Official (ISC)2 Guide to the CISSP CBK, Second Edition

Harold F. Tipton, HFT Associates, Villa Park, California, USA

INFORMATION SECURITY AND RISK MANAGEMENT
Introduction
The Business Case for Information Security Management
Core Information Security Principles: Availability, Integrity,
Information Security Management Governance
Organizational Behavior
Security Awareness, Training, and Education
Risk Management
Ethics
Data Classification Policy
Data Handling Policy
References
Other References
Sample Questions
ACCESS CONTROL
Introduction
Definitions and Key Concepts
Access Control Categories and Types
Access Control Threats
Access to Systems
Access to Data
Intrusion Detection and Prevention Systems
Access Control Assurance
References.
Sample Questions
CRYPTOGRAPHY
Introduction
Key Concepts and Definitions
Encryption Systems
Message Integrity Controls
Digital Signatures
Encryption Management
Cryptanalysis and Attacks
Encryption Usage
References
Sample Questions
PHYSICAL (ENVIRONMENTAL) SECURITY
Introduction
Site Location
The Layered Defense Model
Information Protection and Management Services
Summary
References
Sample Questions
SECURITY ARCHITECTURE AND DESIGN
Introduction
Security Architecture and Design Components and Principles
Security Models and Architecture Theory
Security Product Evaluation Methods and Criteria
Sample Questions
BUSINESS CONTINUITY AND DISASTER RECOVERY PLANNING
Introduction
Organization of the BCP/DRP Domain Chapter
Terminology
Appendix A: Addressing Legislative Compliance within Business Continuity Plans
TELECOMMUNICATIONS AND NETWORK SECURITY
Introduction
Basic Concepts
Layer 1: Physical Layer
Layer 2: Data-Link Layer
Layer 3: Network Layer
Layer 4: Transport Layer
Layer 5: Session Layer
Layer 6: Presentation Layer
Layer 7: Application Layer
Trivial File Transfer Protocol (TFTP)
General References
Sample Questions
Endnotes
APPLICATION SECURITY
Domain Description and Introduction
Applications Development and Programming Concepts and Protection
Audit and Assurance Mechanisms
Malicious Software (Malware)
The Database and Data Warehousing Environment
Web Application Environment
Summary
References
OPERATIONS SECURITY
Introduction
Privileged Entity Controls
Resource Protection
Continuity of Operations
Change Control Management
Summary
References
Sample Questions
LEGAL, REGULATIONS, COMPLIANCE AND INVESTIGATIONS
Introduction
Major Legal Systems
Information Technology Laws and Regulations
Incident Response
Computer Forensics
Conclusions
References
Sample Questions
ANSWERS TO SAMPLE QUESTIONS
CERTIFIED INFORMATION SYSTEMS SECURITY PROFESSIONAL (CISSP®) CANDIDATE INFORMATION BULLETIN
GLOSSARY
INDEX