Book Image

CISSP in 21 Days - Second Edition

By : M. L. Srinivasan, None M.L.Srinivasan
Book Image

CISSP in 21 Days - Second Edition

By: M. L. Srinivasan, None M.L.Srinivasan

Overview of this book

Certified Information Systems Security Professional (CISSP) is an internationally recognized and coveted qualification. Success in this respected exam opens the door to your dream job as a security expert with an eye-catching salary. But passing the final exam is challenging. Every year a lot of candidates do not prepare sufficiently for the examination, and fail at the final stage. This happens when they cover everything but do not revise properly and hence lack confidence. This simple yet informative book will take you through the final weeks before the exam with a day-by-day plan covering all of the exam topics. It will build your confidence and enable you to crack the Gold Standard exam, knowing that you have done all you can to prepare for the big day. This book provides concise explanations of important concepts in all 10 domains of the CISSP Common Body of Knowledge (CBK). Starting with Confidentiality, Integrity, and Availability, you will focus on classifying information and supporting assets. You will understand data handling requirements for sensitive information before gradually moving on to using secure design principles while implementing and managing engineering processes. You will understand the application of cryptography in communication security and prevent or mitigate strategies for network attacks. You will also learn security control requirements and how to assess their effectiveness. Finally, you will explore advanced topics such as automated and manual test result analysis and reporting methods. A complete mock test is included at the end to evaluate whether you're ready for the exam. This book is not a replacement for full study guides; instead, it builds on and reemphasizes concepts learned from them.

Related Content you might be interested in

Current Title:

Small book image
CISSP in 21 Days - Second Edition
M. L. Srinivasan | None M.L.Srinivasan
Jun, 2016 | 402 pages
No titles found
Table of Contents (27 chapters)
CISSP in 21 Days Second Edition
CISSP in 21 Days Second Edition
Credits
Credits
About the Author
About the Author
About the Reviewer
About the Reviewer
www.PacktPub.com
www.PacktPub.com
Preface
Preface
Free Chapter
1
Day 1 – Security and Risk Management - Security, Compliance, and Policies
Day 1 – Security and Risk Management - Security, Compliance, and Policies
Overview of security, compliance, and policies
Confidentiality, Integrity, and Availability (CIA)
Security governance
Compliance
Legal and regulatory issues
Professional ethics
Security policies, standards, procedures, and guidelines
Personnel security policies
Summary
Sample questions
2
Day 2 – Security and Risk Management - Risk Management, Business Continuity, and Security Education
Day 2 – Security and Risk Management - Risk Management, Business Continuity, and Security Education
Overview of risk management, business continuity, and security education
Risk management
Security risk considerations in acquisitions, strategy, and practice
Information security education, training, and awareness
Summary
Sample questions
3
Day 3 – Asset Security - Information and Asset Classification
Day 3 – Asset Security - Information and Asset Classification
Overview of asset security - information and asset classification
Asset classification and control
Data privacy
Data retention
Summary
Sample questions
4
Day 4 – Asset Security - Data Security Controls and Handling
Day 4 – Asset Security - Data Security Controls and Handling
Overview of asset security - data security controls and handling
Data security controls
Data Loss Prevention (DLP)
Data Loss Prevention strategies
DLP controls
Cryptographic methods to secure data
Data handling requirements
Summary
Sample questions
5
Day 5 – Exam Cram and Practice Questions
Day 5 – Exam Cram and Practice Questions
An overview of exam cram and practice questions
Sample questions
References and further reading
Summary
6
Day 6 – Security Engineering - Security Design, Practices, Models, and Vulnerability Mitigation
Day 6 – Security Engineering - Security Design, Practices, Models, and Vulnerability Mitigation
An overview of security design, practices, models, and vulnerability mitigation
Secure design principles
Assurance
Certification and accreditation
Information security models
Vulnerability assessment and mitigation
Summary
Sample questions
7
Day 7 – Security Engineering - Cryptography
Day 7 – Security Engineering - Cryptography
An overview of cryptography
The fundamentals of cryptography
Applications and the use of cryptography
Public Key Infrastructure (PKI)
Key management techniques
Cryptanalytic attacks
Cryptographic standards
Summary
Sample questions
8
Day 8 – Communication and Network Security - Network Security
Day 8 – Communication and Network Security - Network Security
An overview of communication and network security
Network architecture, protocols, and technologies
Open System Interconnect (OSI) model
OSI layers and security
Summary
Sample questions
9
Day 9 – Communication and Network Security - Communication Security
Day 9 – Communication and Network Security - Communication Security
An overview of communication security
Security in communication channels
Attacks on communication networks
Preventing or mitigating communication network attacks
Summary
Sample questions
10
Day 10 – Exam Cram and Practice Questions
Day 10 – Exam Cram and Practice Questions
An overview of exam cram and practice questions
The exam cram
Sample questions
References and further reading
Summary
11
Day 11 – Identity and Access Management - Identity Management
Day 11 – Identity and Access Management - Identity Management
An overview of identity and access management
Physical and logical access to assets
Identity management principles and implementation
Identity as a service
Third-party identity services
Summary
Sample questions
12
Day 12 – Identity and Access Management - Access Management, Provisioning, and Attacks
Day 12 – Identity and Access Management - Access Management, Provisioning, and Attacks
An overview of access management
Access management concepts, methodologies, and techniques
Identity and provisioning life cycle
Access control attacks and countermeasures
Accountability
Summary
Sample questions
13
Day 13 – Security Assessment and Testing - Designing, Performing Security Assessment, and Tests
Day 13 – Security Assessment and Testing - Designing, Performing Security Assessment, and Tests
An overview of security assessment and testing
Security assessment and test strategies
Security controls
Summary
Sample questions
14
Day 14 – Security Assessment and Testing - Controlling, Analyzing, Auditing, and Reporting
Day 14 – Security Assessment and Testing - Controlling, Analyzing, Auditing, and Reporting
An overview of controlling, analyzing, auditing, and reporting security test data
A collection of security process data
Analyzing security process data
Internal and third-party security audits
Reporting test and audit outputs
Summary
Sample questions
15
Day 15 – Exam Cram and Practice Questions
Day 15 – Exam Cram and Practice Questions
An overview of exam cram and practice questions
Exam cram
Mock test
References and further reading
Summary
16
Day 16 – Security Operations - Foundational Concepts
Day 16 – Security Operations - Foundational Concepts
An overview of operations security
The physical security design
Physical and operations security controls
Operations/facility security
Protecting and securing equipment
Computer investigations
Summary
Sample questions
17
Day 17 – Security Operations - Incident Management and Disaster Recovery
Day 17 – Security Operations - Incident Management and Disaster Recovery
Incident management and reporting
Business Continuity Planning (BCP)
Disaster Recovery Planning (DRP)
Summary
Sample questions
18
Day 18 – Software Development Security - Security in Software Development Life Cycle
Day 18 – Software Development Security - Security in Software Development Life Cycle
An overview of software development security
Systems engineering
Software development life cycle
Security in software development
Summary
Sample questions
19
Day 19 – Software Development Security - Assessing effectiveness of Software Security
Day 19 – Software Development Security - Assessing effectiveness of Software Security
Overview
Security in information technology systems
Threats and vulnerabilities to application systems
Security impact analysis
Monitoring and testing activities
Summary
Sample questions
20
Day 20 – Exam Cram and Practice Questions
Day 20 – Exam Cram and Practice Questions
Overview of exam cram and practice questions
Exam cram
References and further reading
Summary
Sample questions
21
Day 21 – Exam Cram and Mock Test
Day 21 – Exam Cram and Mock Test
An overview of the exam cram and mock test
Exam cram
Summary
Mock test
References and further reading

Security policies, standards, procedures, and guidelines

Policies, standards, procedures, and guidelines form a quartet of organizational mechanisms in protecting information:

  • Security policies are high-level statements that provide management intent and direction for information security. They describe the what of the description.

  • Security standards provide prescriptive statements, control objectives, and controls for enforcing security policies. In a way, they provide the how of the description. They can be internally developed by the organization and/or published by standard bodies, such as National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO), or country-specific standard bodies.

  • Security procedures are step-by-step instructions to implement the policies and standards.

  • Security guidelines provide the best practice methods to support security controls selection and implementation. They can be used in whole or part while implementing security standards.

    For example, NIST Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems provides procedures and guidelines for System security life cycle.

International Organization for Standardization (ISO) along with International Electro-Technical Commission (IEC) has published code of practice guidelines and a standard for Information Security Management System (ISMS). They are as follows:

  • ISO/IEC 27002: Code of practice for information security. This standard provides a list of best practices an organization could adopt for security management.

  • ISO/IEC 27001: This standard specifies the management framework required for Information Security and is a certifiable standard. Organizations can seek certification against this standard for their Information Security Management System (ISMS).

Previous Section
End of Section 8
Next Section