CISSP Exam Cram

The CISSP exam is the first ANSI ISO accredited credential in the field of information security. This text is a great complement to larger study guides, either as an introduction to CISSP or as a refresher. It includes practice questions and mock exams.

Introduction... 1 How to Prepare for the Exam... 1 Practice Tests ... 2 Taking a Certification Exam ... 2 Arriving at the Exam Location . . 2 In the Testing Center ... 3 After the Exam... 3 Retaking a Test ... 3 Tracking Your CISSP Status . . 3 About This Book... 4 The Chapter Elements... 4 Other Book Elements... 7 Chapter Contents ... 7 Pearson IT Certification Practice Test Engine and Questions on the CD ... 9 Install the Software from the CD. . 10 Activate and Download the Practice Exam . . 11 Activating Other Exams ... 11 Contacting the Author ... 12 Self-Assessment... 12 CISSPs in the Real World ... 12 The Ideal CISSP Candidate . . 12 Put Yourself to the Test ... 13 After the Exam ... 15 Chapter 1: The CISSP Certification Exam ... 17 Introduction... 18 Assessing Exam Readiness ... 18 Taking the Exam ... 19 Multiple-Choice Question Format . . 21 Exam Strategy ... 21 Question-Handling Strategies ... 22 Mastering the Inner Game ... 23 Need to Know More? ... 24 Chapter 2: Physical Security ... 25 Introduction... 26 Physical Security Risks... 26 Natural Disasters... 27 Man-Made Threats... 28 Technical Problems... 28 Facility Concerns and Requirements . . 29 CPTED ... 30 Area Concerns ... 30 Location ... 31 Construction ... 32 Doors, Walls, Windows, and Ceilings . . 32 Asset Placement... 35 Physical Port Controls ... 36 Perimeter Controls... 36 Fences ... 36 Gates... 38 Bollards... 39 CCTV Cameras ... 40 Lighting ... 41 Guards and Dogs ... 42 Locks... 43 Employee Access Control ... 46 Badges, Tokens, and Cards . . 47 Biometric Access Controls... 48 Environmental Controls ... 49 Heating, Ventilating, and Air Conditioning . . 50 Electrical Power ... 51 Uninterruptible Power Supply . . 52 Equipment Life Cycle ... 53 Fire Prevention, Detection, and Suppression . . 53 Fire-Detection Equipment . . 54 Fire Suppression ... 54 Alarm Systems ... 57 Intrusion Detection Systems . . 57 Monitoring and Detection... 58 Exam Prep Questions... 60 Answers to Exam Prep Questions . . 62 Suggested Reading and Resources . . 64 Chapter 3: Access Control Systems and Methodology. . 65 Introduction... 66 Identification, Authentication, and Authorization . . 67 Authentication ... 67 Access Management ... 79 Single Sign-On ... 80 Kerberos... 81 SESAME ... 83 Authorization and Access Controls Techniques . . 84 Discretionary Access Control . . 84 Mandatory Access Control . . 85 Role-Based Access Control . . 87 Other Types of Access Controls . . 88 Access Control Methods ... 89 Centralized Access Control . . 89 Decentralized Access Control . . 92 Access Control Types ... 93 Administrative Controls... 93 Technical Controls ... 94 Physical Controls ... 94 Access Control Categories... 95 Audit and Monitoring ... 96 Monitoring Access and Usage. . 96 Intrusion Detection Systems . . 97 Intrusion Prevention Systems . . 101 Network Access Control ... 102 Keystroke Monitoring ... 102 Emanation Security ... 103 Access Control Attacks... 104 Unauthorized Access ... 104 Access Aggregation ... 105 Password Attacks... 105 Spoofing ... 109 Sniffing ... 109 Eavesdropping and Shoulder Surfing. . 110 Wiretapping... 110 Identity Theft ... 110 Denial of Service Attacks ... 111 Distributed Denial of Service Attacks . . 113 Botnets ... 113 Exam Prep Questions... 116 Answers to Exam Prep Questions . . 119 Suggesting Reading and Resources . . 121 Chapter 4: Cryptography... 123 Introduction... 124 Cryptographic Basics ... 124 History of Encryption ... 127 Steganography... 132 Steganography Operation . . 133 Digital Watermark ... 134 Algorithms ... 135 Cipher Types and Methods ... 137 Symmetric Encryption ... 137 Data Encryption Standard. . 140 Triple-DES ... 144 Advanced Encryption Standard. . 145 International Data Encryption Algorithm. . 146 Rivest Cipher Algorithms . . 146 Asymmetric Encryption ... 147 Diffie-Hellman ... 149 RSA... 150 El Gamal ... 151 Elliptical Curve Cryptosystem . . 152 Merkle-Hellman Knapsack . . 152 Review of Symmetric and Asymmetric Cryptographic Systems ... 153 Hybrid Encryption ... 153 Integrity and Authentication... 154 Hashing and Message Digests. . 155 Digital Signatures ... 158 Cryptographic System Review . . 159 Public Key Infrastructure ... 160 Certificate Authority ... 160 Registration Authority ... 161 Certificate Revocation List . . 161 Digital Certificates ... 161 The Client's Role in PKI ... 163 Email Protection Mechanisms ... 164 Pretty Good Privacy... 164 Other Email Security Applications. . 165 Securing TCP/IP with Cryptographic Solutions. . 165 Application/Process Layer Controls . . 166 Host to Host Layer Controls . . 167 Internet Layer Controls... 168 Network Access Layer Controls . . 170 Link and End-to-End Encryption . . 170 Cryptographic Attacks ... 171 Exam Prep Questions... 175 Answers to Exam Prep Questions . . 178 Need to Know More? ... 180 Chapter 5: Security Architecture and Models ... 181 Introduction... 182 Computer System Architecture . . 182 Central Processing Unit ... 182 Storage Media ... 186 I/O Bus Standards... 189 Hardware Cryptographic Components . . 190 Virtual Memory and Virtual Machines . . 190 Computer Configurations . . 191 Security Architecture ... 192 Protection Rings ... 192 Trusted Computer Base ... 194 Open and Closed Systems . . 197 Security Modes of Operation . . 197 Operating States ... 199 Recovery Procedures ... 199 Process Isolation ... 200 Security Models ... 201 State Machine Model ... 202 Information Flow Model ... 203 Noninterference Model ... 203 Confidentiality... 203 Integrity ... 204 Other Models ... 208 Documents and Guidelines ... 208 The Rainbow Series ... 209 The Red Book: Trusted Network Interpretation . 211 Information Technology Security Evaluation Criteria . 212 Common Criteria ... 212 System Validation ... 214 Certification and Accreditation. . 215 Governance and Enterprise Architecture . . 216 Security Architecture Threats... 219 Buffer Overflow ... 219 Back Doors ... 220 Asynchronous Attacks ... 220 Covert Channels ... 221 Incremental Attacks ... 221 Exam Prep Questions... 223 Answers to Exam Prep Questions . . 226 Need to Know More? ... 228 Chapter 6: Telecommunications and Network Security . . 229 Introduction... 230 Network Models and Standards . . 230 OSI Model ... 231 Encapsulation/De-Encapsulation . . 237 TCP/IP ... 238 Network Access Layer ... 238 Internet Layer ... 239 Host-to-Host (Transport) Layer. . 243 Application Layer ... 245 LANs and Their Components ... 249 LAN Communication Protocols . . 250 Network Topologies ... 251 LAN Cabling... 253 Network Types ... 255 Communication Standards ... 256 Network Equipment... 257 Repeaters ... 257 Hubs ... 257 Bridges ... 257 Switches ... 258 VLANs ... 259 Routers ... 260 Brouters ... 261 Gateways ... 261 Routing... 262 WANs and Their Components . . 264 Packet Switching... 264 Circuit Switching ... 266 Cloud Computing... 270 Voice Communications and Wireless Communications . 271 Voice over IP ... 271 Cell Phones ... 272 802.11 Wireless Networks and Standards . . 274 Network Security ... 281 Firewalls ... 282 Demilitarized Zone... 283 Firewall Design ... 285 Remote Access... 285 Point-to-Point Protocol... 286 Virtual Private Networks ... 287 Remote Authentication Dial-in User Service . 288 Terminal Access Controller Access Control System . 288 IPSec... 288 Message Privacy ... 289 Threats to Network Security ... 290 DoS Attacks ... 290 Distributed Denial of Service . . 291 Disclosure Attacks... 291 Destruction, Alteration, or Theft . . 292 Exam Prep Questions... 295 Answers to Exam Prep Questions . . 298 Need to Know More? ... 299 Chapter 7: Business Continuity and Disaster Recovery Planning. . 301 Introduction... 302 Threats to Business Operations . . 302 Disaster Recovery and Business Continuity Management . 303 Project Management and Initiation . . 305 Business Impact Analysis ... 307 Recovery Strategy ... 313 Plan Design and Development . . 327 Implementation... 330 Testing ... 331 Monitoring and Maintenance . . 333 Disaster Life Cycle ... 334 Teams and Responsibilities . . 336 Exam Prep Questions... 338 Answers to Exam Prep Questions . . 341 Need to Know More? ... 343 Chapter 8: Legal, Regulations, Investigations, and Compliance . . 345 Introduction... 346 United States Legal System and Laws. . 346 International Legal Systems and Laws . . 347 International Property Laws ... 349 Piracy and Issues with Copyrights . . 350 Privacy Laws and Protection of Personal Information . 351 Privacy Impact Assessment . . 353 Computer Crime Laws ... 354 Regulatory Compliance and Process Control. . 354 Ethics ... 355 ISC2 Code of Ethics... 356 Computer Ethics Institute . . 357 Internet Architecture Board . . 357 NIST 800-14... 358 Computer Crime and Criminals. . 359 Pornography ... 361 Well-Known Computer Crimes . . 362 How Computer Crime Has Changed . . 363 Attack Vectors ... 364 Keystroke Logging ... 365 Wiretapping... 365 Spoofing Attacks ... 366 Manipulation Attacks ... 367 Social Engineering ... 367 Dumpster Diving ... 368 Investigating Computer Crime... 368 Computer Crime Jurisdiction . . 369 Incident Response... 369 Forensics ... 374 Standardization of Forensic Procedures . . 375 Computer Forensics ... 376 Investigations... 381 Search, Seizure, and Surveillance . . 381 Interviews and Interrogations . . 381 Honeypots and Honeynets . . 381 Evidence Types ... 383 Trial ... 384 The Evidence Life Cycle ... 384 Exam Prep Questions... 385 Answers to Exam Prep Questions . . 388 Need to Know More? ... 390 Chapter 9: Software Development Security ... 391 Introduction... 392 Software Development... 392 Avoiding System Failure ... 393 The System Development Life Cycle . . 394 System Development Methods... 402 The Waterfall Model ... 402 The Spiral Model ... 402 Joint Application Development . . 403 Rapid Application Development. . 404 Incremental Development . . 404 Prototyping ... 404 Computer-Aided Software Engineering . . 405 Agile Development Methods. . 405 Capability Maturity Model . . 406 Scheduling ... 407 Change Management ... 408 Programming Languages... 409 Object-Oriented Programming . . 412 CORBA ... 413 Database Management... 413 Database Terms... 414 Integrity ... 416 Transaction Processing... 416 Data Warehousing ... 416 Data Mining ... 417 Knowledge Management ... 418 Artificial Intelligence and Expert Systems. . 418 Malicious Code ... 419 Viruses ... 420 Worms ... 421 Spyware ... 422 Back Doors and Trapdoors . . 423 Change Detection... 423 Mobile Code ... 424 Financial Attacks ... 424 Buffer Overflow ... 424 Input Validation and Injection Attacks . . 426 Exam Prep Questions... 429 Answers to Exam Prep Questions . . 432 Need to Know More? ... 434 Chapter 10: Information Security Governance and Risk Management . . 435 Introduction... 436 Basic Security Principles ... 436 Security Management and Governance. . 438 Asset Identification ... 440 Risk Assessment ... 441 Risk Management ... 442 Policies Development... 458 Security Policy... 459 Standards ... 461 Baselines ... 461 Guidelines ... 461 Procedures ... 462 Data Classification ... 462 Implementation... 465 Roles and Responsibility ... 465 Security Controls ... 467 Training and Education ... 469 Security Awareness ... 470 Social Engineering ... 471 Auditing Your Security Infrastructure . . 472 The Risk of Poor Security Management. . 474 Exam Prep Questions... 475 Answers to Exam Prep Questions . . 478 Need to Know More? ... 480 Chapter 11: Security Operations ... 481 Introduction... 482 Security Operations ... 482 Employee Recruitment ... 483 New-Hire Orientation ... 484 Separation of Duties... 484 Job Rotation... 485 Least Privilege... 485 Mandatory Vacations ... 486 Termination ... 486 Accountability ... 486 Controls ... 488 Security Controls ... 489 Operational Controls ... 490 Auditing and Monitoring... 498 Auditing ... 498 Security Information and Event Management (SIEM) . 499 Monitoring Controls ... 499 Clipping Levels ... 501 Intrusion Detection ... 501 Keystroke Monitoring ... 502 Antivirus ... 503 Facility Access Control ... 504 Telecommunication Controls ... 504 Fax... 505 PBX... 506 Email... 507 Backup, Fault Tolerance, and Recovery Controls . . 509 Backups... 509 Fault Tolerance ... 511 RAID ... 513 Recovery Controls ... 515 Security Assessments ... 516 Policy Reviews... 516 Vulnerability Scanning ... 517 Penetration Testing... 518 Operational Security Threats and Vulnerabilities . . 521 Common Attack Methodologies. . 522 Attack Terms and Techniques . . 524 Exam Prep Questions... 526 Answers to Exam Prep Questions . . 529 Need to Know More? ... 531 Practice Exam I... 533 Practice Exam Questions... 533 Answers to Practice Exam I ... 547 Practice Exam II ... 563 Practice Exam Questions... 563 Answers to Practice Exam II ... 577 TOC, 9780789749574, 11/2/2012