Author biography |
|
xv | |
|
Chapter 1 Domain 1: Security Risk Management |
|
|
1 | (32) |
|
|
2 | (1) |
|
Cornerstone Information Security Concepts |
|
|
3 | (1) |
|
Confidentiality, Integrity, and Availability |
|
|
3 | (1) |
|
Identity and Authentication, Authorization, and Accountability |
|
|
4 | (1) |
|
|
5 | (1) |
|
Least Privilege and Need to Know |
|
|
5 | (1) |
|
|
5 | (1) |
|
|
5 | (1) |
|
Legal and Regulatory Issues |
|
|
5 | (1) |
|
Compliance With Laws and Regulations |
|
|
6 | (1) |
|
|
6 | (1) |
|
Criminal, Civil, and Administrative Law |
|
|
7 | (1) |
|
|
7 | (1) |
|
Due Care and Due Diligence |
|
|
8 | (1) |
|
Legal Aspects of Investigations |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
11 | (1) |
|
International Cooperation |
|
|
12 | (1) |
|
Import/Export Restrictions |
|
|
13 | (1) |
|
Security and Third Parties |
|
|
13 | (1) |
|
Service Provider Contractual Security |
|
|
13 | (1) |
|
|
14 | (1) |
|
|
14 | (1) |
|
|
14 | (1) |
|
|
14 | (1) |
|
|
15 | (1) |
|
The (ISC)2® Code of Ethics |
|
|
15 | (1) |
|
Computer Ethics Institute |
|
|
16 | (1) |
|
IAB's Ethics and the Internet |
|
|
16 | (1) |
|
Information Security Governance |
|
|
17 | (1) |
|
Security Policy and Related Documents |
|
|
17 | (2) |
|
|
19 | (1) |
|
Access Control Defensive Categories and Types |
|
|
20 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
|
22 | (1) |
|
|
22 | (1) |
|
|
22 | (1) |
|
Threats and Vulnerabilities |
|
|
22 | (1) |
|
Risk = Threat X Vulnerability |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
23 | (1) |
|
Calculating Annualized Loss Expectancy |
|
|
24 | (1) |
|
|
25 | (1) |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
26 | (1) |
|
Quantitative and Qualitative Risk Analysis |
|
|
27 | (1) |
|
The Risk Management Process |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
29 | (1) |
|
Phishers and Spear Phishers |
|
|
29 | (1) |
|
Summary of Exam Objectives |
|
|
29 | (1) |
|
Top Five Toughest Questions |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
Chapter 2 Domain 2: Asset Security |
|
|
33 | (14) |
|
|
34 | (1) |
|
|
34 | (1) |
|
|
34 | (1) |
|
|
34 | (1) |
|
|
35 | (1) |
|
|
35 | (1) |
|
Sensitive Information/Media Security |
|
|
35 | (1) |
|
|
36 | (1) |
|
Business or Mission Owners |
|
|
36 | (1) |
|
|
36 | (1) |
|
|
36 | (1) |
|
|
36 | (1) |
|
|
36 | (1) |
|
Data Controllers and Data Processors |
|
|
37 | (1) |
|
Data Collection Limitation |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
37 | (2) |
|
|
39 | (1) |
|
|
39 | (1) |
|
|
40 | (1) |
|
|
40 | (1) |
|
|
40 | (1) |
|
Determining Data Security Controls |
|
|
40 | (1) |
|
Certification and Accreditation |
|
|
40 | (1) |
|
Standards and Control Frameworks |
|
|
40 | (3) |
|
|
43 | (1) |
|
Protecting Data in Motion and Data at Rest |
|
|
43 | (1) |
|
Summary of Exam Objectives |
|
|
44 | (1) |
|
Top Five Toughest Questions |
|
|
44 | (1) |
|
|
45 | (1) |
|
|
46 | (1) |
|
Chapter 3 Domain 3: Security Engineering |
|
|
47 | (48) |
|
|
49 | (1) |
|
|
49 | (1) |
|
Reading Down and Writing Up |
|
|
50 | (1) |
|
|
50 | (1) |
|
Lattice-Based Access Controls |
|
|
50 | (1) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
52 | (1) |
|
Secure System Design Concepts |
|
|
52 | (1) |
|
|
52 | (1) |
|
|
52 | (1) |
|
|
52 | (1) |
|
|
53 | (1) |
|
|
54 | (1) |
|
Secure Hardware Architecture |
|
|
54 | (1) |
|
The System Unit and Motherboard |
|
|
54 | (1) |
|
|
54 | (1) |
|
|
54 | (2) |
|
|
56 | (2) |
|
|
58 | (1) |
|
Data Execution Prevention and Address Space Layout Randomization |
|
|
58 | (1) |
|
Secure Operating System and Software Architecture |
|
|
58 | (1) |
|
|
58 | (1) |
|
Virtualization and Distributed Computing |
|
|
59 | (1) |
|
|
59 | (1) |
|
|
59 | (1) |
|
|
60 | (1) |
|
Large-Scale Parallel Data Systems |
|
|
60 | (1) |
|
|
61 | (1) |
|
|
61 | (1) |
|
System Vulnerabilities, Threats, and Countermeasures |
|
|
61 | (1) |
|
|
61 | (1) |
|
|
61 | (1) |
|
|
62 | (1) |
|
|
63 | (1) |
|
|
63 | (1) |
|
Web Architecture and Attacks |
|
|
63 | (2) |
|
|
65 | (1) |
|
|
66 | (1) |
|
Cornerstone Cryptographic Concepts |
|
|
66 | (1) |
|
|
66 | (1) |
|
Confidentiality, Integrity, Authentication, and Nonrepudiation |
|
|
67 | (1) |
|
Confusion, Diffusion, Substitution, and Permutation |
|
|
67 | (1) |
|
|
67 | (1) |
|
Monoalphabetic and Polyalphabetic Ciphers |
|
|
67 | (1) |
|
|
68 | (1) |
|
Data at Rest and Data in Motion |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
69 | (3) |
|
|
72 | (1) |
|
|
73 | (1) |
|
|
74 | (1) |
|
|
74 | (1) |
|
|
74 | (1) |
|
|
74 | (1) |
|
Chosen Plaintext and Adaptive Chosen Plaintext |
|
|
75 | (1) |
|
Chosen Ciphertext and Adaptive Chosen Ciphertext |
|
|
75 | (1) |
|
|
75 | (1) |
|
Differential Cryptanalysis |
|
|
75 | (1) |
|
|
75 | (1) |
|
|
75 | (1) |
|
Implementing Cryptography |
|
|
76 | (1) |
|
|
76 | (1) |
|
Public Key Infrastructure |
|
|
77 | (1) |
|
|
78 | (1) |
|
|
78 | (1) |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
80 | (1) |
|
|
80 | (1) |
|
|
80 | (1) |
|
|
80 | (1) |
|
|
81 | (1) |
|
Smart Cards and Magnetic Stripe Cards |
|
|
81 | (1) |
|
|
81 | (1) |
|
|
82 | (1) |
|
|
82 | (1) |
|
Motion Detectors and Other Perimeter Alarms |
|
|
82 | (1) |
|
|
82 | (1) |
|
Walls, Floors, and Ceilings |
|
|
83 | (1) |
|
|
83 | (1) |
|
|
83 | (1) |
|
Site Selection, Design, and Configuration |
|
|
83 | (1) |
|
|
83 | (1) |
|
Site Design and Configuration Issues |
|
|
84 | (1) |
|
|
85 | (1) |
|
|
85 | (1) |
|
|
85 | (1) |
|
|
85 | (1) |
|
|
85 | (1) |
|
Heating, Ventilation, and Air Conditioning |
|
|
86 | (1) |
|
Heat, Flame, and Smoke Detectors |
|
|
87 | (1) |
|
Personnel Safety, Training, and Awareness |
|
|
87 | (1) |
|
ABCDK Fires and Suppression |
|
|
88 | (1) |
|
Types of Fire Suppression Agents |
|
|
88 | (3) |
|
Summary of Exam Objectives |
|
|
91 | (1) |
|
Top Five Toughest Questions |
|
|
91 | (1) |
|
|
92 | (1) |
|
|
93 | (2) |
|
Chapter 4 Domain 4: Communication and Network Security |
|
|
95 | (22) |
|
|
95 | (1) |
|
Network Architecture and Design |
|
|
96 | (1) |
|
Fundamental Network Concepts |
|
|
96 | (1) |
|
|
97 | (2) |
|
|
99 | (2) |
|
Application-Layer TCP/IP Protocols and Concepts |
|
|
101 | (2) |
|
LAN Technologies and Protocols |
|
|
103 | (1) |
|
WAN Technologies and Protocols |
|
|
103 | (1) |
|
|
104 | (1) |
|
Software-Defined Networks |
|
|
105 | (1) |
|
Wireless Local-Area Networks |
|
|
105 | (2) |
|
|
107 | (1) |
|
Secure Network Devices and Protocols |
|
|
107 | (1) |
|
|
108 | (1) |
|
|
108 | (1) |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
109 | (2) |
|
|
111 | (1) |
|
|
111 | (1) |
|
Authentication Protocols and Frameworks |
|
|
111 | (1) |
|
|
112 | (1) |
|
|
112 | (3) |
|
Summary of Exam Objectives |
|
|
115 | (1) |
|
Top Five Toughest Questions |
|
|
115 | (1) |
|
|
116 | (1) |
|
|
116 | (1) |
|
Chapter 5 Domain 5: Identity and Access Management (controlling access and managing identity) |
|
|
117 | (18) |
|
|
117 | (1) |
|
|
118 | (1) |
|
Type 1 Authentication: Something You Know |
|
|
118 | (2) |
|
Type 2 Authentication: Something You Have |
|
|
120 | (1) |
|
Type 3 Authentication: Something You Are |
|
|
120 | (4) |
|
|
124 | (1) |
|
Access Control Technologies |
|
|
124 | (1) |
|
Centralized Access Control |
|
|
125 | (1) |
|
Decentralized Access Control |
|
|
125 | (1) |
|
|
125 | (1) |
|
User Entitlement, Access Review, and Audit |
|
|
125 | (1) |
|
Federated Identity Management |
|
|
126 | (1) |
|
|
126 | (1) |
|
|
127 | (1) |
|
|
127 | (1) |
|
|
128 | (1) |
|
Access Control Protocols and Frameworks |
|
|
128 | (2) |
|
|
130 | (1) |
|
Discretionary Access Controls |
|
|
130 | (1) |
|
Mandatory Access Controls |
|
|
130 | (1) |
|
Nondiscretionary Access Control |
|
|
130 | (1) |
|
Rule-Based Access Controls |
|
|
131 | (1) |
|
Content-Dependent and Context-Dependent Access Controls |
|
|
131 | (1) |
|
Summary of Exam Objectives |
|
|
131 | (1) |
|
Top Five Toughest Questions |
|
|
132 | (1) |
|
|
133 | (1) |
|
|
133 | (2) |
|
Chapter 6 Domain 6: Security Assessment and Testing |
|
|
135 | (10) |
|
|
135 | (1) |
|
|
136 | (1) |
|
|
136 | (1) |
|
|
137 | (1) |
|
|
138 | (1) |
|
|
138 | (1) |
|
|
138 | (1) |
|
|
138 | (1) |
|
Static and Dynamic Testing |
|
|
139 | (1) |
|
|
139 | (1) |
|
|
140 | (1) |
|
|
140 | (1) |
|
|
140 | (1) |
|
Combinatorial Software Testing |
|
|
140 | (1) |
|
|
141 | (1) |
|
|
141 | (1) |
|
|
141 | (1) |
|
Summary of Exam Objectives |
|
|
141 | (1) |
|
Top Five Toughest Questions |
|
|
142 | (1) |
|
|
143 | (1) |
|
|
144 | (1) |
|
Chapter 7 Domain 7: Security Operations |
|
|
145 | (40) |
|
|
146 | (1) |
|
|
146 | (1) |
|
Administrative Personnel Controls |
|
|
146 | (2) |
|
|
148 | (1) |
|
|
148 | (1) |
|
|
149 | (1) |
|
Embedded Device Forensics |
|
|
149 | (1) |
|
Electronic Discovery (eDiscovery) |
|
|
149 | (1) |
|
Incident Response Management |
|
|
150 | (1) |
|
|
150 | (3) |
|
|
153 | (1) |
|
Operational Preventive and Detective Controls |
|
|
153 | (1) |
|
Intrusion Detection Systems and Intrusion Prevention Systems |
|
|
153 | (2) |
|
Security Information and Event Management |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
156 | (1) |
|
|
157 | (1) |
|
|
157 | (1) |
|
|
157 | (1) |
|
|
158 | (1) |
|
|
158 | (1) |
|
|
158 | (4) |
|
BCP and DRP overview and process |
|
|
162 | (1) |
|
Business Continuity Planning |
|
|
162 | (1) |
|
Disaster Recovery Planning |
|
|
163 | (1) |
|
Relationship Between BCP and DRP |
|
|
163 | (1) |
|
Disasters or Disruptive Events |
|
|
164 | (1) |
|
The Disaster Recovery Process |
|
|
165 | (1) |
|
|
166 | (1) |
|
|
166 | (1) |
|
Assessing the Critical State |
|
|
167 | (1) |
|
|
167 | (2) |
|
Identify Preventive Controls |
|
|
169 | (1) |
|
|
169 | (2) |
|
|
171 | (2) |
|
|
173 | (1) |
|
Emergency Operations Center |
|
|
173 | (1) |
|
|
173 | (1) |
|
|
174 | (1) |
|
|
174 | (2) |
|
DRP Testing, Training, and Awareness |
|
|
176 | (1) |
|
|
176 | (2) |
|
Continued BCP/DRP Maintenance |
|
|
178 | (1) |
|
|
178 | (1) |
|
|
179 | (1) |
|
Specific BCP/DRP Frameworks |
|
|
179 | (1) |
|
|
179 | (1) |
|
|
179 | (1) |
|
|
180 | (1) |
|
|
180 | (1) |
|
Summary of Exam Objectives |
|
|
181 | (1) |
|
Top Five Toughest Questions |
|
|
181 | (1) |
|
|
182 | (1) |
|
|
183 | (2) |
|
Chapter 8 Domain 8: Software Development Security |
|
|
185 | (22) |
|
|
186 | (1) |
|
|
186 | (1) |
|
Machine Code, Source Code, and Assemblers |
|
|
186 | (1) |
|
Compilers, Interpreters, and Bytecode |
|
|
187 | (1) |
|
Computer-Aided Software Engineering |
|
|
187 | (1) |
|
Types of Publicly Released Software |
|
|
187 | (1) |
|
Application Development Methods |
|
|
188 | (1) |
|
|
188 | (1) |
|
|
188 | (1) |
|
Agile Software Development |
|
|
189 | (1) |
|
|
190 | (1) |
|
Rapid Application Development |
|
|
190 | (1) |
|
|
191 | (1) |
|
|
192 | (1) |
|
|
192 | (1) |
|
|
192 | (1) |
|
Security of Application Programming Interfaces |
|
|
193 | (1) |
|
Software Change and Configuration Management |
|
|
193 | (1) |
|
|
193 | (1) |
|
|
194 | (1) |
|
|
194 | (2) |
|
|
196 | (1) |
|
|
196 | (1) |
|
|
196 | (1) |
|
|
196 | (1) |
|
Object-Oriented Databases |
|
|
197 | (1) |
|
|
197 | (1) |
|
Database Replication and Shadowing |
|
|
197 | (1) |
|
Data Warehousing and Data Mining |
|
|
197 | (1) |
|
Object-Oriented Programming |
|
|
198 | (1) |
|
Cornerstone Object-Oriented Programming Concepts |
|
|
198 | (2) |
|
|
200 | (1) |
|
Assessing the Effectiveness of Software Security |
|
|
200 | (1) |
|
|
200 | (2) |
|
|
202 | (1) |
|
Software Capability Maturity Model |
|
|
202 | (1) |
|
|
202 | (1) |
|
Commercial Off-the-Shelf Software |
|
|
203 | (1) |
|
Custom-Developed Third-Party Products |
|
|
203 | (1) |
|
Summary of Exam Objectives |
|
|
204 | (1) |
|
Top Five Toughest Questions |
|
|
204 | (1) |
|
|
205 | (1) |
|
|
205 | (2) |
Index |
|
207 | |