CISSP Best Practices Guide to the Basics of Certified Information Systems Security Professional

Ivanka Menken

Description

The Certified Information System Security Professional (CISSP®) credential is the global benchmark for information system security professionals. It gives you the technical know-how and full understanding of IS issues to perform information security functions for your organization.

This book provides the full foundation for your CISSP knowledge: Protect and serve your business at your very best.

The Certification That Inspires Utmost Confidence: If you plan to build a career in information security - one of today's most visible professions - then the CISSP® credential should be your next career goal.

The CISSP was the first credential in the field of information security, accredited by the ANSI (American National Standards Institute) to ISO (International Standards Organization) Standard 17024:2003. CISSP certification is not only an objective measure of excellence, but a globally recognized standard of achievement.

This book covers the following CISSP domains:

* Access Control

* Application Security

* Business Continuity and Disaster Recovery Planning

* Cryptography

* Information Security and Risk Management

* Legal, Regulations, Compliance and Investigations

* Operations Security

* Physical (Environmental) Security CISSP

* Security Architecture and Design

* Telecommunications and Network Security

This guide has an amazing amount of coverage over the concepts ISC2 indicates in their outline of topics that is on the exam. 10-12 Books have been combined into one Guide and Overview , which makes it a lot easier to understand and digest.

Sujets

• Computers
• Informatique
• Security

Informations

• Publié par: Emereo Publishing
• Date de parution: 24 octobre 2012
• Nombre de lectures: 0
• EAN13: 9781486454877
• Langue: English

Extrait

Certification for Information System Security Professional (CISSP)

©The Art of Service

Copyright © Notice of rights All rights reserved. No part of this book may be reproduced or transmitted in any form by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Notice of Liability The information in this book is distributed on an “As Is” basis without warranty. While every precaution has been taken in the preparation of the book, neither the author nor the publisher shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the instructions contained in this book or by the products described in it. Trademarks

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations appear as requested by the owner of the trademark. All other product names and services identified throughout this book are used in editorial fashion only and for the benefit of such companies with no intention of infringement of the trademark. No such use, or the use of any trade name, is intended to convey endorsement or other affiliation with this book.

©The Art of Service

Certification for Information System Security Professional (CISSP)

1

TABLE OF CONTENTS

INTRODUCTION

1.1 I NTRODUCTION TO CISSP 9 1.2W HERE DID CISSP COME FROM ? 10 1.3W HAT IS CISSP? 12 1.4H ISTORY OF I NFORMATION S ECURITY 14 1.5W HAT IS I NFORMATION S ECURITY ? 16 1.6U NDERSTANDING THE CIAT RIAD 18 1.6.1C ONFIDENTIALITY 1.6.2I NTEGRITY 1.6.3A VAILABILITY 1.6.4L IMITATIONS TO CIAT RIAD 1.7W HY CERTIFY FOR CISSP? 21 1.8C OMPANIES U SING CISSP 23

9

18 19 20 21

2DOMAIN ONE – INFORMATION SECURITY AND RISK MANAGEMENT 27

2.1E XPECTATIONS FOR CISSP 27 2.2U NDERSTANDING S ECURITY P OLICIES ,P ROCEDURES ,  S TANDARDS ,G UIDELINES AND B ASELINES 29 2.3W HAT ARE THE C OMPLIANCE F RAMEWORKS ? 31 2.3.1COSO 2.3.2ITIL 2.3.3COBIT 2.3.4ISO17799/BS7799 2.4C HANGING O RGANIZATIONAL B EHAVIOR 35 2.5 R ESPONSIBILITIES OF THE I NFORMATION S ECURITY  O FFICER 37 2.6C REATING AN E NTERPRISE S ECURITY O VERSIGHT

31 32 32 33

3

Certification for Information System Security Professional (CISSP)

2.7 2.8

C OMMITTEE 39 W HY S ECURITY A WARENESS T RAINING ? 42 U NDERSTANDING R ISK M ANAGEMENT 43

DOMAIN TWO – ACCESS CONTROL

47

3

4

3.1P RINCIPLES OF A CCESS C ONTROL 49 3.2I NFORMATION C LASSIFICATION 50 3.3C REATING A D ATA C LASSIFICATION P ROGRAM 52 3.4U NDERSTANDING C ATEGORIES TO A CCESS C ONTROL 55 3.5U NDERSTANDING A CCESS C ONTROL T YPES 57 3.6L OOKING M ORE AT A DMINISTRATION A CCESS C ONTROLS 59 3.7U NDERSTANDING C HANGE C ONTROL 61 3.8U NDERSTANDING B USINESS C ONTINUITY AND D ISASTER R ECOVERY 63 3.9U NDERSTANDING THE P ERFORMANCE M ANAGEMENT ,  C ONFIGURATION M ANAGEMENT ,L IFECYCLE M ANAGEMENT AND N ETWORK M ANAGEMENT 65 3.10U NDERSTANDING V ULNERABILITY M ANAGEMENT 67 3.11U NDERSTANDING U SER M ANAGEMENT 68 3.12 U NDERSTANDING P RIVILEGE M ANAGEMENT 71 3.13U NDERSTANDING T ECHNICAL C ONTROLS 72 3.14U NDERSTANDING A CCESS C ONTROL T HREATS 75 3.15E MPLOYING D IFFERENT T YPES OF I DENTIFICATION 78 3.16E MPLOYING D IFFERENT T YPES OF A UTHENTICATION 80 3.17U NDERSTANDING M EMORY C ARDS AND S MART C ARDS 83 3.18U SING B IOMETRICS 85 3.19P ERFORMING A UDITS 87

Certification for Information System Security Professional (CISSP)

4

4.1 4.2 4.3 4.4 4.5 4.6

5

5.1 5.2 5.3 5.4

DOMAIN THREE - CRYPTOGRAPHY

H ISTORY OF C RYPTOGRAPHY 91 M ETHODS OF C RYPTOGRAPHY 92 T YPES OF C IPHERS 94 U NDERSTANDING E NCRYPTION M ANAGEMENT 96 U SING P UBLIC K EY I NFRASTRUCTURES (PKI) 97 I DENTIFYING A TTACKS TO C RYPTOGRAPHY 99

89

DOMAIN 4 – PHYSICAL (ENVIRONMENT) SECURITY 101

I DENTIFYING T HREATS AND V ULNERABILITIES TO P HYSICAL S ECURITY 103 U SING THE L AYERED D EFENCE M ODEL 105 I MPLEMENTING A L AYERED D EFENCE M ODEL 107 U NDERSTANDING I NFORMATION P ROTECTION AND M ANAGEMENT 109

6

DOMAIN FIVE – SECURITY ARCHITECTURE AND DESIGN 113

6.1U NDERSTANDING D ESIGN P RINCIPLES 115 6.1.1H ARDWARE 6.1.2S OFTWARE 6.2S ECURITY M ODELS AND A RCHITECTURE T HEORY 121 6.3S ECURITY P RODUCT E VALUATION M ETHODS AND  C RITERIA 124

117 120

7DOMAIN SIX – BUSINESS CONTINUITY AND DISASTER RECOVERY PLANNING 127

7.1

C ONCERNS OF C ONTINUITY P LANNING 129

5

Certification for Information System Security Professional (CISSP)

7.2 7.3 7.4 7.5

P ROJECT I NITIATION P HASE 131 C URRENT S TATE A SSESSMENT P HASE 133 D EVELOPMENT P HASE 135 I MPLEMENTATION AND M ANAGEMENT P HASES 137

8DOMAIN SEVEN – TELECOMMUNICATIONS AND NETWORK SECURITY 139

8.1 8.2 8.3 8.4 8.5 8.6

9

9.1 9.2 9.3 9.4 9.5

L AYER 1–P HYSICAL L AYER 141 L AYER 2–D ATA -L INK L AYER 143 L AYER 3–N ETWORK L AYER 144 L AYER 4–T RANSPORT L AYER 146 L AYER 5–S ESSION L AYER 147 L AYERS 6&7–P RESENTATION AND A PPLICATION L AYERS 149

DOMAIN EIGHT – APPLICATION SECURITY

U SING P ROGRAMMING E FFECTIVELY 155 P ROTECTING THE S OFTWARE E NVIRONMENT 156 E NFORCING S ECURITY P ROTECTION AND C ONTROLS 158 I DENTIFYING M ALWARE 160 D ATABASE M ANAGEMENT S YSTEM (DBMS) A RCHITECTURE 162

10DOMAIN NINE – OPERATIONS SECURITY

10.1

M ANAGING T HREATS TO O PERATIONS 166

153

165

11DOMAIN TEN – LEGAL, REGULATIONS, COMPLIANCE AND INVESTIGATIONS 169

11.1

I NFORMATION T ECHNOLOGY L AWS AND R EGULATIONS 171

6

Certification for Information System Security Professional (CISSP)

11.2

U NDERSTANDING C OMPUTER C RIMES ,P RIVACY AND L IABILITY 172

12REFERENCES

175

7

Certification for Information System Security Professional (CISSP)

8

Certification for Information System Security Professional (CISSP)

1 Introduction

1.1 Introduction to CISSP Today’s businesses are faced with security threats which are becoming more complex. The use of mobile devices is becoming more widespread; the more mobile the populace, the harder to manage assets and the information on those assets. As a result, companies are increasingly concerned with the security surrounding those assets and information. In addition, the implementation of Sarbanes-Oxley is the U.S. has required focused attention on the security of financial information for companies. And finally, the worldwide scrutiny on security across the board has increased due to global concerns. Because of these reasons, companies are placing more focus on their Information Technology (IT). The IT Governance Global Status Report-200b, compiled by the IT Governance Institute (ITGI), showed 93 percent of corporate executives believed that IT was somewhat to very important to their overall corporate strategy or vision. This was a 6 percent increase from ITGI’s 2005 survey. IT, telecom, and financial service-based companies are much more concerned with IT than other business sectors with 71% and 77% respectively. The bottom line: companies are putting more attention on their IT solutions. Security management and the processes supporting security

9

Certification for Information System Security Professional (CISSP)

management is one of the top concerns of this increasing attention. Information Security Certifications are becoming more valuable for IT security professionals and companies 2 concerned with IT. According to the 2008 (ISC) Global 2 Information Security Workforce Study, compiled by (ISC) , 78% of respondents involved in the hiring process claim certifications are either “Very Important” or “Somewhat Important”. This is a diverse change from twenty, even ten years ago when securing a network was a new discipline and not well-understood. According to the 2008 survey, 15 different security certifications were available, which is in contrast to the 40 vendor-neutral and more than 25 vendor- specific certifications available in the marketplace. Of all these certifications, the Certification for Information System Security Professional (CISSP) has become highly recognized.

1.2 Where did CISSP come from? The Certification for Information System Security Professional is administered by the International Information Systems Security Certification Consortium 2 (ISC) . First available in 1989, the certification demonstrates the qualifications of information systems security practitioners.

10