(Test Bank) Cissp Certification

Handerhan, 1

Computer Science & Engineering

Test Bank

1st Edition

• $15.00 $50.00

---

Description

Test Bank for Cissp Certification, The downloadable file consists of 508 pages, and the total size of the file is 6.63 MB. Purchase now only for highly discounted price.

Author(s): Handerhan

---

---

Study Note Preview

CISSP ( 8Domain ) Certified Information Systems Security Professional Kelly Handerhan, InstructorWELCOME TO CISSP BOOTCAMP CISSP (Certified Information Systems Security Professional) Kelly Handerhan, Instructor Kellymorrison@yahoo.com CASP, CISSP, PMP 2THE 8 DOMAINS OF CISSP CISSP Course Syllabus: Chapter 1: Security and Risk Management Chapter 2: Asset Security Chapter 3: Security Engineering Chapter 4: Communications and Network Security Chapter 5: Identity and Access Management Chapter 6: Security Assessment and Testing Chapter 7: Security Operations Chapter 8: Software Development Security 3EXAM SPECIFICS 250 Questions (25 are “beta” and are not graded) 6 hours to complete the exam You can mark questions for review You will be provided with 1“wipe” board 8x11 and a pen. materials. You will also have access to an on -screen calculator. Many test centers provide earplugs or noise cancelling head phones. Call your center ahead of time to verify Questions are weighted (Remember…security transcends technology) 4THE CISSP MINDSET •Your Role is a Risk Advisor •Do NOT fix Problems •Who is responsible for security? •How much security is enough? •All decisions start with risk management. Risk management starts with Identifying/Valuating your assets. •“Security Transcends Technology” •Physical safety is always the first choice •Technical Questions are for Managers. Management questions are for technicians •Incorporate security into the design, as opposed to adding it on later •Layered Defense! 5CHAPTER 1 Security and Risk Management 6AGENDA •Confidentiality, integrity, and availability concepts •IAAA •Security governance vs. Management •Compliance •Legal and regulatory issues •Professional ethics •Security policies, standards, procedures and guidelines •Business Continuity and Disaster Recovery 7WELL KNOWN EXPLOITS 8 THE ROLE OF INFORMATION SECURITY WITHIN AN ORGANIZATION •First priority is to support the mission of the organization •Requires judgment based on risk tolerance of organization, cost and benefit •Role of the security professional is that of a risk advisor, not a decision maker. 9Planning Horizon Strategic Goals Over -arching -supported by tactical goals and operational Tactical Goals Mid-Term -lay the necessary foundation to accomplish Strategic Goals Operational Goals Day-to-day -focus on productivity and task -oriented activities 10SECURITY FUNDAMENTALS •C-I-A Triad •Confidentiality •Integrity •Availability 11CONFIDENTIALITY •Prevent unauthorized disclosure •Threats against confidentiality: •Social Engineering •Training, Separation of Duties, Enforce Policies and Conduct Vulnerability Assessments •Media Reuse •Proper Sanitization Strategies •Eavesdropping •Encrypt •Keep sensitive information off the network 12INTEGRITY •Detect modification of information •Corruption •Intentional or Malicious Modification •Message Digest (Hash) •MAC •Digital Signatures 13AVAILABILITY •Provide Timely and reliable access to resources •Redundancy, redundancy, redundancy •Prevent single point of failure •Comprehensive fault tolerance (Data, Hard Drives, Servers, Network Links, etc..) 14BEST PRACTICES (TO PROTECT C -I-A) Separation of Duties (SOD) Mandatory Vacations Job rotation Least privilege Need to know Dual control 15