CISSP通行证（英文版）

1 Security Management Practices
Objective 1.01 Management Responsibilities
Objective 1.02 Risk Management
Risk Analysis
Objective 1.03 Possible Threats
Objective 1.04 Security Control Types
Objective 1.05 Calculating Risk
Quantitative Versus Qualitative Approaches
Dealing with Risk
Countermeasure Selection
Objective 1.06 Security Policies and their Supporting
Counterparts
Security Policy
Standards
Baselines
Procedures
Guidelines
Objective 1.07 Roles and Responsibilities
Data Owner
Data Custodian
User
Security Auditor
Objective 1.08 Information Classification
Military Versus Commercial Classifications
Objective 1.09 Employee Management
Operational Administrative Controls
CHECKPOINT
Review Questions
Review Answers
2 Access Control
Objective 2.01 Identification and Authentication
Definitions
Three Steps to Access Control
Authentication
Biometrics
Passwords
Cognitive Password
One-Time Password
Cryptographic keys
Passphrase
Memory Cards
Smart Cards
Authorization
Objective 2.02 Single Sign-On Technologies
Directory Services
Kerberos
SESAME
Thin Clients
Objective 2.03 Access Control Models and Techniques
DAC
MAC
RBAC
Access Control Techniques
Restricted Interfaces
Capability Table and ACLs
Content-Dependent Access Control
Other Access Techniques
Objective 2.04 Access Control Administration
Centralized Access Control Administration
RADIUS
TACACS
Diameter
Decentralized Access Control Administration
Objective 2.05 Intrusion Detection System
Network-Based and Host-Based
Signature-Based and Behavior-Based
Downfalls of IDS
Objective 2.06 Unauthorized Access Control and Attacks
Unatuthorized Disclosure of Information
Emanation Security
Attack Types
Penetration Testing
CHECKPOINT
Review Questions
Review Answers
3 Security Models and Architecture
Objective 3.01 System Components
Central Processing Unit
Storage and Memory Types
Virtual Memory
Data Access Storage
Processing Instructions
Operating States
Objective 3.02 Operation System Security Mechanisms
Process Isolation
Protection Rings
virtual Machine
Trusted Computing Base
Reference Monitor and Security Kernel
Objective 3.03 Security Models
The Different Models
State Machine Models
Bell-LaPadula Model
Biba
Clark-Wilson Model
Non-Interference Model
Access Control Matrix Model
Information Flow Model
Brewer and nash model
Graham-Denning and Harrison-Ruzzo-Ullman MModle
Objective 3.04 Security Evaluation Criteria
Security Evaluations
Trusted Computer System Evaluation Criteria
Rainbow Series
Information Technology Security Evaluation Clritera
Common Critecria
Certification Versus Accreditation
CHECKPOINT
Review Question
Rview Answers
4 Physical Security
Objective 4.01 Controls Pertaining to Physical Security
Facility Location
Facility Construction
Computing Area
Hardware Backups
Objective 4.02 Electrical Power and Environmental Issues
UPS
Power Interference
Environmental Considerations
Ventilation
Water,Steam,and Gas
Objective 4.03 Fire Detection and Suppression
Fire Prevention
Fire Detection
Fire Types
Fire Suppression
Halon
Fire Extinguishing Issues
Water Sprinklers
Emergency Response
Objective 4.04 Perimeter Security
Lock Types
Facility Access
Entrance Protection
Fencing
Lighting
Surveillance Devices
Intrusion Detection Systems
CHECKPOINT
Review Question
Review Answers
5 Telecommunications and Networking Security
Objective 5.01 TCP/IP Suite
Internet Protocol(IP)
Networks
Intranets and Extranets
Objective 5.02 Cabling and Data Transmission Types
Coaxial Cable
Twisted-Pair Cable
Fiber
Cable Issues
Fire Ratings
Broadband and Baseband
Signals
Asynchronous and Synchronous
Transmission Methods
Objective 5.03 LAN Technoogies
Network Topologies
Media Access Technologies
Ethernet
Token Passing
Polling
Protocols
Address Resolution Protocol(ARP)
Reverse Address Resolution Protocol(RARP)
Boot Protocol
Internet Control Message Protocol(ICMP)
Other TCP/IP Protocols
Objective 5.04 Networking Devices and Services
Repeater
Bridge
Switches
VLAN
Router
Brouters
Gateway
Summary of Devices
Firewalls
Packet Filtering
Proxy Firewalls
Stateful Firewalls
Firewall Architecture
Firewall Administration
Remote Connectivity
PPP
SLIP
PAP
CHAP
EAP
VPN
PPTP
L2TP
IPSec
Network Services
DNS
NAT
Objective 5.05 Telecommunications Protocols and Devices
FDDI
SONET
Dedicated Link
CSU/DSU
S/WAN
ISDN
DSL
Cable Modems
WAN Switching
Frame Relay
X.25
ATM
Quality of Service
SMDS
SDLC
HDLC
Multiservice Access Technologies
Objective 5.06 Remote Access Methods and Technologies
Remote Access
Wireless Technology
Spread Spectrum
WAP
Access Points
SSID
OSA and SKA
Cell Phone Cloning
PBX Threats
Objective 5.07 Fault Tolerance Mechanisms
RAID
Clustering
Backing Up
CHECKPOINT
Review Questions
Review Answers
6 Cryptography
Objective 6.01 Cryptography Definitions
Definitions
Keys and Text
Keyspace
Strength of Cryptosystem
Attacks
Spy-Like Ciphers
Steganography
Objective 6.02 Cipher Types
Kerckhoff's Principle
Key Escrow
Substitution Cipher
Transposition Cipher
Block Cipher
Stream Cipher
Symmetric Cryptography
Asymmetric Cryptography
Objective 6.03 Hybrid Approach
Key Management
Data Encryption
Security Goals
Types of Symmetric Algorithms
DES
Triple-DES(3DES)
Advanced Encryption Standard(AES)
Other Symmetric Algorithms
Asymmetrical Algorithms
Diffie-Hellman Key Exchange
EI Gamal
Elliptic Curve Cryptosystems(ECC)
Objective 6.04 Message Integrity and Digital Signatures
Message Integrity
One-Way Hash
Attacks on Hashing Functions
Hashing Algorithms
Message Authentication Code
Electronic Signing
DSS
Objective 6.05 Cryptography Applications
Public Key Infrastructure
Certificate Authority(CA)
Registration Authority
Certificate Revocation List(CRL)
Components of PKI
PKI Steps
One-Time Pad
Encryption at Different Layers
Objective 6.06 Cryptographic Protocols
Privacy-Enhanced Mail(PEM)
Message Security Protocol(MSP)
Pretty Good Privacy(PGP)
Internet Security
Secure Hypertext Transfer Protocol(S-HTTP)
HTTPS
Secure Sockets Layer(SSL)
S/MIME
SSH2
SET
IPSec
Other Security Technologies
Objective 6.07 Attacks
Ciphertext-Only Attack
Known-plaintext Attack
Chosen-plaintext Attack
Adaptive Chosen-plaintext Attack
Chosen-Ciphertext Attack
Adaptive Chosen-Ciphertext Attack
Man-in-the-Middle Attack
Algebraic Attack
Analytic Attack
CHECKPOINT
Review Questions
Review Answers
7 Disaster Recovery and Business Comtinuity
Objective 7.01 Disaster Recovery versus
Business Continuity
Objective 7.02 Project Initiation Phase
Objective 7.03 Business Impact Analysis
Objective 7.04 Possible Threats
Objective 7.05 Backups and Off-Site Facilities
Employees and the Working Environment
Choosing a Software Backup Storage Facility
Backup Facility Alternatives
Objective 7.06 DRP and Off-Site Facilities
Emergency Response
Recovery and Restoration
Documentation
Testing and Drills
Maintenance
Phase Breakdown
Prevention
CHECKPOINT
Review Questions
Review Answers
8 Law,Investigation.and Ethics
Objective 8.01 Ethics
(ISC)平方
Computer Ethics Institute
Internet Activities Board
Objective 8.02 Hacking Methods
Characteristics of an Attacker
Problems with Prosecuting Attackers
Types of Attacks
Salami
Data Diddling
Exessive Privileges
Password Sniffing
IP Spoofing
Dumpster Diving
Wiretapping
Social Engineering
More Attack Types
Attack Categories
Phone Fraud
Objective 8.03 Organization Liabilities and Ramifications
Security Principles
Legal Liability
Privacy Issues
Privacy Act of 1974
electronic Communications Privacy Act of 1986
Health Insurance Portability and Accountability Act(HIPAA)
Gramm Leach Bliley Act of 1999
Employee Monitoring
Transborder Information Flow
International Issues
Objective 8.04 Types of Law
Civil Law
Criminal Law
Administrative Law
Federal Policies
Computer Fraud and Abuse Act of 1986
Economic Espionage Act of 1996
Federal Sentencing Guidelines of 1991
Intellectual Property Laws
Trade Secret
Copyright
Trademark
Patent
Software Piracy
Objective 8.05 Computer Crime Investigation
Who Should Investigate?
Incident Response Plan
Incident response Team
Incident Handling
Collecting Evidence
Search and Seizure
Forensics
Admissibility of Evidence
Evidence Types
Best Evidence
Secondary Evidence
Hearsay Evidence
Enticement and Entrapment
Trial
CHECKPOINT
Review Questions
Review Answers
9 Applications and Systems Development
Objective 9.01 Applications and Systems Development
Software Lifecycle
Software Development Models
Project Initiation
Functional Design Analysis and Planning
System Design Specifications
Software Development
Acceptance Testing/Implementation
Operations/Maintenance
Disposal
Software Development Methods
Change Control
Administrative Controls
Program Language Evolution
Objective 9.02 Object-Oriented Programming
Classes and Objects
Abstraction
Polymorphism
Polyinstantiation
Application Threats
Objective 9.03 Distributed Computing
ORB and CORBA
COM and DCOM
Enterprise Java Bean
OLE
ActiveX
Java Applets
CGI
Cookies
Objective 9.04 Databases
Relational Data Model
Data Dictionary
Database Jargon
Structured query Language
Hierarchical database Model
Network Database Management System
Distributed Data Model
Object-Oriented Database
Database Interface Languages
Concurrency Issues
Aggregation and Inference
Data Warehousing
Data Mining
Objective 9.05 Artificial Intelligence
Expert Systems
Artificial Neural Network
Objective 9.06 Malware
Virus
Worms
Logic Bomb
Trojan Horse
Denial of Service
DDoS
Smurf Attacks
Timing Attacks
CHECKPOINT
Review Questions
Review Answers
10 Operations Security
Objective 10.01 Operations Controls
Due Care
Administrative Control
Separation of Duties
Job Rotation
Least Privilege and Need-to-Know
Mandatory Vacations
Clipping Levels
Control Categories
Objective 10.02 Configuration Management and Media Control
Media Controls
Input/Output Data Controls
Objective 10.03 Reacting to Failures and Recovering
Trusted Recovery
Facsimile Security
Operational Responsibilities
Unusual or Unexplained Occurrences
Deviations from Standards
Unscheduled Initial Program Loads
Personnel Operators
Objective 10.04 Software Backups
Network Availability
RAID
Backups
Contingency Management
CHECKPOINT
Review Questions
Review Answers
A About the Free Online Practice Exam
Mike Meyers' Certification Passport FREE Online Practice Exam Instructions
System Requirements
Technical Support
B Career Flight Path
Career Paths in Security
Index