CISSP Cert Guide

Robin M. Abernathy has been working in the IT certification preparation industry for more than 20 years. She has written and edited certification preparation materials for many (ISC)2, Microsoft, CompTIA, PMI, ITIL, ISACA, and GIAC certifications and holds multiple IT certifications from these vendors. Robin provides training on computer hardware and software, networking, security, and project management. Over the past decade, she has ventured into the traditional publishing industry by technically editing several publications and co-authoring Pearson’s CISSP Cert Guide and CASP+ Cert Guide and authoring Pearson’s Project+ Cert Guide. She presents at technical conferences and hosts webinars on IT certification topics.  Dr. Darren R. Hayes has close to 20 years of academic and professional experience in computer security and digital forensics. He has authored numerous publications in these fields, including A Practical Guide to Digital Forensics Investigations, which is published by Pearson. He is Associate Professor at Pace University, where he is the founder and director of the Seidenberg Digital Forensics Research Lab. He holds numerous IT certifications in security and digital forensics and holds a PhD from Sapienza University in Italy and a doctorate from Pace University. Darren is also a professional digital forensics examiner and has supported both criminal and civil investigations over the past decade and a half. He has also been declared an expert witness in federal court.

• Introduction xlixChapter 1 Security and Risk Management 5Foundation Topics 6Security Terms 6Security Governance Principles 11Compliance 40Legal and Regulatory Issues 42Investigation Types 65Professional Ethics 70Security Documentation 72Business Continuity 76Personnel Security Policies and Procedures 89Risk Management Concepts 95Geographical Threats 133Threat Modeling 142Security Risks in the Supply Chain 148Security Education, Training, and Awareness 153Exam Preparation Tasks 155Review All Key Topics 155Complete the Tables and Lists from Memory 157Define Key Terms 157Answer Review Questions 158Answers and Explanations 164Chapter 2 Asset Security 171Foundation Topics 172Asset Security Concepts 172Identify and Classify Information and Assets 175Information and Asset Handling Requirements 183Provision Resources Securely 185Data Life Cycle 186Asset Retention 201Data Security Controls 203Exam Preparation Tasks 211Review All Key Topics 211Define Key Terms 211Answer Review Questions 212Answers and Explanations 213Chapter 3 Security Architecture and Engineering 219Foundation Topics 220Information Systems Life Cycle 220Engineering Processes Using Secure Design Principles 223Security Model Concepts 231System Security Evaluation Models 255Certification and Accreditation 267Control Selection Based on Systems Security Requirements 268Security Capabilities of Information Systems 269Security Architecture Maintenance 272Vulnerabilities of Security Architectures, Designs, and Solution Elements 273Vulnerabilities in Web-Based Systems 296Vulnerabilities in Mobile Systems 299Vulnerabilities in Embedded Systems 304Cryptographic Solutions 305Cryptographic Types 317Symmetric Algorithms 325Asymmetric Algorithms 332Public Key Infrastructure and Digital Certificates 335Key Management Practices 343Message Integrity 347Digital Signatures and Non-repudiation 354Applied Cryptography 354Cryptanalytic Attacks 355Digital Rights Management 360Site and Facility Design 362Site and Facility Security Controls 368Exam Preparation Tasks 379Review All Key Topics 379Complete the Tables and Lists from Memory 381Define Key Terms 381Answer Review Questions 382Answers and Explanations 387Chapter 4 Communication and Network Security 391Foundation Topics 392Secure Network Design Principles 392IP Networking 403Protocols and Services 435Converged Protocols 443Wireless Networks 448Communications Cryptography 468Secure Network Components 473Secure Communication Channels 520Network Attacks 535Exam Preparation Tasks 547Review All Key Topics 547Define Key Terms 548Answer Review Questions 550Answers and Explanations 555Chapter 5 Identity and Access Management (IAM) 561Foundation Topics 562Access Control Process 562Physical and Logical Access to Assets 563Identification and Authentication Concepts 568Identification and Authentication Implementation 588Identity as a Service (IDaaS) Implementation 602Third-Party Identity Services Integration 602Authorization Mechanisms 603Provisioning Life Cycle 612Access Control Threats 618Prevent or Mitigate Access Control Threats 625Exam Preparation Tasks 625Review All Key Topics 625Define Key Terms 626Answer Review Questions 627Answers and Explanations 630Chapter 6 Security Assessment and Testing 635Foundation Topics 636Design and Validate Assessment and Testing Strategies 636Conduct Security Control Testing 639Collect Security Process Data 655Analyze Test Outputs and Generate a Report 659Conduct or Facilitate Security Audits 659Exam Preparation Tasks 661Review All Key Topics 661Define Key Terms 662Answer Review Questions 662Answers and Explanations 665Chapter 7 Security Operations 673Foundation Topics 674Investigations 674Logging and Monitoring Activities 690Configuration and Change Management 697Security Operations Concepts 702Resource Protection 707Incident Management 719Detective and Preventive Measures 724Patch and Vulnerability Management 729Recovery Strategies 729Disaster Recovery 747Testing Disaster Recovery Plans 751Business Continuity Planning and Exercises 753Physical Security 754Personnel Safety and Security 760Exam Preparation Tasks 763Review All Key Topics 763Define Key Terms 764Answer Review Questions 764Answers and Explanations 768Chapter 8 Software Development Security 773Foundation Topics 774Software Development Concepts 774Security in the System and Software Development Life Cycle 783Security Controls in Development 806Assess Software Security Effectiveness 815Security Impact of Acquired Software 817Exam Preparation Tasks 825Review All Key Topics 825Define Key Terms 825Answer Review Questions 826Answers and Explanations 830Chapter 9 Final Preparation 835Tools for Final Preparation 835Suggested Plan for Final Review/Study 839Summary 840  Online ElementsAppendix A Memory TablesAppendix B Memory Tables Answer KeyGlossary9780135343999, TOC, 7/24/24