Muutke küpsiste eelistusi

E-raamat: Official (ISC)2 Guide to the SSCP CBK

4.00/5 (6 hinnangut Goodreads-ist)
(Florida International University),
  • Formaat: PDF+DRM
  • Ilmumisaeg: 26-Apr-2016
  • Kirjastus: Sybex Inc.,U.S.
  • Keel: eng
  • ISBN-13: 9781119278641
Teised raamatud teemal:
  • Formaat - PDF+DRM
  • Hind: 80,27 €*
  • * hind on lõplik, st. muud allahindlused enam ei rakendu
  • Lisa ostukorvi
  • Lisa soovinimekirja
  • See e-raamat on mõeldud ainult isiklikuks kasutamiseks. E-raamatuid ei saa tagastada.
Official (ISC)2 Guide to the SSCP CBKSuurem pilt
  • Formaat: PDF+DRM
  • Ilmumisaeg: 26-Apr-2016
  • Kirjastus: Sybex Inc.,U.S.
  • Keel: eng
  • ISBN-13: 9781119278641
Teised raamatud teemal:

DRM piirangud

  • Kopeerimine (copy/paste):

    ei ole lubatud

  • Printimine:

    ei ole lubatud

  • Kasutamine:

    Digitaalõiguste kaitse (DRM)
    Kirjastus on väljastanud selle e-raamatu krüpteeritud kujul, mis tähendab, et selle lugemiseks peate installeerima spetsiaalse tarkvara. Samuti peate looma endale  Adobe ID Rohkem infot siin. E-raamatut saab lugeda 1 kasutaja ning alla laadida kuni 6'de seadmesse (kõik autoriseeritud sama Adobe ID-ga).

    Vajalik tarkvara
    Mobiilsetes seadmetes (telefon või tahvelarvuti) lugemiseks peate installeerima selle tasuta rakenduse: PocketBook Reader (iOS / Android)

    PC või Mac seadmes lugemiseks peate installima Adobe Digital Editionsi (Seeon tasuta rakendus spetsiaalselt e-raamatute lugemiseks. Seda ei tohi segamini ajada Adober Reader'iga, mis tõenäoliselt on juba teie arvutisse installeeritud )

    Seda e-raamatut ei saa lugeda Amazon Kindle's. 

The fourth edition of the Official (ISC)2® Guide to the SSCP CBK® is a comprehensive resource providing an in-depth look at the seven domains of the SSCP Common Body of Knowledge (CBK).  This latest edition provides an updated, detailed guide that is considered one of the best tools for candidates striving to become an SSCP. 

The book offers step-by-step guidance through each of SSCP’s domains, including best practices and techniques used by the world's most experienced practitioners. Endorsed by (ISC)² and compiled and reviewed by SSCPs and subject matter experts, this book brings together a global, thorough perspective to not only prepare for the SSCP exam, but it also provides a reference that will serve you well into your career.

 

Foreword xvii
Introduction xix
Domain 1 Access Controls 1(70)
Objectives
3(1)
Access Control Concepts
3(8)
Applying Logical Access Control in Terms of Subjects
4(5)
Applying Logical Access Control in Terms of Objects or Object Groups
9(2)
Implementing Access Controls
11(12)
Discretionary Access Control
11(3)
Role-Based Access Controls
14(7)
Nondiscretionary Access Control
21(1)
Mandatory Access Control
21(1)
Attribute-Based Access Control
22(1)
Security Architecture and Models
23(4)
Bell-LaPadula Confidentiality Model
23(1)
Biba and Clark-Wilson Integrity Models
24(2)
Additional Models
26(1)
Implementing Authentication Mechanisms-Identification, Authentication, Authorization, and Accountability
27(32)
Identification (Who Is the Subject?)
27(2)
Authentication (Proof of Identity)
29(22)
Authorization
51(4)
Authentication Using Kerberos
55(3)
User/Device Authentication Policies
58(1)
Comparing Internetwork Trust Architectures
59(2)
Internet
59(1)
Intranet
60(1)
Extranet
60(1)
Demilitarized Zone (DMZ)
60(1)
Trust Direction
61(1)
One-Way Trust
62(1)
Two-Way Trust
62(1)
Trust Transitivity
62(1)
Administering the Identity Management Lifecycle
62(1)
Authorization
62(1)
Proofing
63(1)
Provisioning
63(1)
Maintenance
63(1)
Entitlement
63(1)
Summary
63(1)
Sample Questions
64(3)
Notes
67(4)
Domain 2 Security Operations 71(114)
Objectives
73(1)
Code of Ethics
74(3)
Code of Ethics Preamble
74(1)
Code of Ethics Canons
75(1)
Applying a Code of Ethics to Security Practitioners
76(1)
Security Program Objectives: The C-I-A Triad and Beyond
77(41)
Confidentiality
77(1)
Integrity
78(1)
Availability
79(1)
Non-Repudiation
80(1)
Privacy
80(2)
Security Best Practices
82(1)
Designing a Security Architecture
82(13)
Secure Development and Acquisition Lifecycles
95(6)
System Vulnerabilities, Secure Development, and Acquisition Practices
101(3)
Hardware/Software
104(2)
Data
106(12)
Disclosure Controls: Data Leakage Prevention
118(59)
Technical Controls
119(2)
Operational Controls
121(1)
Managerial Controls
121(9)
Implementation and Release Management
130(2)
Systems Assurance and Controls Validation
132(1)
Change Control and Management
132(3)
Configuration Management
135(4)
Security Impact Assessment
139(1)
System Architecture/Interoperability of Systems
139(1)
Patch Management
140(2)
Monitoring System Integrity
142(1)
Security Awareness and Training
142(4)
Interior Intrusion Detection Systems
146(6)
Building and Inside Security
152(14)
Securing Communications and Server Rooms
166(3)
Restricted and Work Area Security
169(1)
Data Center Security
170(7)
Summary
177(1)
Sample Questions
178(3)
Notes
181(4)
Domain 3 Risk Identification, Monitoring, And Analysis 185(100)
Objectives
187(1)
Introduction to Risk Management
187(21)
Risk Management Concepts
187(16)
Security Auditing Overview
203(5)
Responding to an Audit
208(1)
Exit Interview
208(1)
Presentation of Audit Findings
208(1)
Management Response
208(1)
Security Assessment Activities
209(30)
Vulnerability Scanning and Analysis
209(15)
Penetration Testing
224(15)
Operating and Maintaining Monitoring Systems
239(27)
Security Monitoring Concepts
239(6)
Attackers
245(1)
Intrusions
246(1)
Events
247(1)
Types of Monitoring
247(2)
Log Files
249(8)
Source Systems
257(1)
Security Analytics, Metrics, and Trends
258(2)
Visualization
260(1)
Event Data Analysis
261(5)
Communication of Findings
266(1)
Going Hands-on-Risk Identification Exercise
266(13)
Virtual Testing Environment
267(1)
Creating the Environment
268(11)
Summary
279(1)
Sample Questions
280(3)
Notes
283(2)
Domain 4 Incident Response And Recovery 285(60)
Objectives
287(1)
Incident Handling
287(32)
Preparation
289(7)
Detection and Analysis
296(10)
Containment, Eradication, and Recovery
306(2)
Post-Incident Activity
308(11)
Recovery and Business Continuity
319(21)
Business Continuity Planning
319(7)
Disaster Recovery Planning
326(4)
Plan Testing
330(3)
Plan Review and Maintenance
333(7)
Summary
340(1)
Sample Questions
341(3)
Notes
344(1)
Domain 5 Cryptography 345(102)
Objectives
346(1)
Encryption Concepts
347(43)
Key Concepts and Definitions
347(3)
Foundational Concepts
350(5)
Evaluation of Algorithms
355(1)
Hashing
356(5)
Encryption and Decryption
361(1)
Symmetric Cryptography
361(15)
Asymmetric Cryptography
376(5)
Hybrid Cryptography
381(1)
Message Digests
382(1)
Message Authentication Code
382(1)
HMAC
383(1)
Digital Signatures
383(1)
Non-Repudiation
384(1)
Methods of Cryptanalytic Attack
385(5)
Data Sensitivity and Regulatory Requirements
390(27)
Legislative and Regulatory Compliance
390(4)
End-User Training
394(1)
Public Key Infrastructure (PKI)
395(2)
Fundamental Key Management Concepts
397(7)
Management and Distribution of Keys
404(9)
Secure Protocols
413(4)
Going Hands-on with Cryptography-Cryptography Exercise
417(22)
Requirements
417(1)
Setup
418(13)
Key Exchange and Sending Secure E-mail
431(8)
Conclusion
439(1)
Summary
439(1)
Sample Questions
440(3)
End Notes
443(4)
Domain 6 Networks And Communications Security 447(130)
Objectives
449(1)
Security Issues Related to Networks
449(47)
OSI and TCP/IP Models
450(10)
IP Networking
460(7)
Network Topographies and Relationships
467(10)
Commonly Used Ports and Protocols
477(19)
Telecommunications Technologies
496(7)
Converged Communications
496(3)
VoIP
499(1)
POTS and PBX
500(1)
Cellular
501(1)
Attacks and Countermeasures
501(2)
Control Network Access
503(19)
Hardware
507(2)
Wired Transmission Media
509(4)
Endpoint Security
513(1)
Voice Technologies
513(2)
Multimedia Collaboration
515(1)
Open Protocols, Applications, and Services
516(1)
Remote Access
517(5)
Data Communication
522(1)
LAN-Based Security
522(8)
Separation of Data Plane and Control Plane
522(1)
Segmentation
523(3)
Media Access Control Security (IEEE 802.1AE)
526(1)
Secure Device Management
527(3)
Network-Based Security Devices
530(25)
Network Security Objectives and Attack Modes
531(3)
Firewalls and Proxies
534(3)
Network Intrusion Detection/Prevention Systems
537(7)
IP Fragmentation Attacks and Crafted Packets
544(3)
DoS/DDoS
547(4)
Spoofing
551(4)
Wireless Technologies
555(8)
Wireless Technologies, Networks, and Methodologies
555(3)
Transmission Security and Common Vulnerabilities and Countermeasures
558(5)
Summary
563(1)
Sample Questions
564(4)
End Notes
568(9)
Domain 7 Systems And Application Security 577(192)
Objectives
580(1)
Identifying and Analyzing Malicious Code and Activity
580(1)
CIA Triad: Applicability to Malcode
581(30)
Malcode Naming Conventions and Types
582(16)
Malicious Code Countermeasures
598(13)
Vectors of Infection
611(19)
Malicious Activity
614(1)
How to Do It for Yourself: Using the Social Engineer Toolkit (SET)
615(4)
Long File Extensions
619(1)
Double File Extensions
619(3)
Fake Related Extension
622(1)
Fake Icons
623(1)
Password-Protected ZIP Files/RAR
624(1)
Hostile Codecs
624(1)
E-mail
624(2)
Insider Human Threats
626(2)
Insider Hardware and Software Threats
628(2)
Spoofing, Phishing, Spam, and Botnets
630(8)
Spoofing
630(1)
Phishing
631(2)
Spam
633(2)
Botnets
635(3)
Malicious Web Activity
638(8)
Cross-Site Scripting (XSS) Attacks
639(1)
Zero-Day Exploits and Advanced Persistent Threats (APTs)
639(2)
Brute-Force Attacks
641(2)
Instant Messaging
643(1)
Peer-to-Peer Networks
643(1)
Internet Relay Chat
644(1)
Rogue Products and Search Engines
645(1)
Infected Factory Builds and Media
645(1)
Web Exploitation Frameworks
645(1)
Payloads
646(3)
Backdoor Trojans
646(1)
Man-in-the-Middle Malcode
647(2)
Identifying Infections
649(17)
Malicious Activity Countermeasures
652(3)
Third-Party Certifications
655(1)
The Wildlist
656(1)
Questionable Behavior on a Computer
656(2)
Inspection of Processes
658(1)
Inspection of the Windows Registry
659(1)
How to Do It for Yourself: Installing Strawberry Perl in Windows 7 or Windows 8
659(2)
Inspection of Common File Locations
661(5)
Behavioral Analysis of Malcode
666(21)
Static File Analysis
669(8)
Testing Remote Websites Found in Network Log Files
677(6)
Testing of Samples in Virtualized Environments
683(3)
Free Online Sandbox Solutions
686(1)
Interactive Behavioral Testing
687(1)
Malcode Mitigation
687(4)
Strategic
687(2)
Tactical
689(2)
Implementing and Operating End-Point Device Security
691(5)
Host-Based Intrusion Detection System
691(1)
Host-Based Firewalls
692(1)
Application Whitelisting
692(1)
Endpoint Encryption
693(1)
Trusted Platform Module
693(1)
Mobile Device Management
694(1)
Secure Browsing
695(1)
Operating and Configuring Cloud Security
696(23)
The Five Essential Characteristics of Clouds
696(1)
Deployment Models
697(2)
Service Models
699(3)
Virtualization
702(2)
Legal and Privacy Concerns
704(5)
Classification of Discovered Sensitive Data
709(1)
Mapping and Definition of Controls
710(1)
Application of Defined Controls for Personally Identifiable Information (PII)
711(1)
Data Storage and Transmission
712(4)
Threats to Storage Types
716(1)
Technologies Available to Address Threats
716(1)
DLP
716(3)
Encryption
719(7)
Sample Use Cases for Encryption
720(1)
Cloud Encryption Challenges
720(2)
Encryption Architecture
722(1)
Data Encryption in IaaS
722(2)
Key Management
724(2)
Encryption Alternatives and Other Data Protection Technologies
726(12)
Data Masking/Data Obfuscation
726(1)
Data Anonymization
727(1)
Tokenization
728(1)
Third-Party/Outsourcing Implications
729(1)
Data Retention Policies
729(1)
Data Deletion Procedures and Mechanisms
730(1)
Data Archiving Procedures and Mechanisms
731(1)
Event Sources
732(3)
Data Event Logging and Event Attributes
735(1)
Storage and Analysis of Data Events
736(2)
Securing Big Data Systems
738(2)
Operating and Securing Virtual Environments
740(10)
Software-Defined Network (SDN)
741(1)
Virtual Appliances
741(1)
Continuity and Resilience
742(1)
Attacks and Countermeasures
743(1)
Security Virtualization Best Practices
744(6)
Summary
750(1)
Sample Questions
750(7)
End Notes
757(12)
Appendix A: Answers To Sample Questions 769(62)
Domain 1: Access Controls
770(7)
Domain 2: Security Operations
777(8)
Domain 3: Risk, Identification, Monitoring, and Analysis
785(8)
Domain 4: Incident Response and Recovery
793(5)
Domain 5: Cryptography
798(7)
Domain 6: Networks and Communications Security
805(9)
Domain 7: Systems and Application Security
814(17)
Appendix B: DNSSEC Walkthrough 831(10)
Hardware and Software Requirements
832(1)
Configuring the Test Lab
832(1)
Configuring DC1
832(3)
Creating a Domain Administrator Account
834(1)
Configuring the sec.isc2.com DNS Zone
834(1)
Enabling Remote Desktop on DC1
835(1)
Configuring DNS1
835(2)
Installing the OS and Configuring TCP/IP on DC1
836(1)
Installing and Configuring DNS on DNS1
836(1)
Signing a Zone on DC1 and Distributing Trust Anchors
837(4)
Distributing a Trust Anchor to DNS1
838(1)
Verifying Trust Anchors
838(1)
Querying a Signed Zone with DNSSEC Validation Required
838(1)
Unsigning the Zone
839(1)
Resigning the Zone with Custom Parameters
840(1)
Appendix C: Glossary Of Terms Related To The SSCP 841(32)
Index 873
With over 20 years of experience as both an educator and IT professional, Adam Gordon holds numerous Professional IT Certifications including CISSP, CISA, CRISC, CHFI, CEH, SCNA, VCP, and VCI. He is the author of several books and has achieved many awards, including EC-Council Instructor of Excellence for 2006-07 and Top Technical Instructor Worldwide, 2002-2003. Adam holds his Bachelor's Degree in International Relations and his Master's Degree in International Political Affairs from Florida International University. Adam has held a number of positions during his professional career including CISO, CTO, Consultant, and Solutions Architect. He has worked on many large implementations involving multiple customer program teams for delivery. Adam has been invited to lead projects for companies such as Microsoft, Citrix, Lloyds Bank TSB, Campus Management, US Southern Command (SOUTHCOM), Amadeus, World Fuel Services, and Seaboard Marine.
Lisainfo e-raamatute kohta Lisainfo e-raamatute kohta
Püsilink: https://www.kriso.ee/db/97811192786412e.html
Märksõnad: