Muutke küpsiste eelistusi

E-raamat: CISSP All-in-One Exam Guide, Eighth Edition

  • Formaat: 1376 pages
  • Ilmumisaeg: 26-Oct-2018
  • Kirjastus: McGraw-Hill Education
  • Keel: eng
  • ISBN-13: 9781260142648
  • Formaat - EPUB+DRM
  • Hind: 65,52 €*
  • * hind on lõplik, st. muud allahindlused enam ei rakendu
  • Lisa ostukorvi
  • Lisa soovinimekirja
  • See e-raamat on mõeldud ainult isiklikuks kasutamiseks. E-raamatuid ei saa tagastada.
  • Formaat: 1376 pages
  • Ilmumisaeg: 26-Oct-2018
  • Kirjastus: McGraw-Hill Education
  • Keel: eng
  • ISBN-13: 9781260142648

DRM piirangud

  • Kopeerimine (copy/paste):

    ei ole lubatud

  • Printimine:

    ei ole lubatud

  • Kasutamine:

    Digitaalõiguste kaitse (DRM)
    Kirjastus on väljastanud selle e-raamatu krüpteeritud kujul, mis tähendab, et selle lugemiseks peate installeerima spetsiaalse tarkvara. Samuti peate looma endale  Adobe ID Rohkem infot siin. E-raamatut saab lugeda 1 kasutaja ning alla laadida kuni 6'de seadmesse (kõik autoriseeritud sama Adobe ID-ga).

    Vajalik tarkvara
    Mobiilsetes seadmetes (telefon või tahvelarvuti) lugemiseks peate installeerima selle tasuta rakenduse: PocketBook Reader (iOS / Android)

    PC või Mac seadmes lugemiseks peate installima Adobe Digital Editionsi (Seeon tasuta rakendus spetsiaalselt e-raamatute lugemiseks. Seda ei tohi segamini ajada Adober Reader'iga, mis tõenäoliselt on juba teie arvutisse installeeritud )

    Seda e-raamatut ei saa lugeda Amazon Kindle's. 

A new edition of Shon Harris’ bestselling exam prep guide—fully updated for the new CISSP 2018 Common Body of Knowledge

Thoroughly updated for the latest release of the Certified Information Systems Security Professional exam, this comprehensive resource covers all exam domains, as well as the new 2018 CISSP Common Body of Knowledge developed by the International Information Systems Security Certification Consortium (ISC)2®. CISSP All-in-One Exam Guide, Eighth Edition features learning objectives at the beginning of each chapter, exam tips, practice questions, and in-depth explanations. Written by leading experts in information security certification and training, this completely up-to-date self-study system helps you pass the exam with ease and also serves as an essential on-the-job reference.

Covers all 8 CISSP domains:

Security and risk management
Asset security
Security architecture and engineering
Communication and network security
Identity and access management
Security assessment and testing
Security operations
Software development security

Digital content includes:

1400+ practice questions, including new hot spot and drag-and-drop questions
Flashcards

In Memory of Shon Harris xxv
Foreword xxvii
From the Author xxix
Acknowledgments xxx
Why Become a CISSP? xxxi
Chapter 1 Security and Risk Management 1(192)
Fundamental Principles of Security
3(3)
Availability
3(1)
Integrity
4(1)
Confidentiality
5(1)
Balanced Security
5(1)
Security Definitions
6(2)
Control Types
8(5)
Security Frameworks
13(32)
ISO/IEC 27000 Series
16(2)
Enterprise Architecture Development
18(14)
Security Controls Development
32(5)
Process Management Development
37(7)
Functionality vs. Security
44(1)
The Crux of Computer Crime Laws
45(2)
Complexities in Cybercrime
47(15)
Electronic Assets
49(1)
The Evolution of Attacks
49(4)
International Issues
53(5)
Types of Legal Systems
58(4)
Intellectual Property Laws
62(8)
Trade Secret
63(1)
Copyright
63(1)
Trademark
64(1)
Patent
65(2)
Internal Protection of Intellectual Property
67(1)
Software Piracy
67(3)
Privacy
70(13)
The Increasing Need for Privacy Laws
72(1)
Laws, Directives, and Regulations
73(8)
Employee Privacy Issues
81(2)
Data Breaches
83(2)
U.S. Laws Pertaining to Data Breaches
84(1)
Other Nations' Laws Pertaining to Data Breaches
85(1)
Policies, Standards, Baselines, Guidelines, and Procedures
85(8)
Security Policy
86(3)
Standards
89(1)
Baselines
90(1)
Guidelines
91(1)
Procedures
92(1)
Implementation
92(1)
Risk Management
93(4)
Holistic Risk Management
94(1)
Information Systems Risk Management Policy
95(1)
The Risk Management Team
95(1)
The Risk Management Process
96(1)
Threat Modeling
97(4)
Threat Modeling Concepts
97(2)
Threat Modeling Methodologies
99(2)
Risk Assessment and Analysis
101(24)
Risk Assessment Team
103(1)
The Value of Information and Assets
104(1)
Costs That Make Up the Value
104(1)
Identifying Vulnerabilities and Threats
105(1)
Methodologies for Risk Assessment
106(6)
Risk Analysis Approaches
112(3)
Qualitative Risk Analysis
115(4)
Protection Mechanisms
119(3)
Total Risk vs. Residual Risk
122(2)
Handling Risk
124(1)
Supply Chain Risk Management
125(3)
Upstream and Downstream Suppliers
127(1)
Service Level Agreements
128(1)
Risk Management Frameworks
128(4)
Categorize Information System
130(1)
Select Security Controls
130(1)
Implement Security Controls
131(1)
Assess Security Controls
131(1)
Authorize Information System
132(1)
Monitor Security Controls
132(1)
Business Continuity and Disaster Recovery
132(24)
Standards and Best Practices
135(3)
Making BCM Part of the Enterprise Security Program
138(3)
BCP Project Components
141(15)
Personnel Security
156(4)
Hiring Practices
157(2)
Onboarding
159(1)
Termination
159(1)
Security Awareness Training
160(3)
Degree or Certification?
162(1)
Security Governance
163(9)
Metrics
165(4)
Ethics
169(1)
The Computer Ethics Institute
170(1)
The Internet Architecture Board
170(2)
Corporate Ethics Programs
172(1)
Summary
172(2)
Quick Tips
174(19)
Questions
179(9)
Answers
188(5)
Chapter 2 Asset Security 193(58)
Information Life Cycle
194(3)
Acquisition
194(1)
Use
195(1)
Archival
195(1)
Disposal
196(1)
Classification
197(6)
Classifications Levels
198(3)
Classification Controls
201(2)
Layers of Responsibility
203(7)
Executive Management
204(3)
Data Owner
207(1)
Data Custodian
208(1)
System Owner
208(1)
Security Administrator
209(1)
Supervisor
209(1)
Change Control Analyst
209(1)
Data Analyst
209(1)
User
210(1)
Auditor
210(1)
Why So Many Roles?
210(1)
Retention Policies
210(4)
Developing a Retention Policy
211(3)
Protecting Privacy
214(5)
Data Owners
214(1)
Data Processers
215(1)
Data Remanence
215(3)
Limits on Collection
218(1)
Protecting Assets
219(12)
Data Security Controls
219(4)
Media Controls
223(6)
Protecting Mobile Devices
229(1)
Paper Records
229(1)
Safes
230(1)
Selecting Standards
231(1)
Data Leakage
231(10)
Data Leak Prevention
232(9)
Summary
241(1)
Quick Tips
241(10)
Questions
243(4)
Answers
247(4)
Chapter 3 Security Architecture and Engineering 251(230)
System Architecture
252(4)
Computer Architecture
256(18)
The Central Processing Unit
256(5)
Multiprocessing
261(1)
Memory Types
261(13)
Operating Systems
274(31)
Process Management
274(10)
Memory Management
284(5)
Input/Output Device Management
289(2)
CPU Architecture Integration
291(4)
Operating System Architectures
295(7)
Virtual Machines
302(3)
System Security Architecture
305(7)
Security Policy
306(1)
Security Architecture Requirements
307(5)
Security Models
312(6)
Bell-LaPadula Model
312(1)
Biba Model
313(1)
Clark-Wilson Model
314(1)
Noninterference Model
315(1)
Brewer and Nash Model
316(1)
Graham-Denning Model
316(1)
Harrison-Ruzzo-Ullman Model
317(1)
Systems Evaluation
318(5)
Common Criteria
319(3)
Why Put a Product Through Evaluation?
322(1)
Certification vs. Accreditation
323(2)
Certification
323(1)
Accreditation
324(1)
Open vs. Closed Systems
325(1)
Open Systems
325(1)
Closed Systems
325(1)
Systems Security
326(12)
Client-Based Systems
326(1)
Client-Server Systems
326(1)
Distributed Systems
327(1)
Cloud Computing
327(1)
Parallel Computing
328(1)
Database Systems
329(3)
Web-Based Systems
332(1)
Mobile Systems
333(1)
Cyber-Physical Systems
334(4)
A Few Threats to Review
338(3)
Maintenance Hooks
338(1)
Time-of-Check/Time-of-Use Attacks
339(2)
Cryptography in Context
341(5)
The History of Cryptography
341(5)
Cryptography Definitions and Concepts
346(10)
Kerckhoffs' Principle
349(1)
The Strength of the Cryptosystem
349(1)
One-Time Pad
350(2)
Running and Concealment Ciphers
352(1)
Steganography
353(3)
Types of Ciphers
356(2)
Substitution Ciphers
356(1)
Transposition Ciphers
356(2)
Methods of Encryption
358(16)
Symmetric vs. Asymmetric Algorithms
359(1)
Symmetric Cryptography
359(4)
Block and Stream Ciphers
363(6)
Hybrid Encryption Methods
369(5)
Types of Symmetric Systems
374(11)
Data Encryption Standard
375(7)
Triple-DES
382(1)
Advanced Encryption Standard
383(1)
International Data Encryption Algorithm
383(1)
Blowfish
384(1)
RC4
384(1)
RC5
384(1)
RC6
384(1)
Types of Asymmetric Systems
385(8)
Diffie-Hellman Algorithm
385(3)
RSA
388(3)
El Gamal
391(1)
Elliptic Curve Cryptosystems
391(1)
Knapsack
391(1)
Zero Knowledge Proof
392(1)
Message Integrity
393(7)
The One-Way Hash
393(5)
Various Hashing Algorithms
398(1)
MD4
398(1)
MD5
398(1)
SHA
399(1)
Attacks Against One-Way Hash Functions
399(1)
Public Key Infrastructure
400(6)
Certificate Authorities
401(2)
Certificates
403(1)
The Registration Authority
403(1)
PKI Steps
404(2)
Applying Cryptography
406(9)
Services of Cryptosystems
406(1)
Digital Signatures
407(2)
Digital Signature Standard
409(1)
Key Management
410(2)
Trusted Platform Module
412(2)
Digital Rights Management
414(1)
Attacks on Cryptography
415(5)
Ciphertext-Only Attacks
415(1)
Known-Plaintext Attacks
416(1)
Chosen-Plaintext Attacks
416(1)
Chosen-Ciphertext Attacks
416(1)
Differential Cryptanalysis
417(1)
Linear Cryptanalysis
417(1)
Side-Channel Attacks
418(1)
Replay Attacks
418(1)
Algebraic Attacks
419(1)
Analytic Attacks
419(1)
Statistical Attacks
419(1)
Social Engineering Attacks
419(1)
Meet-in-the-Middle Attacks
419(1)
Site and Facility Security
420(1)
The Site Planning Process
421(24)
Crime Prevention Through Environmental Design
426(6)
Designing a Physical Security Program
432(13)
Internal Support Systems
445(15)
Electric Power
446(5)
Environmental Issues
451(2)
Fire Prevention, Detection, and Suppression
453(7)
Summary
460(1)
Quick Tips
460(21)
Questions
466(10)
Answers
476(5)
Chapter 4 Communication and Network Security 481(248)
Principles of Network Architectures
482(1)
Open Systems Interconnection Reference Model
483(18)
Protocol
484(3)
Application Layer
487(1)
Presentation Layer
488(1)
Session Layer
489(2)
Transport Layer
491(2)
Network Layer
493(1)
Data Link Layer
494(1)
Physical Layer
495(1)
Functions and Protocols in the OSI Model
496(2)
Tying the Layers Together
498(1)
Multilayer Protocols
499(2)
TCP/IP Model
501(15)
TCP
502(5)
IP Addressing
507(3)
IPv6
510(3)
Layer 2 Security Standards
513(2)
Converged Protocols
515(1)
Transmission Media
516(11)
Types of Transmission
516(6)
Cabling
522(5)
Wireless Networks
527(24)
Wireless Communications Techniques
528(3)
WLAN Components
531(1)
Evolution of WLAN Security
532(7)
Wireless Standards
539(5)
Best Practices for Securing WLANs
544(1)
Satellites
544(1)
Mobile Wireless Communication
545(6)
Networking Foundations
551(16)
Network Topology
552(2)
Media Access Technologies
554(12)
Transmission Methods
566(1)
Network Protocols and Services
567(29)
Address Resolution Protocol
567(2)
Dynamic Host Configuration Protocol
569(3)
Internet Control Message Protocol
572(2)
Simple Network Management Protocol
574(2)
Domain Name Service
576(7)
E-mail Services
583(6)
Network Address Translation
589(2)
Routing Protocols
591(5)
Network Components
596(49)
Repeaters
596(1)
Bridges
597(2)
Routers
599(2)
Switches
601(4)
Gateways
605(2)
PBXs
607(4)
Firewalls
611(24)
Proxy Servers
635(2)
Unified Threat Management
637(1)
Content Distribution Networks
638(1)
Software Defined Networking
639(2)
Endpoints
641(1)
Honeypot
642(1)
Network Access Control
643(1)
Virtualized Networks
644(1)
Intranets and Extranets
645(2)
Metropolitan Area Networks
647(3)
Metro Ethernet
649(1)
Wide Area Networks
650(18)
Telecommunications Evolution
650(2)
Dedicated Links
652(4)
WAN Technologies
656(12)
Communications Channels
668(1)
Multiservice Access Technologies
668(9)
H.323 Gateways
670(1)
Digging Deeper into SIP
671(4)
IP Telephony Issues
675(2)
Remote Access
677(15)
Dial-up Connections
677(1)
ISDN
678(2)
DSL
680(1)
Cable Modems
681(1)
VPN
682(8)
Authentication Protocols
690(2)
Network Encryption
692(11)
Link Encryption vs. End-to-End Encryption
692(3)
E-mail Encryption Standards
695(2)
Internet Security
697(6)
Network Attacks
703(5)
Denial of Service
703(3)
Sniffing
706(1)
DNS Hijacking
706(1)
Drive-by Download
707(1)
Summary
708(1)
Quick Tips
708(21)
Questions
713(9)
Answers
722(7)
Chapter 5 Identity and Access Management 729(134)
Access Controls Overview
729(2)
Security Principles
731(1)
Availability
731(1)
Integrity
731(1)
Confidentiality
732(1)
Identification, Authentication,
Authorization, and Accountability
732(2)
Identification and Authentication
734(11)
Authentication Methods
745(21)
Authorization
766(13)
Accountability
779(5)
Session Management
784(1)
Federation
785(11)
Integrating Identity as a Service
796(2)
On-premise
796(1)
Cloud
796(1)
Integration Issues
797(1)
Access Control Mechanisms
798(9)
Discretionary Access Control
798(2)
Mandatory Access Control
800(2)
Role-Based Access Control
802(3)
Rule-Based Access Control
805(1)
Attribute-Based Access Control
806(1)
Access Control Techniques and Technologies
807(10)
Constrained User Interfaces
807(1)
Remote Access Control Technologies
808(6)
Access Control Matrix
814(1)
Content-Dependent Access Control
815(1)
Context-Dependent Access Control
816(1)
Managing the Identity and Access
Provisioning Life Cycle
817(1)
Provisioning
817(1)
User Access Review
817(1)
System Account Access Review
818(1)
Deprovisioning
818(1)
Controlling Physical and Logical Access
819(6)
Access Control Layers
819(1)
Administrative Controls
820(1)
Physical Controls
821(1)
Technical Controls
822(3)
Access Control Practices
825(3)
Unauthorized Disclosure of Information
826(2)
Access Control Monitoring
828(12)
Intrusion Detection Systems
828(9)
Intrusion Prevention Systems
837(3)
Threats to Access Control
840(6)
Dictionary Attack
841(1)
Brute-Force Attacks
842(1)
Spoofing at Logon
842(1)
Phishing and Pharming
843(3)
Summary
846(1)
Quick Tips
846(17)
Questions
850(9)
Answers
859(4)
Chapter 6 Security Assessment and Testing 863(62)
Assessment, Test, and Audit Strategies
864(7)
Internal Audits
866(2)
External Audits
868(1)
Third-Party Audits
869(1)
Test Coverage
870(1)
Auditing Technical Controls
871(20)
Vulnerability Testing
871(2)
Penetration Testing
873(5)
War Dialing
878(1)
Other Vulnerability Types
879(2)
Postmortem
881(2)
Log Reviews
883(3)
Synthetic Transactions
886(1)
Misuse Case Testing
887(1)
Code Reviews
888(2)
Code Testing
890(1)
Interface Testing
890(1)
Auditing Administrative Controls
891(18)
Account Management
891(3)
Backup Verification
894(3)
Disaster Recovery and Business Continuity
897(5)
Security Training and Security Awareness Training
902(5)
Key Performance and Risk Indicators
907(2)
Reporting
909(4)
Analyzing Results
910(1)
Writing Technical Reports
911(1)
Executive Summaries
912(1)
Management Review and Approval
913(3)
Before the Management Review
914(1)
Reviewing Inputs
914(1)
Management Approval
915(1)
Summary
916(1)
Quick Tips
916(9)
Questions
918(4)
Answers
922(3)
Chapter 7 Security Operations 925(158)
The Role of the Operations Department
926(1)
Administrative Management
927(5)
Security and Network Personnel
929(2)
Accountability
931(1)
Clipping Levels
932(1)
Physical Security
932(23)
Facility Access Control
933(7)
Personnel Access Controls
940(1)
External Boundary Protection Mechanisms
941(10)
Intrusion Detection Systems
951(2)
Patrol Force and Guards
953(1)
Dogs
954(1)
Auditing Physical Access
954(1)
Internal Security Controls
955(1)
Secure Resource Provisioning
955(17)
Asset Inventory
956(1)
Asset Management
957(3)
Configuration Management
960(4)
Trusted Recovery
964(2)
Input and Output Controls
966(1)
System Hardening
967(3)
Remote Access Security
970(1)
Provisioning Cloud Assets
971(1)
Network and Resource Availability
972(13)
Mean Time Between Failures
973(1)
Mean Time to Repair
973(1)
Single Points of Failure
974(8)
Backups
982(2)
Contingency Planning
984(1)
Preventing and Detecting
985(15)
Continuous Monitoring
986(1)
Firewalls
987(1)
Intrusion Detection and Prevention Systems
988(1)
Whitelisting and Blacklisting
989(1)
Antimalware
990(1)
Vulnerability Management
990(3)
Patch Management
993(3)
Sandboxing
996(1)
Honeypots and Honeynets
997(1)
Egress Monitoring
998(1)
Security Information and Event Management
998(1)
Outsourced Services
999(1)
The Incident Management Process
1000(9)
Detection
1005(1)
Response
1005(1)
Mitigation
1006(1)
Reporting
1007(1)
Recovery
1008(1)
Remediation
1008(1)
Investigations
1009(16)
Computer Forensics and Proper Collection of Evidence
1010(2)
Motive, Opportunity, and Means
1012(1)
Computer Criminal Behavior
1012(1)
Incident Investigators
1013(1)
Types of Investigations
1014(1)
The Forensic Investigation Process
1015(6)
What Is Admissible in Court?
1021(2)
Surveillance, Search, and Seizure
1023(2)
Disaster Recovery
1025(28)
Business Process Recovery
1028(1)
Recovery Site Strategies
1029(7)
Supply and Technology Recovery
1036(4)
Backup Storage Strategies
1040(10)
End-User Environment
1050(1)
Availability
1051(2)
Liability and Its Ramifications
1053(7)
Liability Scenarios
1056(2)
Third-Party Risk
1058(1)
Contractual Agreements
1059(1)
Procurement and Vendor Processes
1059(1)
Insurance
1060(1)
Implementing Disaster Recovery
1061(6)
Personnel
1062(1)
Assessment
1063(1)
Restoration
1064(2)
Communications
1066(1)
Training
1067(1)
Personal Safety Concerns
1067(3)
Emergency Management
1068(1)
Duress
1068(1)
Travel
1069(1)
Training
1070(1)
Summary
1070(1)
Quick Tips
1070(13)
Questions
1073(6)
Answers
1079(4)
Chapter 8 Software Development Security 1083(134)
Building Good Code
1083(6)
Where Do We Place Security?
1084(2)
Different Environments Demand Different Security
1086(1)
Environment vs. Application
1087(1)
Functionality vs. Security
1087(1)
Implementation and Default Issues
1088(1)
Software Development Life Cycle
1089(13)
Project Management
1090(1)
Requirements Gathering Phase
1091(1)
Design Phase
1092(3)
Development Phase
1095(3)
Testing Phase
1098(2)
Operations and Maintenance Phase
1100(2)
Software Development Methodologies
1102(12)
Waterfall Methodology
1103(1)
V-Shaped Methodology
1103(1)
Prototyping
1104(1)
Incremental Methodology
1105(1)
Spiral Methodology
1106(1)
Rapid Application Development
1107(1)
Agile Methodologies
1108(4)
Integrated Product Team
1112(1)
DevOps
1112(2)
Capability Maturity Model Integration
1114(2)
Change Management
1116(2)
Change Control
1117(1)
Security of Development Environments
1118(3)
Security of Development Platforms
1118(1)
Security of Code Repositories
1119(1)
Software Configuration Management
1120(1)
Secure Coding
1121(2)
Source Code Vulnerabilities
1121(1)
Secure Coding Practices
1122(1)
Programming Languages and Concepts
1123(15)
Assemblers, Compilers, Interpreters
1126(2)
Object-Oriented Concepts
1128(7)
Other Software Development Concepts
1135(2)
Application Programming Interfaces
1137(1)
Distributed Computing
1138(10)
Distributed Computing Environment
1138(1)
CORBA and ORBS
1139(2)
COM and DCOM
1141(3)
Java Platform, Enterprise Edition
1144(1)
Service-Oriented Architecture
1144(4)
Mobile Code
1148(3)
Java Applets
1148(2)
ActiveX Controls
1150(1)
Web Security
1151(9)
Specific Threats for Web Environments
1152(7)
Web Application Security Principles
1159(1)
Database Management
1160(22)
Database Management Software
1160(2)
Database Models
1162(5)
Database Programming Interfaces
1167(2)
Relational Database Components
1169(2)
Integrity
1171(3)
Database Security Issues
1174(5)
Data Warehousing and Data Mining
1179(3)
Malicious Software (Malware)
1182(15)
Viruses
1184(2)
Worms
1186(1)
Rootkit
1187(1)
Spyware and Adware
1188(1)
Botnets
1188(1)
Logic Bombs
1189(1)
Trojan Horses
1190(1)
Antimalware Software
1191(3)
Spam Detection
1194(2)
Antimalware Programs
1196(1)
Assessing the Security of Acquired Software
1197(1)
Summary
1198(1)
Quick Tips
1198(19)
Questions
1203(7)
Answers
1210(7)
Appendix A Comprehensive Questions 1217(56)
Answers
1253(20)
Appendix B About the Online Content 1273(6)
System Requirements
1273(1)
Your Total Seminars Training Hub Account
1273(2)
Single User License Terms and Conditions
1273(2)
TotalTester Online
1275(1)
Hotspot and Drag-and-Drop Questions
1275(1)
Online Flash Cards
1276(1)
Single User License Terms and Conditions
1276(1)
Technical Support
1277(2)
Glossary 1279(18)
Index 1297
Fernando Maymï¿ (West Point, NY) , Ph.D., CISSP is a security practitioner with over 25 years experience in the field. He is currently the Deputy Director at the Army Cyber Institute at West Point, where he leads a multidisciplinary team charged with developing disruptive innovations for cyberspace operations as well as impactful public-private partnerships aimed at better securing cyberspace. Dr. Maymï¿ has served as a consultant for both government and private sector organizations in the US and abroad. He has authored and taught dozens of courses and workshops in cyber security for academic, government, and professional audiences in the United States and Latin America. Dr. Maymï¿ is the author of over a dozen publications and holds three patents. His awards include the U.S. Department of the Army Research and Development Achievement Award and he was recognized as a HENAAC Luminary. He worked closely with Shon Harris for the last two years of her life, advising her on a multitude of projects, including the previous version of this book. Dr. Maymï¿ is also a volunteer puppy raiser for Guiding Eyes for the Blind and has raised two guide dogs, Trinket and Virgo.