(ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide

Essentials 269Written Lab 270Review Questions 271Chapter 8 Principles of Security Models, Design, and Capabilities 275Implement and Manage Engineering Processes Using Secure Design Principles 276Understand the Fundamental Concepts of Security Models 281Select Controls Based On Systems Security Requirements 295Understand Security Capabilities of Information Systems 309Summary 311Exam Essentials 312Written Lab 313Review Questions 314Chapter 9 Security Vulnerabilities, Threats, and Countermeasures 319Assess and Mitigate Security Vulnerabilities 320Client-Based Systems 342Server-Based Systems 346Database Systems Security 347Distributed Systems and Endpoint Security 350Internet of Things 358Industrial Control Systems 359Assess and Mitigate Vulnerabilities in Web-Based Systems 360Assess and Mitigate Vulnerabilities in Mobile Systems 365Assess and Mitigate Vulnerabilities in Embedded Devices and Cyber-Physical Systems 375Essential Security Protection Mechanisms 379Common Architecture Flaws and Security Issues 384Summary 390Exam Essentials 391Written Lab 394Review Questions 395Chapter 10 Physical Security Requirements 399Apply Security Principles to Site and Facility Design 400Implement Site and Facility Security Controls 403Implement and Manage Physical Security 422Summary 431Exam Essentials 432Written Lab 434Review Questions 435Chapter 11 Secure Network Architecture and Securing Network Components 439OSI Model 440TCP/IP Model 451Converged Protocols 470Wireless Networks 472Secure Network Components 486Cabling, Wireless, Topology, Communications, and Transmission Media Technology 495Summary 513Exam Essentials 514Written Lab 516Review Questions 517Chapter 12 Secure Communications and Network Attacks 521Network and Protocol Security Mechanisms 522Secure Voice Communications 525Multimedia Collaboration 529Manage Email Security 530Remote Access Security Management 536Virtual Private Network 540Virtualization 546Network Address Translation 549Switching Technologies 553WAN Technologies 556Miscellaneous Security Control Characteristics 561Security Boundaries 563Prevent or Mitigate Network Attacks 564Summary 569Exam Essentials 571Written Lab 573Review Questions 574Chapter 13 Managing Identity and Authentication 579Controlling Access to Assets 580Comparing Identification and Authentication 584Implementing Identity Management 602Managing the Identity and Access Provisioning Lifecycle 611Summary 614Exam Essentials 615Written Lab 617Review Questions 618Chapter 14 Controlling and Monitoring Access 623Comparing Access Control Models 624Understanding Access Control Attacks 635Summary 653Exam Essentials 654Written Lab 656Review Questions 657Chapter 15 Security Assessment and Testing 661Building a Security Assessment and Testing Program 662Performing Vulnerability Assessments 668Testing Your Software 681Implementing Security Management Processes 688Summary 690Exam Essentials 691Written Lab 692Review Questions 693Chapter 16 Managing Security Operations 697Applying Security Operations Concepts 698Securely Provisioning Resources 710Managing Configuration 718Managing Change 719Managing Patches and Reducing Vulnerabilities 723Summary 728Exam Essentials 729Written Lab 731Review Questions 732Chapter 17 Preventing and Responding to Incidents 737Managing Incident Response 738Implementing Detective and Preventive Measures 745Logging, Monitoring, and Auditing 773Summary 790Exam Essentials 792Written Lab 795Review Questions 796Chapter 18 Disaster Recovery Planning 801The Nature of Disaster 802Understand System Resilience and Fault Tolerance 812Recovery Strategy 818Recovery Plan Development 827Training, Awareness, and Documentation 835Testing and Maintenance 836Summary 838Exam Essentials 838Written Lab 839Review Questions 840Chapter 19 Investigations and Ethics 845Investigations 846Major Categories of Computer Crime 857Ethics 861Summary 864Exam Essentials 864Written Lab 865Review Questions 866Chapter 20 Software Development Security 871Introducing Systems Development Controls 872Establishing Databases and Data Warehousing 895Storing Data and Information 904Understanding Knowledge-Based Systems 906Summary 909Exam Essentials 909Written Lab 910Review Questions 911Chapter 21 Malicious Code and Application Attacks 915Malicious Code 916Password Attacks 929Application Attacks 933Web Application Security 935Reconnaissance Attacks 940Masquerading Attacks 941Summary 942Exam Essentials 943Written Lab 944Review Questions 945Appendix A Answers to Review Questions 949Chapter 1: Security Governance Through Principles and Policies 950Chapter 2: Personnel Security and Risk Management Concepts 951Chapter 3: Business Continuity Planning 952Chapter 4: Laws, Regulations, and Compliance 954Chapter 5: Protecting Security of Assets 956Chapter 6: Cryptography and Symmetric Key Algorithms 958Chapter 7: PKI and Cryptographic Applications 960Chapter 8: Principles of Security Models, Design, and Capabilities 961Chapter 9: Security Vulnerabilities, Threats, and Countermeasures 963Chapter 10: Physical Security Requirements 965Chapter 11: Secure Network Architecture and Securing Network Components 966Chapter 12: Secure Communications and Network Attacks 968Chapter 13: Managing Identity and Authentication 969Chapter 14: Controlling and Monitoring Access 971Chapter 15: Security Assessment and Testing 973Chapter 16: Managing Security Operations 975Chapter 17: Preventing and Responding to Incidents 977Chapter 18: Disaster Recovery Planning 980Chapter 19: Investigations and Ethics 981Chapter 20: Software Development Security 983Chapter 21: Malicious Code and Application Attacks 984Appendix B Answers to Written Labs 987Chapter 1: Security Governance Through Principles and Policies 988Chapter 2: Personnel Security and Risk Management Concepts 988Chapter 3: Business Continuity Planning 989Chapter 4: Laws, Regulations, and Compliance 990Chapter 5: Protecting Security of Assets 991Chapter 6: Cryptography and Symmetric Key Algorithms 991Chapter 7: PKI and Cryptographic Applications 992Chapter 8: Principles of Security Models, Design, and Capabilities 992Chapter 9: Security Vulnerabilities, Threats, and Countermeasures 993Chapter 10: Physical Security Requirements 994Chapter 11: Secure Network Architecture and Securing Network Components 994Chapter 12: Secure Communications and Network Attacks 995Chapter 13: Managing Identity and Authentication 996Chapter 14: Controlling and Monitoring Access 996Chapter 15: Security Assessment and Testing 997Chapter 16: Managing Security Operations 997Chapter 17: Preventing and Responding to Incidents 998Chapter 18: Disaster Recovery Planning 999Chapter 19: Investigations and Ethics 999Chapter 20: Software Development Security 1000Chapter 21: Malicious Code and Application Attacks 1000Index 1001