Foreword |
|
xxiv | |
Preface |
|
xxvi | |
Introduction |
|
xxviii | |
Instructor Web Site |
|
xxxi | |
|
Chapter 1 Introduction and Security Trends |
|
|
1 | (17) |
|
The Computer Security Problem |
|
|
1 | (11) |
|
Definition of Computer Security |
|
|
1 | (1) |
|
Historical Security Incidents |
|
|
1 | (3) |
|
The Current Threat Environment |
|
|
4 | (3) |
|
|
7 | (4) |
|
|
11 | (1) |
|
|
12 | (1) |
|
|
12 | (1) |
|
|
12 | (1) |
|
Minimizing Possible Avenues of Attack |
|
|
12 | (1) |
|
Approaches to Computer Security |
|
|
13 | (1) |
|
|
14 | (1) |
|
|
14 | (4) |
|
|
15 | (3) |
|
Chapter 2 General Security Concepts |
|
|
18 | (24) |
|
Basic Security Terminology |
|
|
19 | (14) |
|
|
19 | (3) |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
24 | (7) |
|
|
31 | (1) |
|
Authentication Mechanisms |
|
|
32 | (1) |
|
Authentication and Access Control Policies |
|
|
32 | (1) |
|
|
33 | (9) |
|
|
34 | (1) |
|
|
35 | (3) |
|
|
38 | (4) |
|
Chapter 3 Operational and Organizational Security |
|
|
42 | (30) |
|
Policies, Procedures, Standards, and Guidelines |
|
|
43 | (11) |
|
|
44 | (1) |
|
|
44 | (1) |
|
|
45 | (2) |
|
|
47 | (6) |
|
Due Care and Due Diligence |
|
|
53 | (1) |
|
|
54 | (1) |
|
Incident Response Policies and Procedures |
|
|
54 | (1) |
|
Security Awareness and Training |
|
|
54 | (4) |
|
Security Policy Training and Procedures |
|
|
55 | (1) |
|
|
55 | (1) |
|
Compliance with Laws, Best Practices, and Standards |
|
|
56 | (1) |
|
|
56 | (1) |
|
New Threats and Security Trends/Alerts |
|
|
57 | (1) |
|
Training Metrics and Compliance |
|
|
58 | (1) |
|
Interoperability Agreements |
|
|
58 | (2) |
|
|
59 | (1) |
|
Business Partnership Agreement |
|
|
59 | (1) |
|
Memorandum of Understanding |
|
|
59 | (1) |
|
Interconnection Security Agreement |
|
|
59 | (1) |
|
|
60 | (1) |
|
|
61 | (2) |
|
|
61 | (2) |
|
|
63 | (1) |
|
|
63 | (2) |
|
|
64 | (1) |
|
|
65 | (1) |
|
Electromagnetic Eavesdropping |
|
|
66 | (6) |
|
|
67 | (1) |
|
|
68 | (4) |
|
Chapter 4 The Role of People in Security |
|
|
72 | (18) |
|
People---A Security Problem |
|
|
73 | (10) |
|
|
73 | (5) |
|
|
78 | (5) |
|
People as a Security Tool |
|
|
83 | (7) |
|
|
84 | (1) |
|
Security Policy Training and Procedures |
|
|
85 | (1) |
|
|
86 | (4) |
|
|
90 | (38) |
|
|
91 | (2) |
|
|
92 | (1) |
|
Comparative Strengths and Performance of Algorithms |
|
|
93 | (1) |
|
|
93 | (3) |
|
|
94 | (2) |
|
|
96 | (1) |
|
|
96 | (3) |
|
|
98 | (1) |
|
|
98 | (1) |
|
|
99 | (4) |
|
|
100 | (1) |
|
|
101 | (1) |
|
|
101 | (1) |
|
|
102 | (1) |
|
|
103 | (6) |
|
|
103 | (1) |
|
|
104 | (1) |
|
|
105 | (1) |
|
|
105 | (1) |
|
|
106 | (1) |
|
|
107 | (1) |
|
|
107 | (1) |
|
|
107 | (1) |
|
|
108 | (1) |
|
Symmetric Encryption Summary |
|
|
108 | (1) |
|
|
109 | (4) |
|
|
110 | (1) |
|
|
110 | (1) |
|
|
111 | (1) |
|
|
112 | (1) |
|
Asymmetric Encryption Summary |
|
|
113 | (1) |
|
|
113 | (1) |
|
|
113 | (1) |
|
|
114 | (2) |
|
Cryptography Algorithm Use |
|
|
116 | (12) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
120 | (1) |
|
|
120 | (1) |
|
|
120 | (1) |
|
Digital Rights Management |
|
|
121 | (1) |
|
Cryptographic Applications |
|
|
122 | (1) |
|
Use of Proven Technologies |
|
|
123 | (1) |
|
|
124 | (4) |
|
Chapter 6 Public Key Infrastructure |
|
|
128 | (38) |
|
The Basics of Public Key Infrastructures |
|
|
129 | (1) |
|
|
130 | (1) |
|
|
131 | (3) |
|
Local Registration Authorities |
|
|
132 | (2) |
|
|
134 | (3) |
|
|
135 | (1) |
|
|
136 | (1) |
|
|
137 | (6) |
|
Registration and Generation |
|
|
137 | (1) |
|
|
138 | (1) |
|
|
138 | (1) |
|
|
139 | (1) |
|
|
139 | (3) |
|
|
142 | (1) |
|
|
143 | (1) |
|
Trust and Certificate Verification |
|
|
143 | (3) |
|
Centralized and Decentralized Infrastructures |
|
|
146 | (5) |
|
Hardware Security Modules |
|
|
147 | (1) |
|
|
148 | (1) |
|
|
149 | (1) |
|
|
150 | (1) |
|
Public Certificate Authorities |
|
|
151 | (1) |
|
In-House Certificate Authorities |
|
|
152 | (8) |
|
Choosing Between a Public CA and an In-House CA |
|
|
152 | (1) |
|
Outsourced Certificate Authorities |
|
|
153 | (1) |
|
Tying Different PKIs Together |
|
|
154 | (1) |
|
|
155 | (5) |
|
Certificate-Based Threats |
|
|
160 | (6) |
|
|
161 | (1) |
|
|
162 | (4) |
|
Chapter 7 PKI Standards and Protocols |
|
|
166 | (24) |
|
|
168 | (4) |
|
|
169 | (1) |
|
|
170 | (2) |
|
Why You Need to Know the PKIX and PKCS Standards |
|
|
172 | (1) |
|
|
172 | (1) |
|
|
173 | (1) |
|
|
174 | (1) |
|
|
174 | (2) |
|
|
176 | (1) |
|
|
176 | (2) |
|
|
178 | (2) |
|
|
178 | (1) |
|
IETF S/MIME v3 Specifications |
|
|
179 | (1) |
|
|
180 | (2) |
|
|
180 | (2) |
|
|
182 | (1) |
|
|
182 | (1) |
|
|
183 | (1) |
|
|
183 | (7) |
|
|
183 | (1) |
|
|
184 | (1) |
|
|
184 | (1) |
|
ISO/IEC 27002 (Formerly ISO 17799) |
|
|
184 | (1) |
|
|
185 | (1) |
|
|
186 | (4) |
|
Chapter 8 Physical Security |
|
|
190 | (30) |
|
|
191 | (4) |
|
Physical Security Safeguards |
|
|
195 | (10) |
|
|
195 | (1) |
|
Physical Access Controls and Monitoring |
|
|
196 | (4) |
|
|
200 | (1) |
|
|
200 | (4) |
|
|
204 | (1) |
|
|
205 | (3) |
|
Water-Based Fire Suppression Systems |
|
|
205 | (1) |
|
Halon-Based Fire Suppression Systems |
|
|
205 | (1) |
|
Clean-Agent Fire Suppression Systems |
|
|
206 | (1) |
|
Handheld Fire Extinguishers |
|
|
206 | (1) |
|
|
207 | (1) |
|
|
208 | (2) |
|
|
208 | (1) |
|
Backup Power and Cable Shielding |
|
|
209 | (1) |
|
Electromagnetic Interference |
|
|
209 | (1) |
|
Electronic Access Control Systems |
|
|
210 | (10) |
|
|
211 | (5) |
|
|
216 | (4) |
|
Chapter 9 Network Fundamentals |
|
|
220 | (32) |
|
|
221 | (1) |
|
|
222 | (1) |
|
|
223 | (3) |
|
|
223 | (2) |
|
|
225 | (1) |
|
|
226 | (5) |
|
|
226 | (1) |
|
|
227 | (2) |
|
|
229 | (2) |
|
|
231 | (2) |
|
|
233 | (7) |
|
|
233 | (1) |
|
|
233 | (1) |
|
|
234 | (2) |
|
IP Addresses and Subnetting |
|
|
236 | (2) |
|
Network Address Translation |
|
|
238 | (2) |
|
|
240 | (6) |
|
|
240 | (1) |
|
|
241 | (1) |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
244 | (2) |
|
|
246 | (1) |
|
|
246 | (1) |
|
|
247 | (5) |
|
|
247 | (1) |
|
|
247 | (1) |
|
|
247 | (1) |
|
|
248 | (4) |
|
Chapter 10 Infrastructure Security |
|
|
252 | (36) |
|
|
253 | (3) |
|
|
253 | (1) |
|
|
253 | (1) |
|
|
254 | (1) |
|
|
255 | (1) |
|
Device Security, Common Concerns |
|
|
255 | (1) |
|
|
255 | (1) |
|
|
256 | (1) |
|
|
256 | (11) |
|
|
256 | (1) |
|
|
257 | (1) |
|
|
257 | (1) |
|
|
257 | (1) |
|
|
258 | (2) |
|
|
260 | (1) |
|
|
261 | (2) |
|
Next-Generation Firewalls |
|
|
263 | (1) |
|
Web Application Firewalls vs. Network Firewalls |
|
|
264 | (1) |
|
|
264 | (1) |
|
|
264 | (1) |
|
|
265 | (1) |
|
|
266 | (1) |
|
|
266 | (1) |
|
|
267 | (6) |
|
Intrusion Detection Systems |
|
|
267 | (1) |
|
|
267 | (1) |
|
Network Monitoring/Diagnostic |
|
|
268 | (1) |
|
|
269 | (1) |
|
|
270 | (1) |
|
|
271 | (1) |
|
|
272 | (1) |
|
|
272 | (1) |
|
Unified Threat Management |
|
|
272 | (1) |
|
|
273 | (4) |
|
|
274 | (1) |
|
|
274 | (1) |
|
|
275 | (1) |
|
|
276 | (1) |
|
|
277 | (4) |
|
|
278 | (1) |
|
|
279 | (1) |
|
|
280 | (1) |
|
Security Concerns for Transmission Media |
|
|
281 | (1) |
|
Physical Security Concerns |
|
|
282 | (1) |
|
|
283 | (5) |
|
|
283 | (1) |
|
|
284 | (1) |
|
|
284 | (1) |
|
|
284 | (1) |
|
|
284 | (1) |
|
|
284 | (1) |
|
Infrastructure as a Service |
|
|
284 | (1) |
|
|
285 | (3) |
|
Chapter 11 Authentication and Remote Access |
|
|
288 | (48) |
|
User, Group, and Role Management |
|
|
289 | (3) |
|
|
289 | (2) |
|
|
291 | (1) |
|
|
292 | (1) |
|
|
292 | (2) |
|
|
293 | (1) |
|
|
294 | (3) |
|
|
295 | (1) |
|
|
296 | (1) |
|
Account and Password Expiration |
|
|
297 | (1) |
|
Security Controls and Permissions |
|
|
297 | (7) |
|
|
300 | (1) |
|
Mandatory Access Control (MAC) |
|
|
301 | (1) |
|
Discretionary Access Control (DAC) |
|
|
302 | (1) |
|
Role-Based Access Control (RBAC) |
|
|
303 | (1) |
|
Rule-Based Access Control |
|
|
303 | (1) |
|
Attribute Based Access Control (ABAC) |
|
|
303 | (1) |
|
|
304 | (1) |
|
Preventing Data Loss or Theft |
|
|
304 | (1) |
|
The Remote Access Process |
|
|
305 | (6) |
|
|
305 | (1) |
|
|
306 | (4) |
|
|
310 | (1) |
|
|
311 | (1) |
|
|
311 | (19) |
|
|
311 | (1) |
|
|
312 | (2) |
|
|
314 | (3) |
|
|
317 | (5) |
|
|
322 | (1) |
|
|
323 | (1) |
|
|
324 | (5) |
|
Vulnerabilities of Remote Access Methods |
|
|
329 | (1) |
|
|
330 | (6) |
|
|
331 | (5) |
|
Chapter 12 Wireless Security and Mobile Devices |
|
|
336 | (40) |
|
Introduction to Wireless Networking |
|
|
337 | (1) |
|
|
338 | (5) |
|
Wireless Application Protocol |
|
|
340 | (2) |
|
|
342 | (1) |
|
|
343 | (1) |
|
|
343 | (4) |
|
|
345 | (2) |
|
|
347 | (1) |
|
|
347 | (12) |
|
802.11: Individual Standards |
|
|
348 | (2) |
|
|
350 | (4) |
|
|
354 | (5) |
|
Wireless Systems Configuration |
|
|
359 | (3) |
|
|
359 | (1) |
|
|
360 | (1) |
|
|
361 | (1) |
|
|
361 | (1) |
|
|
362 | (1) |
|
|
362 | (1) |
|
|
362 | (14) |
|
|
363 | (3) |
|
|
366 | (4) |
|
|
370 | (1) |
|
Mobile Application Security |
|
|
370 | (3) |
|
|
373 | (3) |
|
Chapter 13 Intrusion Detection Systems and Network Security |
|
|
376 | (32) |
|
History of Intrusion Detection Systems |
|
|
377 | (1) |
|
|
378 | (4) |
|
|
379 | (2) |
|
|
381 | (1) |
|
False Positives and False Negatives |
|
|
382 | (1) |
|
|
382 | (6) |
|
|
386 | (1) |
|
|
386 | (1) |
|
|
387 | (1) |
|
|
387 | (1) |
|
|
388 | (6) |
|
|
391 | (1) |
|
|
392 | (1) |
|
|
393 | (1) |
|
Resurgence and Advancement of HIDSs |
|
|
393 | (1) |
|
Intrusion Prevention Systems |
|
|
394 | (2) |
|
|
396 | (2) |
|
|
398 | (10) |
|
|
398 | (2) |
|
|
400 | (1) |
|
|
400 | (2) |
|
|
402 | (1) |
|
|
403 | (2) |
|
|
405 | (3) |
|
Chapter 14 System Hardening and Baselines |
|
|
408 | (56) |
|
|
409 | (1) |
|
Operating System and Network Operating System Hardening |
|
|
409 | (1) |
|
|
410 | (1) |
|
|
410 | (27) |
|
|
411 | (1) |
|
Operating System Security and Settings |
|
|
412 | (1) |
|
|
412 | (1) |
|
Hardening Microsoft Operating Systems |
|
|
413 | (4) |
|
Hardening UNIX- or Linux-Based Operating Systems |
|
|
417 | (6) |
|
Updates (a.k.a. Hotfixes, Service Packs, and Patches) |
|
|
423 | (3) |
|
|
426 | (8) |
|
White Listing vs. Black Listing Applications |
|
|
434 | (1) |
|
|
434 | (1) |
|
|
435 | (1) |
|
|
436 | (1) |
|
|
437 | (1) |
|
Host-Based Security Controls |
|
|
437 | (4) |
|
Hardware-Based Encryption Devices |
|
|
437 | (1) |
|
|
438 | (1) |
|
|
439 | (1) |
|
|
440 | (1) |
|
|
440 | (1) |
|
|
441 | (1) |
|
|
441 | (1) |
|
|
441 | (3) |
|
|
442 | (1) |
|
|
442 | (1) |
|
Securing Management Interfaces |
|
|
443 | (1) |
|
|
443 | (1) |
|
|
443 | (1) |
|
|
444 | (6) |
|
Application Configuration Baseline |
|
|
444 | (1) |
|
|
444 | (1) |
|
|
445 | (3) |
|
|
448 | (2) |
|
|
450 | (2) |
|
|
452 | (2) |
|
|
454 | (10) |
|
|
454 | (1) |
|
|
455 | (1) |
|
Phones and Mobile Devices |
|
|
455 | (1) |
|
|
456 | (1) |
|
|
457 | (1) |
|
In-Vehicle Computing Systems |
|
|
457 | (1) |
|
Alternative Environment Methods |
|
|
457 | (1) |
|
|
457 | (1) |
|
|
458 | (1) |
|
|
458 | (1) |
|
|
458 | (1) |
|
|
458 | (1) |
|
|
459 | (1) |
|
Control Redundancy and Diversity |
|
|
459 | (1) |
|
|
460 | (4) |
|
Chapter 15 Types of Attacks and Malicious Software |
|
|
464 | (40) |
|
|
465 | (1) |
|
Minimizing Possible Avenues of Attack |
|
|
465 | (1) |
|
|
466 | (8) |
|
|
466 | (3) |
|
|
469 | (1) |
|
|
469 | (1) |
|
|
470 | (1) |
|
|
470 | (1) |
|
|
471 | (1) |
|
|
471 | (1) |
|
|
471 | (1) |
|
|
472 | (1) |
|
|
472 | (1) |
|
|
473 | (1) |
|
|
473 | (1) |
|
Attacking Computer Systems and Networks |
|
|
474 | (21) |
|
Denial-of-Service Attacks |
|
|
474 | (4) |
|
|
478 | (1) |
|
|
478 | (1) |
|
|
479 | (1) |
|
|
480 | (3) |
|
|
483 | (1) |
|
Man-in-the-Middle Attacks |
|
|
483 | (1) |
|
|
484 | (1) |
|
|
484 | (1) |
|
|
484 | (1) |
|
|
485 | (1) |
|
|
485 | (1) |
|
|
485 | (1) |
|
|
485 | (1) |
|
|
485 | (1) |
|
|
486 | (1) |
|
|
486 | (1) |
|
|
487 | (1) |
|
|
488 | (2) |
|
|
490 | (2) |
|
|
492 | (1) |
|
|
492 | (2) |
|
|
494 | (1) |
|
Advanced Persistent Threat |
|
|
495 | (1) |
|
|
496 | (1) |
|
|
496 | (1) |
|
|
496 | (1) |
|
|
496 | (1) |
|
Social-Engineering Toolkit |
|
|
496 | (1) |
|
|
497 | (1) |
|
|
497 | (1) |
|
|
497 | (1) |
|
|
497 | (7) |
|
|
498 | (2) |
|
|
500 | (4) |
|
Chapter 16 E-Mail and Instant Messaging |
|
|
504 | (26) |
|
|
505 | (4) |
|
|
506 | (2) |
|
|
508 | (1) |
|
|
509 | (8) |
|
|
510 | (3) |
|
|
513 | (1) |
|
Unsolicited Commercial E-Mail (Spam) |
|
|
514 | (2) |
|
|
516 | (1) |
|
DomainKeys Identified Mail |
|
|
517 | (1) |
|
|
517 | (5) |
|
|
518 | (2) |
|
|
520 | (2) |
|
|
522 | (8) |
|
Modern Instant Messaging Systems |
|
|
524 | (2) |
|
|
526 | (4) |
|
Chapter 17 Web Components |
|
|
530 | (28) |
|
Current Web Components and Concerns |
|
|
531 | (1) |
|
|
531 | (10) |
|
|
531 | (6) |
|
|
537 | (1) |
|
|
538 | (1) |
|
HTTP Strict Transport Security |
|
|
538 | (1) |
|
Directory Services (DAP and LDAP) |
|
|
539 | (1) |
|
File Transfer (FTP and SFTP) |
|
|
540 | (1) |
|
|
541 | (1) |
|
Code-Based Vulnerabilities |
|
|
541 | (11) |
|
|
542 | (1) |
|
|
542 | (2) |
|
|
544 | (1) |
|
|
545 | (1) |
|
|
546 | (1) |
|
|
546 | (1) |
|
|
547 | (1) |
|
|
547 | (3) |
|
|
550 | (1) |
|
|
551 | (1) |
|
|
551 | (1) |
|
Application-Based Weaknesses |
|
|
552 | (6) |
|
|
553 | (1) |
|
|
554 | (1) |
|
|
554 | (1) |
|
|
555 | (3) |
|
Chapter 18 Secure Software Development |
|
|
558 | (26) |
|
The Software Engineering Process |
|
|
559 | (9) |
|
|
559 | (1) |
|
Secure Development Lifecycle |
|
|
560 | (8) |
|
|
568 | (4) |
|
Error and Exception Handling |
|
|
568 | (1) |
|
Input and Output Validation |
|
|
568 | (3) |
|
|
571 | (1) |
|
|
571 | (1) |
|
|
572 | (6) |
|
|
572 | (1) |
|
|
573 | (2) |
|
Directory Traversal/Command Injection |
|
|
575 | (1) |
|
|
575 | (1) |
|
|
576 | (1) |
|
Cross-Site Request Forgery |
|
|
576 | (1) |
|
|
577 | (1) |
|
|
577 | (1) |
|
|
577 | (1) |
|
|
577 | (1) |
|
Arbitrary/Remote Code Execution |
|
|
578 | (1) |
|
Open Vulnerability and Assessment Language |
|
|
578 | (1) |
|
|
578 | (6) |
|
Application Configuration Baseline |
|
|
579 | (1) |
|
Application Patch Management |
|
|
579 | (1) |
|
NoSQL Databases vs. SQL Databases |
|
|
579 | (1) |
|
Server-Side vs. Client-Side Validation |
|
|
579 | (2) |
|
|
581 | (3) |
|
Chapter 19 Business Continuity and Disaster Recovery, and Organizational Policies |
|
|
584 | (24) |
|
|
585 | (2) |
|
Business Continuity Plans |
|
|
585 | (1) |
|
|
586 | (1) |
|
Identification of Critical Systems and Components |
|
|
586 | (1) |
|
Removing Single Points of Failure |
|
|
586 | (1) |
|
|
586 | (1) |
|
|
586 | (1) |
|
|
587 | (1) |
|
|
587 | (21) |
|
Disaster Recovery Plans/Process |
|
|
587 | (1) |
|
Categories of Business Functions |
|
|
588 | (1) |
|
|
589 | (1) |
|
Test, Exercise, and Rehearse |
|
|
589 | (2) |
|
Recovery Time Objective and Recovery Point Objective |
|
|
591 | (1) |
|
|
591 | (5) |
|
|
596 | (1) |
|
|
597 | (1) |
|
|
598 | (1) |
|
|
599 | (1) |
|
High Availability and Fault Tolerance |
|
|
599 | (1) |
|
Failure and Recovery Timing |
|
|
600 | (4) |
|
|
604 | (4) |
|
Chapter 20 Risk Management |
|
|
608 | (26) |
|
An Overview of Risk Management |
|
|
609 | (2) |
|
Example of Risk Management at the International Banking Level |
|
|
609 | (1) |
|
Risk Management Vocabulary |
|
|
610 | (1) |
|
|
611 | (2) |
|
|
612 | (1) |
|
|
613 | (1) |
|
Examples of Business Risks |
|
|
613 | (1) |
|
Examples of Technology Risks |
|
|
613 | (1) |
|
Risk Mitigation Strategies |
|
|
614 | (1) |
|
|
614 | (1) |
|
|
615 | (1) |
|
User Rights and Permissions Reviews |
|
|
615 | (1) |
|
|
615 | (1) |
|
|
615 | (5) |
|
General Risk Management Model |
|
|
616 | (2) |
|
Software Engineering Institute Model |
|
|
618 | (1) |
|
|
618 | (1) |
|
|
619 | (1) |
|
Qualitatively Assessing Risk |
|
|
620 | (1) |
|
Quantitatively Assessing Risk |
|
|
621 | (4) |
|
Adding Objectivity to a Qualitative Assessment |
|
|
621 | (1) |
|
|
622 | (3) |
|
Qualitative vs. Quantitative Risk Assessment |
|
|
625 | (1) |
|
|
625 | (2) |
|
Cost-Effectiveness Modeling |
|
|
626 | (1) |
|
Risk Management Best Practices |
|
|
627 | (7) |
|
|
627 | (1) |
|
|
627 | (1) |
|
Probability/Threat Likelihood |
|
|
628 | (1) |
|
Risk-Avoidance, Transference, Acceptance, Mitigation, Deterrence |
|
|
628 | (1) |
|
Risks Associated with Cloud Computing and Virtualization |
|
|
629 | (1) |
|
|
630 | (4) |
|
Chapter 21 Change Management |
|
|
634 | (16) |
|
|
635 | (2) |
|
The Key Concept: Separation of Duties |
|
|
637 | (2) |
|
Elements of Change Management |
|
|
639 | (1) |
|
Implementing Change Management |
|
|
640 | (2) |
|
|
642 | (1) |
|
The Purpose of a Change Control Board |
|
|
642 | (2) |
|
|
643 | (1) |
|
The Capability Maturity Model Integration |
|
|
644 | (6) |
|
|
646 | (4) |
|
Chapter 22 Incident Response |
|
|
650 | (24) |
|
Foundations of Incident Response |
|
|
651 | (3) |
|
|
651 | (1) |
|
|
652 | (2) |
|
Goals of Incident Response |
|
|
654 | (1) |
|
Incident Response Process |
|
|
654 | (13) |
|
|
655 | (3) |
|
Security Measure Implementation |
|
|
658 | (1) |
|
Incident Identification/Detection |
|
|
659 | (1) |
|
|
660 | (1) |
|
|
661 | (2) |
|
|
663 | (1) |
|
|
664 | (1) |
|
Recovery/Reconstitution Procedures |
|
|
665 | (1) |
|
|
666 | (1) |
|
Follow-up/Lessons Learned |
|
|
666 | (1) |
|
Standards and Best Practices |
|
|
667 | (7) |
|
|
667 | (1) |
|
|
667 | (1) |
|
|
667 | (1) |
|
|
668 | (1) |
|
|
669 | (1) |
|
Making Security Measurable |
|
|
669 | (2) |
|
|
671 | (3) |
|
Chapter 23 Computer Forensics |
|
|
674 | (22) |
|
|
675 | (2) |
|
|
676 | (1) |
|
|
676 | (1) |
|
Three Rules Regarding Evidence |
|
|
677 | (1) |
|
|
677 | (7) |
|
|
679 | (2) |
|
|
681 | (1) |
|
|
681 | (1) |
|
|
682 | (1) |
|
|
682 | (1) |
|
Conducting the Investigation |
|
|
682 | (2) |
|
|
684 | (1) |
|
|
684 | (1) |
|
|
685 | (1) |
|
|
685 | (3) |
|
|
685 | (2) |
|
|
687 | (1) |
|
|
688 | (1) |
|
|
688 | (1) |
|
|
689 | (1) |
|
|
689 | (7) |
|
|
689 | (1) |
|
|
690 | (1) |
|
|
690 | (1) |
|
|
691 | (5) |
|
Chapter 24 Legal Issues and Ethics |
|
|
696 | (20) |
|
|
697 | (13) |
|
Common Internet Crime Schemes |
|
|
698 | (1) |
|
|
698 | (1) |
|
|
699 | (1) |
|
|
700 | (3) |
|
Payment Card Industry Data Security Standard (PCI DSS) |
|
|
703 | (2) |
|
Import/Export Encryption Restrictions |
|
|
705 | (1) |
|
|
706 | (1) |
|
|
706 | (2) |
|
Digital Rights Management |
|
|
708 | (2) |
|
|
710 | (6) |
|
|
713 | (3) |
|
|
716 | (22) |
|
Personally Identifiable Information (PII) |
|
|
717 | (2) |
|
|
718 | (1) |
|
Notice, Choice, and Consent |
|
|
719 | (1) |
|
|
719 | (7) |
|
|
720 | (1) |
|
Freedom of Information Act (FOIA) |
|
|
720 | (1) |
|
Family Education Records and Privacy Act (FERPA) |
|
|
721 | (1) |
|
U.S. Computer Fraud and Abuse Act (CFAA) |
|
|
721 | (1) |
|
U.S. Children's Online Privacy Protection Act (COPPA) |
|
|
722 | (1) |
|
Video Privacy Protection Act (VPPA) |
|
|
722 | (1) |
|
Health Insurance Portability & Accountability Act (HIPAA) |
|
|
723 | (1) |
|
Gramm-Leach-Bliley Act (GLBA) |
|
|
724 | (1) |
|
California Senate Bill 1386 (SB 1386) |
|
|
724 | (1) |
|
U.S. Banking Rules and Regulations |
|
|
724 | (1) |
|
Payment Card Industry Data Security Standard (PCI DSS) |
|
|
725 | (1) |
|
Fair Credit Reporting Act (FCRA) |
|
|
725 | (1) |
|
Fair and Accurate Credit Transactions Act (FACTA) |
|
|
725 | (1) |
|
Non-Federal Privacy Concerns in the United States |
|
|
726 | (1) |
|
International Privacy Laws |
|
|
727 | (3) |
|
OECD Fair Information Practices |
|
|
727 | (1) |
|
|
728 | (1) |
|
|
729 | (1) |
|
|
729 | (1) |
|
Privacy-Enhancing Technologies |
|
|
730 | (1) |
|
|
730 | (1) |
|
Privacy Impact Assessment |
|
|
731 | (1) |
|
|
731 | (1) |
|
|
732 | (1) |
|
|
732 | (6) |
|
|
732 | (1) |
|
|
733 | (2) |
|
|
735 | (3) |
|
Appendix A CompTIA Security+ Exam Objectives: SYO-401 |
|
|
738 | (18) |
|
Appendix B About the CD-ROM |
|
|
756 | (2) |
|
|
756 | (1) |
|
Total Tester Premium Practice Exam Software |
|
|
756 | (1) |
|
Installing and Running Total Tester Premium Practice Exam Software |
|
|
757 | (1) |
|
|
757 | (1) |
|
|
757 | (1) |
|
Total Seminars Technical Support |
|
|
757 | (1) |
|
McGraw-Hill Education Content Support |
|
|
757 | (1) |
Glossary |
|
758 | (23) |
Index |
|
781 | |