Home >Documents >CISSP Overview

CISSP Overview

Date post:22-Feb-2016
Category:
View:119 times
Download:0 times
Share this document with a friend
Description:
CISSP Overview. 목 차. Introduction CISSP 의 의미와 시험준비방법 CBK 소개. 1.Introduction. 1.1 ISC2 ?. (ISC) 2 = International Information Systems Security Certifications Consortium, Inc. (ISC) 2 is a global, not-for-profit organization dedicated to: - PowerPoint PPT Presentation
Transcript:
PowerPoint (ISC)2 is a global, not-for-profit organization dedicated to:
Maintaining a Common Body of Knowledge for Information Security [IS].
Certifying industry professionals and practitioners in an international IS standard
Administering training and certification examinations.
Ensuring credentials are maintained, primarily through continuing education.
Governments, corporations, centers of higher learning and organizations worldwide demand a common platform for and proficiency in mastering the dynamic nature of information security. (ISC)2 helps fulfill these needs.
Thousands of IS professionals in over 35 countries worldwide have attained certification in one of the two designations administered by (ISC)2:
Certified Information Systems Security Professional [CISSP]
System Security Certified Practitioner [SSCP]
Both credentials indicate those certified have demonstrated experience in the field of information security, passed a rigorous examination, subscribe to a Code of Ethics and maintain certification with continuing education.
1.Introduction
Information security [IS] professionals invest substantially in information assets, including technology, architecture and process.
But how can protection of these assets be ensured? Only through the strengths of the professionals in charge.
Industry standards, ethics and certification of IS professionals and practitioners becomes critical to ensuring a higher standard for security is achieved. (ISC)2, as the only not-for-profit consortium charged with maintaining, administering and certifying IS professionals in the Common Body of Knowledge [CBK], is the premier resource for IS professionals worldwide.
Benefits of (ISC)2 Certification to the Enterprise
Establishes best practices
Provides a solutions-orientation, not specialization, particularly with the broader understanding of the IS CBK
Access to a network of global industry and subject matter/domain experts
Resource for broad-based security information
Adds to credibility with the rigor and regimen of the certification examinations
Provides a business and technology orientation to risk management
Benefits of (ISC)2 Certification to the Professional
Confirms a working knowledge of information security
Confirms passing of a rigorous examination
Career differentiator, with peer networking and added IS credibility
Broadening expectation of credentials
Determine which type of certification you are best qualified for:
CISSP [Certified Information Systems Security Professional] ?Tailored for IS professionals with a minimum of 3 years cumulative experience in one or more of the ten CBK domains
Understand and accept the principles stated in the (ISC)2 Certification Code of Ethics, which all certified individuals are required to adhere to.
Broaden your IS understanding of the Common Body of Knowledge [CBK], usually achieved through personal study guides [which can be downloaded online], taking of CBK Review Seminars, keeping abreast of industry news, and familiarity with examination reference materials.
Taking and passing of the appropriate certification examination.
Upon passing the certification examination, continuing to keep your credential vital with continuing professional education, recertification every three years and other requirements to stay in good standing.
1.Introduction
1.4 Code of Ethics
Safety of the commonwealth, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior. Therefore, strict adherence to this code is a condition of certification.
Canons
Advance and protect the profession.
1.Introduction
1.5 CISSP Exam Structure
The CISSP Certification examination consists of 250 multiple-choice questions. Candidates have up to 6 hours to complete the examination. Ten CISSP information systems security test domains are covered in the examination pertaining to the Common Body of Knowledge:
Access Control Systems & Methodology
Cryptography
1.Introduction
December 08, 2001
(ISC)2

.
: 70%
1.Introduction
. Knowledge .
. .
. .
General Common Sense
.
.
. …
.
:http://www.danam21.co.kr/sjs1234
.
:http://www.danam21.co.kr/sjs1234
CISSP Examination Textbook, Rao
. Ben Rothke PPT
.
. Study group
. Site
- www.cccure.org, www.isc2.org, www.sans.org,
www.cissps.com
Adrien de Beaupr Tips&Tricks to help you in your studies
2. CISSP
. 2 .
. 10 .
. .
**
. .
Adrien de Beaupr Tips&Tricks to help you in your studies
2. CISSP
.
.
.
2. CISSP
3.2 Access Control Systems & Methodology
Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use & content of a system. In permits management to specify what users can do, which resources they can access, and what operations they can perform on a system.
Accountability
3.CBK
CISSP Overview
….
Access control techniques, detective and corrective measures should be studied to understands the potential risks, vulnerabilities, and exposures.
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
3.CBK
User X
Access control mechanism
3.CBK
User X
ADD(insert, append)
Access request
Reference monitor
* Security Policy: which rules decide who gets access to your data?
- capture the security requirement of an enterprise or describe the steps that have to be taken to achieve security
* Security Model: capture policies for confidentiality(BLP)…
- formalisation of security policy
3.CBK
 
1. The Computer Security Policy Model the Orange Book is based on is:
the Bell-LaPadula Model
Kerberos
Tempest
2. Which of the following is needed for System Accountability?
audit mechanisms
authorization
CISSP Overview
ISO/OSI Layers and characteristics
Protocols, Services, Security techniques
Security boundaries and how to translate security policy to control
Network Attacks & countermeasures
3.CBK
CISSP Overview
Communications & network security as it relates to voice communications
Data communications in terms of local area, wide area, and remote access
Intranet/Internet/Extranet in terms of Firewalls, Routers, & TCP/IP
Communications security management & techniques in terms of preventive, detective and corrective measures.
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
 
10. Which one of the following benefits resulting from the use of secure gateways
(firewalls) is not true:
prevents the spread of viruses
reduces the threat level on internal system
allow centralize management and control of services
CISSP Overview
Security management entails the identification of an organizations’ information assets and the development, documentation, and implementation of policies, standards, procedures, and guidelines that ensure confidentiality, Integrity, and availability. Management tools such as data classification, risk assessment, and risk analysis are used to identify the threats, classify assets, and to rate their vulnerabilities so that effective security controls can be implemented.
Security Management Concepts & Principles
Role & Responsibilities
3.CBK
CISSP Overview

The planning, organization, and roles of individuals in identifying and securing an organization’s information assets
The development and use of policies stating management’s views and position on particular topics and the use of guidelines, standards, and procedures, to support the policies
Security Awareness training
Employment agreement, hiring, and termination practices
Risk Management practices
3.CBK
CISSP Overview
ISO: Overview of the planning & management of IT security
Organizational aspects of IT security
IT security recommendations
 
15. Which of the following is the best reason for the use of an automated risk analysis tool:
much of the data gathered during the review cannot be reused for subsequent analysis's
automated methodologies require minimal training and knowledge of risk analysis
most software tools have user interfaces that are easy to use
 
3.5 Application & Systems Development Security
Applications and systems development security refers to the controls that are included within systems and applications software and the steps used in their development. Applications refer to agents, applets, SW, DB, DW, KB systems.
Application Issues
Database & DW
Data/Information storage
Knowledge-based Systems
3.CBK
CISSP Overview

Security & controls of System development process, system life cycle, application control, DW, DM, KB systems, program interfaces, and concepts used to ensure data and application integrity, security and availability
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
3.CBK
3.CBK
 
16. Which of the following can be used as a covert channel?
Storage and timing
Cryptography domain addressed the principles, means, and methods of disguising information to ensure its integrity, confidentiality, and authenticity.
Use of Cryptography to achieve
Cryptographic concepts, methodologies, and practices
Private key algorithms
Public Key algorithms
Method of attack
3.CBK
CISSP Overview
3.6 Cryptography

Public key and private key algorithms in terms of their applications and uses
Algorithm construction, key distribution and management, and methods of attack
The application, construction, and use of digital signatures to provide authenticity of electronic transactions, and nonrepudiation of the parties involved.
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
3.6 Cryptography
3.CBK
Cryptography: deals with systems for transforming data into codes.-Cryptographer.
Cryptanalysis: deals with techniques for illegitimately recovering the critical data from cryptograms. – Cryptanalyst.
Attack
CISSP Overview
3.6 Cryptography
3.CBK
Which one of the following statements about digital signatures is not true:
it enhances authentication
it prevents non-repudiation by the receiver
it makes repudiation by the sender impossible
CISSP Overview
The security architectures and models contains the concepts, principles, structures, and standards used to design, implement, monitor, and secure, operating systems, equipment, networks, applications, and those controls used to inforce various levels of confidentiality, integrity, and availability.
Principles of common computer and network organizations, architectures and designs.
Principles of common security models(BLP…), architectures(IPSEC..), and evaluation criteria(Orange Book, ITSEC..).
Common flaw and security issues associated with system architectures and designs
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
System models in terms of CC, ITSEC, TCSE, IETF IPSEC
Technical platforms in terms of HW, firmware, and SW
System security techniques in terms of preventative, detective, and corrective controls
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
26. In Mandatory Access Control, sensitivity labels contain what information?
the item's classification
CISSP Overview
3.8 Operations Security
Operation Security is used to identify the controls over HW, media, and the operator with access privileges to any resources.
Administrative management
3.CBK
CISSP Overview

The resources that must be protected, the privileges that must be restricted, the control mechanisms available, the potential for abuse of access, the appropriate controls, and the principles of good practice.
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
3.CBK
3.CBK
32. It is a violation of the "separation of duties" principle when which of the
following individuals access the security systems software:
security administrator
security analyst
systems auditor
systems programmer
CISSP Overview
3.9 BCP & DRP
The BCP & DRP domain addresses the preservation of the business in the face of major disruptions to normal business operations. BCP & DRP involve the preparation, testing and updating of specific actions to protect critical business processes from the effect of major system and network failure.
BCP
DRP
BCP/DRP Events
3.CBK
CISSP Overview
Business continuity planning in terms of project scope and planning, business impact analysis, recovery strategies, recovery plan development, and implementation.
DR in terms of recovery plan development, implementation and restoration.
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
Identifying the resources that support the critical functions
Anticipating potential contingencies or disaster (likelihood, scenarios)
Selecting contingency planning strategies
Implementing the contingency strategies
Testing & revising the strategies
BCP: If a man or natural event is minor & less constructive, the challenge is to recover from disruptions and continue support for critical functions.
DRP: If a man or natural event is major & very constructive, the challenge is to recover from a disaster and restore critical functions to normal operations
CISSP Overview
 
37. Which of the following *must* be at a "hot site"?
Backup data, computers, climate control, cables and peripherals
Computers and peripherals
Dedicated climate control systems
3.10 Law, Investigations & Ethics
The Law, Investigations, and Ethics domain address computer crime laws & regulations; the investigative measures and techniques which can be used to determine if a crime has been committed, methods to gather evidence if it has, as well as the ethical issues and code of conduct for the security professional.
Laws
Investigations
Incident handling
3.CBK
CISSP Overview

The method for determining whether a computer crime has been committed
The law that would be applicable for the crime
Laws prohibiting specific types of computer crime
Methods to gather and preserve evidence of a computer crime, investigative methods and techniques
The way in which RFC 1087 and ISC2 code of ethics
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
3.CBK
44. The ISC2 Code of Ethics does not include which of the following behaviors for
a CISSP:
3.11 Physical security
The Physical security domain addresses the threats, vulnerabilities, and countermeasures that can be utilized to physically protect an enterprise’s resources and sensitive information. These resources include people, the facility in which they work, and the data, equipment, support system, media, and supplies they utilize.
Facility Requirements
Technical Controls
Environment/Life Safety
3.CBK
CISSP Overview

The elements involved in choosing a secure site, its design and configuration, and the methods for securing the facility against unauthorized access, theft of equipment and information, and the environmental and safety measures needed to protect people, the facility, and its resources.
: CISSP Study Guide , ISC2
3.CBK
CISSP Overview
3.CBK
3.CBK
46. Which is the last line of defense in a physical security sense:
people

Click here to load reader

Embed Size (px)
Recommended