CISSP E-Book

James Michael Stewart

• Herausgeber: John Wiley & Sons
• Kategorie: Wissenschaft und neue Technologien
• Sprache: Englisch

Seitenzahl: 1652

Veröffentlichungsjahr: 2011

Beschreibung

Totally updated for 2011, here's the ultimate study guide forthe CISSP exam Considered the most desired certification for IT securityprofessionals, the Certified Information Systems SecurityProfessional designation is also a career-booster. Thiscomprehensive study guide covers every aspect of the 2011 exam andthe latest revision of the CISSP body of knowledge. It offersadvice on how to pass each section of the exam and featuresexpanded coverage of biometrics, auditing and accountability,software security testing, and other key topics. Included is a CDwith two full-length, 250-question sample exams to test yourprogress. * CISSP certification identifies the ultimate IT securityprofessional; this complete study guide is fully updated to coverall the objectives of the 2011 CISSP exam * Provides in-depth knowledge of access control, applicationdevelopment security, business continuity and disaster recoveryplanning, cryptography, Information Security governance and riskmanagement, operations security, physical (environmental) security,security architecture and design, and telecommunications andnetwork security * Also covers legal and regulatory investigation andcompliance * Includes two practice exams and challenging review questions onthe CD Professionals seeking the CISSP certification will boost theirchances of success with CISSP: Certified Information SystemsSecurity Professional Study Guide, 5th Edition.

Leseprobe

Contents

Introduction

Chapter 1: Accountability and Access Control

Access Control Overview

Identification and Authentication Techniques

Access Control Techniques

Access Control Methodologies and Implementation

Access Control Administration

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 2: Attacks and Monitoring

Monitoring

Intrusion Detection

IDS-Related Tools

Penetration Testing

Methods of Attack

Access Control Compensations

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 3: ISO Model, Protocols, Network Security, and Network Infrastructure

OSI Model

Communications and Network Security

Internet/Intranet/Extranet Components

Remote Access Security Management

Network and Protocol Security Mechanisms

Avoiding Single Points of Failure

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 4: Communications Security and Countermeasures

Virtual Private Network (VPN)

Network Address Translation

Switching Technologies

WAN Technologies

Miscellaneous Security Control Characteristics

Managing Email Security

Securing Voice Communications

Security Boundaries

Network Attacks and Countermeasures

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 5: Security Management Concepts and Principles

Security Management Concepts and Principles

Protection Mechanisms

Change Control/Management

Data Classification

Planning to Plan

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 6: Asset Value, Policies, and Roles

Employment Policies and Practices

Security Roles

Security Management Planning

Policies, Standards, Baselines, Guidelines, and Procedures

Risk Management

Security Awareness Training

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 7: Data and Application Security Issues

Application Issues

Databases and Data Warehousing

Data/Information Storage

Knowledge-Based Systems

Systems Development Controls

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 8: Malicious Code and Application Attacks

Malicious Code

Password Attacks

Denial-of-Service Attacks

Application Attacks

Web Application Security

Reconnaissance Attacks

Masquerading Attacks

Decoy Techniques

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 9: Cryptography and Symmetric Key Algorithms

Historical Milestones in Cryptography

Cryptographic Basics

Modern Cryptography

Symmetric Cryptography

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 10: PKI and Cryptographic Applications

Asymmetric Cryptography

Hash Functions

Digital Signatures

Public Key Infrastructure

Applied Cryptography

Cryptographic Attacks

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 11: Principles of Computer Design

Computer Architecture

Security Protection Mechanisms

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 12: Principles of Security Models

Security Models

Objects and Subjects

Understanding System Security Evaluation

Common Flaws and Security Issues

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 13: Administrative Management

Operations Security Concepts

Personnel Controls

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 14: Auditing and Monitoring

Auditing

Monitoring

Monitoring Tools and Techniques

Penetration-Testing Techniques

Inappropriate Activities

Indistinct Threats and Countermeasures

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 15: Business Continuity Planning

Business Continuity Planning

Project Scope and Planning

Business Impact Assessment

Continuity Planning

BCP Documentation

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 16: Disaster Recovery Planning

The Nature of Disaster

Recovery Strategy

Recovery Plan Development

Training and Documentation

Testing and Maintenance

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 17: Law and Investigations

Categories of Laws

Laws

Investigations

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 18: Incidents and Ethics

Major Categories of Computer Crime

Incident Handling

Ethics

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Chapter 19: Physical Security Requirements

Facility Requirements

Forms of Physical Access Controls

Technical Controls

Environment and Life Safety

Equipment Failure

Summary

Exam Essentials

Written Lab

Answers to Written Lab

Review Questions

Answers to Review Questions

Appendix: About the Companion CD

Index

Advertisement

Perf Card & Objectives Map

Glossary

Acquisitions Editor: Jeff Kellum

Development Editor: Rob Truhn

Technical Editor: Darril Gibson

Production Editor: Eric Charbonneau

Copy Editor: Judy Flynn

Editorial Manager: Pete Gaughan

Production Manager: Tim Tate

Vice President and Executive Group Publisher: Richard Swadley

Vice President and Publisher: Neil Edde

Media Project Manager 1: Laura Moss-Hollister

Media Associate Producer: Shawn Patrick

Media Quality Assurance: Marilyn Hummel

Book Designer: Judy Fung

Proofreader: Nancy Bell

Indexer: Nancy Guenther

Project Coordinator, Cover: Katie Crocker

Cover Designer: Ryan Sneed

Copyright © 2011 by Wiley Publishing, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-0-470-94498-1

ISBN: 978-1-118-02825-4 (ebk)

ISBN: 978-1-118-02827-8 (ebk)

ISBN: 978-1-118-02826-1 (ebk)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, [phone], fax [phone]. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, [phone], fax [phone], or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at [phone], outside the U.S. at [phone] or fax [phone].

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Library of Congress Cataloging-in-Publication Data is available from the publisher.

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CISSP is a registered trademark of International Information Systems Security Certification Consortium, Inc. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.

Dear Reader,

Thank you for choosing CISSP: Certified Information Systems Security Professional Study Guide. This book is part of a family of premium-quality Sybex books, all of which are written by outstanding authors who combine practical experience with a gift for teaching.

Sybex was founded in 1976. More than 30 years later, we’re still committed to producing consistently exceptional books. With each of our titles, we’re working hard to set a new standard for the industry. From the paper we print on, to the authors we work with, our goal is to bring you the best books available.

I hope you see all that reflected in these pages. I’d be very interested to hear your comments and get your feedback on how we’re doing. Feel free to let me know what you think about this or any other Sybex book by sending me an email at [email protected]. If you think you’ve found a technical error in this book, please visit http://sybex.custhelp.com. Customer feedback is critical to our efforts at Sybex.

Best regards,

Neil Edde

Vice President and Publisher

Sybex, an Imprint of Wiley

To Cathy, whenever there is trouble, just remember “Some beach, somewhere . . .”

—James Michael Stewart

To my Mom, Cecilia Katherine: the world is not as bright without you in it anymore, and we all still miss you every day.

—Ed Tittel

To my family: Renee, Richard, Matthew, and Christopher, who lovingly put up with me during the hours I spent buried in my laptop writing this book.

—Mike Chapple

Acknowledgments

I hope our efforts to improve this study guide will lend themselves handily to your understanding and comprehension of the wide berth of CISSP concepts. I’d like to express my thanks to Sybex for continuing to support this project. Thanks to Ed Tittel and Mike Chapple for continuing to contribute to this project. Also thanks to all my CISSP course students who have provided their insight and input to improve my training courseware and ultimately this tome. Extra thanks to the 5th Edition Technical Editor, Darril Gibson, who performed amazing feats in guiding us to improve this book.

To my wonderful wife, Cathy, our life together is just getting started. To my son, Xzavier Slayde, and daughter, Remington Annaliese, may you grow to be more than we could imagine. To my parents, Dave and Sue, thanks for your love and consistent support. To Mark, as best friends go, it could’ve been worse. And finally, as always, to Elvis—all hail the King!

—James Michael Stewart

Thanks to both Michael Stewart and Mike Chapple for continuing to keep me involved in this project. Michael continues to teach CISSP courses with amazing frequency, which provides us with a lifeline to the hard-working professionals in the trenches for whom this credential means so much. Congrats again to Michael on another addition to his family; my son, Gregory, is now in first grade and the time just keeps flying by. May the months and years slip by as pleasantly and painlessly for you as they have for us. Next, thanks to the folks at Sybex, especially Jeff Kellum for rounding us all up and keeping us headed in the same direction and for his excellent view of where we need to take this book. Finally, I’d like to thank my loving and lovely wife, Dina, for all the great things she does to make family life so comfortable, clean, interesting and fun.

—Ed Tittel

Special thanks go to the information security team at the University of Notre Dame. Gary Dobbins, Bob Winding, David Seidl, and Robert Riley provided hours of interesting conversation and debate on security issues that inspired and informed much of the material in this book.

I would like to thank the team at Wiley who provided invaluable assistance throughout the book development process. I also owe a debt of gratitude to my literary agent, Carole Jelen of Waterside Productions. My coauthors, Ed Tittel and James Michael Stewart, have worked with me ever since we published the first edition of this book together eight years ago. I’d also like to thank the many people who participated in the production of this book but whom I never had the chance to meet: the graphics team, the production staff, and all of those involved in bringing this book to press.

—Mike Chapple

About the Authors

James Michael Stewart,CISSP, has been writing and training for more than 16 years, with a current focus on security. He has been teaching CISSP training courses since 2002, not to mention other courses on Windows security and ethical hacking/penetration testing. He is the author of several books and courseware sets on security certification, Microsoft topics, and network administration. More information about Michael can be found at his website: www.impactonline.com.

Ed Tittel is a full-time freelance writer, trainer, and consultant specializing in matters related to information security, markup languages, and networking technologies. He is a regular contributor to numerous TechTarget websites (and keeps updating his security certification survey for SearchSecurity.com), teaches online security and technology courses for HP, and enjoys his occasional gigs as an expert witness on Web technologies from the mid-1990s when he was lucky enough to write a raft of books in that arena. Ed’s professional bio and other information are available at www.edtittel.com.

Mike Chapple,CISSP, PhD, is an IT professional with the University of Notre Dame. In the past, he was chief information officer of Brand Institute and an information security researcher with the National Security Agency and the U.S. Air Force. His primary areas of expertise include network intrusion detection and access controls. Mike is a frequent contributor to TechTarget’s SearchSecurity site and the author of several information security titles including The GSEC Prep Guide from Wiley and Information Security Illuminated from Jones and Bartlett Publishers.

Introduction

The CISSP: Certified Information Systems Security Professional Study Guide, 5th Edition, offers you a solid foundation for the Certified Information Systems Security Professional (CISSP) exam. By purchasing this book, you’ve shown a willingness to learn and a desire to develop the skills you need to achieve this certification. This introduction provides you with a basic overview of this book and the CISSP exam.

This book is designed for readers and students who want to study for the CISSP certification exam. If your goal is to become a certified security professional, then the CISSP certification and this study guide are for you. The purpose of this book is to adequately prepare you to take the CISSP exam.

Before you dive into this book, you need to have accomplished a few tasks on your own. You need to have a general understanding of IT and of security. You should have the necessary five years of experience (or four years if you have a college degree) in one of the 10 domains covered by the CISSP exam. If you are qualified to take the CISSP exam according to (ISC)2, then you are sufficiently prepared to use this book to study for the CISSP exam. For more information on (ISC)2, see the next section.

(ISC)2

The CISSP exam is governed by the International Information Systems Security Certification Consortium (ISC)2 organization. (ISC)2 is a global not-for-profit organization. It has four primary mission goals:

Maintain the Common Body of Knowledge (CBK) for the field of information systems security.Provide certification for information systems security professionals and practitioners.Conduct certification training and administer the certification exams.Oversee the ongoing accreditation of qualified certification candidates through continued education.

The (ISC)2 is operated by a board of directors elected from the ranks of its certified practitioners. You can obtain more information about (ISC)2 from its website at www.isc2.org.

CISSP and SSCP

(ISC)2 supports and provides two primary certifications: CISSP and SSCP. These certifications are designed to verify the knowledge and skills of IT security professionals across all industries. The Certified Information Systems Security Professional credential is for security professionals responsible for designing and maintaining security infrastructure within an organization. The System Security Certified Practitioner (SSCP) is a credential for security professionals responsible for implementing or operating a security infrastructure in an organization.

The CISSP certification covers material from the 10 CBK domains:

Access ControlTelecommunications and Network SecurityInformation Security Governance and Risk ManagementApplication Development SecurityCryptographySecurity Architecture and DesignOperations SecurityBusiness Continuity and Disaster Recovery PlanningLegal, Regulations, Investigations, and CompliancePhysical (Environmental) Security

The SSCP certification covers material from seven CBK domains:

Access ControlsAdministrationAudit and MonitoringCryptographyData CommunicationsMalicious Code/MalwareRisk, Response, and Recovery

The content for the CISSP and SSCP domains overlap significantly, but the focus is different for each set of domains. The CISSP focuses on theory and design, whereas the SSCP focuses more on implementation and best practices. This book focuses only on the domains for the CISSP exam.

Prequalifications

(ISC)2 has defined several qualification requirements you must meet to become a CISSP. First, you must be a practicing security professional with at least five years’ experience or with four years’ experience and a recent IT or IS degree. Professional experience is defined as security work performed for salary or commission within one or more of the 10 CBK domains.

Second, you must agree to adhere to a formal code of ethics. The CISSP Code of Ethics is a set of guidelines the (ISC)2 wants all CISSP candidates to follow to maintain professionalism in the field of information systems security. You can find it in the Information section on the (ISC)2 website at www.isc2.org.

(ISC)2 also offers an entry program known as an Associate of (ISC)2. This program allows someone without any or enough experience to qualify as a CISSP to take the CISSP exam anyway and then obtain experience afterward. Associates are granted six years to obtain five years of security experience. Only after providing proof of such experience, usually by means of endorsement and a resume, can the individual be awarded CISSP certification.

To sign up, visit the (ISC)2 website, and follow the instructions listed there for registering to take the CISSP exam (the link reads “Register Now for CISSP Certification Exams”). You’ll provide your contact information, payment details, and security-related professional experience. You’ll also select one of the available time and location settings for the exam. Once (ISC) approves your application to take the exam, you’ll receive a confirmation email with all the details you’ll need to find the testing center and take the exam.