Purchase textbook

CISSP Study Guide,

Edition 1

Editors: By Eric Conrad, Seth Misenar and Joshua Feldman

Publication Date: 26 Jul 2010

0 Reviews

Inaccessible, or known limited accessibility

Ways Of Reading

This e-publication is accessible to the full extent that the file format and types of content allow, on a specific reading device, by default, without necessarily including any additions such as textual descriptions of images or enhanced navigation.

Navigation

The contents of the PDF have been tagged to permit access by assistive technologies as per PDF-UA-1 standard.
Page breaks included from the original print source

Additional Accessibility Information

All (or substantially all) textual matter is arranged in a single logical reading order (including text that is visually presented as separate from the main text flow, e.g., in boxouts, captions, tables, footnotes, endnotes, citations, etc.). Non-textual content is also linked from within this logical reading order. (Purely decorative non-text content can be ignored).
The language of the text has been specified (e.g., via the HTML or XML lang attribute) to optimise text-to-speech (and other alternative renderings), both at the whole document level and, where appropriate, for individual words, phrases or passages in a different language.

Conformance

The publication was certified on 20250728
Accessibility addendum
For detailed accessibility information, see Elsevier’s website at https://www.elsevier.com/about/accessibility
For queries regarding accessibility information, contact [email protected]

Note

This product relies on 3rd party tooling which may impact the accessibility features visible in inspection copies. All accessibility features mentioned would be present in the purchased version of the title.

CISSP Study Guide serves as a review for those who want to take the Certified Information Systems Security Professional (CISSP) exam and obtain CISSP certification. The exam is designed to ensure that someone who is handling computer security in a company has a standardized body of knowledge. The book is composed of 10 domains of the Common Body of Knowledge. In each section, it defines each domain. It also provides tips on how to prepare for the exam and take the exam. It also contains CISSP practice quizzes to test ones knowledge. The first domain provides information about risk analysis and mitigation. It also discusses security governance. The second domain discusses different techniques for access control, which is the basis for all the security disciplines. The third domain explains the concepts behind cryptography, which is a secure way of communicating that is understood only by certain recipients. Domain 5 discusses security system design, which is fundamental for operating the system and software security components. Domain 6 is a critical domain in the Common Body of Knowledge, the Business Continuity Planning, and Disaster Recovery Planning. It is the final control against extreme events such as injury, loss of life, or failure of an organization. Domains 7, 8, and 9 discuss telecommunications and network security, application development security, and the operations domain, respectively. Domain 10 focuses on the major legal systems that provide a framework in determining the laws about information system.

Key Features

Clearly Stated Exam Objectives
Unique Terms / Definitions
Exam Warnings
Helpful Notes
Learning By Example
Stepped Chapter Ending Questions
Self Test Appendix
Detailed Glossary
Web Site (http://booksite.syngress.com/companion/conrad) Contains Two Practice Exams and Ten Podcasts-One for Each Domain

About the author

By Eric Conrad, CISSP, GIAC GSE, GPEN, GCIH, GCIA, GCFA, GAWN, GSEC, Security+, SANS-certified instructor and President of Backshore Communications; Seth Misenar, CISSP, GPEN, GCIH, GCIA, GCFA, GWAPT, GCWN, GSEC, MCSE, MCDBA, SANS-certified instructor and lead consultant for Context Security, and Joshua Feldman, CISSP

Acknowledgments

About the authors

Chapter 1 Introduction

    How to Prepare for the Exam

         The Notes Card Approach

         Practice Tests

         Read the Glossary

         Readiness Checklist

    How to Take the Exam

         Steps to Becoming a CISSP

         Exam Logistics

         How to Take the Exam

         After the Exam

    Good Luck!

Chapter 2 Domain 1: Information security governance and risk management

    Unique Terms and Definitions

    Introduction

    Cornerstone Information Security Concepts

         Confidentiality, Integrity, and Availability

         Identity and Authentication, Authorization, and Accountability

    Risk Analysis

         Assets

         Threats and Vulnerabilities

         Risk = Threat × Vulnerability

         Impact

         Risk Analysis Matrix

         Calculating Annualized Loss Expectancy

         Total Cost of Ownership

         Return on Investment

         Risk Choices

         Qualitative and Quantitative Risk Analysis

         The Risk Management Process

    Information Security Governance

         Security Policy and Related Documents

         Security Awareness and Training

         Roles and Responsibilities

         Compliance with Laws and Regulations

         Privacy

         Due Care and Due Diligence

         Best Practice

         Outsourcing and Offshoring

         Auditing and Control Frameworks

         Certification and Accreditation

    Ethics

         The (ISC)2 © Code of Ethics

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 3 Domain 2: Access control

    Unique Terms and Definitions

    Introduction

    Cornerstone Access Control Concepts

         The CIA triad

         Identification and AAA

         Subjects and objects

    Access Control Models

         Discretionary Access Controls (DAC)

         Mandatory Access Controls (MAC)

         Non-Discretionary Access Control

         Content and Context-Dependent Access Controls

         Centralized Access Control

         Decentralized Access Control

         Access Control Protocols and Frameworks

    Procedural Issues for Access Control

         Labels, Clearance, Formal Access Approval, and Need to Know

         Rule-Based Access Controls

         Access Control Lists

    Access Control Defensive Categories and Types

         Preventive

         Detective

         Corrective

         Recovery

         Deterrent

         Compensating

         Comparing Access Controls

    Authentication Methods

         Type 1 Authentication: Something You Know

         Type 2 Authentication: Something You Have

         Type 3 Authentication: Something You Are

         Someplace You Are

    Access Control Technologies

         Single Sign-On (SSO)

         Kerberos

         SESAME

         Security Audit Logs

    Types of Attackers

         Hackers

         Black Hats and White Hats

         Script Kiddies

         Outsiders

         Insiders

         Hacktivist

         Bots and BotNets

         Phishers and Spear Phishers

    Assessing Access Control

         Penetration Testing

         Vulnerability Testing

         Security Audits

         Security Assessments

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 4 Domain 3: Cryptography

    Unique Terms and Definitions

    Introduction

    Cornerstone Cryptographic Concepts

         Key Terms

         Confidentiality, Integrity, Authentication, and Non-Repudiation

         Confusion, Diffusion, Substitution, and Permutation

         Cryptographic Strength

         Monoalphabetic and Polyalphabetic Ciphers

         Modular Math

         Exclusive Or (XOR)

         Types of Cryptography

    History of Cryptography

         Egyptian Hieroglyphics

         Spartan Scytale

         Caesar Cipher and other Rotation Ciphers

         Vigenère Cipher

         Cipher Disk

         Jefferson Disks

         Book Cipher and Running-Key Cipher

         Codebooks

         One-Time Pad

         Hebern Machines and Purple

         Cryptography Laws

    Symmetric Encryption

         Stream and Block Ciphers

         Initialization Vectors and Chaining

         Data Encryption Standard

         International Data Encryption Algorithm (IDEA)

         Advanced Encryption Standard (AES)

         Blowfish and Twofish

         RC5 and RC6

    Asymmetric Encryption

         Asymmetric Methods

    Hash Functions

         Collisions

         MD5

         Secure Hash Algorithm

         HAVAL

    Cryptographic Attacks

         Brute Force

         Known Plaintext

         Chosen Plaintext and Adaptive Chosen Plaintext

         Chosen Ciphertext and Adaptive Chosen Ciphertext

         Meet-in-the-middle Attack

         Known Key

         Differential Cryptanalysis

         Linear Cryptanalysis

         Side-channel Attacks

         Birthday Attack

         Key Clustering

    Implementing Cryptography

         Digital Signatures

         HMAC

         CBC-MAC

         Public Key Infrastructure

         IPsec

         SSL and TLS

         PGP

         S/MIME

         Escrowed Encryption

         Steganography

         Digital Watermarks

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 5 Domain 4: Physical (Environmental) security

    Unique Terms and Definitions

    Introduction

    Perimeter Defenses

         Fences

         Gates

         Bollards

         Lights

         CCTV

         Locks

         Smart Cards and Magnetic Stripe Cards

         Tailgating/piggybacking

         Mantraps and Turnstiles

         Contraband Checks

         Motion Detectors and Other Perimeter Alarms

         Doors and Windows

         Walls, floors, and ceilings

         Guards

         Dogs

         Restricted Areas and Escorts

    Site Selection, Design, and Configuration

         Site Selection Issues

         Site Design and Configuration Issues

    System Defenses

         Asset Tracking

         Port Controls

         Drive and Tape Encryption

         Media Storage and Transportation

         Media Cleaning and Destruction

    Environmental Controls

         Electricity

         HVAC

         Heat, Flame, and Smoke Detectors

         Safety Training and Awareness

         ABCD Fires and Suppression

         Types of Fire Suppression Agents

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 6 Domain 5: Security architecture and design

    Unique Terms and Definitions

    Introduction

    Secure System Design Concepts

         Layering

         Abstraction

         Security Domains

         The Ring Model

         Open and Closed Systems

    Secure Hardware Architecture

         The System Unit and Motherboard

         The Computer Bus

         The CPU

         Memory

         Memory Protection

    Secure Operating System and Software Architecture

         The Kernel

         Users and File Permissions

         Virtualization

         Thin Clients

    System Vulnerabilities, Threats, and Countermeasures

         Emanations

         Covert Channels

         Buffer Overflows

         TOCTOU/Race Conditions

         Backdoors

         Malicious Code (Malware)

         Server-Side Attacks

         Client-Side Attacks

         Web Application Attacks

         Mobile Device Attacks

         Database Security

         Countermeasures

    Security Models

         Reading Down and Writing Up

         State Machine model

         Bell-LaPadula model

         Lattice-Based Access Controls

         Integrity Models

         Information Flow Model

         Chinese Wall Model

         Noninterference

         Take-Grant

         Access Control Matrix

         Zachman Framework for Enterprise Architecture

         Graham-Denning Model

         Harrison-Ruzzo-Ullman Model

         Modes of Operation

    Evaluation Methods, Certification, and Accreditation

         The Orange Book

         ITSEC

         The International Common Criteria

         PCI-DSS

         Certification and Accreditation

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 7 Domain 6: Business continuity and disaster recovery planning

    Unique Terms and Definitions

    Introduction

    BCP and DRP Overview and Process

         Business Continuity Planning (BCP)

         Disaster Recovery Planning (DRP)

         Relationship between BCP and DRP

         Disasters or disruptive Events

         The Disaster Recovery Process

    Developing a BCP/DRP

         Project Initiation

         Scoping the Project

         Assessing the Critical State

         Conduct Business Impact Analysis (BIA)

         Identify Preventive Controls

         Recovery Strategy

         Related Plans

         Plan Approval

    Backups and Availability

         Hardcopy Data

         Electronic Backups

         Software Escrow

    DRP Testing, Training, and Awareness

         DRP Testing

         Training

         Awareness

    Continued BCP/DRP Maintenance

         Change Management

         BCP/DRP Mistakes

    Specific BCP/DRP Frameworks

         NIST SP 800-34

         ISO/IEC-27031

         BS-25999

         BCI

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 8 Domain 7: Telecommunications and network security

    Unique Terms and Definitions

    Introduction

    Network Architecture and Design

         Network Defense-in-Depth

         Fundamental Network Concepts

         The OSI Model

         The TCP/IP Model

         Encapsulation

         Network Access, Internet and Transport Layer Protocols and Concepts

         Application Layer TCP/IP Protocols and Concepts

         Layer 1 Network Cabling

         LAN Technologies and Protocols

         LAN Physical Network Topologies

         WAN Technologies and Protocols

    Network Devices and Protocols

         Repeaters and Hubs

         Bridges

         Switches

         TAPs

         Routers

         Firewalls

         Modem

         DTE/DCE and CSU/DSU

         Intrusion Detection Systems and Intrusion Prevention Systems

         Honeypots

         Network Attacks

         Network Scanning Tools

    Secure Communications

         Authentication Protocols and Frameworks

         VPN

         VoIP

         Wireless Local Area Networks

         RFID

         Remote Access

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 9 Domain 8: Application development security

    Unique Terms and Definitions

    Introduction

    Programming Concepts

         Machine Code, Source Code, and Assemblers

         Compilers, Interpreters, and Bytecode

         Procedural and Object-Oriented Languages

         Fourth-generation Programming Language

         Computer-Aided Software Engineering (CASE)

         Top-Down versus Bottom-Up Programming

         Types of Publicly Released Software

    Application Development Methods

         Waterfall Model

         Sashimi Model

         Agile Software Development

         Spiral

         Rapid Application Development (RAD)

         Prototyping

         SDLC

         Software Escrow

    Object-Orientated Design and Programming

         Object-Oriented Programming (OOP)

         Object Request Brokers

         Object-Oriented Analysis (OOA) and Object-Oriented Design (OOD)

    Software Vulnerabilities, Testing, and Assurance

         Software Vulnerabilities

         Software Testing Methods

         Disclosure

         Software Capability Maturity Model (CMM)

    Databases

         Types of Databases

         Database Integrity

         Database Replication and Shadowing

         Data Warehousing and Data Mining

    Artificial Intelligence

         Expert Systems

         Artificial Neural Networks

         Bayesian Filtering

         Genetic Algorithms and Programming

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 10 Domain 9: Operations security

    Unique Terms and Definitions

    Introduction

    Administrative Security

         Administrative Personnel Controls

         Privilege Monitoring

    Sensitive Information/Media Security

         Sensitive Information

    Asset Management

         Configuration Management

         Change Management

    Continuity of Operations

         Service Level Agreements (SLA)

         Fault Tolerance

    Incident Response Management

         Methodology

         Types of attacks

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Chapter 11 Domain 10: Legal regulations, investigations, and compliance

    Unique Terms and Definitions

    Introduction

    Major Legal Systems

         Civil Law (legal system)

         Common Law

         Religious Law

         Other Systems

    Criminal, Civil, and Administrative Law

         Criminal Law

         Civil Law

         Administrative Law

    Information Security Aspects of Law

         Computer Crime

         Intellectual Property

         Import/export Restrictions

         Privacy

         Liability

    Legal Aspects of Investigations

         Digital Forensics

         Incident Response

         Evidence

         Evidence Integrity

         Chain of Custody

         Reasonable Searches

         Entrapment and enticement

    Important Laws and Regulations

         U.S. Computer Fraud and Abuse Act

         USA PATRIOT Act

         HIPAA

         United States Breach Notification Laws

    Ethics

         Computer Ethics Institute

         IAB’s Ethics and the Internet

         The (ISC)2 © Code of Ethics

    Summary of Exam Objectives

    Self Test

    Self Test Quick Answer Key

Appendix: Self test

Glossary

Index

ISBN: 9781597495639

Page Count: 0

Retail Price (USD) :

Harris: CISSP All-in-One Exam Guide, 4e, (McGraw, 11/2007), ISBN: 9780071497879, 1145 pages, $79.95, Bookscan: 19,045
Tipton: Official (ISC)2 Guide to the CISSP CBK, (Auerbach, 11/2006), ISBN: 9780849382314, $73.95, Bookscan: 7726
Miller: CISSP for Dummies, (Wiley, 3/2007), ISBN: 9780470124260, 432 pages, $39.99, Bookscan: 5531

This study guide and the CISSP certification are aimed at information security professionals with at least 5 years of relevant experience.