CISM Certified Information Security Manager Certification Exam Preparation Course in a Book for Passing the CISM Exam - The How To Pass on Your First Try Certification Study Guide

William Manning

Description

CISM certification promotes international practices and provides executive management with assurance that those earning the certificate have the required experience and knowledge to provide effective security management and consulting services.

Individuals earning the CISM certification become part of an elite peer network, attaining a one-of-a-kind credential.

This self-study exam preparation guide for the CISM Certified Information Security Manager certification exam contains everything you need to test yourself and pass the Exam. All Exam topics are covered and insider secrets, complete explanations of all CISM Certified Information Security Manager subjects, test tricks and tips, numerous highly realistic sample questions, and exercises designed to strengthen understanding of CISM Certified Information Security Manager concepts and prepare you for exam success on the first attempt are provided.

Put your knowledge and experience to the test. Achieve CISM certification and accelerate your career.

Can you imagine valuing a book so much that you send the author a "Thank You" letter?

Tens of thousands of people understand why this is a worldwide best-seller. Is it the authors years of experience? The endless hours of ongoing research? The interviews with those who failed the exam, to identify gaps in their knowledge? Or is it the razor-sharp focus on making sure you don't waste a single minute of your time studying any more than you absolutely have to? Actually, it's all of the above.

This book includes new exercises and sample questions never before in print. Offering numerous sample questions, critical time-saving tips plus information available nowhere else, this book will help you pass the CISM Certified Information Security Manager exam on your FIRST try.

Up to speed with the theory? Buy this. Read it. And Pass the CISM Exam.

Sujets

• Information Management
• Gestion et management
• Economics
• Business

Informations

• Publié par: Emereo Publishing
• Date de parution: 24 octobre 2012
• Nombre de lectures: 0
• EAN13: 9781742441122
• Langue: English
• Poids de l'ouvrage: 1 Mo

Extrait

Foreword

This Exam Preparation book is intended for those preparing for the Certified Information Security Manager certification. This book isnota replacement for completing a course. This is a study aid to assist those who have completed an accredited course and preparing for the exam. Do not underestimate the value of your own notes and study aids. The more you have, the more prepared you will be. While it is not possible to pre-empt every question and content that may be asked in the CISM exam, this book covers the main concepts covered within the CISM discipline. Due to licensing rights, we are unable to provide actual CISM Exam. However, the study notes and sample exam questions in this book will allow you to more easily prepare for a CISM exam. Ivanka Menken Executive Director The Art of Service

1 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

Write a review to receive anyfreeeBook from our Catalogue - $99 Value! If you recently bought this book we would love to hear from you! Benefit from receiving a free eBook from our catalogue at http://www.emereo.org/if you write a review on Amazon (or the online store where you purchased this book) about your last purchase! How does it work? To post a review on Amazon, just log in to your account and click on the Create your own review button (under Customer Reviews) of the relevant product page. You can find examples of product reviews in Amazon. If you purchased from another online store, simply follow their procedures. What happens when I submit my review? Once you have submitted your review, send us an email at [e-mail] the link to your review, and the eBook you would like as our thank you fromhttp://www.emereo.org/. Pick any book you like from the catalogue, up to $99 RRP. You will receive an email with your eBook as download link. It is that simple!

2 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

Table of Contents

FOREWORD............................................................................................................ 1

TABLE OF CONTENTS .............................................................................................. 3

1

2

CERTIFIED INFORMATION SECURITY MANAGER ............................................. 8

EXAM SPECIFICS............................................................................................. 9

3INFORMATION SECURITY GOVERNANCE ...................................................... 11 3.1I NFORMATION S ECURITY B ASICS ......11................................................................. 3.1.1Business Goals and Objectives .............................................................11 3.1.2Information Security Concepts.............................................................12 3.1.3Information Security Strategies ...........................................................14 3.2I NFORMATION S ECURITY G OVERNANCE .............................................................17 3.2.1Governance Concepts ..........................................................................18 3.2.2Scope and Charter of Governance .......................................................20 3.2.3Business Function Relationships ..........................................................21 3.2.4Information Security Governance Framework .....................................22 3.3I NFORMATION S ECURITY R EQUIREMENTS ...........................................................23 3.3.1Drivers for Information Security ..........................................................23 3.3.2Budget Planning ..................................................................................24 3.3.3Regulatory Requirements ....................................................................25 3.3.4Third Party Relationships .....................................................................26 3.4I NFORMATION S ECURITY P REPARATION ..............................................................27 3.4.1International Standards .......................................................................27 3.4.2Roles and Responsibilities ....................................................................29 3.4.3Information Security Officer ................................................................30 3.4.4Policies and Objectives.........................................................................32 3.4.5Centralized and Distributed Methods ..................................................33 4INFORMATION RISK MANAGEMENT ............................................................ 35 4.1R ISK M ANAGEMENT ............................................................................53.......... 4.1.1Key Definitions .....................................................................................35 4.1.2Principles and Practices .......................................................................36 4.1.3Controls and Countermeasures............................................................36 4.2I NFORMATION S CHEMAS ................................................................................38 4.2.1Information Classification....................................................................38 4.2.2Information Ownership........................................................................39 4.3I NFORMATION T HREATS AND V ULNERABILITIES .......04............................................. 4.3.1Denial of Service 3 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

(DoS) 41 4.3.2Buffer Overflows ..................................................................................42 4.3.3Mobile Code.........................................................................................42 4.3.4Malicious Software ..............................................................................43 4.3.5Password Crackers ...............................................................................44 4.3.6Spoofing/Masquerading ......................................................................46 4.3.7..................................................48Sniffers, Eavesdropping, and Tapping 4.3.8Emanations..........................................................................................48 4.3.9Shoulder Surfing ..................................................................................49 4.3.10Object Reuse....................................................................................49 4.3.11Data Remanence .............................................................................51 4.3.12Unauthorized Targeted Data Mining ...............................................52 4.3.13..............................................................................53Dumpster Diving 4.3.14Backdoors and Trapdoors ................................................................53 4.3.15Theft ................................................................................................54 4.3.16Social Engineering ...........................................................................54 4.4R ISK A SSESSMENTS AND A NALYSIS ....................................................................55 4.4.1General Process ...................................................................................55 4.4.2Qualitative Risk Assessments...............................................................55 4.4.3Quantitative Risk Assessments ............................................................56 4.4.4........................................................57Common Security Measurements 4.4.5Assessment Methodologies .................................................................58 4.4.6Baseline Modeling ...............................................................................58 4.4.7Gap Analysis ........................................................................................59 4.4.8Cost Benefit Analysis............................................................................60 4.4.9................................................................................61Information Value 563INFORMATION SECURITY PROGRAM DEVELOPMENT................................... 5.1S ECURITY P ROGRAM C ONCEPTS .......................................................................63 5.1.1Strategies .............................................................................................63 5.1.2Program Activities................................................................................64 5.1.3Managing Implementation..................................................................66 5.2S ECURITY C ONTROLS .....................................................................................67 5.2.1Control Categories ...............................................................................69 5.2.2Administrative Controls .......................................................................71 5.2.3Technical Controls ................................................................................75 5.2.4Access Control Models .........................................................................77 5.2.5Integrity Models ..................................................................................78 5.2.6Rainbow Series.....................................................................................78 5.2.7...............82Information Technology Security Evaluation Criteria (ITSEC) 5.2.8Common Criteria..................................................................................82 5.3S ECURITY T ECHNOLOGIES ...............................................................................84 5.3.1Identity Management ..........................................................................84 4 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

5.3.2Access Control Technologies ................................................................87 5.3.3Access Control Lists ..............................................................................92 5.3.4........................................................................92Types of Access Control 5.3.5Authentication Devices ........................................................................94 5.3.6Integrated Circuit Cards .......................................................................96 5.3.7Biometrics ..........................................................................................102 5.3.8......................................................104Intrusion Detection Systems (IDS) 5.3.9Cryptography Methods ......................................................................108 5.3.10Cryptography Forms ......................................................................109 5.3.11Access Control Technologies ..........................................................111 5.4IPS ECURITY (IPS EC ) ...................................................................................114 5.4.1Authentication Headers and Encapsulating Security Payload ...........115 5.4.2Internet Key Exchange (IKE) ...............................................................116 5.4.3The IKE Process ..................................................................................117 5.4.4Methods of Encryption and Integrity .................................................118 5.4.5Renegotiating Lifetimes .....................................................................118 5.4.6Subnets and Security Associations .....................................................119 5.5S ECURITY D OCUMENTATION .........................................................................0.12 5.5.1Types of Documentation ....................................................................120 5.5.2Security Education .............................................................................122 5.6C OMPLIANCE .............................................................................................124 5.6.1Certification and Accreditation ..........................................................124 5.6.2Service Level Agreements ..................................................................125 5.6.3Laws and Standards...........................................................................126 5.6.41996 National Information Infrastructure Protection Act..................127 5.6.5President's Executive Order on Critical Infrastructure Protection ......127 5.6.6USA Patriot Act of 2001 .....................................................................128 5.6.7Homeland Security Act of 2002 .........................................................129 5.6.8Computer Fraud and Abuse Act .........................................................129 5.6.9Electronic Communications Privacy Act (ECPA) .................................130 5.7S ECURITY M ONITORING ................................1......30......................................... 5.7.1........................................................................130Change Management 5.7.2Configuration Management ..............................................................132 5.7.3Information Access Control ................................................................134 5.7.4Problem Management.......................................................................136 5.7.5Recovery and Continuity Planning .....................................................139 5.7.6Continuity Planning Process ..............................................................140 5.7.7Information Incident Management ...................................................144 5.7.8Managing Evidence ...........................................................................146 5.8F ACILITIES ..147................................................................................................ 5.8.1Entry Points........................................................................................150 5.8.2Defense in Depth ...............................................................................153 5.8.3......................................................154Physical Security Implementation 5 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

6PRACTICE EXAM......................................................................................... 155 6.1R EFRESHER ͞W ARM UP Q UESTIONS ͟....................E RROR !B OOKMARK NOT DEFINED . 7ANSWER GUIDE ......................................................................................... 172 7.1A NSWERS TO Q UESTIONS ...................................E RROR !B OOKMARK NOT DEFINED . 8REFERENCES .............................................................................................. 181

6 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

Notice of Rights All rights reserved. No part of this book may be reproduced or transmitted in any form

by any means, electronic, mechanical, photocopying, recording, or otherwise, without

the prior written permission of the publisher. Notice of Liability The information in this book is distributed on an“As Is” basis without warranty. While every precaution has been taken in the preparation of the book, neither the author nor the publisher shall have any liability to any person or entity with respect to any loss or

damage caused or alleged to be caused directly or indirectly by the instructions

contained in this book or by the products described in it. Trademarks Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations appear as

requested by the owner of the trademark. All other product names and services identified throughout this book are used in editorial fashion only and for the benefit of such companies with no intention of infringement of the trademark. No such use, or

the use of any trade name, is intended to convey endorsement or other affiliation with this book.

7 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

1

Certified Information Security Manager

The Certified Information Security Manager certification is for

experienced information security managers and those individuals with

responsibilities in information security management. The certification

covers the management, design, oversight, and assessment of an

enterprise's information security program using internationally

accepted practices. The CISM is accredited by the American National Standards Institute

(ANSI) under ISO/IEC 17024:2003.

The exam covers the following disciplines and percentage scope: Security Governance  Information 23% Risk Management  Information 22% 17% Information Security Program Development 24% Information Security Program Management 14%Management and Response  Incident

8 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

2

Exam Specifics

CISM Exams are proctored by ISACA. Registration and location information can be found on thewww.isaca.orgweb site. The exam is

administered twice a year: June and December. Exams are delivered in a secure environment, proctored, and timed. Specifics about the exam are:  Price: See registration site Limit: 240  Time minutes 200of Questions:  #  Question Type: Multiple Choice  Passing Score: 450 or higher After passing the exam, the candidate has five years to apply for

certification. This is done by completing the certification and verifying work experience. Experience required two years in information security management. This requirement can be substituted with the

achievement of one of the following: Information Systems Auditor (CISA) in good Certification standing. Information Systems Security Professional Certification

(CISSP) in good standing.

 Postgraduate degree in information security or related field. 9 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]

Partial credit to fulfill the requirement is possible with one of the

following:







One full year of information systems management

experience.

One full year of general security management experience.

Skill-based security certification.

10 Copyright The Art of Service│Brisbane, Australia│Email:[e-mail] Web:http://theartofservice.com│eLearning:http://theartofservice.org│Phone: [phone]