CISSP®

Study GuideSeventh Edition

CISSP®

Certified Information Systems Security Professional

Study GuideSeventh Edition

James Michael Stewart

Mike Chapple

Darril Gibson

Copyright © 2015 by John Wiley & Sons, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-1-119-04271-6

ISBN: 978-1-119-04272-3 (ebk.)

ISBN: 978-1-119-04275-4 (ebk.)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sec-tions 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Pub-lisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permis-sion should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warran-ties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent profes-sional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of fur-ther information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Control Number: 2015948797

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CISSP is a registered certification mark of (ISC)² , Inc. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

10 9 8 7 6 5 4 3 2 1

Disclaimer: John Wiley and Sons, Inc., in association with (ISC)2, has prepared this study guide for general information and for use as training for the Official (ISC)2 CISSP® CBK® and not as legal or operational advice. This is a study guide only, and does not imply that any questions or topics from this study guide will appear on the actual (ISC)2 CISSP® certification examination. The study guide was not prepared with writers or editors associated with developing the (ISC)2 CISSP certification examination. The study guide may contain errors and omissions. (ISC)2 does not guarantee a passing score on the exam or provide any assurance or guarantee relating to the use of this study guide and preparing for the (ISC)2 CISSP® certification examination.

The users of the Official CISSP: Certified Information Systems Security Professional Study Guide, Seventh Edition agree that John Wiley and Sons, Inc.. and (ISC)2 are not liable for any indirect, special, incidental, or consequential damages up to and including negligence that may arise from use of these materials. Under no cir-cumstances, including negligence, shall John Wiley and Sons, Inc.or (ISC)2, its officers, directors, agents, author or anyone else involved in creating, producing or distributing these materials be liable for any direct, indirect, incidental, special or consequential damages that may result from the use of this study guide.

Development Editor: Alexa MurphyTechnical Editors: David Seidl, Brian O’Hara, Paul CalatayudProduction Editor: Rebecca AndersonCopy Editors: Elizabeth Welch, Linda RecktenwaldEditorial Manager: Mary Beth WakefieldProduction Manager: Kathleen WisorAssociate Publisher: Jim MinatelMedia Supervising Producer: Richard Graves

Book Designers: Judy Fung and Bill GibsonProofreaders: Josh Chase, Sarah Kaikini and Louise Watson, Word One New YorkIndexer: J & J IndexingProject Coordinator, Cover: Brent SavageCover Designer: WileyCover Image: ©Getty Images Inc./Jeremy Woodhouse

Whenever we look toward the future, we have to first look back and think about where we came from. Back in 1989, (ISC)2 was established by a handful of passionate volunteers who wanted to create a set of standards for a new concept, not yet a full-fledged career field, called information security. In the minds of those volunteers, having the initial 500 applicants sign up to take the Certified Information Systems Security Professional (CISSP®) exam was considered quite a success. Little did they imagine that 26 years later, not only would those 500 applicants grow to a cadre of 100,000 CISSP credential holders across more than 160 countries, the CISSP would also become recognized as the standard certification for the information security industry.

Advancements in technology bring about the need for updates, and we work tirelessly to ensure that our content is always relevant to the industry. As the information security industry continues to transition, and cybersecurity becomes a global focus, the CISSP Common Body of Knowledge (CBK) is even more relevant to today’s challenges.

The new (ISC)² CISSP Study Guide is part of a concerted effort to enhance and increase our education and training offerings. The CISSP Study Guide reflects the most relevant topics in our ever-changing field and is a learning tool for (ISC)² certification exam candidates. It provides a comprehensive study guide to the eight CISSP domains and the most current topics in the industry.

If you are on the path to getting certified, you have no doubt heard of the (ISC)2 Official Guides to the CBK. While our Official Guides to the CBK are the authoritative references to the Common Body of Knowledge, the new study guides are learning tools focused on educating the reader in preparation for exams. As an ANSI accredited certification body under the ISO/IEC 17024 stan-dard, (ISC)² does not teach the CISSP exam. Rather, we strive to generate or endorse content that teaches the CISSP’s CBK. Candidates who have a strong understanding of the CBK are best prepared for success with the exam and within the profession.

(ISC)2 is also breaking new ground by partnering with Wiley, a recognized industry leading brand. Developing a partnership with renowned content provider Wiley allows (ISC)2 to grow its offer-ings on the scale required to keep our content fresh and aligned with the constantly changing environment. The power of combining the expertise of our two organizations benefits certification candidates and the industry alike.

I look forward to your feedback on the (ISC)2 CISSP Study Guide. Congratulations on taking the first step toward earning the certification that SC Magazine named “Best Professional Certification Program.” Good luck with your studies!

Best Regards,

David P. Shearer, CISSP, PMPCEO(ISC)2

To Cathy, your perspective on the world and life often surprises me,

challenges me, and makes me love you even more.

—James Michael Stewart

To Dewitt Latimer, my mentor, friend, and colleague. I miss you dearly.

—Mike Chapple

To Nimfa: Thanks for sharing your life with me for the past 23 years and

letting me share mine with you.

—Darril Gibson

AcknowledgmentsI’d like to express my thanks to Sybex for continuing to support this project. Thanks to Mike Chapple and Darril Gibson for continuing to contribute to this project. Thanks also to all my CISSP course students who have provided their insight and input to improve my training courseware and ultimately this tome. Extra thanks to the seventh edition devel-opmental editor, Alexa Murphy, and technical editor, David Seidl, who performed amaz-ing feats in guiding us to improve this book. Thanks as well to my agent, Carole Jelen, for continuing to assist in nailing down these projects.

To my adoring wife, Cathy: Building a life and a family together has been more wonder-ful than I could have ever imagined. To Slayde and Remi: You are growing up so fast and learning at an outstanding pace, and you continue to delight and impress me daily. You are both growing into amazing individuals. To my mom, Johnnie: It is wonderful to have you close by. To Mark: No matter how much time has passed or how little we see each other, I have been and always will be your friend. And finally, as always, to Elvis: You were way ahead of the current bacon obsession, with your peanut butter‐banana‐bacon sandwich; I think that’s proof you traveled through time!

—James Michael Stewart

Special thanks go to the information security team at the University of Notre Dame, who provided hours of interesting conversation and debate on security issues that inspired and informed much of the material in this book.

I would like to thank the team at Wiley who provided invaluable assistance throughout the book development process. I also owe a debt of gratitude to my literary agent, Carole Jelen of Waterside Productions. My coauthors, James Michael Stewart and Darril Gibson, were great collaborators. David Seidl, our diligent and knowledgeable technical editor, provided valuable insight as we brought this edition to press.

I’d also like to thank the many people who participated in the production of this book but whom I never had the chance to meet: the graphics team, the production staff, and all of those involved in bringing this book to press.

—Mike Chapple

Thanks to Carol Long and Carole Jelen for helping get this update in place before (ISC)2 released the objectives. This helped us get a head start on this new edition and we appre-ciate your efforts. It’s been a pleasure working with talented people like James Michael Stewart and Mike Chapple. Thanks to both of you for all your work and collaborative efforts on this project. The technical editor, Dave Seidl, provided us with some outstanding feedback and this book is better because of his efforts. Thanks again, David. Last, thanks to the team at Sybex (including project managers, editors, and graphics artists) for all the work you did helping us get this book to print.

—Darril Gibson

About the AuthorsJames Michael Stewart, CISSP, has been writing and training for more than 20 years, with a current focus on security. He has been teaching CISSP training courses since 2002, not to mention other courses on Internet security and ethical hacking/penetration testing. He is the author of and contributor to more than 75 books and numerous courseware sets on security certification, Microsoft topics, and network administration. More information about Michael can be found at his website: www.impactonline.com.

Mike Chapple, CISSP, Ph.D., is Senior Director for IT Service Delivery at the University of Notre Dame. In the past, he was chief information officer of Brand Institute and an information security researcher with the National Security Agency and the U.S. Air Force. His primary areas of expertise include network intrusion detection and access controls. Mike is a frequent contributor to TechTarget’s SearchSecurity site and the author of more than 25 books including CompTIA Security+ Training Kit and Information Security Illuminated. Mike can be found on Twitter @mchapple.

Darril Gibson, CISSP, is the CEO of YCDA, LLC (short for You Can Do Anything) and he has authored or coauthored more than 35 books. Darril regularly writes, consults, and teaches on a wide variety of technical and security topics and holds several certifications. He regularly posts blog articles at http://blogs.getcertifiedgetahead.com/ about certifi-cation topics and uses that site to help people stay abreast of changes in certification exams. He loves hearing from readers, especially when they pass an exam after using one of his books, and you can contact him through the blogging site.

Contents at a GlanceIntroduction xxxiii

Assessment Test xlii

Chapter 1 Security Governance Through Principles and Policies 1

Chapter 2 Personnel Security and Risk Management Concepts 47

Chapter 3 Business Continuity Planning 93

Chapter 4 Laws, Regulations, and Compliance 123

Chapter 5 Protecting Security of Assets   157

Chapter 6 Cryptography and Symmetric Key Algorithms 189

Chapter 7 PKI and Cryptographic Applications 231

Chapter 8 Principles of Security Models, Design, and Capabilities  269

Chapter 9 Security Vulnerabilities, Threats, and Countermeasures 313

Chapter 10 Physical Security Requirements  385

Chapter 11 Secure Network Architecture and Securing Network Components 425

Chapter 12 Secure Communications and Network Attacks 499

Chapter 13 Managing Identity and Authentication 555

Chapter 14 Controlling and Monitoring Access  593

Chapter 15 Security Assessment and Testing 629

Chapter 16 Managing Security Operations  659

Chapter 17 Preventing and Responding to Incidents 697

Chapter 18 Disaster Recovery Planning 759

Chapter 19 Incidents and Ethics 803

Chapter 20 Software Development Security 837

Chapter 21 Malicious Code and Application Attacks 881

Appendix A Answers to Review Questions 915

Appendix B Answers to Written Labs 953

Appendix C About the Additional Study Tools 967

Index 971

Contents

Introduction xxxiii

Assessment Test xliit

Chapter 1 Security Governance Through

Principles and Policies 1

Understand and Apply Concepts of Confidentiality, Integrity, and Availability 3

Confidentiality 4Integrity 5Availability 6Other Security Concepts 8Protection Mechanisms 12Layering 12Abstraction 12Data Hiding 13Encryption 13

Apply Security Governance Principles 13Alignment of Security Function to Strategy, Goals,

Mission, and Objectives 14Organizational Processes 16Security Roles and Responsibilities 22Control Frameworks 23Due Care and Due Diligence 24

Develop and Implement Documented Security Policy,Standards, Procedures, and Guidelines 25

Security Policies 25Security Standards, Baselines, and Guidelines 26Security Procedures 27

Understand and Apply Threat Modeling 28Identifying Threats 30Determining and Diagramming Potential Attacks 32Performing Reduction Analysis 33Prioritization and Response 34

Integrate Security Risk Considerations into AcquisitionStrategy and Practice 35

Summary 36Exam Essentials 38Written Lab 41Review Questions 42

xvi Contents

Chapter 2 Personnel Security and Risk Management Concepts 47

Contribute to Personnel Security Policies 49Employment Candidate Screening 52Employment Agreements and Policies 53Employment Termination Processes 54Vendor, Consultant, and Contractor Controls 56Compliance 57Privacy 57

Security Governance 59Understand and Apply Risk Management Concepts 60

Risk Terminology 61Identify Threats and Vulnerabilities 63Risk Assessment/Analysis 64Risk Assignment/Acceptance 72Countermeasure Selection and Assessment 73Implementation 74Types of Controls 75Monitoring and Measurement 76Asset Valuation 77Continuous Improvement 78Risk Frameworks 78

Establish and Manage Information Security Education,Training, and Awareness 81

Manage the Security Function 82Summary 83Exam Essentials 84Written Lab 88Review Questions 89

Chapter 3 Business Continuity Planning 93

Planning for Business Continuity 94Project Scope and Planning 95

Business Organization Analysis 96BCP Team Selection 96Resource Requirements 98Legal and Regulatory Requirements 100

Business Impact Assessment 101Identify Priorities 101Risk Identification 102Likelihood Assessment 104Impact Assessment 104Resource Prioritization 106

Continuity Planning 107Strategy Development 107

Contents xvii

Provisions and Processes 108Plan Approval 109Plan Implementation 110Training and Education 110

BCP Documentation 110Continuity Planning Goals 111Statement of Importance 111Statement of Priorities 111Statement of Organizational Responsibility 111Statement of Urgency and Timing 112Risk Assessment 112Risk Acceptance/Mitigation 112Vital Records Program 113Emergency-Response Guidelines 113Maintenance 114Testing and Exercises 114

Summary 114Exam Essentials 115Written Lab 117Review Questions 118

Chapter 4 Laws, Regulations, and Compliance 123

Categories of Laws 124Criminal Law 124Civil Law 126Administrative Law 126

Laws 127Computer Crime 127Intellectual Property 132Licensing 138Import/Export 139Privacy 139

Compliance 146Contracting and Procurement 147Summary 148Exam Essentials 149Written Lab 151Review Questions 152

Chapter 5 Protecting Security of Assets   157

Classifying and Labeling Assets 158Defining Sensitive Data 158Defining Classifications 160Defining Data Security Requirements 163

xviii Contents

Understanding Data States 164Managing Sensitive Data 165Protecting Confidentiality with Cryptography 172

Identifying Data Roles 174Data Owners 174System Owners 175Business/Mission Owners 176Data Processors 176Administrators 177Custodians 178Users 178

Protecting Privacy 178Using Security Baselines 179Scoping and Tailoring 180Selecting Standards 180

Summary 181Exam Essentials 182Written Lab 183Review Questions 184

Chapter 6 Cryptography and Symmetric Key Algorithms 189

Historical Milestones in Cryptography 190Caesar Cipher 190American Civil War 191Ultra vs. Enigma 192

Cryptographic Basics 192Goals of Cryptography 192Cryptography Concepts 194Cryptographic Mathematics 196Ciphers 201

Modern Cryptography 208Cryptographic Keys 208Symmetric Key Algorithms 209Asymmetric Key Algorithms 210Hashing Algorithms 213

Symmetric Cryptography 214Data Encryption Standard 214Triple DES 216International Data Encryption Algorithm 217Blowfish 217Skipjack 217Advanced Encryption Standard 218Symmetric Key Management 219

Cryptographic Life Cycle 222

Contents xix

Summary 222Exam Essentials 223Written Lab 225Review Questions 226

Chapter 7 PKI and Cryptographic Applications 231

Asymmetric Cryptography 232Public and Private Keys 232RSA 233El Gamal 235Elliptic Curve 235

Hash Functions 236SHA 237MD2 238MD4 238MD5 239

Digital Signatures 240HMAC 241Digital Signature Standard 242

Public Key Infrastructure 242Certificates 243Certificate Authorities 243Certificate Generation and Destruction 245

Asymmetric Key Management 246Applied Cryptography 247

Portable Devices 247Email 248Web Applications 249Digital Rights Management 252Networking 255

Cryptographic Attacks 258Summary 261Exam Essentials 261Written Lab 264Review Questions 265

Chapter 8 Principles of Security Models, Design,

and Capabilities  269

Implement and Manage Engineering Processes Using Secure Design Principles 270

Objects and Subjects 271Closed and Open Systems 271Techniques for Ensuring Confidentiality, Integrity,

and Availability 272

xx Contents

Controls 274Trust and Assurance 274

Understand the Fundamental Concepts of Security Models 275Trusted Computing Base 276State Machine Model 278Information Flow Model 279Noninterference Model 279Take-Grant Model 280Access Control Matrix 280Bell-LaPadula Model 282Biba Model 284Clark-Wilson Model 286Brewer and Nash Model (aka Chinese Wall) 287Goguen-Meseguer Model 288Sutherland Model 288Graham-Denning Model 288

Select Controls and Countermeasures Based on SystemsSecurity Evaluation Models 289

Rainbow Series 290ITSEC Classes and Required Assurance

and Functionality 295Common Criteria 296Industry and International Security Implementation

Guidelines 299Certification and Accreditation 300

Understand Security Capabilities of Information Systems 303Memory Protection 303Virtualization 303Trusted Platform Module 303Interfaces 304Fault Tolerance 304

Summary 305Exam Essentials 305Written Lab 307Review Questions 308

Chapter 9 Security Vulnerabilities, Threats, and

Countermeasures 313

Assess and Mitigate Security Vulnerabilities 314Hardware 315Input/Output Structures 335Firmware 336

Contents xxi

Client-Based 337Applets 337Local Caches 339

Server Based 341Database Security 341

Aggregation 341Inference 342Data Mining and Data Warehousing 342Data Analytics 343Large-Scale Parallel Data Systems 344

Distributed Systems 344Cloud Computing 346Grid Computing 347Peer to Peer 348

Industrial Control Systems 348Assess and Mitigate Vulnerabilities

in Web-Based Systems 349Assess and Mitigate Vulnerabilities

in Mobile Systems 350Device Security 352Application Security 355BYOD Concerns 357

Assess and Mitigate Vulnerabilities in EmbeddedDevices and Cyber-Physical Systems 360

Examples of Embedded and Static Systems 360Methods of Securing 362

Essential Security Protection Mechanisms 364Technical Mechanisms 364Security Policy and Computer Architecture 367Policy Mechanisms 367

Common Architecture Flaws and Security Issues 369Covert Channels 369Attacks Based on Design or Coding Flaws

and Security Issues 370Programming 373Timing, State Changes, and Communication Disconnects 373Technology and Process Integration 374Electromagnetic Radiation 374

Summary 375Exam Essentials 376Written Lab 379Review Questions 380

xxii Contents

Chapter 10 Physical Security Requirements  385

Apply Secure Principles to Site and Facility Design 386Secure Facility Plan 387Site Selection 387Visibility 388Natural Disasters 388Facility Design 388

Design and Implement Physical Security 389Equipment Failure 390Wiring Closets 391Server Rooms 393Media Storage Facilities 394Evidence Storage 395Restricted and Work Area Security

(e.g., Operations Centers) 395Datacenter Security 396Utilities and HVAC Considerations 399Water Issues (e.g., Leakage, Flooding) 402Fire Prevention, Detection, and Suppression 402

Implement and Manage Physical Security 407Perimeter (e.g., Access Control and Monitoring) 407Internal Security (e.g., Escort Requirements/Visitor

Control, Keys, and Locks) 409Summary 415Exam Essentials 416Written Lab 420Review Questions 421

Chapter 11 Secure Network Architecture and Securing

Network Components 425

OSI Model 426History of the OSI Model 427OSI Functionality 427Encapsulation/Deencapsulation 428OSI Layers 429

TCP/IP Model 437TCP/IP Protocol Suite Overview 438

Converged Protocols 452Content Distribution Networks 453

Wireless Networks 454Securing Wireless Access Points 454Securing the SSID 456Conducting a Site Survey 457

Contents xxiii

Using Secure Encryption Protocols 458Determining Antenna Placement 461Antenna Types 461Adjusting Power Level Controls 461Using Captive Portals 462

General Wi-Fi Security Procedure 462Secure Network Components 463Network Access Control 464Firewalls 465Endpoint Security 469Other Network Devices 469

Cabling, Wireless, Topology, and Communications Technology 473

Network Cabling 473Network Topologies 477Wireless Communications and Security 480LAN Technologies 485

Summary 490Exam Essentials 490Written Lab 494Review Questions 495

Chapter 12 Secure Communications and Network Attacks 499

Network and Protocol Security Mechanisms 500Secure Communications Protocols 501Authentication Protocols 502

Secure Voice Communications 503Voice over Internet Protocol (VoIP) 503Social Engineering 504Fraud and Abuse 505

Multimedia Collaboration 507Remote Meeting 508Instant Messaging 508

Manage Email Security 508Email Security Goals 509Understand Email Security Issues 510Email Security Solutions 511

Remote Access Security Management 513Plan Remote Access Security 515Dial-Up Protocols 516Centralized Remote Authentication Services 517

Virtual Private Network 517Tunneling 518How VPNs Work 519

xxiv Contents

Common VPN Protocols 520Virtual LAN 522

Virtualization 523Virtual Software 523Virtual Networking 524

Network Address Translation 525Private IP Addresses 526Stateful NAT 527Static and Dynamic NAT 528Automatic Private IP Addressing 528

Switching Technologies 530Circuit Switching 530Packet Switching 531Virtual Circuits 532

WAN Technologies 532WAN Connection Technologies 534Dial-Up Encapsulation Protocols 536

Miscellaneous Security Control Characteristics 537Transparency 537Verify Integrity 537Transmission Mechanisms 538

Security Boundaries 539Prevent or Mitigate Network Attacks 539

DoS and DDoS 540Eavesdropping 541Impersonation/Masquerading 542Replay Attacks 542Modification Attacks 542Address Resolution Protocol Spoofing 542DNS Poisoning, Spoofing, and Hijacking 543Hyperlink Spoofing 544

Summary 545Exam Essentials 546Written Lab 549Review Questions 550

Chapter 13 Managing Identity and Authentication 555

Controlling Access to Assets 556Comparing Subjects and Objects 557Types of Access Control 557The CIA Triad 560

Comparing Identification and Authentication 560Registration and Proofing of Identity 561Authorization and Accountability 561

Contents xxv

Authentication Factors 563Passwords 564Smartcards and Tokens 566Biometrics 568Multifactor Authentication 572Device Authentication 572

Implementing Identity Management 573Single Sign-On 573Credential Management Systems 578Integrating Identity Services 579Managing Sessions 579AAA Protocols 580

Managing the Identity and Access Provisioning Life Cycle 582Provisioning 582Account Review 583Account Revocation 584

Summary 585Exam Essentials 586Written Lab 588Review Questions 589

Chapter 14 Controlling and Monitoring Access  593

Comparing Access Control Models 594Comparing Permissions, Rights, and Privileges 594Understanding Authorization Mechanisms 595Defining Requirements with a Security Policy 596Implementing Defense in Depth 597Discretionary Access Controls 598Nondiscretionary Access Controls 598

Understanding Access Control Attacks 604Risk Elements 605Identifying Assets 605Identifying Threats 607Identifying Vulnerabilities 609Common Access Control Attacks 610Summary of Protection Methods 619

Summary 621Exam Essentials 622Written Lab 624Review Questions 625

Chapter 15 Security Assessment and Testing 629

Building a Security Assessment and Testing Program 630Security Testing 630

xxvi Contents

Security Assessments 631Security Audits 632

Performing Vulnerability Assessments 634Vulnerability Scans 634Penetration Testing 642

Testing Your Software 643Code Review and Testing 644Interface Testing 646Misuse Case Testing 648Test Coverage Analysis 648

Implementing Security Management Processes 649Log Reviews 649Account Management 649Backup Verification 650Key Performance and Risk Indicators 650

Summary 650Exam Essentials 651Written Lab 653Review Questions 654

Chapter 16 Managing Security Operations  659

Applying Security Operations Concepts 661Need to Know and Least Privilege 661Separation of Duties and Responsibilities 663Job Rotation 666Mandatory Vacations 666Monitor Special Privileges 667Managing the Information Life Cycle 668Service Level Agreements 669Addressing Personnel Safety 670

Provisioning and Managing Resources 670Managing Hardware and Software Assets 671Protecting Physical Assets 672Managing Virtual Assets 672Managing Cloud-based Assets 673Media Management 675

Managing Configuration 678Baselining 678Using Images for Baselining 678

Managing Change 680Security Impact Analysis 682Versioning 683Configuration Documentation 683

Contents xxvii

Managing Patches and Reducing Vulnerabilities 684Patch Management 684Vulnerability Management 685Common Vulnerabilities and Exposures 688

Summary 688Exam Essentials 689Written Lab 691Review Questions 692

Chapter 17 Preventing and Responding to Incidents 697

Managing Incident Response 698Defining an Incident 698Incident Response Steps 699

Implementing Preventive Measures 704Basic Preventive Measures 705Understanding Attacks 705Intrusion Detection and Prevention Systems 715Specific Preventive Measures 721

Logging, Monitoring, and Auditing 731Logging and Monitoring 731Egress Monitoring 740Auditing to Assess Effectiveness 742Security Audits and Reviews 745Reporting Audit Results 746

Summary 748Exam Essentials 750Written Lab 754Review Questions 755

Chapter 18 Disaster Recovery Planning 759

The Nature of Disaster 760Natural Disasters 761Man-made Disasters 765

Understand System Resilience and Fault Tolerance 770Protecting Hard Drives 771Protecting Servers 772Protecting Power Sources 773Trusted Recovery 773Quality of Service 775

Recovery Strategy 775Business Unit and Functional Priorities 776Crisis Management 777Emergency Communications 777

xxviii Contents

Workgroup Recovery 778Alternate Processing Sites 778Mutual Assistance Agreements 782Database Recovery 783

Recovery Plan Development 784Emergency Response 785Personnel and Communications 786Assessment 787Backups and Offsite Storage 787Software Escrow Arrangements 790External Communications 791Utilities 791Logistics and Supplies 791Recovery vs. Restoration 791

Training, Awareness, and Documentation 792Testing and Maintenance 793

Read-Through Test 793Structured Walk-Through 794Simulation Test 794Parallel Test 794Full-Interruption Test 794Maintenance 794

Summary 795Exam Essentials 795Written Lab 797Review Questions 798

Chapter 19 Incidents and Ethics 803

Investigations 804Investigation Types 804Evidence 806Investigation Process 810

Major Categories of Computer Crime 812Military and Intelligence Attacks 813Business Attacks 814Financial Attacks 814Terrorist Attacks 815Grudge Attacks 815Thrill Attacks 817

Incident Handling 817Common Types of Incidents 818Response Teams 820Incident Response Process 821Interviewing Individuals 824