Foreword |
|
xv | |
Introduction |
|
xvii | |
Editors |
|
xxv | |
|
Domain 1 Access Control Systems & Methodology |
|
|
1 | (130) |
|
|
4 | (1) |
|
|
4 | (7) |
|
Discretionary Access Control |
|
|
11 | (3) |
|
DAC Implementation Strategies |
|
|
14 | (4) |
|
Nondiscretionary Access Control |
|
|
18 | (3) |
|
Mandatory Access Control (MAC) |
|
|
21 | (4) |
|
|
25 | (3) |
|
|
28 | (9) |
|
|
37 | (3) |
|
Authentication, Authorization, and Accounting (AAA) |
|
|
40 | (1) |
|
Centralized Access Control |
|
|
40 | (3) |
|
|
43 | (2) |
|
|
45 | (1) |
|
Decentralized Access Control |
|
|
46 | (1) |
|
|
47 | (3) |
|
|
50 | (1) |
|
|
51 | (1) |
|
Directories and Access Control |
|
|
52 | (2) |
|
|
54 | (1) |
|
|
54 | (6) |
|
|
60 | (5) |
|
Access Control Administration and Management Concepts |
|
|
65 | (1) |
|
Access Control Administration |
|
|
65 | (5) |
|
|
70 | (7) |
|
|
77 | (1) |
|
Official (ISC)2 Guide to the ISSAP CBK: Second Edition |
|
|
|
|
78 | (1) |
|
Change of Privilege Levels |
|
|
79 | (1) |
|
|
79 | (2) |
|
|
81 | (5) |
|
|
86 | (2) |
|
|
88 | (4) |
|
|
92 | (1) |
|
|
92 | (1) |
|
|
92 | (2) |
|
Geographical Considerations |
|
|
94 | (2) |
|
|
96 | (4) |
|
|
100 | (2) |
|
Strengths and Weaknesses of Authentication Tools |
|
|
102 | (1) |
|
Token-Based Authentication Tools |
|
|
102 | (4) |
|
Common Issues with Token Management |
|
|
106 | (1) |
|
Biometric Authentication Tools |
|
|
107 | (1) |
|
Performance Characteristics |
|
|
107 | (1) |
|
Implementation Considerations |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
109 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
Authentication Tool Considerations |
|
|
111 | (1) |
|
|
112 | (2) |
|
Architecture Effectiveness Assurance |
|
|
114 | (2) |
|
|
116 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
Developing Test Procedures |
|
|
120 | (1) |
|
Risk-Based Considerations |
|
|
121 | (10) |
|
Domain 2 Communications & Network Security |
|
|
131 | (106) |
|
Voice and Facsimile Communications |
|
|
134 | (1) |
|
Pulse Code Modulation (PCM) |
|
|
135 | (1) |
|
Circuit-Switched versus Packet-Switched Networks |
|
|
136 | (3) |
|
VoIP Architecture Concerns |
|
|
139 | (1) |
|
|
139 | (1) |
|
|
140 | (1) |
|
Method of Voice Digitization Used |
|
|
140 | (1) |
|
|
140 | (1) |
|
|
141 | (1) |
|
Voice Security Policies and Procedures |
|
|
141 | (1) |
|
|
141 | (1) |
|
|
142 | (1) |
|
Administrative Change Control |
|
|
143 | (1) |
|
|
143 | (1) |
|
|
143 | (1) |
|
|
144 | (8) |
|
|
152 | (1) |
|
Redundancy and Availability |
|
|
152 | (1) |
|
|
152 | (1) |
|
|
153 | (1) |
|
|
153 | (3) |
|
|
156 | (4) |
|
|
160 | (1) |
|
Communications and Network Polices |
|
|
161 | (1) |
|
|
162 | (3) |
|
|
165 | (1) |
|
Demilitarized Zone's Perimeter Controls |
|
|
166 | (1) |
|
|
167 | (1) |
|
|
167 | (5) |
|
Intrusion Prevention System |
|
|
172 | (1) |
|
Security Information & Event Management Considerations (SIEM) |
|
|
173 | (3) |
|
|
176 | (1) |
|
|
176 | (3) |
|
|
179 | (1) |
|
|
179 | (1) |
|
|
180 | (1) |
|
|
180 | (1) |
|
|
181 | (1) |
|
|
182 | (1) |
|
|
182 | (1) |
|
|
182 | (1) |
|
|
183 | (1) |
|
Outbound Traffic Filtering |
|
|
184 | (1) |
|
|
185 | (1) |
|
Policy Enforcement Design |
|
|
185 | (2) |
|
Application and Transport Layer Security |
|
|
187 | (1) |
|
|
188 | (3) |
|
Secure E-Commerce Protocols |
|
|
191 | (1) |
|
SSL/TSL and the TCP/IP Protocol Stack |
|
|
191 | (1) |
|
|
192 | (1) |
|
|
193 | (1) |
|
Certificates and Certificate Authorities |
|
|
193 | (1) |
|
Official (ISC)2 Guide to the ISSAP CBK: Second Edition |
|
|
|
|
193 | (1) |
|
|
194 | (1) |
|
|
195 | (1) |
|
|
195 | (1) |
|
Secure Remote Procedure Calls |
|
|
196 | (1) |
|
Network Layer Security and VPNs |
|
|
196 | (2) |
|
|
198 | (1) |
|
|
199 | (2) |
|
Layer 2 Tunneling Protocol (L2TP) |
|
|
201 | (3) |
|
|
204 | (1) |
|
Authentication Header (AH) |
|
|
205 | (3) |
|
Encapsulating Security Payload (ESP) |
|
|
208 | (1) |
|
|
209 | (1) |
|
|
209 | (1) |
|
|
209 | (1) |
|
|
210 | (1) |
|
|
211 | (1) |
|
Comparing SOCKS and HTTP Proxies |
|
|
211 | (1) |
|
|
212 | (1) |
|
|
212 | (1) |
|
|
212 | (1) |
|
|
212 | (1) |
|
|
212 | (1) |
|
|
213 | (1) |
|
|
213 | (1) |
|
Operating System and Browser Support |
|
|
213 | (1) |
|
|
213 | (1) |
|
|
213 | (1) |
|
|
214 | (1) |
|
Network Security Design Considerations |
|
|
215 | (1) |
|
Interoperability and Associated Risks |
|
|
215 | (1) |
|
Cross-Domain Risks and Solutions |
|
|
215 | (2) |
|
|
217 | (1) |
|
|
218 | (1) |
|
|
218 | (4) |
|
|
222 | (1) |
|
|
222 | (1) |
|
|
222 | (1) |
|
|
222 | (1) |
|
|
223 | (1) |
|
Monitoring and Network Attacks |
|
|
223 | (1) |
|
|
223 | (1) |
|
|
224 | (13) |
|
|
237 | (110) |
|
|
240 | (1) |
|
Applications of Cryptography |
|
|
240 | (1) |
|
|
240 | (1) |
|
|
241 | (3) |
|
|
244 | (1) |
|
|
245 | (1) |
|
|
246 | (1) |
|
Secure Wireless Communication |
|
|
247 | (2) |
|
Other Types of Secure Communication |
|
|
249 | |
|
Identification and Authentication |
|
|
25 | (227) |
|
|
252 | (1) |
|
Electronic Commerce (E-Commerce) |
|
|
253 | (2) |
|
|
255 | (1) |
|
|
255 | (1) |
|
|
256 | (1) |
|
|
256 | (3) |
|
|
259 | (4) |
|
|
263 | (1) |
|
|
264 | (3) |
|
Hash Functions and Message Authentication Codes |
|
|
267 | (4) |
|
|
271 | (1) |
|
Vet Proprietary Cryptography & Design Testable Cryptographic Systems |
|
|
272 | (2) |
|
Computational Overhead & Useful Life |
|
|
274 | (2) |
|
|
276 | (1) |
|
Purpose of the Keys and Key Types |
|
|
276 | (2) |
|
Cryptographic Strength and Key Size |
|
|
278 | (5) |
|
|
283 | (1) |
|
|
284 | (3) |
|
Key Distribution and Crypto Information in Transit |
|
|
287 | (1) |
|
Symmetric Keys Distribution |
|
|
288 | (1) |
|
Public and Private Keys Distribution |
|
|
288 | (2) |
|
|
290 | (3) |
|
|
293 | (1) |
|
|
294 | (1) |
|
|
295 | (1) |
|
|
296 | (1) |
|
|
296 | (1) |
|
|
297 | (1) |
|
Public Key Infrastructure |
|
|
297 | (1) |
|
|
298 | (1) |
|
Certificate and Key Storage |
|
|
299 | (1) |
|
|
300 | (1) |
|
Official (ISC)2 Guide to the ISSAP CBK: Second Edition |
|
|
|
How the Subject Proves Its Organizational Entity |
|
|
301 | (1) |
|
How a Person, Acting on Behalf of the Subject, Authenticates to Request a Certificate (Case Studies) |
|
|
302 | (4) |
|
|
306 | (1) |
|
|
307 | (1) |
|
|
307 | (1) |
|
|
308 | (1) |
|
|
309 | (1) |
|
|
310 | (1) |
|
|
311 | (1) |
|
Modified CRL-Based Models |
|
|
312 | (2) |
|
|
314 | (1) |
|
How Applications Use Cross-Certification |
|
|
314 | (2) |
|
How Cross-Certification Is Set Up |
|
|
316 | (1) |
|
How Cross-Certification with a Bridge CA Is Implemented in Practice |
|
|
317 | (1) |
|
|
318 | (1) |
|
Review of Cryptanalytic Attacks |
|
|
318 | (1) |
|
|
318 | (1) |
|
|
319 | (1) |
|
|
319 | (1) |
|
|
320 | (1) |
|
Network-Based Cryptanalytic Attacks |
|
|
320 | (1) |
|
|
321 | (1) |
|
|
322 | (1) |
|
Side-Channel Cryptanalysis |
|
|
322 | (1) |
|
Risk-Based Cryptographic Architecture |
|
|
323 | (2) |
|
Identifying Risk and Requirements by Cryptographic Areas |
|
|
325 | (3) |
|
|
328 | (3) |
|
Cryptographic Compliance Monitoring |
|
|
331 | (1) |
|
Cryptographic Standards Compliance |
|
|
332 | (1) |
|
Industry- and Application-Specific Cryptographic Standards Compliance |
|
|
333 | (14) |
|
Domain 4 Security Architecture Analysis |
|
|
347 | (80) |
|
|
352 | (1) |
|
Quantitative Risk Analysis |
|
|
352 | (1) |
|
Qualitative Risk Analysis |
|
|
353 | (1) |
|
|
353 | (2) |
|
|
355 | (1) |
|
Methods of "Vector" Attack |
|
|
355 | (3) |
|
|
358 | (1) |
|
|
359 | (1) |
|
|
359 | (1) |
|
|
359 | (1) |
|
|
360 | (1) |
|
|
360 | (1) |
|
|
361 | (1) |
|
Instant Messaging, IRC, and P2P File-Sharing Networks |
|
|
362 | (1) |
|
|
362 | (1) |
|
|
362 | (1) |
|
|
363 | (1) |
|
Corporate versus Departmental: Valuation |
|
|
364 | (1) |
|
Business, Legal, and Regulatory Requirements |
|
|
364 | (2) |
|
Product Assurance Evaluation Criteria |
|
|
366 | (2) |
|
Common Criteria (CC) Part 1 |
|
|
368 | (3) |
|
Common Criteria (CC) Part2 |
|
|
371 | (1) |
|
The Target of Evaluation (TOE) |
|
|
372 | (1) |
|
Evaluation Assurance Level (EAL) Overview |
|
|
373 | (4) |
|
Evaluation Assurance Level 1 (EAL1) - Functionally Tested |
|
|
377 | (1) |
|
Evaluation Assurance Level2 (EAL2) - Structurally Tested |
|
|
377 | (1) |
|
Evaluation Assurance Level 3 (EAL3) - Methodically Tested and Checked |
|
|
377 | (1) |
|
Evaluation Assurance Level 4 (EAL4) - Methodically Designed, Tested, and Reviewed |
|
|
378 | (1) |
|
Evaluation Assurance Level 5 (EAL5) - Semiformally Designed and Tested |
|
|
378 | (1) |
|
Evaluation Assurance Level 6 (EAL6) - Semiformally Verified Design and Tested |
|
|
378 | (1) |
|
Evaluation Assurance Level 7 (EAL7) - Formally Verified Design and Tested |
|
|
379 | (1) |
|
Common Criteria (CC) Part 3: Assurance Paradigm |
|
|
380 | (1) |
|
Significance of Vulnerabilities |
|
|
380 | (1) |
|
The Causes of Vulnerabilities |
|
|
380 | (1) |
|
Common Criteria Assurance |
|
|
381 | (1) |
|
Assurance through Evaluation |
|
|
381 | (1) |
|
The Common Criteria Evaluation Assurance Scale |
|
|
381 | (1) |
|
|
382 | (2) |
|
Software Engineering Institute - Capability Maturity Model (CMMI-DEV) Key Practices Version 1.3 |
|
|
384 | (1) |
|
Introducing the Capability Maturity Model |
|
|
384 | (1) |
|
Sources of the Capability Maturity Model (CMM) |
|
|
384 | (2) |
|
Structure of the CMMI-DEV V1.3 |
|
|
386 | (11) |
|
|
397 | (1) |
|
|
398 | (2) |
|
|
400 | (1) |
|
Concepts of a Layered Architecture |
|
|
401 | (1) |
|
Payment Card Industry Data Security Standard (PCI-DSS) |
|
|
402 | (2) |
|
|
404 | (4) |
|
|
408 | (2) |
|
Department of Defense Architecture Framework (DoDAF) |
|
|
410 | (2) |
|
|
412 | (1) |
|
|
413 | (1) |
|
Official (ISC)2 Guide to the ISSAP CBK: Second Edition |
|
|
|
System Security Engineering Methodologies |
|
|
413 | (2) |
|
|
415 | (1) |
|
|
416 | (1) |
|
|
416 | (3) |
|
|
419 | (8) |
|
Domain 5 Technology Related Business Continuity Planning (BCP) & Disaster Recovery Planning (DRP) |
|
|
427 | (50) |
|
Planning Phases and Deliverables |
|
|
432 | (1) |
|
|
433 | (5) |
|
|
438 | (2) |
|
Human-Made Risks and Threats |
|
|
440 | (2) |
|
|
442 | (1) |
|
Do Not Forget the Neighbors! |
|
|
442 | (2) |
|
|
444 | (5) |
|
Data Stored in Electronic Form |
|
|
449 | (1) |
|
Remote Replication and Off-Site Journaling |
|
|
449 | (2) |
|
|
451 | (5) |
|
Selecting a Recovery Strategy for Technology |
|
|
456 | (3) |
|
|
459 | (1) |
|
Implementing Recovery Strategies |
|
|
460 | (1) |
|
|
460 | (1) |
|
|
461 | (1) |
|
|
461 | (1) |
|
Plan Maintenance Strategies |
|
|
462 | (2) |
|
Bringing It All Together - A Sample "Walk Through" of a DR Plan |
|
|
464 | (1) |
|
Step by Step Guide for Disaster Recovery Planning for Security Architects |
|
|
465 | (6) |
|
|
465 | (3) |
|
II Plan Development and Testing |
|
|
468 | (2) |
|
|
470 | (1) |
|
|
471 | (6) |
|
Domain 6 Physical Security Considerations |
|
|
477 | (46) |
|
Physical Security Policies and Standards |
|
|
480 | (9) |
|
|
489 | (1) |
|
|
490 | (4) |
|
Physical Security Needs and Organization Drivers |
|
|
494 | (2) |
|
|
496 | (5) |
|
|
501 | (2) |
|
|
503 | (2) |
|
|
505 | (4) |
|
|
509 | (2) |
|
|
511 | (1) |
|
|
511 | (2) |
|
Access Control Violation Monitoring |
|
|
513 | (10) |
Appendix A Answers to Review Questions |
|
523 | (36) |
Index |
|
559 | |