book

Certified Information Systems Security Professional (CISSP) Exam Guide

Name: Certified Information Systems Security Professional (CISSP) Exam Guide
ISBN: 9781800567610

by Ted Jordan, Ric Daza, Hinne Hettema

September 2024

Intermediate to advanced

526 pages

14h 36m

English

Packt Publishing

Read now

Unlock full access

Certified Information Systems Security Professional (CISSP) Exam Guide
ContributorsAbout the AuthorsAbout the Reviewers
Preface
Who This Book Is ForWhat This Book CoversHow to Get the Most Out of This BookOnline Practice ResourcesDownload the Color ImagesConventions UsedGet in TouchShare Your ThoughtsFree Benefits with Your BookHow to Unlock
Intro I: Becoming a CISSP
Making the Most Out of This Book – Your Certification and BeyondThe Need for CISSPsCISSP Exam OverviewDomainsCISSP CAT Examination WeightageCISSP CAT Examination InformationCISSP Exam StructureInformation About Becoming a CISSPExam Tips and TricksSummary
Intro II: Pre-Assessment Test
Security and Risk Management – 16%Asset Security – 10%Security Architecture and Engineering – 13%Communication and Network Security – 13%Identity and Access Management (IAM) – 13%Security Assessment and Testing – 12%Security Operations – 13%Software Development Security – 10%Answer KeySummary
Chapter 1: Ethics, Security Concepts, and Governance Principles
The ISC2 Code of Professional EthicsImportant Security ConceptsConfidentiality ConceptsAuthenticity and NonrepudiationIntegrity ConceptsAvailability ConceptsPeople Safety ConceptsEvaluating and Applying Security Governance PrinciplesOrganizational Policies and Decision-MakingMergers, Acquisitions, and DivestituresEssential Security FrameworksThe Organizational Legal Liability RiskSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 2: Compliance, Regulation, and Investigations
Determining Compliance and Other RequirementsContractual RequirementsLegal RequirementsIndustry StandardsRegulatory RequirementsPrivacy RequirementsUnderstanding Legal and Regulatory IssuesCybercrimes and Data BreachesLicensing and Intellectual Property RequirementsTrademarksPatentsCopyrightsTrade SecretsSoftware LicensingDigital Rights ManagementImport and Export ControlsTransborder Data FlowContractsPrivacyUnderstanding the Requirements for Investigation TypesAdministrative InvestigationsCriminal InvestigationsCivil InvestigationsRegulatory InvestigationsIndustry StandardsSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 3: Security Policies and Business Continuity
PoliciesCharacteristics of a Successful PolicyInformation Security Policy Life CycleDevelopment PhasePublishing PhaseAdoption PhaseEvaluation PhaseStandardsProceduresGuidelinesIdentifying, Analyzing, and Prioritizing BC RequirementsBusiness Impact Analysis (BIA)Developing and Documenting the Scope and the PlanContributing to and Enforcing Personnel Security Policies and ProceduresCandidate Screening and HiringEmployment Agreements and PoliciesOnboarding, Transfers, and Termination ProcessesVendor, Consultant, and Contractor Agreements and ControlsCompliance Policy RequirementsPrivacy Policy RequirementsSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 4: Risk Management, Threat Modeling, SCRM, and SETA
Risk ManagementIdentify Threats and VulnerabilitiesRisk Assessment/AnalysisRisk ResponseCountermeasure Selection and ImplementationTypes of ControlsPreventiveDetectiveCorrectiveControl AssessmentsMonitoring and MeasurementReportingContinuous Improvement and Risk Maturity ModelingRisk FrameworksThreat Modeling Concepts and MethodologiesSupply Chain Risk ManagementRisks Associated with Hardware, Software, and ServicesThird-Party Assessment and MonitoringMinimum Security RequirementsService-level requirementsSETA ProgramsAwareness and TrainingPeriodic Content ReviewsProgram Effectiveness EvaluationSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 5: Asset and Privacy Protection
Identifying and Classifying Information and AssetsData ClassificationAsset ClassificationEstablishing Information- and Asset-Handling RequirementsProvisioning Resources SecurelyInformation and Asset OwnershipAsset InventoryAsset ManagementSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 6: Information and Asset Handling
Managing the Data Life CycleData RolesData CollectionData LocationData MaintenanceData RetentionData RemanenceData DestructionAsset RetentionData Security Controls and ComplianceData StatesStandards SelectionScoping and TailoringData Protection MethodsDigital Rights ManagementData Loss PreventionCloud Access Security BrokerSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing

Chapter 7: Secure Design Principles and Controls
Researching, Implementing, and Managing Engineering Processes SecurelyThreat ModelingMicrosoft STRIDEOCTAVEVASTLeast PrivilegeDefense in DepthSecure DefaultsFail SecurelySeparation of DutiesKeep It SimpleTrust but VerifyZero TrustPrivacy by DesignShared ResponsibilityUnderstanding the Fundamental Concepts of Security ModelsBell-LaPadulaBibaClark-WilsonBrewer and NashGraham-DenningJames AndersonHarrison, Ruzzo, UllmanSelecting Controls Based on System Security RequirementsDetermining Security Requirements versus ControlsIdentifying Security ControlsNoting Layered ControlsChoosing the Security ControlsNoting the Major Security Control FrameworksTailoring or Scoping Security ControlsEvaluating Security ControlsSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 8: Architecture Vulnerabilities and Cryptography
Security Capabilities of Information SystemsSecurity Engineering StandardsSecurity Engineering ProcessesUniversal Security ModelsMitigating with Access Control TechniquesMitigating Threats with Other TechniquesMitigating Threats in System VirtualizationAssessing and Mitigating the Vulnerabilities of Security Architectures and DesignsClient-Based SystemsServer-Based SystemsDatabase SystemsCryptographic SystemsIndustrial Control SystemsCloud-Based SystemsDistributed SystemsIoTMicroservicesServerlessContainerizationEmbedded SystemsHigh-Performance Computing SystemsEdge Computing SystemsVirtualized SystemsSelecting and Determining Cryptographic SolutionsPortable Device SecurityEmail SecurityEmail and Pretty Good PrivacyEmail Certificates with S/MIMEWeb Application SecurityEncrypting Data in TransitLink EncryptionEnd-to-End EncryptionOther Security Methods for Data in TransitEncrypting Data in UseCryptographic Life CycleDifferent Cryptographic MethodsSymmetric EncryptionEncrypting Data at Rest and Data in TransitAsymmetric EncryptionSymmetric versus Asymmetric AlgorithmsHashing AlgorithmsMD5 Hashing AlgorithmSHA Hash AlgorithmStronger Encryption with Salts and Initialization VectorsSaltsInitialization VectorsPublic Key InfrastructureEncryption, Hashing, and Digital Signatures for PKIDigital Certificates and CAsDigital Certificate Verification ProcessUnderstanding Methods of Cryptanalytic AttacksSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 9: Facilities and Physical Security
Security Principles in Site and Facility DesignExternal Boundary SecurityPersonnel Access Security ControlsPhysical and Electronic LocksMitigating card cloning and skimmingSite and Facility Alarm SystemsSurveillance SystemsMachine Learning and AIReception Area Personnel and Person BadgingCabling Wiring and Distribution FacilitiesRestricted and Work Area SecurityServer Rooms and Data CentersMedia Storage FacilitiesEvidence StorageUtilities and Heating, Ventilation, and Air Conditioning (HVAC)Environmental IssuesFire Prevention, Detection, and SuppressionBackup and Redundant PowerSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 10: Network Architecture Security
Secure Design Principles in Network ArchitecturesThe Seven Layers of OSIOSI Layer 1 – PhysicalOSI Layer 2 – Data LinkOSI Layer 3 – NetworkOSI Layer 4 – TransportOSI Layer 5 – SessionOSI Layer 6 – PresentationOSI Layer 7 – ApplicationTCP/IP ModelImplications of Multilayer ProtocolsConverged ProtocolsMicro-SegmentationSoftware Defined Networks and Software-Defined Wide Area NetworksVirtual Extensible Local Area Network EncapsulationWireless NetworksCellular NetworksContent Distribution NetworksSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 11: Securing Communication Channels
Secure Network ComponentsOperation of HardwareTransmission MediaNetwork Access Control DevicesEndpoint SecuritySecure Communication ChannelsVoiceMultimedia CollaborationRemote AccessData CommunicationsVirtualized NetworksThird-Party ConnectivitySummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 12: Identity, Access Management, and Federation
Securing Access ControlSecuring Data and InformationAccess ControlsDevice TypesIdentity ProvisioningStandard User and Superuser AccountsUser Account Setup and RemovalIdentity and AuthenticationComponents of Identity ManagementAuthentication MethodsAuthorizationSession ManagementCloud AuthenticationSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 13: Identity Management Implementation
Implementing Authentication SystemsSAMLOpen Authorization 2.0OpenID ConnectAuthentication, Authorization, and Accounting SystemsRADIUSTACACS+KerberosKerberos AuthenticationKerberos AttacksMandatory Access ControlRisk-Based Access ControlsRole-Based Access ControlRule-Based Access ControlAttribute-Based Access ControlAccountabilitySummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 14: Designing and Conducting Security Assessments
Designing and Validating Assessment, Test, and Audit StrategiesInternal AuditsConducting an Internal AuditExternal AuditsPlanning the External AuditConducting an External AuditThird-Party AuditsPlanning a Third-Party Cybersecurity AuditConducting a Third-Party Cybersecurity AuditAdvantages of Third-Party, External, and Internal AuditsConducting Security Control TestingVulnerability AssessmentPenetration TestingLog ReviewsSynthetic TransactionsCode Review and TestingMisuse Case TestingTest Coverage AnalysisInterface TestingBreach and Attack SimulationsCompliance ChecksSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 15: Designing and Conducting Security Testing
Collecting Security Process DataManagement Review and ApprovalAccount ManagementKey Performance and Risk IndicatorsBackup Verification DataTraining and AwarenessDisaster Recovery and Business ContinuityAnalyzing Test Output and Generating a ReportRemediationException HandlingEthical DisclosureSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 16: Planning for Security Operations
Understanding and Complying with InvestigationsEvidence Collection and HandlingLocard’s Exchange PrincipleChain of CustodyEphemeral EvidencePolicies and GuidelinesReporting and DocumentationInvestigative TechniquesDisk ForensicsMemory ForensicsICS, IoT, and Mobile DevicesExtended Detection and ResponseDigital Forensics Tactics, Techniques, and ProceduresArtifactsJump BagsConducting Logging and Monitoring ActivitiesIntrusion Detection and PreventionHost-Based ApproachNetwork-Based ApproachXDR-Based ApproachContinuous MonitoringEgress MonitoringLog ManagementSIEMThe Role of SIEM SystemsOperating a SIEM SystemThe (Likely) Future of SIEMThreat IntelligenceTypes of Threat Intelligence: the Pyramid of PainIntelligence CycleThreat HuntingATT&CK FrameworkStrategy and Threat IntelligenceUEBAPerforming Configuration ManagementProvisioningBackupEndpoint ProtectionVulnerability and Configuration ManagementLogging and MonitoringBaseliningAutomationApplying Foundational Security Operations ConceptsNeed to Know and Least PrivilegeSeparation of Duties and ResponsibilitiesPrivileged Account ManagementAttack GraphsAdmin AccountsService AccountsDomain AdministratorsDevelopersEngineering WorkstationsJob RotationService-Level AgreementsApplying Resource ProtectionMedia ManagementMedia Protection TechniquesBreak-Glass ScenariosSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 17: Security Operations
Conducting Incident ManagementDetectionResponseMitigation or ContainmentAnalysisMalwareLateral MovementLiving Off the LandEradicationComplete Removal of MalwareDisabling or Removing Backdoor AccountsDisabling or Removing Persistence MechanismsBlocking Paths for Data Exfiltration or Remote ControlClosing the Barn DoorRecoveryReportingLessons LearnedEnvironment ImprovementsMeasuring EffectivenessOperating and Maintaining Detective and Preventive MeasuresEndpoint Security and Anti-MalwareAgent coverageCausalityOne-off signaturesHunting and Endpoint QueriesEndpoint ForensicsNetwork Security and FirewallsIntrusion Detection and Prevention SystemsWhitelisting and BlacklistingThird-party Security ServicesSandboxingPublic SandboxesHoneypots and HoneynetsMachine Learning and Artificial Intelligence (AI)-Based ToolsThe Zero Trust ConceptImplementing and Supporting Patch and Vulnerability ManagementIdentifying the VulnerabilityAssessing and Prioritizing the RiskStakeholder EngagementRemediationMonitoring and ReportingChange Management ProcessesArchitectureChange ManagementSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 18: Disaster Recovery
Implementing Disaster Recovery StrategiesBackup Storage StrategiesRecovery Site StrategiesSetting Up Secondary Data CentersReplicationVirtualizationGeographical ConsiderationsUsing the Cloud as a Recovery SiteMultiple Processing SitesComparing Security and Resilience in SystemsImplementing Disaster Recovery ProcessesResponsePersonnelCommunicationsAssessmentService RestorationTraining and AwarenessLessons LearnedTesting Disaster Recovery PlansTabletop ExerciseWalk-ThroughSimulation of a DisasterParallel TestingFull InterruptionSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 19: Business Continuity, Personnel, and Physical Security
Planning and ExercisesSecurity Infrastructure Engineering and Business ContinuityMaintain Security Posture During FailoverKey Management During FailoverImplement and Manage Physical SecurityPerimeter Security ControlsAccess CardsAccess SystemsSecurity Auditing of Physical Access SystemsInternal Security ControlsSeparation of Duties and ResponsibilitiesBusiness Email Compromise and Processes for PaymentsPersonnel Safety and Security ConcernsTravelSecurity Training and AwarenessSocial Media PolicyEmergency ManagementDuressSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 20: Software Development Life Cycle Security
Software Development MethodologiesWaterfallAgileDevOps and DevSecOpsMaturity ModelsCMMISAMMOperations and MaintenanceChange ManagementIntegrated Product TeamSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 21: Software Development Security Controls
Computer ProgrammingProgramming LanguagesLibrariesTool SetsIntegrated Development EnvironmentsRuntimeContinuous Integration and Continuous DeliveryApplication Security TestingSoftware Security AutomationSecurity Orchestration, Automation, and ResponseSoftware Configuration ManagementCode RepositoriesSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 22: Securing Software Development
Assessing the Effectiveness of Software SecurityAuditing and Logging of ChangesInjection AttacksSQL Injection AttacksBuffer OverflowsRace ConditionsCross-Site ScriptingCross-Site Request ForgeryPath TraversalAssess the Security Impact of Acquired SoftwareCOTSOpen Source SoftwareThird-PartyManaged ServicesSOC ReportsFurther Securing Managed ServicesSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 23: Secure Coding Guidelines, Third-Party Software, and Databases
Security Vulnerabilities at the Source Code LevelTestingSecurity WeaknessesUnintentional ErrorsLogic LoopholesLegacy BurdensThird-Party TrustSecurity of APIsSecure Coding PracticesSoftware-Defined SecurityEstablishing Secure DatabasesDatabase ModelsHierarchical Database ModelRelational Database ModelCentralized/Decentralized ModelsProcessing Database TransactionsDatabase SecurityAggregation AttacksInference AttacksConcurrency AttacksConcurrency ControlPolyinstantiationOpen Database ConnectivityNoSQLKnowledge-Based AIExpert SystemsMachine LearningNeural NetworksSummaryFurther ReadingExam Readiness Drill – Chapter Review QuestionsExam Readiness DrillATTEMPT 1ATTEMPT 2ATTEMPT 3Working On Timing
Chapter 24: Accessing the Online Practice Resources
How to Access These MaterialsPurchased from Packt Store (packtpub.com)Packt+ SubscriptionPurchased from Amazon and Other SourcesSTEP 1STEP 2STEP 3STEP 4STEP 5Troubleshooting TipsShare FeedbackBack to the Book
Why subscribe?
Other Books You May EnjoyShare Your Thoughts

Content preview from Certified Information Systems Security Professional (CISSP) Exam Guide

4 Risk Management, Threat Modeling, SCRM, and SETA

This chapter is about risk management, threat modeling, Supply Chain Risk Management (SCRM), and Security, Education, Training and Awareness, commonly referred to as SETA. For risk management, you’ll review how to apply risk management concepts. You will look into threat modeling concepts and methodologies and SCRM concepts. Finally, you will examine SETA programs.

By the end of this chapter, you will be able to answer questions on:

Understanding and apply risk management concepts
Understanding and apply threat modeling concepts and methodologies
Applying Supply Chain Risk Management (SCRM) concepts
Establishing and maintain a security education, training and awareness program

Will we start ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

Publisher Resources

ISBN: 9781800567610

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Certified Information Systems Security Professional (CISSP) Exam Guide

by Ted Jordan, Ric Daza, Hinne Hettema

4

Risk Management, Threat Modeling, SCRM, and SETA

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.