第1页 / 共195页
第2页 / 共195页
第3页 / 共195页
第4页 / 共195页
第5页 / 共195页
第6页 / 共195页
第7页 / 共195页
第8页 / 共195页
11小时CISSP学习指导.pdf
Front Matter
Copyright
Author Biography
Domain 1: Access Control
Introduction
Cornerstone information security concepts
Confidentiality, integrity, and availability
Confidentiality
Integrity
Availability
Disclosure, alteration, and destruction
Identity and authentication, authorization, and accountability
Identity and authentication
Authorization
Accountability
Nonrepudiation
Least privilege and need to know
Subjects and objects
Defense-in-depth
Access control models
Discretionary access controls
Mandatory access controls
Nondiscretionary access control
Rule-based access controls
Centralized access control
Access control lists
Access provisioning lifecycle
User entitlement, access review, and audit
Access control protocols and frameworks
RADIUS
Diameter
TACACS and TACACS+
PAP and CHAP
Access control defensive categories and types
Preventive
Detective
Corrective
Recovery
Deterrent
Compensating
Authentication methods
Type 1 authentication: something you know
Passwords
Password hashes and password cracking
Dictionary attacks
Hybrid attacks
Brute-force attacks
Rainbow tables
Salts
Type 2 authentication: something you have
Synchronous dynamic token
Asynchronous dynamic token
Type 3 authentication: something you are
Biometric enrollment and throughput
Accuracy of biometric systems
False reject rate
False accept rate
Crossover Error Rate
Types of biometric controls
Fingerprints
Retina scan
Iris scan
Hand geometry
Keyboard dynamics
Dynamic signature
Voiceprint
Facial scan
Someplace you are
Single sign-on
Endnotes
Domain 2: Telecommunications and Network Security
Introduction
Network architecture and design
Fundamental network concepts
Simplex, half-duplex, and full-duplex communication
LANs, WANs, MANs, and PANs
Internet, Intranet, and Extranet
The OSI model
Layer 1: Physical
Layer 2: Data Link
Layer 3: Network
Layer 4: Transport
Layer 5: Session
Layer 6: Presentation
Layer 7: Application
The TCP/IP model
Network Access Layer
Internet Layer
Host-to-Host Transport Layer
Application Layer
MAC addresses
EUI-64 MAC addresses
IPv4
IPv6
TCP
TCP ports
UDP
ICMP
Application-Layer TCP/IP protocols and concepts
Telnet
FTP
SSH
SMTP, POP, and IMAP
DNS
HTTP and HTTPS
LAN technologies and protocols
Ethernet
WAN technologies and protocols
T1s, T3s, E1s, and E3s
Frame Relay
MPLS
Network devices and protocols
Repeaters and hubs
Bridges
Switches
Routers
Firewalls
Packet filter
Stateful firewalls
Proxy firewalls
Application-Layer Proxy firewalls
Modem
Intrusion Detection Systems and Intrusion Prevention Systems
Endpoint security
Antivirus
Application whitelisting
Removable media controls
Disk encryption
Secure communications
Authentication protocols and frameworks
PAP and CHAP
802.1X and EAP
VPN
PPP
IPsec
Remote meeting technology
Domain 3: Information Security Governance and Risk Management
Introduction
Risk Analysis
Assets
Threats and vulnerabilities
Risk=threat×vulnerability
Impact
Risk Analysis Matrix
Calculating Annualized Loss Expectancy
Asset Value
Exposure Factor
Single Loss Expectancy
Annual Rate of Occurrence
Annualized Loss Expectancy
Total Cost of Ownership
Return on Investment
Budget and metrics
Risk choices
Accept the risk
Risk acceptance criteria
Mitigate the risk
Transfer the risk
Risk avoidance
Qualitative and Quantitative Risk Analysis
The Risk Management process
Information Security Governance
Security policy and related documents
Policy
Components of program policy
Policy types
Procedures
Standards
Guidelines
Baselines
Roles and responsibilities
Personnel security
Background checks
Employee termination
Security awareness and training
Vendor, consultant, and contractor security
Outsourcing and offshoring
Privacy
Due care and due diligence
Gross negligence
Best practice
Auditing and control frameworks
OCTAVE
ISO 17799 and the ISO 27000 series
COBIT
ITIL
Certification and Accreditation
Summary of exam objectives
Top five toughest questions
Answers
Endnotes
Domain 4: Software Development Security
Introduction
Programming concepts
Machine code, source code, and assemblers
Compilers, interpreters, and bytecode
Types of publicly released software
Open and closed source software
Free Software, Shareware, and Crippleware
Application development methods
Waterfall Model
Spiral
Agile Software Development
Extreme Programming
Rapid Application Development
SDLC
Object-Oriented Programming
Cornerstone Object-Oriented Programming concepts
Object Request Brokers
COM and DCOM
Software vulnerabilities, testing, and assurance
Software vulnerabilities
Types of software vulnerabilities
Cross-Site Scripting and Cross-Site Request Forgery
Privilege escalation
Backdoors
Disclosure
Software Capability Maturity Model
Databases
Relational databases
Foreign keys
Referential, semantic, and entity integrity
Database normalization
Database views
Database query languages
Database integrity
Database replication and shadowing
Summary of exam objectives
Top five toughest questions
Self-test quick answer key
Endnotes
Domain 5: Cryptography
Introduction
Cornerstone cryptographic concepts
Key terms
Confidentiality, integrity, authentication, and nonrepudiation
Substitution and permutation
Cryptographic strength
Monoalphabetic and polyalphabetic ciphers
Exclusive Or XOR
Types of cryptography
Symmetric encryption
Stream and block ciphers
Initialization vectors and chaining
DES
Modes of DES
Electronic Code Book
Cipher Block Chaining
Cipher Feedback
Output Feedback
Counter
Single DES
Triple DES
Triple DES encryption order and keying options
International Data Encryption Algorithm
Advanced Encryption Standard
Choosing AES
Blowfish and Twofish
RC5 and RC6
Asymmetric encryption
Asymmetric methods
Factoring prime numbers
Discrete logarithm
Diffie-Hellman Key Agreement Protocol
Elliptic Curve Cryptography
Asymmetric and symmetric trade-offs
Hash functions
MD5
Secure Hash Algorithm
HAVAL
Cryptographic attacks
Brute force
Known plaintext
Chosen plaintext and adaptive-chosen plaintext
Chosen ciphertext and adaptive-chosen ciphertext
Meet-in-the-middle attack
Known key
Differential cryptanalysis
Linear cryptanalysis
Side-channel attacks
Implementing cryptography
Digital signatures
Public Key Infrastructure
Certificate Authorities and Organizational Registration Authorities
Certificate Revocation Lists
Key management issues
SSL and TLS
IPsec
AH and ESP
Security association and ISAKMP
Tunnel and transport mode
IKE
PGP
S/MIME
Escrowed encryption
Clipper Chip
Endnotes
Domain 6: Security Architecture and Design
Introduction
Secure system design concepts
Layering
Abstraction
Security domains
The ring model
Secure Hardware Architecture
The system unit and motherboard
The computer bus
The CPU
Arithmetic logic unit and control unit
Fetch and execute
Pipelining
Interrupts
Processes and threads
Multitasking and multiprocessing
CISC and RISC
Memory
Cache memory
RAM and ROM
DRAM and SRAM
Memory protection
Process isolation
Hardware segmentation
Virtual memory
Swapping and paging
Firmware
Flash memory
BIOS
Secure operating system and software architecture
The kernel
Reference monitor
Virtualization
Hypervisor
Virtualization security issues
Cloud computing
Grid computing
Peer-to-peer
Thin clients
System vulnerabilities, threats, and countermeasures
Covert channels
Buffer overflows
TOCTOU/race conditions
Maintenance Hooks
Malicious code malware
Computer viruses
Worms
Trojans
Rootkits
Web architecture and attacks
Applets
Java
ActiveX
OWASP
XML and SAML
Service-Oriented Architecture
Mobile device attacks
Mobile device defenses
Database security
Polyinstantiation
Inference and aggregation
Security models
Bell-LaPadula model
Lattice-based access controls
The International Common Criteria
Endnotes
Domain 7: Operations Security
Introduction
Administrative security
Labels
Clearance
Separation of duties
Rotation of duties
Mandatory leave/forced vacation
Nondisclosure agreement
Background checks
Sensitive information/media security
Sensitive information
Labeling/marking
Handling
Storage
Retention
Media sanitization or destruction of data
Data remanence
Wiping, overwriting, or shredding
Degaussing
Physical destruction
Shredding
Asset management
Configuration management
Baselining
Vulnerability management
Zero-day vulnerabilities and zero-day exploits
Change management
Continuity of operations
Service-Level Agreements
Fault tolerance
Backup
Full
Incremental and differential
Redundant Array of Inexpensive Disks
RAID 0: Striped set
RAID 1: Mirrored set
RAID 2: Hamming code
RAID 3: Striped set with dedicated parity byte level
RAID 4: Striped set with dedicated parity block level
RAID 5: Striped set with distributed parity
RAID 6: Striped set with dual distributed parity
RAID 1+0 or RAID 10
System redundancy
Redundant hardware and redundant systems
High-availability clusters
Incident response management
Methodology
Preparation
Detection and analysis
Containment
Eradication
Recovery
Lessons learned
Types of attacks
Session hijacking and MITM
Malware
Denial of Service and Distributed Denial of Service
Summary of exam objectives
Top five toughest questions
Answers
Endnotes
Domain 8: Business Continuity and Disaster Recovery Planning
Introduction
BCP and DRP overview and process
Business Continuity Planning
Disaster Recovery Planning
Relationship between BCP and DRP
Disasters or disruptive events
The Disaster Recovery Process
Respond
Activate team
Communicate
Assess
Reconstitution
Developing a BCP/DRP
Project Initiation
Assessing the critical state
Conduct Business Impact Analysis
Identify critical assets
Conduct BCP/DRP-focused risk assessment
Determine Maximum Tolerable Downtime
Alternate terms for MTD
Failure and recovery metrics
Recovery Point Objective
Recovery Time Objective and Work Recovery Time
Mean Time Between Failures
Mean Time to Repair
Minimum Operating Requirements
Identify Preventive Controls
Recovery strategy
Redundant site
Hot site
Warm site
Cold site
Reciprocal agreement
Mobile site
Related plans
Call Trees
DRP testing and training
DRP testing
DRP review
Checklist
Structured walk-through/tabletop
Simulation test/walk-through drill
Parallel processing
Partial and complete business interruption
Training
Starting emergency power
Calling tree training/test
Continued BCP/DRP maintenance
Change management
BCP/DRP mistakes
Specific BCP/DRP frameworks
NIST SP 800-34
ISO/IEC 27031
BCI
Summary of exam objectives
Top five toughest questions
Answers
Endnotes
Domain 9: Legal, Regulations, Investigations, and Compliance
Introduction
Major legal systems
Civil law legal system
Common law
Religious and customary law
Criminal, civil, and administrative law
Criminal law
Civil law
Administrative law
Information security aspects of law
Computer crime
International cooperation
Intellectual property
Trademark
Patent
Copyright
Licenses
Trade secrets
Import/export restrictions
Legal aspects of investigations
Evidence
Best evidence rule
Evidence integrity
Entrapment and enticement
Privacy, important laws, and regulations
Privacy
European Union privacy
OECD privacy guidelines
EU-US Safe Harbor
US Privacy Act of 1974
US Computer Fraud and Abuse Act
USA PATRIOT Act
Forensics
Forensic media analysis
Network forensics
Embedded device forensics
Security and third parties
Service provider contractual security
Service-Level Agreements
Attestation
Right to Penetration Test/Right to Audit
Vendor governance
Ethics
The ISC2© Code of Ethics
The ISC2© Code of Ethics Canons in detail
Computer Ethics Institute
IAB's Ethics and the Internet
Summary of exam objectives
Top five toughest questions
Answers
Endnotes
Domain 10: Physical Environmental Security
Introduction
Perimeter defenses
Fences
Gates
Bollards
Lights
CCTV
Locks
Key locks
Combination locks
Smart cards and magnetic stripe cards
Tailgating/piggybacking
Mantraps and turnstiles
Contraband checks
Motion detectors and other perimeter alarms
Doors and windows
Walls, floors, and ceilings
Guards
Dogs
Site selection, design, and configuration
Site selection issues
Utility reliability
Crime
Site design and configuration issues
Site marking
Shared tenancy and adjacent buildings
System defenses
Asset tracking
Port controls
Drive and tape encryption
Media storage and transportation
Media cleaning and destruction
Paper shredders
Overwriting
Degaussing and destruction
Environmental controls
Electricity
Surge protectors, UPSs, and generators
HVAC
Static and corrosion
Heat, flame, and smoke detectors
Personnel safety, training, and awareness
Evacuation routes
Evacuation roles and procedures
ABCD fires and suppression
Classes of fire and suppression agents
Types of fire suppression agents
Water
Soda acid
Dry powder
Wet chemical
CO2
Halon and Halon substitutes
Montreal Accord
Sprinkler systems
Portable fire extinguishers
Summary of Exam Objectives
Top five toughest questions
Answers
Index
Eleventh Hour CISSP®
Eleventh Hour CISSP®
Study Guide
Second Edition
Eric Conrad
Seth Misenar
Joshua Feldman
Kevin Riggins, Technical Editor
AMSTERDAM BOSTON HEIDELBERG LONDON
NEW YORK OXFORD PARIS SAN DIEGO
SAN FRANCISCO SINGAPORE SYDNEY TOKYO
Syngress is an Imprint of Elsevier
Acquiring Editor: Chris Katsaropoulos
Editorial Project Manager: Benjamin Rearick
Project Manager: Mohana Natarajan
Designer: Alan Studholme
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
Second edition 2014
Copyright # 2014, 2011 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by
any means electronic, mechanical, photocopying, recording or otherwise without the prior written
permission of the publisher.
Permissions may be sought directly from Elsevier’s Science & Technology Rights Department in Oxford,
UK: phone (þ44) (0) 1865 843830; fax (þ44) (0) 1865 853333; email: permissions@elsevier.com.
Alternatively you can submit your request online by visiting the Elsevier web site at http://elsevier.com/
locate/permissions, and selecting Obtaining permission to use Elsevier material.
Notice
No responsibility is assumed by the publisher for any injury and/or damage to persons or property as a
matter of products liability, negligence or otherwise, or from any use or operation of any methods,
products, instructions or ideas contained in the material herein. Because of rapid advances in the medical
sciences, in particular, independent verification of diagnoses and drug dosages should be made.
Library of Congress Cataloging-in-Publication Data
Application Submitted
British Library Cataloguing in Publication Data
A catalogue record for this book is available from the British Library
For information on all Syngress publications, visit our web site at store.elsevier.com/syngress
ISBN: 978-0-12-417142-8
Printed and bound in USA
14 15 16 17 18
10 9
8 7 6
5 4 3 2
1
Author biography
®
Seth Misenar (CISSP
, GIAC GSE, CompTIA CASP, GPEN, GCIH, GCIA, GCFA,
GWAPT, GCWN, GSEC, MCSE, and MCDBA) is a Certified Instructor with the
SANS Institute and coauthor of the SANS SEC528: SANS Training Program for
the CompTIA Advanced Security Practitioner (CASP) Certification. Seth also serves
as lead consultant for Jackson, Mississippi-based Context Security. Seth’s background
includes security research, network and Web application penetration testing, vulnera-
bility assessment, regulatory compliance efforts, security architecture design, and gen-
eral security consulting. He has previously served as a physical and network security
consultant for Fortune 100 companies as well as the HIPAA and information security
officer for a state government agency. Seth teaches a variety of courses for the SANS
Institute, including Security Essentials, Advanced Web Application Penetration
Testing, Hacker Techniques, and the CISSP
and CASP
®
®
courses.
Seth is pursuing a Master of Science degree in information security engineering
from the SANS Technology Institute and holds a Bachelor of Science degree from
Millsaps College. Seth resides in Jackson, Mississippi, with his family, Rachel, Jude,
and Hazel.
Eric Conrad (CISSP, GIAC GSE, GPEN, GCIH, GCIA, GCFA, GAWN, GSEC,
GISP, CompTIA CASP, and Securityþ) is a partner with Backshore Communica-
tions, which provides information warfare, penetration testing, incident handling,
and intrusion detection consulting services. He is also a Certified Instructor with
the SANS Institute and coauthor of SANS Security 528: SANS Training Program
for the CompTIA Advanced Security Practitioner (CASP) Certification.
Eric’s professional career began in 1991 as a UNIX systems administrator for a
small oceanographic communications company. He gained information security
experience in a variety of industries, including research, education, power, Internet,
and healthcare, in roles ranging from systems programmer to security engineer to
HIPAA security officer and ISSO. He has taught thousands of students in courses
, Security 560: Network Penetration
including SANS Management 414: CISSP
Testing and Ethical Hacking, Security 504 Hacker Techniques, Exploits and Incident
Handling, and others.
®
Eric is a graduate of the SANS Technology Institute with a Master of Science
degree in information security engineering. Eric currently lives in Peaks Island,
Maine, with his family, Melissa, Eric, and Emma.
Joshua Feldman (CISSP, NSA IAM) has supported the Department of Defense
Information Systems Agency (DISA), as a contractor working for SAIC, Inc., since
2002. He is a subject matter expert and training developer for DISA’s cyber security
mission. During his tenure, he has contributed to the DoD 8500 series, specifically
conducting research and authoring sections of the DoD 8570.01-M, also known as
the DoD IA Workforce Improvement Program. He is the program manager for
DISA’s Computer Network Defense training initiative (entitled, “RaD-X”) and
has instructed well over 1000 students. He also is a subject matter expert for the
xv
xvi
Author biography
Web-based Information Assurance awareness training every DoD user is required to
take each year as part of their security awareness curriculum. He is a regular pre-
senter and panel member at the Information Assurance Symposium, hosted by both
DISA and NSA.
Before joining the support team at DoD/DISA, Joshua spent time as an IT Sec
engineer working for the Department of State, Diplomatic Security. There, he trav-
eled to embassies worldwide to conduct Tiger Team assessments of the security of
each embassy. Joshua got his start in the IT Security field when he left his position
teaching science for Montgomery County Public Schools, Maryland, and went to
work for NFR Security Software. At the time, NFR was one of the leading companies
producing Network Intrusion Detection systems.
CHAPTER
Domain 1: Access Control 1
EXAM OBJECTIVES IN THIS CHAPTER
Cornerstone Access Control Concepts
Access Control Models
Access Control Defensive Categories and Types
Authentication Methods
Access Control Technologies
Assessing Access Control
INTRODUCTION
The purpose of access control is to allow authorized users access to appropriate data
and deny access to unauthorized users. Access controls protect against threats such as
unauthorized access, inappropriate modification of data, and loss of confidentiality.
CORNERSTONE INFORMATION SECURITY CONCEPTS
Before we can explain access control, we must define cornerstone information secu-
rity concepts. These concepts provide the foundation upon which the 10 domains of
the Common Body of Knowledge are built.
Confidentiality, integrity, and availability
Confidentiality, Integrity, and Availability are the “CIA triad,” the cornerstone con-
cept of information security. The triad, shown in Figure 1.1, forms the three-legged
stool information security is built upon. The order of the acronym may change (some
prefer “AIC,” perhaps to avoid association with a certain intelligence agency), but
the concepts are essential. This book will use the “CIA” acronym.
Confidentiality
Confidentiality seeks to prevent the unauthorized disclosure of information: it keeps
data secret. In other words, confidentiality seeks to prevent unauthorized read access
to data. An example of a confidentiality attack would be the theft of Personally Iden-
tifiable Information (PII), such as credit card information.
1
2
CHAPTER 1 Domain 1: Access Control
Confidentiality
A
v
a
i
l
a
b
i
l
i
t
y
Integrity
FIGURE 1.1
The CIA triad.
Integrity
Integrity seeks to prevent unauthorized modification of information. In other words,
integrity seeks to prevent unauthorized write access to data.
CRUNCH TIME
There are two types of integrity: data integrity and system integrity. Data integrity seeks to
protect information against unauthorized modification; system integrity seeks to protect a
system, such as a Windows 2012 server operating system, from unauthorized modification.
Availability
Availability ensures that information is available when needed. Systems need to be
usable (available) for normal business use. An example of attack on availability
would be a Denial-of-Service (DoS) attack, which seeks to deny service (or availabil-
ity) of a system.
Disclosure, alteration, and destruction
The CIA triad may also be described by its opposite: Disclosure, Alteration, and
Destruction (DAD). Disclosure is the unauthorized disclosure of information; alter-
ation is the unauthorized modification of data, and destruction is making systems
unavailable. While the CIA acronym sometimes changes, the DAD acronym is
shown in that order.
Identity and authentication, authorization, and accountability
The term “AAA” is often used, describing cornerstone concepts Authentication,
Authorization, and Accountability. Left out of the AAA acronym is Identification,
which is required before the three “A’s” can follow.
Cornerstone Information Security Concepts
3
Identity and authentication
Identity is a claim: if your name is “Person X,” you identify yourself by saying “I am
Person X.” Identity alone is weak because there is no proof. You can also identify
yourself by saying “I am Person Y.” Proving an identity claim is called authentica-
tion: you authenticate the identity claim, usually by supplying a piece of information
or an object that only you posses, such as a password or your passport.
Authorization
Authorization describes the actions you can perform on a system once you have iden-
tified and authenticated. Actions may include reading, writing, or executing files or
programs.
Accountability
Accountability holds users accountable for their actions. This is typically accom-
plished by logging and analyzing audit data. Enforcing accountability helps keep
“honest people honest.” For some users, knowing that data is logged is not enough
to provide accountability: they must know that the data is logged and audited and that
sanctions may result from violation of policy.
Nonrepudiation
Nonrepudiation means a user cannot deny (repudiate) having performed a transac-
tion. It combines authentication and integrity: nonrepudiation authenticates the iden-
tity of a user who performs a transaction and ensures the integrity of that transaction.
You must have both authentication and integrity to have nonrepudiation: proving you
signed a contract to buy a car (authenticating your identity as the purchaser) is not
useful if the car dealer can change the price from $20,000 to $40,000 (violate the
integrity of the contract).
Least privilege and need to know
Least privilege means users should be granted the minimum amount of access
(authorization) required to do their jobs, but no more. Least privilege is applied to
groups of objects. Need to know is more granular than least privilege: the user must
need to know that specific piece of information before accessing it.
Subjects and objects
A subject is an active entity on a data system. Most examples of subjects involve
people accessing data files. However, running computer programs are subjects
as well.
An object is any passive data within the system. Objects can range from databases
to text files. The important thing to remember about objects is that they are passive
within the system. They do not manipulate other objects.
相关推荐
2023年江西萍乡中考道德与法治真题及答案.doc
2012年重庆南川中考生物真题及答案.doc
2013年江西师范大学地理学综合及文艺理论基础考研真题.doc
2020年四川甘孜小升初语文真题及答案I卷.doc
2020年注册岩土工程师专业基础考试真题及答案.doc
2023-2024学年福建省厦门市九年级上学期数学月考试题及答案.doc
2021-2022学年辽宁省沈阳市大东区九年级上学期语文期末试题及答案.doc
2022-2023学年北京东城区初三第一学期物理期末试卷及答案.doc
2018上半年江西教师资格初中地理学科知识与教学能力真题及答案.doc
2012年河北国家公务员申论考试真题及答案-省级.doc
2020-2021学年江苏省扬州市江都区邵樊片九年级上学期数学第一次质量检测试题及答案.doc
2022下半年黑龙江教师资格证中学综合素质真题及答案.doc
