Website Search
Find information on spaces, staff, and services.
Catalog Search
Books
(ISC)2 CISSP certified information systems security professional official study guide
- Author / Creator
- Available as
- Online
- Summary
-
" Along with the book, you also get access to Sybex's superior online interactive learning environment that includes: Over 900 new and improved practice test questions with complete answer explanat...
" Along with the book, you also get access to Sybex's superior online interactive learning environment that includes: Over 900 new and improved practice test questions with complete answer explanations. This includes all of the questions from the book plus four additional online-only practice exams, each with 125 unique questions. You can use the online-only practice exams as full exam simulations. Our questions will help you identify where you need to study more. Get more than 90 percent of the answers correct, and you're ready to take the certification exam. More than 700 Electronic Flashcards to reinforce your learning and give you last-minute test prep before the exam A searchable glossary in PDF to give you instant access to the key terms you need to know for the exam New for the 9th edition: Audio Review. Author Mike Chapple reads the Exam Essentials for each chapter providing you with 2 hours and 50 minutes of new audio review for yet another way to reinforce your knowledge as you prepare. Coverage of all of the exam topics in the book means you'll be ready for: Security and Risk Management Asset Security Security Architecture and Engineering Communication and Network Security Identity and Access Management (IAM) Security Assessment and Testing Security Operations Software Development Security" -- Publisher
Details
- Creator
- Mike Chapple, James Michael Stewart, Darril Gibson
- Format
- Books
- Language
- English
- Contributors
- Publication
-
- Ninth edition
- Hoboken, NJ : John Wiley & Sons, Inc., [2021]
- ©2021
- Physical Details
-
- 1 online resource (1250 pages)
- ISBNs
- 9781119786245, 111978624X, 9781119786337, 1119786339, 1119786231
- OCLC
- on1263872097
- Cover -- Title Page -- Copyright Page -- Acknowledgments -- About the Authors -- About the Technical Editors -- Contents at a Glance -- Contents -- Foreword -- Introduction -- Overview of the CISSP Exam -- The Elements of This Study Guide -- Interactive Online Learning Environment and TestBank -- Study Guide Exam Objectives -- Objective Map -- Reader Support for This Book -- Assessment Test -- Answers to Assessment Test -- Chapter 1 Security Governance Through Principles and Policies -- Security 101 -- Understand and Apply Security Concepts -- Confidentiality -- Integrity -- Availability -- DAD, Overprotection, Authenticity, Non-repudiation, and AAA Services -- Protection Mechanisms -- Security Boundaries -- Evaluate and Apply Security Governance Principles -- Third-Party Governance -- Documentation Review -- Manage the Security Function -- Alignment of Security Function to Business Strategy, Goals, Mission, and Objectives -- Organizational Processes -- Organizational Roles and Responsibilities -- Security Control Frameworks -- Due Diligence and Due Care -- Security Policy, Standards, Procedures, and Guidelines -- Security Policies -- Security Standards, Baselines, and Guidelines -- Security Procedures -- Threat Modeling -- Identifying Threats -- Determining and Diagramming Potential Attacks -- Performing Reduction Analysis -- Prioritization and Response -- Supply Chain Risk Management -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 2 Personnel Security and Risk Management Concepts -- Personnel Security Policies and Procedures -- Job Descriptions and Responsibilities -- Candidate Screening and Hiring -- Onboarding: Employment Agreements and Policies -- Employee Oversight -- Offboarding, Transfers, and Termination Processes -- Vendor, Consultant, and Contractor Agreements and Controls -- Compliance Policy Requirements
- Privacy Policy Requirements -- Understand and Apply Risk Management Concepts -- Risk Terminology and Concepts -- Asset Valuation -- Identify Threats and Vulnerabilities -- Risk Assessment/Analysis -- Risk Responses -- Cost vs. Benefit of Security Controls -- Countermeasure Selection and Implementation -- Applicable Types of Controls -- Security Control Assessment -- Monitoring and Measurement -- Risk Reporting and Documentation -- Continuous Improvement -- Risk Frameworks -- Social Engineering -- Social Engineering Principles -- Eliciting Information -- Prepending -- Phishing -- Spear Phishing -- Whaling -- Smishing -- Vishing -- Spam -- Shoulder Surfing -- Invoice Scams -- Hoax -- Impersonation and Masquerading -- Tailgating and Piggybacking -- Dumpster Diving -- Identity Fraud -- Typo Squatting -- Influence Campaigns -- Establish and Maintain a Security Awareness, Education, and Training Program -- Awareness -- Training -- Education -- Improvements -- Effectiveness Evaluation -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 3 Business Continuity Planning -- Planning for Business Continuity -- Project Scope and Planning -- Organizational Review -- BCP Team Selection -- Resource Requirements -- Legal and Regulatory Requirements -- Business Impact Analysis -- Identifying Priorities -- Risk Identification -- Likelihood Assessment -- Impact Analysis -- Resource Prioritization -- Continuity Planning -- Strategy Development -- Provisions and Processes -- Plan Approval and Implementation -- Plan Approval -- Plan Implementation -- Training and Education -- BCP Documentation -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 4 Laws, Regulations, and Compliance -- Categories of Laws -- Criminal Law -- Civil Law -- Administrative Law -- Laws -- Computer Crime -- Intellectual Property (IP) -- Licensing
- Import/Export -- Privacy -- State Privacy Laws -- Compliance -- Contracting and Procurement -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 5 Protecting Security of Assets -- Identifying and Classifying Information and Assets -- Defining Sensitive Data -- Defining Data Classifications -- Defining Asset Classifications -- Understanding Data States -- Determining Compliance Requirements -- Determining Data Security Controls -- Establishing Information and Asset Handling Requirements -- Data Maintenance -- Data Loss Prevention -- Marking Sensitive Data and Assets -- Handling Sensitive Information and Assets -- Data Collection Limitation -- Data Location -- Storing Sensitive Data -- Data Destruction -- Ensuring Appropriate Data and Asset Retention -- Data Protection Methods -- Digital Rights Management -- Cloud Access Security Broker -- Pseudonymization -- Tokenization -- Anonymization -- Understanding Data Roles -- Data Owners -- Asset Owners -- Business/Mission Owners -- Data Processors and Data Controllers -- Data Custodians -- Administrators -- Users and Subjects -- Using Security Baselines -- Comparing Tailoring and Scoping -- Standards Selection -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 6 Cryptography and Symmetric Key Algorithms -- Cryptographic Foundations -- Goals of Cryptography -- Cryptography Concepts -- Cryptographic Mathematics -- Ciphers -- Modern Cryptography -- Cryptographic Keys -- Symmetric Key Algorithms -- Asymmetric Key Algorithms -- Hashing Algorithms -- Symmetric Cryptography -- Cryptographic Modes of Operation -- Data Encryption Standard -- Triple DES -- International Data Encryption Algorithm -- Blowfish -- Skipjack -- Rivest Ciphers -- Advanced Encryption Standard -- CAST -- Comparison of Symmetric Encryption Algorithms -- Symmetric Key Management
- Cryptographic Lifecycle -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 7 PKI and Cryptographic Applications -- Asymmetric Cryptography -- Public and Private Keys -- RSA -- ElGamal -- Elliptic Curve -- Diffie-Hellman Key Exchange -- Quantum Cryptography -- Hash Functions -- SHA -- MD5 -- RIPEMD -- Comparison of Hash Algorithm Value Lengths -- Digital Signatures -- HMAC -- Digital Signature Standard -- Public Key Infrastructure -- Certificates -- Certificate Authorities -- Certificate Lifecycle -- Certificate Formats -- Asymmetric Key Management -- Hybrid Cryptography -- Applied Cryptography -- Portable Devices -- Email -- Web Applications -- Steganography and Watermarking -- Networking -- Emerging Applications -- Cryptographic Attacks -- Salting Saves Passwords -- Ultra vs. Enigma -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 8 Principles of Security Models, Design, and Capabilities -- Secure Design Principles -- Objects and Subjects -- Closed and Open Systems -- Secure Defaults -- Fail Securely -- Keep It Simple -- Zero Trust -- Privacy by Design -- Trust but Verify -- Techniques for Ensuring CIA -- Confinement -- Bounds -- Isolation -- Access Controls -- Trust and Assurance -- Understand the Fundamental Concepts of Security Models -- Trusted Computing Base -- State Machine Model -- Information Flow Model -- Noninterference Model -- Take-Grant Model -- Access Control Matrix -- Bell-LaPadula Model -- Biba Model -- Clark-Wilson Model -- Brewer and Nash Model -- Goguen-Meseguer Model -- Sutherland Model -- Graham-Denning Model -- Harrison-Ruzzo-Ullman Model -- Select Controls Based on Systems Security Requirements -- Common Criteria -- Authorization to Operate -- Understand Security Capabilities of Information Systems -- Memory Protection -- Virtualization -- Trusted Platform Module
- Interfaces -- Fault Tolerance -- Encryption/Decryption -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 9 Security Vulnerabilities, Threats, and Countermeasures -- Shared Responsibility -- Assess and Mitigate the Vulnerabilities of Security Architectures, Designs, and Solution Elements -- Hardware -- Firmware -- Client-Based Systems -- Mobile Code -- Local Caches -- Server-Based Systems -- Large-Scale Parallel Data Systems -- Grid Computing -- Peer to Peer -- Industrial Control Systems -- Distributed Systems -- High-Performance Computing (HPC) Systems -- Internet of Things -- Edge and Fog Computing -- Embedded Devices and Cyber-Physical Systems -- Static Systems -- Network-Enabled Devices -- Cyber-Physical Systems -- Elements Related to Embedded and Static Systems -- Security Concerns of Embedded and Static Systems -- Specialized Devices -- Microservices -- Infrastructure as Code -- Virtualized Systems -- Virtual Software -- Virtualized Networking -- Software-Defined Everything -- Virtualization Security Management -- Containerization -- Serverless Architecture -- Mobile Devices -- Mobile Device Security Features -- Mobile Device Deployment Policies -- Essential Security Protection Mechanisms -- Process Isolation -- Hardware Segmentation -- System Security Policy -- Common Security Architecture Flaws and Issues -- Covert Channels -- Attacks Based on Design or Coding Flaws -- Rootkits -- Incremental Attacks -- Summary -- Exam Essentials -- Written Lab -- Review Questions -- Chapter 10 Physical Security Requirements -- Apply Security Principles to Site and Facility Design -- Secure Facility Plan -- Site Selection -- Facility Design -- Implement Site and Facility Security Controls -- Equipment Failure -- Wiring Closets -- Server Rooms/Data Centers -- Intrusion Detection Systems -- Cameras -- Access Abuses
- Media Storage Facilities