Acknowledgments |
|
xvii | |
About the authors |
|
xix | |
|
|
1 | (6) |
|
How to Prepare for the Exam |
|
|
2 | (1) |
|
|
2 | (1) |
|
|
2 | (1) |
|
|
3 | (1) |
|
|
3 | (1) |
|
|
3 | (3) |
|
Steps to Becoming a CISSP® |
|
|
3 | (1) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
Chapter 2 Domain 1: Information security governance and risk management |
|
|
7 | (30) |
|
Unique Terms and Definitions |
|
|
7 | (1) |
|
|
7 | (1) |
|
Cornerstone Information Security Concepts |
|
|
8 | (5) |
|
Confidentiality, Integrity, and Availability |
|
|
8 | (2) |
|
Identity and Authentication, Authorization, and Accountability |
|
|
10 | (3) |
|
|
13 | (9) |
|
|
13 | (1) |
|
Threats and Vulnerabilities |
|
|
13 | (1) |
|
Risk = Threat x Vulnerability |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
15 | (1) |
|
Calculating Annualized Loss Expectancy |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
19 | (1) |
|
Qualitative and Quantitative Risk Analysis |
|
|
20 | (1) |
|
The Risk Management Process |
|
|
21 | (1) |
|
Information Security Governance |
|
|
22 | (9) |
|
Security Policy and Related Documents |
|
|
22 | (2) |
|
Security Awareness and Training |
|
|
24 | (1) |
|
Roles and Responsibilities |
|
|
25 | (1) |
|
Compliance with Laws and Regulations |
|
|
26 | (1) |
|
|
26 | (1) |
|
Due Care and Due Diligence |
|
|
26 | (1) |
|
|
27 | (1) |
|
Outsourcing and Offshoring |
|
|
27 | (1) |
|
Auditing and Control Frameworks |
|
|
28 | (2) |
|
Certification and Accreditation |
|
|
30 | (1) |
|
|
31 | (1) |
|
The (ISC)2 © Code of Ethics |
|
|
31 | (1) |
|
Summary of Exam Objectives |
|
|
32 | (1) |
|
|
32 | (2) |
|
Self Test Quick Answer Key |
|
|
34 | (3) |
|
Chapter 3 Domain 2: Access control |
|
|
37 | (54) |
|
Unique Terms and Definitions |
|
|
37 | (1) |
|
|
37 | (1) |
|
Cornerstone Access Control Concepts |
|
|
38 | (3) |
|
|
38 | (2) |
|
|
40 | (1) |
|
|
41 | (1) |
|
|
41 | (6) |
|
Discretionary Access Controls (DAC) |
|
|
42 | (1) |
|
Mandatory Access Controls (MAC) |
|
|
42 | (1) |
|
Non-Discretionary Access Control |
|
|
42 | (2) |
|
Content and Context-Dependent Access Controls |
|
|
44 | (1) |
|
Centralized Access Control |
|
|
44 | (1) |
|
Decentralized Access Control |
|
|
44 | (1) |
|
Access Control Protocols and Frameworks |
|
|
45 | (2) |
|
Procedural Issues for Access Control |
|
|
47 | (3) |
|
Labels, Clearance, Formal Access Approval, and Need to Know |
|
|
48 | (2) |
|
Rule-Based Access Controls |
|
|
50 | (1) |
|
|
50 | (1) |
|
Access Control Defensive Categories and Types |
|
|
50 | (3) |
|
|
51 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
|
52 | (1) |
|
|
52 | (1) |
|
|
52 | (1) |
|
Comparing Access Controls |
|
|
52 | (1) |
|
|
53 | (14) |
|
Type 1 Authentication Something You Know |
|
|
53 | (6) |
|
Type 2 Authentication Something You Have |
|
|
59 | (2) |
|
Type 3 Authentication Something You Are |
|
|
61 | (6) |
|
|
67 | (1) |
|
Access Control Technologies |
|
|
67 | (6) |
|
|
67 | (1) |
|
|
68 | (4) |
|
|
72 | (1) |
|
|
72 | (1) |
|
|
73 | (6) |
|
|
73 | (1) |
|
Black Hats and White Hats |
|
|
74 | (1) |
|
|
74 | (1) |
|
|
75 | (1) |
|
|
76 | (1) |
|
|
77 | (1) |
|
|
77 | (2) |
|
Phishers and Spear Phishers |
|
|
79 | (1) |
|
|
79 | (6) |
|
|
82 | (2) |
|
|
84 | (1) |
|
|
84 | (1) |
|
|
84 | (1) |
|
Summary of Exam Objectives |
|
|
85 | (1) |
|
|
85 | (3) |
|
Self Test Quick Answer Key |
|
|
88 | (3) |
|
Chapter 4 Domain 3: Cryptography |
|
|
91 | (40) |
|
Unique Terms and Definitions |
|
|
91 | (1) |
|
|
91 | (1) |
|
Cornerstone Cryptographic Concepts |
|
|
91 | (4) |
|
|
92 | (1) |
|
Confidentiality, Integrity, Authentication, and Non-Repudiation |
|
|
92 | (1) |
|
Confusion, Diffusion, Substitution, and Permutation |
|
|
92 | (1) |
|
|
93 | (1) |
|
Monoalphabetic and Polyalphabetic Ciphers |
|
|
93 | (1) |
|
|
93 | (1) |
|
|
93 | (2) |
|
|
95 | (1) |
|
|
95 | (10) |
|
|
95 | (1) |
|
|
96 | (1) |
|
Caesar Cipher and other Rotation Ciphers |
|
|
96 | (1) |
|
|
97 | (1) |
|
|
97 | (1) |
|
|
98 | (2) |
|
Book Cipher and Running-Key Cipher |
|
|
100 | (1) |
|
|
100 | (1) |
|
|
100 | (2) |
|
Hebern Machines and Purple |
|
|
102 | (3) |
|
|
105 | (1) |
|
|
105 | (8) |
|
|
106 | (1) |
|
Initialization Vectors and Chaining |
|
|
106 | (1) |
|
|
106 | (4) |
|
International Data Encryption Algorithm (IDEA) |
|
|
110 | (1) |
|
Advanced Encryption Standard (AES) |
|
|
110 | (3) |
|
|
113 | (1) |
|
|
113 | (1) |
|
|
113 | (3) |
|
|
114 | (2) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
117 | (1) |
|
|
117 | (3) |
|
|
117 | (1) |
|
|
117 | (1) |
|
Chosen Plaintext and Adaptive Chosen Plaintext |
|
|
118 | (1) |
|
Chosen Ciphertext and Adaptive Chosen Ciphertext |
|
|
118 | (1) |
|
Meet-in-the-middle Attack |
|
|
118 | (1) |
|
|
119 | (1) |
|
Differential Cryptanalysis |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
120 | (1) |
|
Implementing Cryptography |
|
|
120 | (7) |
|
|
120 | (1) |
|
|
121 | (1) |
|
|
122 | (1) |
|
Public Key Infrastructure |
|
|
122 | (1) |
|
|
122 | (2) |
|
|
124 | (1) |
|
|
124 | (1) |
|
|
125 | (1) |
|
|
125 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
Summary of Exam Objectives |
|
|
127 | (1) |
|
|
127 | (2) |
|
Self Test Quick Answer Key |
|
|
129 | (2) |
|
Chapter 5 Domain 4: Physical (Environmental) security |
|
|
131 | (34) |
|
Unique Terms and Definitions |
|
|
131 | (1) |
|
|
131 | (1) |
|
|
132 | (12) |
|
|
132 | (1) |
|
|
132 | (1) |
|
|
132 | (1) |
|
|
133 | (1) |
|
|
133 | (2) |
|
|
135 | (3) |
|
Smart Cards and Magnetic Stripe Cards |
|
|
138 | (1) |
|
|
138 | (2) |
|
|
140 | (1) |
|
|
140 | (1) |
|
Motion Detectors and Other Perimeter Alarms |
|
|
140 | (1) |
|
|
141 | (1) |
|
Walls, floors, and ceilings |
|
|
142 | (1) |
|
|
142 | (1) |
|
|
143 | (1) |
|
Restricted Areas and Escorts |
|
|
143 | (1) |
|
Site Selection, Design, and Configuration |
|
|
144 | (2) |
|
|
144 | (1) |
|
Site Design and Configuration Issues |
|
|
144 | (2) |
|
|
146 | (3) |
|
|
146 | (1) |
|
|
146 | (1) |
|
Drive and Tape Encryption |
|
|
146 | (1) |
|
Media Storage and Transportation |
|
|
147 | (1) |
|
Media Cleaning and Destruction |
|
|
147 | (2) |
|
|
149 | (11) |
|
|
149 | (2) |
|
|
151 | (1) |
|
Heat, Flame, and Smoke Detectors |
|
|
152 | (1) |
|
Safety Training and Awareness |
|
|
153 | (1) |
|
ABCD Fires and Suppression |
|
|
154 | (2) |
|
Types of Fire Suppression Agents |
|
|
156 | (4) |
|
Summary of Exam Objectives |
|
|
160 | (1) |
|
|
160 | (3) |
|
Self Test Quick Answer Key |
|
|
163 | (2) |
|
Chapter 6 Domain 5: Security architecture and design |
|
|
165 | (46) |
|
Unique Terms and Definitions |
|
|
165 | (1) |
|
|
165 | (1) |
|
Secure System Design Concepts |
|
|
166 | (2) |
|
|
166 | (1) |
|
|
166 | (1) |
|
|
167 | (1) |
|
|
167 | (1) |
|
|
168 | (1) |
|
Secure Hardware Architecture |
|
|
168 | (9) |
|
The System Unit and Motherboard |
|
|
168 | (1) |
|
|
169 | (1) |
|
|
170 | (2) |
|
|
172 | (2) |
|
|
174 | (3) |
|
Secure Operating System and Software Architecture |
|
|
177 | (6) |
|
|
178 | (1) |
|
Users and File Permissions |
|
|
178 | (3) |
|
|
181 | (1) |
|
|
182 | (1) |
|
System Vulnerabilities, Threats, and Countermeasures |
|
|
183 | (10) |
|
|
183 | (1) |
|
|
183 | (1) |
|
|
184 | (1) |
|
|
185 | (1) |
|
|
185 | (1) |
|
|
186 | (1) |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
189 | (1) |
|
|
190 | (1) |
|
|
191 | (2) |
|
|
193 | (1) |
|
|
193 | (9) |
|
Reading Down and Writing Up |
|
|
193 | (2) |
|
|
195 | (1) |
|
|
195 | (1) |
|
Lattice-Based Access Controls |
|
|
196 | (1) |
|
|
197 | (1) |
|
|
198 | (1) |
|
|
199 | (1) |
|
|
199 | (1) |
|
|
199 | (1) |
|
|
200 | (1) |
|
Zachman Framework for Enterprise Architecture |
|
|
200 | (1) |
|
|
200 | (1) |
|
Harrison-Ruzzo-Ullman Model |
|
|
201 | (1) |
|
|
202 | (1) |
|
Evaluation Methods, Certification, and Accreditation |
|
|
202 | (4) |
|
|
203 | (1) |
|
|
204 | (1) |
|
The International Common Criteria |
|
|
205 | (1) |
|
|
206 | (1) |
|
Certification and Accreditation |
|
|
206 | (1) |
|
Summary of Exam Objectives |
|
|
206 | (1) |
|
|
207 | (2) |
|
Self Test Quick Answer Key |
|
|
209 | (2) |
|
Chapter 7 Domain 6: Business continuity and disaster recovery planning |
|
|
211 | (44) |
|
Unique Terms and Definitions |
|
|
211 | (1) |
|
|
211 | (1) |
|
BCP and DRP Overview and Process |
|
|
212 | (11) |
|
Business Continuity Planning (BCP) |
|
|
212 | (1) |
|
Disaster Recovery Planning (DRP) |
|
|
213 | (1) |
|
Relationship between BCP and DRP |
|
|
213 | (1) |
|
Disasters or disruptive Events |
|
|
214 | (7) |
|
The Disaster Recovery Process |
|
|
221 | (2) |
|
|
223 | (18) |
|
|
224 | (3) |
|
|
227 | (1) |
|
Assessing the Critical State |
|
|
227 | (1) |
|
Conduct Business Impact Analysis (BIA) |
|
|
228 | (4) |
|
Identify Preventive Controls |
|
|
232 | (1) |
|
|
232 | (4) |
|
|
236 | (5) |
|
|
241 | (1) |
|
|
241 | (4) |
|
|
242 | (1) |
|
|
243 | (2) |
|
|
245 | (1) |
|
DRP Testing, Training, and Awareness |
|
|
245 | (3) |
|
|
246 | (2) |
|
|
248 | (1) |
|
|
248 | (1) |
|
Continued BCP/DRP Maintenance |
|
|
248 | (1) |
|
|
248 | (1) |
|
|
249 | (1) |
|
Specific BCP/DRP Frameworks |
|
|
249 | (2) |
|
|
249 | (1) |
|
|
250 | (1) |
|
|
250 | (1) |
|
|
251 | (1) |
|
Summary of Exam Objectives |
|
|
251 | (1) |
|
|
251 | (2) |
|
Self Test Quick Answer Key |
|
|
253 | (2) |
|
Chapter 8 Domain 7: Telecommunications and network security |
|
|
255 | (74) |
|
Unique Terms and Definitions |
|
|
255 | (1) |
|
|
255 | (1) |
|
Network Architecture and Design |
|
|
256 | (35) |
|
|
256 | (1) |
|
Fundamental Network Concepts |
|
|
256 | (3) |
|
|
259 | (2) |
|
|
261 | (1) |
|
|
262 | (1) |
|
Network Access, Internet and Transport Layer Protocols and Concepts |
|
|
263 | (13) |
|
Application Layer TCP/IP Protocols and Concepts |
|
|
276 | (5) |
|
|
281 | (2) |
|
LAN Technologies and Protocols |
|
|
283 | (2) |
|
LAN Physical Network Topologies |
|
|
285 | (3) |
|
WAN Technologies and Protocols |
|
|
288 | (3) |
|
Network Devices and Protocols |
|
|
291 | (21) |
|
|
291 | (1) |
|
|
292 | (1) |
|
|
293 | (1) |
|
|
294 | (1) |
|
|
295 | (4) |
|
|
299 | (7) |
|
|
306 | (1) |
|
|
306 | (1) |
|
Intrusion Detection Systems and Intrusion Prevention Systems |
|
|
306 | (3) |
|
|
309 | (1) |
|
|
310 | (1) |
|
|
311 | (1) |
|
|
312 | (12) |
|
Authentication Protocols and Frameworks |
|
|
312 | (2) |
|
|
314 | (2) |
|
|
316 | (1) |
|
Wireless Local Area Networks |
|
|
317 | (4) |
|
|
321 | (1) |
|
|
322 | (2) |
|
Summary of Exam Objectives |
|
|
324 | (1) |
|
|
325 | (2) |
|
Self Test Quick Answer Key |
|
|
327 | (2) |
|
Chapter 9 Domain 8: Application development security |
|
|
329 | (42) |
|
Unique Terms and Definitions |
|
|
329 | (1) |
|
|
329 | (1) |
|
|
330 | (5) |
|
Machine Code, Source Code, and Assemblers |
|
|
330 | (1) |
|
Compilers, Interpreters, and Bytecode |
|
|
330 | (1) |
|
Procedural and Object-Oriented Languages |
|
|
331 | (2) |
|
Fourth-generation Programming Language |
|
|
333 | (1) |
|
Computer-Aided Software Engineering (CASE) |
|
|
333 | (1) |
|
Top-Down versus Bottom-Up Programming |
|
|
333 | (1) |
|
Types of Publicly Released Software |
|
|
334 | (1) |
|
Application Development Methods |
|
|
335 | (11) |
|
|
336 | (1) |
|
|
337 | (2) |
|
Agile Software Development |
|
|
339 | (1) |
|
|
340 | (1) |
|
Rapid Application Development (RAD) |
|
|
341 | (1) |
|
|
341 | (1) |
|
|
342 | (4) |
|
|
346 | (1) |
|
Object-Orientated Design and Programming |
|
|
346 | (6) |
|
Object-Oriented Programming (OOP) |
|
|
346 | (3) |
|
|
349 | (2) |
|
Object-Oriented Analysis (OOA) and Object-Oriented Design (OOD) |
|
|
351 | (1) |
|
Software Vulnerabilities, Testing, and Assurance |
|
|
351 | (1) |
|
|
352 | (4) |
|
|
353 | (2) |
|
|
355 | (1) |
|
Software Capability Maturity Model (CMM) |
|
|
356 | (1) |
|
|
356 | (6) |
|
|
357 | (4) |
|
|
361 | (1) |
|
Database Replication and Shadowing |
|
|
361 | (1) |
|
Data Warehousing and Data Mining |
|
|
362 | (1) |
|
|
362 | (3) |
|
|
362 | (1) |
|
Artificial Neural Networks |
|
|
363 | (1) |
|
|
364 | (1) |
|
Genetic Algorithms and Programming |
|
|
365 | (1) |
|
Summary of Exam Objectives |
|
|
365 | (1) |
|
|
366 | (2) |
|
Self Test Quick Answer Key |
|
|
368 | (3) |
|
Chapter 10 Domain 9: Operations security |
|
|
371 | (34) |
|
Unique Terms and Definitions |
|
|
371 | (1) |
|
|
371 | (1) |
|
|
372 | (4) |
|
Administrative Personnel Controls |
|
|
372 | (3) |
|
|
375 | (1) |
|
Sensitive Information/Media Security |
|
|
376 | (2) |
|
|
376 | (2) |
|
|
378 | (5) |
|
|
379 | (2) |
|
|
381 | (2) |
|
|
383 | (7) |
|
Service Level Agreements (SLA) |
|
|
383 | (1) |
|
|
384 | (6) |
|
Incident Response Management |
|
|
390 | (8) |
|
|
391 | (2) |
|
|
393 | (5) |
|
Summary of Exam Objectives |
|
|
398 | (2) |
|
|
400 | (3) |
|
Self Test Quick Answer Key |
|
|
403 | (2) |
|
Chapter 11 Domain 10: Legal regulations, investigations, and compliance |
|
|
405 | (36) |
|
Unique Terms and Definitions |
|
|
405 | (1) |
|
|
406 | (1) |
|
|
406 | (1) |
|
|
406 | (1) |
|
|
406 | (1) |
|
|
407 | (1) |
|
|
407 | (1) |
|
Criminal, Civil, and Administrative Law |
|
|
407 | (2) |
|
|
408 | (1) |
|
|
408 | (1) |
|
|
409 | (1) |
|
Information Security Aspects of Law |
|
|
409 | (11) |
|
|
410 | (1) |
|
|
411 | (4) |
|
Import/export Restrictions |
|
|
415 | (1) |
|
|
416 | (3) |
|
|
419 | (1) |
|
Legal Aspects of Investigations |
|
|
420 | (9) |
|
|
420 | (3) |
|
|
423 | (1) |
|
|
423 | (2) |
|
|
425 | (1) |
|
|
426 | (1) |
|
|
426 | (2) |
|
Entrapment and enticement |
|
|
428 | (1) |
|
Important Laws and Regulations |
|
|
429 | (4) |
|
U.S. Computer Fraud and Abuse Act |
|
|
430 | (1) |
|
|
431 | (1) |
|
|
431 | (1) |
|
United States Breach Notification Laws |
|
|
432 | (1) |
|
|
433 | (2) |
|
Computer Ethics Institute |
|
|
433 | (1) |
|
IAB's Ethics and the Internet |
|
|
434 | (1) |
|
The (ISC)2 © Code of Ethics |
|
|
434 | (1) |
|
Summary of Exam Objectives |
|
|
435 | (1) |
|
|
436 | (2) |
|
Self Test Quick Answer Key |
|
|
438 | (3) |
Appendix: Self test |
|
441 | (48) |
Glossary |
|
489 | (36) |
Index |
|
525 | |