Getty Images Inc./Jeremy Woodhouse

Media Supervising Producer: Richard Graves

Copyright © 2015 by John Wiley & Sons, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-1-119-04271-6

ISBN: 978-1-119-04272-3 (ebk.)

ISBN: 978-1-119-04275-4 (ebk.)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, [phone], fax [phone]. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, [phone], fax [phone], or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at [phone], outside the U.S. at [phone] or fax [phone].

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com For more information about Wiley products, visit www.wiley.com.

Library of Congress Control Number: 2015948797

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CISSP is a registered certification mark of (ISC)², Inc. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

Disclaimer: John Wiley and Sons, Inc., in association with (ISC)2, has prepared this study guide for general information and for use as training for the Official (ISC)2 CISSP® CBK® and not as legal or operational advice. This is a study guide only, and does not imply that any questions or topics from this study guide will appear on the actual (ISC)2 CISSP® certification examination. The study guide was not prepared with writers or editors associated with developing the (ISC)2 CISSP certification examination. The study guide may contain errors and omissions. (ISC)2 does not guarantee a passing score on the exam or provide any assurance or guarantee relating to the use of this study guide and preparing for the (ISC)2 CISSP® certification examination.

The users of the Official CISSP: Certified Information Systems Security Professional Study Guide, Seventh Edition agree that John Wiley and Sons, Inc.. and (ISC)2 are not liable for any indirect, special, incidental, or consequential damages up to and including negligence that may arise from use of these materials. Under no circumstances, including negligence, shall John Wiley and Sons, Inc.or (ISC)2, its officers, directors, agents, author or anyone else involved in creating, producing or distributing these materials be liable for any direct, indirect, incidental, special or consequential damages that may result from the use of this study guide.

Whenever we look toward the future, we have to first look back and think about where we came from. Back in 1989, (ISC)2 was established by a handful of passionate volunteers who wanted to create a set of standards for a new concept, not yet a full-fledged career field, called information security. In the minds of those volunteers, having the initial 500 applicants sign up to take the Certified Information Systems Security Professional (CISSP®) exam was considered quite a success. Little did they imagine that 26 years later, not only would those 500 applicants grow to a cadre of 100,000 CISSP credential holders across more than 160 countries, the CISSP would also become recognized as the standard certification for the information security industry.

Advancements in technology bring about the need for updates, and we work tirelessly to ensure that our content is always relevant to the industry. As the information security industry continues to transition, and cybersecurity becomes a global focus, the CISSP Common Body of Knowledge (CBK) is even more relevant to today's challenges.

The new (ISC)² CISSP Study Guide is part of a concerted effort to enhance and increase our education and training offerings. The CISSP Study Guide reflects the most relevant topics in our ever-changing field and is a learning tool for (ISC)² certification exam candidates. It provides a comprehensive study guide to the eight CISSP domains and the most current topics in the industry.

If you are on the path to getting certified, you have no doubt heard of the (ISC)2Official Guides to the CBK. While our Official Guides to the CBK are the authoritative references to the Common Body of Knowledge, the new study guides are learning tools focused on educating the reader in preparation for exams. As an ANSI accredited certification body under the ISO/IEC 17024 standard, (ISC)² does not teach the CISSP exam. Rather, we strive to generate or endorse content that teaches the CISSP's CBK. Candidates who have a strong understanding of the CBK are best prepared for success with the exam and within the profession.

(ISC)2 is also breaking new ground by partnering with Wiley, a recognized industry leading brand. Developing a partnership with renowned content provider Wiley allows (ISC)2 to grow its offerings on the scale required to keep our content fresh and aligned with the constantly changing environment. The power of combining the expertise of our two organizations benefits certification candidates and the industry alike.

I look forward to your feedback on the (ISC)2CISSP Study Guide. Congratulations on taking the first step toward earning the certification that SC Magazine named “Best Professional Certification Program.” Good luck with your studies!

Best Regards,

David P. Shearer, CISSP, PMP

CEO

(ISC)2

To Cathy, your perspective on the world and life often surprises me, challenges me, and makes me love you even more.

—James Michael Stewart

To Dewitt Latimer, my mentor, friend, and colleague. I miss you dearly.

—Mike Chapple

To Nimfa: Thanks for sharing your life with me for the past 23 years and letting me share mine with you.

—Darril Gibson

Acknowledgments

I’d like to express my thanks to Sybex for continuing to support this project. Thanks to Mike Chapple and Darril Gibson for continuing to contribute to this project. Thanks also to all my CISSP course students who have provided their insight and input to improve my training courseware and ultimately this tome. Extra thanks to the seventh edition developmental editor, Alexa Murphy, and technical editor, David Seidl, who performed amazing feats in guiding us to improve this book. Thanks as well to my agent, Carole Jelen, for continuing to assist in nailing down these projects.

To my adoring wife, Cathy: Building a life and a family together has been more wonderful than I could have ever imagined. To Slayde and Remi: You are growing up so fast and learning at an outstanding pace, and you continue to delight and impress me daily. You are both growing into amazing individuals. To my mom, Johnnie: It is wonderful to have you close by. To Mark: No matter how much time has passed or how little we see each other, I have been and always will be your friend. And finally, as always, to Elvis: You were way ahead of the current bacon obsession, with your peanut butter-banana-bacon sandwich; I think that’s proof you traveled through time!

—James Michael Stewart

Special thanks go to the information security team at the University of Notre Dame, who provided hours of interesting conversation and debate on security issues that inspired and informed much of the material in this book.

I would like to thank the team at Wiley who provided invaluable assistance throughout the book development process. I also owe a debt of gratitude to my literary agent, Carole Jelen of Waterside Productions. My coauthors, James Michael Stewart and Darril Gibson, were great collaborators. David Seidl, our diligent and knowledgeable technical editor, provided valuable insight as we brought this edition to press.

I’d also like to thank the many people who participated in the production of this book but whom I never had the chance to meet: the graphics team, the production staff, and all of those involved in bringing this book to press.

—Mike Chapple

Thanks to Carol Long and Carole Jelen for helping get this update in place before (ISC)2 released the objectives. This helped us get a head start on this new edition and we appreciate your efforts. It’s been a pleasure working with talented people like James Michael Stewart and Mike Chapple. Thanks to both of you for all your work and collaborative efforts on this project. The technical editor, Dave Seidl, provided us with some outstanding feedback and this book is better because of his efforts. Thanks again, David. Last, thanks to the team at Sybex (including project managers, editors, and graphics artists) for all the work you did helping us get this book to print.

—Darril Gibson

About the Authors

James Michael Stewart, CISSP, has been writing and training for more than 20 years, with a current focus on security. He has been teaching CISSP training courses since 2002, not to mention other courses on Internet security and ethical hacking/penetration testing. He is the author of and contributor to more than 75 books and numerous courseware sets on security certification, Microsoft topics, and network administration. More information about Michael can be found at his website:www.impactonline.com.

Mike Chapple, CISSP, Ph.D., is Senior Director for IT Service Delivery at the University of Notre Dame. In the past, he was chief information officer of Brand Institute and an information security researcher with the National Security Agency and the U.S. Air Force. His primary areas of expertise include network intrusion detection and access controls. Mike is a frequent contributor to TechTarget’s SearchSecurity site and the author of more than 25 books including CompTIA Security+ Training Kit and Information Security Illuminated. Mike can be found on Twitter @mchapple.

Darril Gibson, CISSP, is the CEO of YCDA, LLC (short for You Can Do Anything) and he has authored or coauthored more than 35 books. Darril regularly writes, consults, and teaches on a wide variety of technical and security topics and holds several certifications. He regularly posts blog articles at http://blogs.getcertifiedgetahead.com/ about certification topics and uses that site to help people stay abreast of changes in certification exams. He loves hearing from readers, especially when they pass an exam after using one of his books, and you can contact him through the blogging site.

Contents

Introduction

Assessment Test

Chapter 1 Security Governance Through Principles and Policies

Understand and Apply Concepts of Confidentiality, Integrity, and Availability

Apply Security Governance Principles

Develop and Implement Documented Security Policy, Standards, Procedures, and Guidelines

Understand and Apply Threat Modeling

Integrate Security Risk Considerations into Acquisition Strategy and Practice

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 2 Personnel Security and Risk Management Concepts

Contribute to Personnel Security Policies

Security Governance

Understand and Apply Risk Management Concepts

Establish and Manage Information Security Education, Training, and Awareness

Manage the Security Function

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 3 Business Continuity Planning

Planning for Business Continuity

Project Scope and Planning

Business Impact Assessment

Continuity Planning

Plan Approval and Implementation

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 4 Laws, Regulations, and Compliance

Categories of Laws

Laws

Compliance

Contracting and Procurement

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 5 Protecting Security of Assets

Classifying and Labeling Assets

Identifying Data Roles

Protecting Privacy

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 6 Cryptography and Symmetric Key Algorithms

Historical Milestones in Cryptography

Cryptographic Basics

Modern Cryptography

Symmetric Cryptography

Cryptographic Life Cycle

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 7 PKI and Cryptographic Applications

Asymmetric Cryptography

Hash Functions

Digital Signatures

Public Key Infrastructure

Asymmetric Key Management

Applied Cryptography

Cryptographic Attacks

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 8 Principles of Security Models, Design, and Capabilities

Implement and Manage Engineering Processes Using Secure Design Principles

Understand the Fundamental Concepts of Security Models

Select Controls and Countermeasures Based on Systems Security Evaluation Models

Understand Security Capabilities of Information Systems

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 9 Security Vulnerabilities, Threats, and Countermeasures

Assess and Mitigate Security Vulnerabilities

Client-Based

Server-Based

Database Security

Distributed Systems

Industrial Control Systems

Assess and Mitigate Vulnerabilities in Web-Based Systems

Assess and Mitigate Vulnerabilities in Mobile Systems

Assess and Mitigate Vulnerabilities in Embedded Devices and Cyber-Physical Systems

Essential Security Protection Mechanisms

Common Architecture Flaws and Security Issues

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 10 Physical Security Requirements

Apply Secure Principles to Site and Facility Design

Design and Implement Physical Security

Implement and Manage Physical Security

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 11 Secure Network Architecture and Securing Network Components

OSI Model

TCP/IP Model

Converged Protocols

Wireless Networks

General Wi-Fi Security Procedure

Cabling, Wireless, Topology, and Communications Technology

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 12 Secure Communications and Network Attacks

Network and Protocol Security Mechanisms

Secure Voice Communications

Multimedia Collaboration

Manage Email Security

Remote Access Security Management

Virtual Private Network

Virtualization

Network Address Translation

Switching Technologies

WAN Technologies

Miscellaneous Security Control Characteristics

Security Boundaries

Prevent or Mitigate Network Attacks

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 13 Managing Identity and Authentication

Controlling Access to Assets

Comparing Identification and Authentication

Implementing Identity Management

Managing the Identity and Access Provisioning Life Cycle

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 14 Controlling and Monitoring Access

Comparing Access Control Models

Understanding Access Control Attacks

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 15 Security Assessment and Testing

Building a Security Assessment and Testing Program

Performing Vulnerability Assessments

Testing Your Software

Implementing Security Management Processes

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 16 Managing Security Operations

Applying Security Operations Concepts

Provisioning and Managing Resources

Managing Configuration

Managing Change

Managing Patches and Reducing Vulnerabilities

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 17 Preventing and Responding to Incidents

Managing Incident Response

Implementing Preventive Measures

Logging, Monitoring, and Auditing

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 18 Disaster Recovery Planning

The Nature of Disaster

Understand System Resilience and Fault Tolerance

Recovery Strategy

Recovery Plan Development

Training, Awareness, and Documentation

Testing and Maintenance

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 19 Incidents and Ethics

Investigations

Major Categories of Computer Crime

Incident Handling

Ethics

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 20 Software Development Security

Introducing Systems Development Controls

Establishing Databases and Data Warehousing

Storing Data and Information

Understanding Knowledge-Based Systems

Summary

Exam Essentials

Written Lab

Review Questions

Chapter 21 Malicious Code and Application Attacks

Malicious Code

Password Attacks

Application Attacks

Web Application Security

Reconnaissance Attacks

Masquerading Attacks

Summary

Exam Essentials

Written Lab

Review Questions

Appendix A Answers to Review Questions

Chapter 1: Security Governance Through Principles and Policies

Chapter 2: Personnel Security and Risk Management Concepts

Chapter 3: Business Continuity Planning

Chapter 4: Laws, Regulations, and Compliance

Chapter 5: Protecting Security of Assets

Chapter 6: Cryptography and Symmetric Key Algorithms

Chapter 7: PKI and Cryptographic Applications

Chapter 8: Principles of Security Models, Design, and Capabilities

Chapter 9: Security Vulnerabilities, Threats, and Countermeasures

Chapter 10: Physical Security Requirements

Chapter 11: Secure Network Architecture and Securing Network Components

Chapter 12: Secure Communications and Network Attacks

Chapter 13: Managing Identity and Authentication

Chapter 14: Controlling and Monitoring Access