CISSP精要备考文档(高清PDF版)
3星 · 超过75%的资源 需积分: 46 104 浏览量
2011-10-22
09:21:16
上传
评论
收藏 1.1MB PDF 举报 
CISSP aide-mémoire
CISSP aide-mémoire
By Éric Allaire, B.Sc., CISSP, P+CP
eric_is@ericallaire.com
April 3, 2007
Table of contents
REFERENCES USED:..............................................................................I
TABLE OF FIGURE:................................................................................I
SPECIAL NOTES......................................................................................I
DISTRIBUTION AGREEMENT: ..............................................................I
DOMAIN 1 – ACCESS CONTROLS........................................................1
D
EFINITIONS
: .......................................................................................1
B
ASICS AUTHENTICATION PRINCIPLES
................................................1
Types of password: ..........................................................................1
B
IOMETRICS
.........................................................................................1
Error types:......................................................................................1
Crossover Error rate (CER):...........................................................1
A
CCESS CONTROL MODELS
: ................................................................1
Discretionary Access Control..........................................................1
Mandatory Access Control ..............................................................1
Role-Based Access Control (RBAC)................................................1
Lattice-based Access Control;.........................................................1
Ruled based......................................................................................1
Restricted interfaces.........................................................................1
Physically constrained:....................................................................1
Control matrix..................................................................................1
Capability table................................................................................1
ACL ..................................................................................................1
Content-dependent Access Control..................................................1
A
CCESS CONTROL ADMINISTRATION
..................................................1
Access control administration – centralized....................................1
Access control administration – Decentralized ...............................1
Access control administration – Hybrid ..........................................1
A
CCESS CONTROL CATEGORIES
: .........................................................1
Technical Access Controls:..............................................................1
Physical Controls: ...........................................................................1
Administrative controls:...................................................................1
I
NTRUSION DETECTION
........................................................................1
A
TTACKS TO ACCESS
...........................................................................1
A
TTACKS ON PASSWORDS
...................................................................1
DOMAIN 2 - TELECOM AND NET SECURITY.....................................1
D
EFINITIONS
: .......................................................................................1
TCP/IP..................................................................................................2
User Datagram Protocol .................................................................2
C
ABLING AND DATA TRANSMISSION TYPES
........................................2
Cables:.............................................................................................2
LAN
TECHNOLOGY
..............................................................................2
Network topology.............................................................................2
Media access technology .................................................................2
Protocols stack: ...............................................................................2
N
ETWORK DEVICES AND SERVICES
.....................................................2
Firewalls:.........................................................................................2
Data diode: ......................................................................................2
C
ONNECTIVITY PROTOCOLS
:...............................................................2
Connectivity protocols .....................................................................2
Authentication protocol:..................................................................2
Tunneling protocols.........................................................................2
R
EMOTE ACCESS METHODS AND TECHNOLOGY
.................................3
Remote network access ....................................................................3
Wireless technology:........................................................................ 3
Wireless Application Protocols........................................................3
Network services ..............................................................................3
T
ELECOMMUNICATIONS PROTOCOLS AND DEVICES
...........................3
A
TTACKS RELATED TO TELECOMMS
...................................................3
DOMAIN 3 – SECURITY MANAGEMENT.............................................3
S
ECURITY DEFINITIONS
: ......................................................................3
C
ONTROL TYPES
: .................................................................................3
Administrative..................................................................................3
Technical..........................................................................................3
physical ............................................................................................3
S
ECURITY MODEL
:...............................................................................3
R
ISK
M
ANAGEMENT
............................................................................3
R
ISK
A
NALYSIS
....................................................................................3
Assigning value to the assets:..........................................................3
C
ALCULATION IN STEPS
.......................................................................3
Annualized Loss Expectancy............................................................3
S
ECURITY
P
OLICY
................................................................................4
L
AYERS OF RESPONSIBILITIES
:............................................................4
Data classification...........................................................................4
Employee management:...................................................................4
DOMAIN 4 – APPS & SYS DEV..............................................................4
D
EFINITIONS
: .......................................................................................4
P
ROJECT DEVELOPMENT SECURITY
.................................................... 4
A
DMINISTRATIVE CONTROLS
:............................................................. 4
S
OFTWARE DEVELOPING MODELS
...................................................... 4
O
BJECT
-O
RIENTED PROGRAMMING
.................................................... 4
A
PPLICATION THREAT
......................................................................... 4
D
ISTRIBUTED COMPUTING
.................................................................. 4
D
ATABASES
......................................................................................... 5
Database Definition: ....................................................................... 5
Database securities:........................................................................ 5
A
RTIFICIAL INTELLIGENCE
(AI).......................................................... 5
T
YPES OF ATTACKS
(
MALWARE
) ........................................................ 5
DOMAIN 5 - CRYPTOGRAPHY............................................................. 5
CIA
GOALS
: ......................................................................................... 5
D
EFINITIONS
:....................................................................................... 5
C
IPHER PRINCIPLES
: ............................................................................ 5
B
ASIC ENCRYPTION METHODS
............................................................ 5
Substitution...................................................................................... 5
Transposition................................................................................... 5
Block symmetric............................................................................... 5
Stream.............................................................................................. 5
S
YMMETRIC CRYPTOGRAPHY
: ............................................................ 5
A
SYMMETRY CRYPTOGRAPHY
............................................................ 5
Asymmetric algorithm ..................................................................... 5
H
YBRID APPROACH
: ............................................................................ 5
K
EY MANAGEMENT
:............................................................................ 5
I
NTEGRITY AND SIGNATURES
(
HASHING
)............................................ 6
C
RYPTOGRAPHY APPLICATIONS
: ........................................................ 6
Mail application:............................................................................. 6
Internet security applications:......................................................... 6
Public Key Infrastructure................................................................ 6
A
TTACKS
: ............................................................................................ 6
DOMAIN 6 – SECURITY MODELS & ARCHITECTURES ................... 6
D
EFINITIONS
:....................................................................................... 6
C
OMPUTING PRINCIPLES
..................................................................... 6
O
PERATING SYSTEM MECHANISM
....................................................... 6
Protection rings:.............................................................................. 7
S
ECURITY MODELS
.............................................................................. 7
S
ECURITY EVALUATION TYPES
........................................................... 7
Trusted Computer System Evaluation Criteria ............................... 7
Information Technology Security Evaluation Criteria.................... 7
Common Criteria............................................................................. 7
C
ERTIFICATION
V
S
A
CCREDITATION
: ................................................ 7
DOMAIN 7 – OPERATION SECURITY.................................................. 7
D
EFINITIONS
:....................................................................................... 7
O
PERATION CONTROLS
....................................................................... 7
C
ONFIGURATION MANAGEMENT AND MEDIA CONTROL
:................... 7
R
EACTING TO FAILURES AND RECOVERING
: ...................................... 7
Systems can react in four different ways:........................................ 7
A
VAILABILITY
:.................................................................................... 7
F
AX SECURITY
:.................................................................................... 8
DOMAIN 8 – DRP & BCP ...................................................................... 8
D
EFINITIONS
:....................................................................................... 8
P
OSSIBLE THREATS
: ............................................................................ 8
S
TEP IN PREPARING THE
BCP
S
............................................................ 8
1.
Project initiation.............................................................. 8
2.
Business impact analysis (BIA):...................................... 8
3.
Recovery strategies/plan ................................................. 8
4.
Plan design and implementation ..................................... 8
5.
Testing, maintenance and awareness training................ 8
DOMAIN 9 – LAW AND ETHICS........................................................... 8
D
EFINITIONS
:....................................................................................... 8
E
THICS INSTITUTION
........................................................................... 8
H
ACKER ISSUES
................................................................................... 8
E
STABLISHING LIABILITIES AND RAMIFICATION
................................ 8
T
YPES OF LAW
..................................................................................... 9
criminal............................................................................................ 9
Civil/tort .......................................................................................... 9
Administrative.................................................................................. 9
I
NTELLECTUAL PROPERTY LAW
.......................................................... 9
Trade secret..................................................................................... 9
Copyright
©
...................................................................................... 9
Trademark
™
.................................................................................... 9
Patent............................................................................................... 9
I
NVESTIGATING COMPUTER CRIME
..................................................... 9
C
HAIN OF CUSTODY
............................................................................ 9
Evidence life cycle ........................................................................... 9
T
YPES OF ATTACKS
............................................................................. 9
DOMAIN 10 – PHYSICAL SECURITY .................................................. 9
D
EFINITIONS
:....................................................................................... 9
A
REAS OF PHYSICAL SECURITY
.......................................................... 9
Physical location:............................................................................ 9
Construction:................................................................................... 9
Computing area:.............................................................................. 9
E
LECTRICAL AND ENVIRONMENTAL CONCERNS
................................ 9
F
IRE DETECTION AND SUPPRESSION
................................................... 9
Detection.......................................................................................... 9
Suppression...................................................................................... 9
P
ERIMETER SECURITY
......................................................................... 9
Passage............................................................................................ 9
Fence................................................................................................9
lighting .............................................................................................9
Surveillance devices:......................................................................10
IDS
(
PHYSICAL
): ................................................................................10
OSI MODEL...........................................................................................10
TCP/IP (INTERNET REFERENCE MODEL).......................................10
D
ETAILS OF
TCP/IP ...........................................................................10
Application layer............................................................................10
Transport layer ..............................................................................10
Internet layer..................................................................................10
References used:
Susan Hansche/John Berti/Chris Hare, Official (isc2) guide to the
CISSP Exam; 2004
Shon Harris, all-in-one CISSP certification guide, 2002;
Shon Harris, Mikes Meyer certification to CISSP, 2002;
Peter H. Gregory; CISSP for Dummies , 2003;
Ellen Dutton, LAN security handbook, 1994;
Peter H. Gregory, Solaris security, 2000;
Ed Tittel/Mike Chapple/James Michael Stewart, CISSP study
guide, 2003;
www.Infosecuritymag.com
www.cccure.net
www.cccure.org
www.isc2.org
Table of figures:
figure 1 (http://searchnetworking.techtarget.com).......................10
figure 2 .......................................................................................10
figure 3 .......................................................................................10
Special notes
This is not a supplement to your readings, web site browsing,
and other studying formulas but intends to be an aide-mémoire
prior to your exam. Many hours are required to study the various
CKB subjects using web sites, books on-line questionnaires, and
forums. The CISSP exam can be very time consuming study, but
worth it!
*This document is not a supplement or a substitution to your
local/area building codes or local laws.
Distribution agreement:
This document may be freely read, stored, reproduced,
disseminated, translated or quoted by any means and on any
medium provided the following conditions are met:
Every reader or user of this document acknowledges that he his
aware that no guarantee is given regarding its contents, on any
account, and specifically concerning veracity, accuracy and
fitness for any purpose. Do not blame me if some of the exam
questions are not covered or the correct answer is different from
the content of this document. Remember: look for the most
correct answer, this document is based on the seminar content,
standards, books, and where and when possible the source of
information will be mentioned.
No modification is made other than cosmetic, change of
representation format, translation, correction of obvious syntactic
errors.
Comments and other additions may be inserted, provided they
clearly appear as such. Comments and additions must be dated
and their author(s) identifiable. Please forward your comments for
insertion into the original document.
*This document is not a supplement or a substitution to your
local/area building codes or local laws.
CISSP Aide-mémoire www.ericallaire.com
i
剩余10页未读，继续阅读
资源评论
ok800net2022-02-05垃圾， 都是英文版的。- hao1414212014-08-11学习安全的一本很的资料
- adrianobean2013-11-02非常好的资源 打印出来看也非常好
