30
SSCP® Systems Security Certified
Practitioner Study Guide
George B. Murphy
Development Editor: Tom CirtinTechnical Editors: Brian D. McCarthy and John GillelandProduction Editor: Christine O’ConnorCopy Editor: Judy FlynnEditorial Manager: Mary Beth WakefieldProduction Manager: Kathleen WisorAssociate Publisher: Jim Minatel
Media Supervising Producer: Richard GravesBook Designers: Judy Fung and Bill Gibson Proofreader: Kim WimpsettIndexer: Ted LauxProject Coordinator, Cover: Brent SavageCover Designer: WileyCover Image: ©Getty Images Inc./Jeremy Woodhouse
Copyright © 2015 by John Wiley & Sons, Inc., Indianapolis, Indiana
Published simultaneously in Canada
ISBN: 978-1-119-05965-3 ISBN: 978-1-119-05968-4 (ebk.)ISBN: 978-1-119-05995-0 (ebk.)
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permis-sions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.
Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the pub-lisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.
For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with stan-dard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksup-port.wiley.com. For more information about Wiley products, visit www.wiley.com.
Library of Congress Control Number: 2015947763
TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. SSCP, the SSCP logo, and the (ISC)2 logo are registered trademarks or service marks of the International Information Sys-tems Security Certification Consortium. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.
10 9 8 7 6 5 4 3 2 1
Disclaimer: Wiley Publishing, Inc., in association with (ISC)2®, has prepared this study guide for general information and for use as training for the Official (ISC)2 SSCP® CBK® and not as legal or operational advice. This is a study guide only, and does not imply that any questions or topics from this study guide will appear on the actual (ISC)2 SSCP® cer-tification examination. The study guide was not prepared with writers or editors associated with developing the (ISC)2® SSCP® certification examination. The study guide may contain errors and omissions. (ISC)2® does not guarantee a pass-ing score on the exam or provide any assurance or guarantee relating to the use of this study guide and preparing for the (ISC)2® SSCP® certification examination.
The users of the Official SSCP®: Systems Security Certified Practitioner Study Guide agree that Wiley Publishing, Inc. and (ISC)2® are not liable for any indirect, special, incidental, or consequential damages up to and including negligence that may arise from use of these materials. Under no circumstances, including negligence, shall Wiley Publishing Inc. or (ISC)2®, its officers, directors, agents, author or anyone else involved in creating, producing or distributing these materials be liable for any direct, indirect, incidental, special or consequential damages that may result from the use of this study guide.
ffi rs.indd 09/18/2015 Page iii
Attacks on organizations’ information assets and infrastructure continue to escalate while attackers refi ne and improve their tactics. The best way to combat these assaults starts with qualifi ed information security staff armed with proven technical skills and practical security knowledge. Practitioners who have proven hands-on technical abil-ity would do well to include the (ISC)2 Systems Security Certifi ed Practitioner (SSCP®) credential in their arsenal of tools to competently handle day-to-day responsibilities and secure their organization’s data and IT infrastructure.
The SSCP certifi cation affi rms the breadth and depth of practical security knowledge expected of those in hands-on operational IT roles. The SSCP provides industry-lead-ing confi rmation of a practitioner’s ability to implement, monitor and administer poli-cies and procedures that ensure data confi dentiality, integrity and availability (CIA).
Refl ecting the most relevant topics in our ever-changing fi eld, this new SSCP Study Guide is a learning tool for (ISC)2 certifi cation exam candidates. This comprehensive study guide of the seven SSCP domains draws from a global body of knowledge, and prepares you to join thousands of practitioners worldwide who have obtained the (ISC)2 SSCP credential. The SSCP Study Guide will help facilitate the practical knowledge you need to assure a strong security posture for your organization’s daily operations.
As the information security industry continues to transition, and cybersecurity becomes a global focus, the SSCP Common Body of Knowledge (CBK®) is even more relevant to the challenges faced by today’s frontline information security practitioner. While our Offi cial Guides to the CBK are the authoritative references, the new study guides are focused on educating the reader in preparation for exams. As an ANSI accredited certi-fi cation body under the ISO/IEC 17024 standard, (ISC)2 does not teach the SSCP exam. Rather, we strive to generate or endorse content that teaches the SSCP’s CBK. Candidates who have a strong understanding of the CBK are best prepared for success with the exam and within the profession.
Advancements in technology bring about the need for updates, and we work to ensure that our content is always relevant to the industry. (ISC)2 is breaking new ground by partnering with Wiley, a recognized industry-leading brand. Developing a partnership with renowned content provider Wiley allows (ISC)2 to grow its offerings on the scale required to keep our content fresh and aligned with the constantly changing environment. The power of combining the expertise of our two organizations benefi ts certifi cation candidates and the industry alike.
For more than 26 years, (ISC)2 has been recognized worldwide as a leader in the fi eld of information security education and certifi cation. Earning an (ISC)2 credential also puts you in great company with a global network of professionals who echo (ISC)2’s focus to inspire a safe a secure cyber world.
Congratulations on taking the fi rst step toward earning your certifi cation. Good luck with your studies!
Regards,
David P. ShearerCEO(ISC)2
To my beautiful wife, Cathy—thank you for your patience, understanding,
and especially your encouragement. You are and always will be my angel.
With much love.
Acknowledgments
It’s always amazing how many people are involved in the production of a book like this. Everyone involved deserves a world of thanks for all of their hard work and efforts. I espe-cially want to thank Carol Long, who was executive acquisitions editor for Wiley & Sons when we started this project. I genuinely appreciate the opportunity that she afforded me. I also owe so much to many others, especially Tom Cirtin, for keeping everything on track, as well as Christine O’Connor, who tied together all of the production efforts. I want to thank Jim Minatel for herding all of the cats and keeping it all running. Many thanks to Judy Flynn for her tireless efforts in making sure all of the copy worked, as well as the entire team of layout editors, graphic design folks, and others, all of whom provided their expertise to make this project come together. I would like to express a big thanks to Brian McCarthy for his knowledge and his wonderful work as technical editor. I would also like to express my appreciation to both Mike Siok and Willie Williams for their friendship and inspiration through a great many projects over the years. They have always been there to lend an ear and offer encouragement. I want to recognize Chuck Easttom for giving me my break into the world of publishing a few years ago. And, I want to especially thank all of the wonderful folks at (ISC)2 for their ongoing assistance in this and many other projects. Thank you all very much.
About the Author
George (Buzz) Murphy, CISSP, SSCP, CASP, is a public speaker, corporate trainer, author, and cybersecurity evangelist who, over the past three decades, has touched the lives of thousands of adult learners around the world through hundreds of speaking and training events covering a variety of technical and cybersecurity topics. A former Dell technology training executive and U.S. Army IT networking security instructor, he has addressed audiences at national conferences, major corporations, and educational institutions, includ-ing Princeton University, and he has trained network and cybersecurity operators for the U.S. military branches, various U.S. government security agencies, and foreign military personnel.
As a military data center manager in Europe, he held a top-secret security clearance in both U.S. and NATO intelligence and through the years has earned 26 IT and cyberse-curity certifi cations from such prestigious organizations as (ISC)2, CompTIA, PMI, and Microsoft. He is an (ISC)2 Authorized Instructor specializing in CISSP and Cloud Security certifi cation training. He has authored, coauthored, and contributed to more than a dozen books on a wide range of topics, including network engineering, industrial technology, and IT security, and recently served as technical editor for the (ISC)2 CCFP – Certifi ed Cyber Forensics Professional Certifi cation Guide by Chuck Easttom (McGraw Hill, 2014) as well as for the recent publication CASP: CompTIA Advanced Security Practitioner Study Guide by Michael Greg (Sybex, 2014).
About the Technical Editor
Brian D. McCarthy, founder and director of 327 Solutions, Inc., has been involved in placement, consulting, and training since 1992. Brian is an entrepreneur, IT trainer, operations leader, certifi cation expert, recruiter, instructional designer, sales executive, formally trained project manager (PMP), and e-learning guru. He has more than 20 years of talent development expertise, has been working in building technical competency for decades, and has held multiple positions in operations, training facilitation, and sales with increasing responsibility for building a world-class national network of performance experts. Brian has worked hand in hand with the Department of Defense to enable infor-mation assurance compliance for cybersecurity workers (8570.1-M / 8140). He also has experience working with cutting-edge e-learning, workshops, immersive environments, gamifi cation/contest design, method-of-action 3D animations, LMS tracking, portal sys-tems, and other learning assets to accelerate world-class corporate teams.
Contents at a GlanceIntroduction xxv
Assessment Test xxxi
Chapter 1 Information Security: The Systems Security Certified Practitioner Certification 1
Chapter 2 Security Basics: A Foundation 27
Chapter 3 Domain 1: Access Controls 61
Chapter 4 Domain 2: Security Operations and Administration 121
Chapter 5 Domain 3: Risk Identification, Monitoring, and Analysis 181
Chapter 6 Domain 4: Incident Response and Recovery 223
Chapter 7 Domain 5: Cryptography 261
Chapter 8 Domain 6: Networks and Communications 317
Chapter 9 Domain 7: Systems and Application Security 389
Appendix A Answers to Written Labs 465
Appendix B Answers to Review Questions 473
Appendix C Diagnostic Tools 487
Index 511
Contents
Introduction xxv
Assessment Test xxxi
Chapter 1 Information Security: The Systems Security Certified Practitioner Certification 1
About the (ISC)2 Organization 2(ISC)2 History 3Organizational Structure and Programs 3
Exams, Testing, and Certification 6Certification Qualification: The SSCP Common
Body of Knowledge 6After Passing the Exam 8Certification Maintenance 9Types of IT Certifications? 10About the Systems Security Certified
Practitioner Certification 12How Do I Use My SSCP Knowledge on the Job? 15
The SSCP Exam 17Preparing for the Exam 17Booking the Exam 21Taking the Exam 22
Summary 25Exam Essentials 25
Chapter 2 Security Basics: A Foundation 27
The Development of Security Techniques 28Understanding Security Terms and Concepts 29
The Problem (Opportunity) and the Solution 29Evolution of Items 31
Security Foundation Concepts 38CIA Triad 38Primary Security Categories 39Access Control 40Nonrepudiation 42Risk 42Prudent Man, Due Diligence, and Due Care 44User Security Management 44Least Privilege 45AAA 45Mandatory Vacation 46
xvi Contents
ftoc.indd 08/18/2015 Page xvi
Separation of Duties 46M of N Requirement 46Two-Man Rule 47Job Rotation 48Geographic Access Control 48Temporal Access Control, Time of Day Control 48Privacy 49Transparency 49Implicit Deny 50Personal Device (BYOD) 51Privilege Management, Privilege Life Cycle 51
Participating in Security Awareness Education 52Types of Security Awareness Education Programs 52Working with Human Resources and Stakeholders 53Senior Executives 53Customers, Vendors, and Extranet Users Security
Awareness Programs 54Summary 54Exam Essentials 55Written Lab 56Review Questions 57
Chapter 3 Domain 1: Access Controls 61
What Are Controls? 62What Should Be Protected? 63Why Control Access? 64
Types of Access Controls 67Physical Access Controls 67Logical Access Controls 68Administrative Access Controls 69
Identification 70Authentication 72
Factors of Authentication 74Single-Factor Authentication 84Multifactor Authentication 84Token-Based Access Controls 85
System-Level Access Controls 86Discretionary Access Control (DAC) 86Nondiscretionary Access Control 87Mandatory Access Control 87
Administering Mandatory Access Control 89Trusted Systems 90Mandatory Access Control Architecture Models 91
Contents xvii
ftoc.indd 08/18/2015 Page xvii
Account-Level Access Control 94Session-Level Access Control 104View-Based Access Control 104Data-Level Access Control 105Contextual- or Content-Based Access Control 106Physical Data and Printed Media Access Control 106Assurance of Accountability 107Manage Internetwork Trust Architectures 108Cloud-Based Security 111
Summary 113Exam Essentials 114Written Lab 115Review Questions 116
Chapter 4 Domain 2: Security Operations and Administration 121
Security Administration Concepts and Principles 122Security Equation 123Security Policies and Practices 124
Data Management Policies 143Data States 144Information Life Cycle Management 144Information Classification Policy 144
Endpoint Device Security 148Endpoint Health Compliance 148Endpoint Defense 149Endpoint Device Policy 149
Security Education and Awareness Training 150Employee Security Training Policy 153Employee Security Training program 154
Business Continuity Planning 157Developing a Business Continuity Plan 160Disaster Recovery Plans 165
Summary 173Exam Essentials 174Written Lab 175Review Questions 176
Chapter 5 Domain 3: Risk Identification, Monitoring, and Analysis 181
Understanding the Risk Management Process 183Defining Risk 183Risk Management Process 184
xviii Contents
ftoc.indd 08/18/2015 Page xviii
Risk Management Frameworks and Guidance for Managing Risks 191
ISO/IEC 27005 191NIST Special Publication 800-37 Revision 1 192NIST Special Publication 800-39 194
Risk Analysis and Risk Assessment 194Risk Analysis 195Risk Assessments 199
Managing Risks 202Treatment Plan 202Risk Treatment 202Risk Treatment Schedule 203Risk Register 205
Risk Visibility and Reporting 207Enterprise Risk Management 207Continuous Monitoring 208Security Operations Center 209Threat Intelligence 210
Analyzing Monitoring Results 211Security Analytics, Metrics, and Trends 212Event Data Analysis 213Visualization 214Communicating Findings 215
Summary 216Exam Essentials 217Written Lab 218Review Questions 219
Chapter 6 Domain 4: Incident Response and Recovery 223
Event and Incident Handling Policy 224Standards 225Procedures 225Guidelines 226
Creating and Maintaining an Incident Response Plan 226Law Enforcement and Media Communication 229Building in Incident Response Team 231Incident Response Records 232Security Event Information 233Incident Response Containment and Restoration 233Implementation of Countermeasures 235
Understanding and Supporting Forensic Investigations 235Incident Scene 236Volatility of Evidence 237
Contents xix
ftoc.indd 08/18/2015 Page xix
Forensic Principles 237Chain of Custody 238Proper Investigation and Analysis of Evidence 238Interpretation and Reporting Assessment Results 239
Understanding and Supporting the Business Continuity Plan and the Disaster Recovery Plan 240
Emergency Response Plans and Procedures 240Business Continuity Planning 240Disaster Recovery Planning 242Interim or Alternate Processing Strategies 245Restoration Planning 247Backup and Redundancy Implementation 247Business Continuity Plan and Disaster Recovery Plan
Testing and Drills 252Summary 253Exam Essentials 254Written Lab 255Review Questions 256
Chapter 7 Domain 5: Cryptography 261
Concepts and Requirements of Cryptography 263Terms and Concepts Used in Cryptography 263Cryptographic Systems and Technology 272Data Classification and Regulatory Requirements 297Public Key Infrastructure and Certificate Management 299
Key Management 303Key Generation 303Key Distribution 303Key Encrypting Keys 304Key Retrieval 304
Secure Protocols 306IPsec 306
Summary 311Exam Essentials 311Written Lab 313Review Questions 314
Chapter 8 Domain 6: Networks and Communications 317
Network Models 318TCP/IP and OSI Reference Models 319
Network Design Topographies 330Network Topology Models 330Network Connection Models 334
xx Contents
ftoc.indd 08/18/2015 Page xx
Media Access Models 335Ports and Protocols 336
Ports 336Common Protocols 338
Converged Network Communications 340Network Monitoring and Control 341
Continuous Monitoring 341Network Monitors 341Managing Network Logs 342
Access Control Protocols and Standards 343Remote Network Access Control 343
Remote User Authentication Services 346RADIUS 347TACACS/TACACS+/XTACACS 347
Local User Authentication Services 348LDAP 348Kerberos 348Single Sign-On 350
Network Segmentation 351Subnetting 352Virtual Local Area Networks 353Demilitarized Zones 353Network Address Translation 354
Securing Devices 355MAC Filtering and Limiting 356Disabling Unused Ports 356
Security Posture 356Firewall and Proxy Implementation 357
Firewalls 357Firewall Rules 359
Network Routers and Switches 361Routers 361Switches 363
Intrusion Detection and Prevention Devices 363Intrusion Detection Systems 364Intrusion Prevention Systems 364Wireless Intrusion Prevention Systems 365Comparing Intrusion Detection Systems and Intrusion
Prevention Systems 366Spam Filter to Prevent Email Spam 368
Telecommunications Remote Access 368Network Access Control 368
Wireless & Cellular Technologies 369IEEE 802.11x Wireless Protocols 370
Contents xxi
ftoc.indd 08/18/2015 Page xxi
WEP/WPA/WPA2 371Wireless Networks 373
Cellular Network 375WiMAX 375Wireless MAN 376Wireless WAN 377Wireless LAN 377Wireless Mesh Network 377Bluetooth 377Wireless Network Attacks 378Wireless Access Points 378
Traffic Shaping Techniques and Devices 381Quality of Service 381Summary 382Exam Essentials 383Written Lab 384Review Questions 385
Chapter 9 Domain 7: Systems and Application Security 389
Understand Malicious Code and Apply Countermeasures 390Malicious Code Terms and Concepts 393Managing Spam to Avoid Malware 401Cookies and Attachments 402Malicious Code Countermeasures 405
Malicious Add-Ons 409Java Applets 409ActiveX 410
User Threats and Endpoint Device Security 410General Workstation Security 411Physical Security 416Securing Mobile Devices and Mobile
Device Management 426Understand and Apply Cloud Security 428
Cloud Concepts and Cloud Security 429Cloud Deployment Model Security 434Cloud Service Model Security 436Cloud Management Security 438Cloud Legal and Privacy Concepts 442Cloud Virtualization Security 449
Secure Data Warehouse and Big Data Environments 449
Data Warehouse and Big Data Deployment and Operations 450Securing the Data Warehouse and Data Environment 451
xxii Contents
ftoc.indd 08/18/2015 Page xxii
Secure Software-Defined Networks and Virtual Environments 451Software-Defined Networks 452Security Benefits and Challenges of Virtualization 455
Summary 457Exam Essentials 458Written Lab 459Review Questions 460
Appendix A Answers to Written Labs 465
Chapter 2 466Chapter 3 466Chapter 4 467Chapter 5 468Chapter 6 468Chapter 7 469Chapter 8 470Chapter 9 471
Appendix B Answers to Review Questions 473
Chapter 2 474Chapter 3 475Chapter 4 476Chapter 5 478Chapter 6 479Chapter 7 481Chapter 8 483Chapter 9 484
Appendix C Diagnostic Tools 487
Microsoft Baseline Security Analyzer 488Using the Tool 488
Microsoft Password Checker 491Using the Tool 491
Internet Explorer Phishing and Malicious Software Filter 492Using the Tool 493
Manage Internet Cookies 494Using the Tool 494
Observing Logs with Event Viewer 495Using the Tool 495
Viewing a Digital Certificate 497Using the Tool 497
Monitoring PC Activities with Windows Performance Monitor 500Using the Tool 500
Contents xxiii
ftoc.indd 08/18/2015 Page xxiii
Analyzing Error Messages in Event Viewer 504Using the Tool 504
Calculate Hash Values 508Using the Tool 509
Index 511
Introduction
What a wonderful time to be involved with IT security. The role of security practitioner is expanding almost on a daily basis. Challenges abound as we all try to get our arms around not only traditional hardwired networks but also everything involved with wireless com-munication and the virtualization of everything in the cloud. There is so much to know and understand, and the growth potential seemingly has no bounds. Keeping up with this pace is (ISC)2, the creators of the Certifi ed Information Systems Security Professional (CISSP) certifi cation, along with several other certifi cations.
(ISC)2 is renowned for offering industry-leading cybersecurity and other types of train-ing courses around the world. Achieving the Systems Security Certifi ed Practitioner (SSCP) from (ISC)2 indicates mastery of a broad-based body of knowledge in IT security. From network engineering to application development and from cybersecurity to physical secu-rity, the prestigious SSCP certifi cation indicates that an individual is an accomplished and knowledgeable security practitioner. The certifi cation is not a vendor-specifi c certifi cation but a comprehensive broad-based certifi cation.
Candidates for this certifi cation will take a 125-question exam over a period of three hours. The exam covers questions from seven separate and distinct areas of knowledge called domains. Upon passing the examination with a score of 700 or better out of a possible 1,000, successful candidates also must agree to adhere to the (ISC)2 Code of Ethics. Applications must also be endorsed by a current (ISC)2 member or by the organization. This sets SSCP certifi cation holders apart because they are true accomplished professionals who adhere to a clear set of standards of conduct and are in the forefront of the IT security industry.
This book is intended to thoroughly prepare you for the SSCP examination. It com-pletely covers all of the new material introduced by (ISC)2 in early 2015. The changes and additional information place increasing importance on subjects such as the cloud, virtual-ization, big data, and security monitoring and detection as well as the importance of personal privacy protection and its enforcement by new laws and legislation.
Although the requirement for the SSCP certifi cation is one year of employment in the industry, it is assumed that that year of employment will aid in the individual’s ability to apply the various concepts covered in this book. The exciting thing about being a security practitioner is the diversity of the assignments and required knowledge of the job. This certifi cation indicates a broad range of knowledge and capabilities and can be a fi rst major step forward in a rewarding career in IT security.
Who Should Read This Book?
Although the Systems Security Certifi ed Practitioner certifi cation has been offered by (ISC)2 for many years, in 2015 the Common Body of Knowledge (CBK), which forms the founda-tion for the exam, was substantially modifi ed. To keep the certifi cation relevant with the rapid developments in the industry, the (ISC)2 organization regularly undertakes a program
xxvi Introduction
fl ast.indd 08/17/2015 Page xxvi
to ascertain the new skills required by the individuals holding its certifi cation. It has been estimated that as much as 25 to 30 percent of new information has been added to vari-ous (ISC)2 certifi cations during this process. As should be expected, the SSCP exam was changed to refl ect the additional information and knowledge required of candidates. These changes were announced as recently as the fi rst quarter of 2015. Although other exam preparation sources may contain adequate information for past examinations, they may not offer the complete scope of the new information as contained in this book.
The SSCP: Systems Security Certifi ed Practitioner Study Guide is intended for candi-dates wishing to achieve the Systems Security Certifi ed Practitioner certifi cation. It is a comprehensive exam preparation guide to assist you in understanding the various concepts that will be included on the exam. Although deep technical knowledge and work experi-ence are not required to pass the examination, it is necessary to have a basic understanding of security technologies such as networking, client/server architecture, and the devices and controls used to reduce risk to organizations. This book covers items such as network tele-communications as well as cryptography in very down-to-earth, easy-to-understand lan-guage that makes comprehension and information retention easy and painless.
What Is Covered in This Book
This textbook is a comprehensive review of all of the subjects you should be familiar with prior to taking the SSCP certifi cation exam. It generally follows the exam outline as expressed by the (ISC)2 organization. Various learning tools will be used, such as examples and typical applications of many of the concepts. You will also read case stud-ies of successful and sometimes not-so-successful real-world examples. Each chapter will include notes that will elaborate in a little more detail about a concept as well as a number of exam points that serve as detailed reminders of important concepts that are important to remember.
As you will see, this book is not a condensed “exam notes guide” type of book. Instead, it comprehensively covers the different subjects and categories of information that a practicing SSCP should know, not only to pass the certifi cation examination but also to apply in the workplace.
To successfully pass this certifi cation examination as well as any future (ISC)2 certifi ca-tion examination, it is important not to just memorize the material but to learn and under-stand the topics. If you understand the material and how it’s applied, you will always be successful on an examination.
Chapter 1: Information Security: The Systems Security Certified Practitioner Certification This chapter introduces the SSCP examination candidate to the require-ments and preparation required to sit for the exam. It familiarizes the you with the (ISC)2 organization, the requirements you must meet to take the examination, examination registration procedures, the (ISC)2 SSCP endorsement requirements, the continuing educa-tion requirements (CEU), and the annual fee.
Introduction xxvii
fl ast.indd 08/17/2015 Page xxvii
In this chapter you will learn what to expect at the examination center and how to plan for your examination day. Through the years, many other individuals have taken technical examinations similar to the SSCP certification examination. In this chapter, you will learn many of their successful study techniques so that you may be equally as successful when preparing for the examination.
Chapter 2: Security Basics: A Foundation The SSCP certifi cation examination consists of 125 multiple-choice questions concerning the (ISC)2 organization’s SSCP Common Body of Knowledge (CBK). This body of knowledge consist of seven domains, or separate sections of information. Chapter 2 introduces you to the concepts of access control and a large num-ber of related terms and defi nitions. It begins with a description of the CIA triad, which is the foundation for enterprise IT security. The discussion includes an understanding of secu-rity terms and concepts. You will see that some of these concepts have various permutations over time such as the wireless security protocols of WEP, WPA, and eventually WPA2 that we use today.
Chapter 3: Domain 1: Access Controls Protecting enterprise resources is a major part of the job description of an IT security professional. In this chapter, you will learn in detail how access controls are selected and implemented to protect resources from unauthorized use or entry. You will learn the importance of identifi cation, authentication, authorization, logging, and accountability. You will understand that various access control techniques, such as discretionary access control as well as nondiscretionary access control in the form of mandatory access control and roll-based access control may be implemented in various situations throughout an enterprise.
Chapter 4: Domain 2: Security Operations and Administration Every enterprise must have policies, standards, procedures, and guidelines that provide documented information that guides the actions of the organization as well as the individuals it employs or interacts with. Chapter 4 will introduce you to the concept of information availability, integrity, and confi -dentiality as it applies to management personnel, system owners, information managers, and end users throughout an organization. In this chapter, you will come to understand change management as well as applying patches and updates to software and systems and complying with data management policies. This chapter will also cover data classifi cation and the importance of validating that a security control is operating effectively.
Chapter 5: Domain 3: Risk Identification, Monitoring, and Analysis Potential threats pose risks to every organization. This chapter introduces organized assessment techniques to provide ongoing threat identifi cation and monitoring. You will learn the importance of implementing controls to mitigate or reduce threats or vulnerabilities, which thereby reduces overall risk to the organization.
This chapter includes a discussion of risk management concepts, the assessment of risk, and typical techniques organizations use to address risks, such as buying insurance, reducing risk, and possibly avoiding risk altogether. You will also learn the importance of discovering events and incidents as they are occurring through monitoring and reviewing log files as well as the techniques of participating in both risk reduction and risk response activities.
xxviii Introduction
Chapter 6: Domain 4: Incident Response and Recovery There are several key tasks that may become the responsibility or assignment of the security practitioner. Some of these tasks can involve actions and activities in response to an incident or emergency situation. In this chapter, you will be introduced to the techniques of incident handling (which include investigations, reporting, and escalation) as well as digital forensic concepts. You will learn the actions required of a fi rst responder, including the requirements concerning protection of an incident scene, evidence acquisition and handling, and restoring the environment to a state prior to the incident.
This chapter will also cover the creation of a business continuity plan as well as a disaster recovery plan, both of which are required by an enterprise to be used during a disaster event. And finally, the importance of testing the plans and providing exercises and drills for the participants will be discussed.
Chapter 7: Domain 5: Cryptography Confi dentiality, as a leg of the CIA triad, is a major responsibility of all of the individuals in IT security as well as the SSCP. This chapter will introduce you to the concepts and requirements of confi dentiality and how to provide it using cryptographic methods. Cryptographic algorithms, the use of keys, and the types of cryptographic systems will be discussed in detail, but in a way that will be easy to under-stand. You will discover that every time an individual logs into an e-commerce website, most of the concepts covered in this chapter, such as public-key infrastructure, will be utilized.
You will gain an understanding of the use of digital certificates, how to provide integrity for data, and what techniques can be used so that data is protected when it is at rest or in transit. Finally, you will learn how authentication can be provided by cryptographic means as well as how to ensure that the sender of a message can’t deny that they sent the message, which is referred to as nonrepudiation.
Chapter 8: Domain 6: Networks and Communications IT networks comprise numer-ous hardware devices that are assembled using various methods and resulting in network models called topologies. Network devices make use of signaling techniques referred to as telecommunications to transfer data between users and through devices. In Chapter 8, you will be introduced to network models and hardware devices as well as the structure of data that fl ows over the networks and through these devices.
This chapter will cover wireless and cellular technologies including the concepts of Bring Your Own Device and the connection of personal digital devices to the enterprise network. It will conclude with a discussion of converged network communications such as voice and media over the digital network and the prioritization of information that transverses a network.
Chapter 9: Domain 7: Systems and Application Security Forming the termination point of a network connection are endpoints such as, for example, host workstations, digital wireless devices, printers, scanners, and devices like point-of-sale equipment. Chapter 9 will introduce you to the importance of securing endpoints against many types of mali-cious code attacks and how to apply various countermeasures to mitigate the threat of end-point attacks.
