Table Of Content®
Eleventh Hour CISSP
®
Eleventh Hour CISSP
Study Guide
Second Edition
Eric Conrad
Seth Misenar
Joshua Feldman
Kevin Riggins, Technical Editor
AMSTERDAM (cid:129) BOSTON (cid:129) HEIDELBERG (cid:129) LONDON
NEW YORK (cid:129) OXFORD (cid:129) PARIS (cid:129) SAN DIEGO
SAN FRANCISCO (cid:129) SINGAPORE (cid:129) SYDNEY (cid:129) TOKYO
Syngress is an Imprint of Elsevier
AcquiringEditor:ChrisKatsaropoulos
EditorialProjectManager:BenjaminRearick
ProjectManager:MohanaNatarajan
Designer:AlanStudholme
SyngressisanimprintofElsevier
225WymanStreet,Waltham,MA02451,USA
Secondedition2014
Copyright#2014,2011ElsevierInc.Allrightsreserved.
Nopartofthispublicationmaybereproduced,storedinaretrievalsystemortransmittedinanyformorby
anymeanselectronic,mechanical,photocopying,recordingorotherwisewithoutthepriorwritten
permissionofthepublisher.
PermissionsmaybesoughtdirectlyfromElsevier’sScience&TechnologyRightsDepartmentinOxford,
UK:phone(þ44)(0)1865843830;fax(þ44)(0)1865853333;email:[email protected].
AlternativelyyoucansubmityourrequestonlinebyvisitingtheElsevierwebsiteathttp://elsevier.com/
locate/permissions,andselectingObtainingpermissiontouseElseviermaterial.
Notice
Noresponsibilityisassumedbythepublisherforanyinjuryand/ordamagetopersonsorpropertyasa
matterofproductsliability,negligenceorotherwise,orfromanyuseoroperationofanymethods,
products,instructionsorideascontainedinthematerialherein.Becauseofrapidadvancesinthemedical
sciences,inparticular,independentverificationofdiagnosesanddrugdosagesshouldbemade.
LibraryofCongressCataloging-in-PublicationData
ApplicationSubmitted
BritishLibraryCataloguinginPublicationData
AcataloguerecordforthisbookisavailablefromtheBritishLibrary
ForinformationonallSyngresspublications,visitourwebsiteatstore.elsevier.com/syngress
ISBN:978-0-12-417142-8
PrintedandboundinUSA
14 15 16 17 18 10 9 8 7 6 5 4 3 2 1
Author biography
SethMisenar(CISSP®,GIACGSE,CompTIACASP,GPEN,GCIH,GCIA,GCFA,
GWAPT, GCWN, GSEC, MCSE, and MCDBA) is a Certified Instructor with the
SANS Institute and coauthor of the SANS SEC528: SANS Training Program for
theCompTIAAdvancedSecurityPractitioner(CASP)Certification.Sethalsoserves
asleadconsultantforJackson,Mississippi-basedContextSecurity.Seth’sbackground
includessecurityresearch,networkandWebapplicationpenetrationtesting,vulnera-
bilityassessment,regulatorycomplianceefforts,securityarchitecturedesign,andgen-
eralsecurityconsulting.Hehaspreviouslyservedasaphysicalandnetworksecurity
consultantforFortune100companiesaswellastheHIPAAandinformationsecurity
officerforastategovernmentagency.SethteachesavarietyofcoursesfortheSANS
Institute, including Security Essentials, Advanced Web Application Penetration
® ®
Testing,HackerTechniques,andtheCISSP andCASP courses.
SethispursuingaMasterofSciencedegreeininformationsecurityengineering
fromtheSANSTechnologyInstituteandholdsaBachelorofSciencedegreefrom
MillsapsCollege.SethresidesinJackson,Mississippi,withhisfamily,Rachel,Jude,
and Hazel.
EricConrad(CISSP,GIACGSE,GPEN,GCIH,GCIA,GCFA,GAWN,GSEC,
GISP, CompTIA CASP, and Securityþ) is a partner with Backshore Communica-
tions, which provides information warfare, penetration testing, incident handling,
and intrusion detection consulting services. He is also a Certified Instructor with
the SANS Institute and coauthor of SANS Security 528: SANS Training Program
for the CompTIA Advanced Security Practitioner (CASP) Certification.
Eric’sprofessionalcareerbeganin1991asaUNIXsystemsadministratorfora
small oceanographic communications company. He gained information security
experienceinavarietyofindustries,includingresearch,education,power,Internet,
and healthcare, in roles ranging from systems programmer to security engineer to
HIPAA security officer and ISSO. He has taught thousands of students in courses
®
including SANS Management 414: CISSP , Security 560: Network Penetration
TestingandEthicalHacking,Security504HackerTechniques,ExploitsandIncident
Handling,and others.
Eric is a graduate of the SANS Technology Institute with a Master of Science
degree in information security engineering. Eric currently lives in Peaks Island,
Maine, with his family, Melissa, Eric, andEmma.
JoshuaFeldman(CISSP,NSAIAM)hassupportedtheDepartmentofDefense
InformationSystemsAgency(DISA),asacontractorworkingforSAIC,Inc.,since
2002.HeisasubjectmatterexpertandtrainingdeveloperforDISA’scybersecurity
mission.Duringhistenure,hehascontributedtotheDoD8500series,specifically
conducting research and authoring sections of the DoD 8570.01-M, also known as
the DoD IA Workforce Improvement Program. He is the program manager for
DISA’s Computer Network Defense training initiative (entitled, “RaD-X”) and
has instructed well over 1000 students. He also is a subject matter expert for the
xv
xvi Author biography
Web-basedInformationAssuranceawarenesstrainingeveryDoDuserisrequiredto
take each year as part of their security awareness curriculum. He is a regular pre-
senterandpanelmemberattheInformationAssuranceSymposium,hostedbyboth
DISAand NSA.
Before joining the support team at DoD/DISA, Joshua spent time as an IT Sec
engineerworkingfortheDepartmentofState,DiplomaticSecurity.There,hetrav-
eledtoembassiesworldwidetoconductTigerTeamassessmentsofthesecurityof
eachembassy.JoshuagothisstartintheITSecurityfieldwhenhelefthisposition
teaching science for Montgomery County Public Schools, Maryland, and went to
workforNFRSecuritySoftware.Atthetime,NFRwasoneoftheleadingcompanies
producingNetworkIntrusion Detection systems.
CHAPTER
1
Domain 1: Access Control
EXAM OBJECTIVES IN THIS CHAPTER
(cid:129) CornerstoneAccessControlConcepts
(cid:129) AccessControlModels
(cid:129) AccessControlDefensiveCategoriesandTypes
(cid:129) AuthenticationMethods
(cid:129) AccessControlTechnologies
(cid:129) AssessingAccessControl
INTRODUCTION
Thepurposeofaccesscontrolistoallowauthorizedusersaccesstoappropriatedata
anddenyaccesstounauthorizedusers.Accesscontrolsprotectagainstthreatssuchas
unauthorizedaccess,inappropriatemodificationofdata,andlossofconfidentiality.
CORNERSTONE INFORMATION SECURITY CONCEPTS
Beforewecanexplainaccesscontrol,wemustdefinecornerstoneinformationsecu-
rityconcepts.Theseconceptsprovidethefoundationuponwhichthe10domainsof
the Common Body ofKnowledge are built.
Confidentiality, integrity, and availability
Confidentiality,Integrity,andAvailabilityarethe“CIAtriad,”thecornerstonecon-
ceptofinformationsecurity.Thetriad,showninFigure1.1,formsthethree-legged
stoolinformationsecurityisbuiltupon.Theorderoftheacronymmaychange(some
prefer “AIC,”perhaps toavoid association with a certain intelligence agency), but
the concepts are essential. This book will usethe “CIA” acronym.
Confidentiality
Confidentialityseekstopreventtheunauthorizeddisclosureofinformation:itkeeps
datasecret.Inotherwords,confidentialityseekstopreventunauthorizedreadaccess
todata.AnexampleofaconfidentialityattackwouldbethetheftofPersonallyIden-
tifiableInformation (PII), such as credit card information.
1
2 CHAPTER 1 Domain 1: Access Control
y
entialit Avail
d a
onfi bilit
C y
Integrity
FIGURE1.1
TheCIAtriad.
Integrity
Integrityseekstopreventunauthorizedmodificationofinformation.Inotherwords,
integrity seeks topreventunauthorized writeaccesstodata.
CRUNCH TIME
Therearetwotypesofintegrity:dataintegrityandsystemintegrity.Dataintegrityseeksto
protectinformationagainstunauthorizedmodification;systemintegrityseekstoprotecta
system,suchasaWindows2012serveroperatingsystem,fromunauthorizedmodification.
Availability
Availabilityensuresthatinformationisavailablewhenneeded.Systemsneedtobe
usable (available) for normal business use. An example of attack on availability
wouldbeaDenial-of-Service(DoS)attack,whichseekstodenyservice(oravailabil-
ity)ofa system.
Disclosure, alteration, and destruction
The CIA triad may also be described by its opposite: Disclosure, Alteration, and
Destruction(DAD).Disclosureistheunauthorizeddisclosureofinformation;alter-
ation is the unauthorized modification of data, and destruction is making systems
unavailable. While the CIA acronym sometimes changes, the DAD acronym is
shown inthat order.
Identity and authentication, authorization, and accountability
The term “AAA” is often used, describing cornerstone concepts Authentication,
Authorization, and Accountability. Left out of the AAA acronym is Identification,
whichisrequired before the three “A’s”can follow.
Cornerstone Information Security Concepts 3
Identity and authentication
Identityisaclaim:ifyournameis“PersonX,”youidentifyyourselfbysaying“Iam
Person X.” Identity alone isweak because there isnoproof. You can alsoidentify
yourselfbysaying“IamPersonY.”Provinganidentityclaimiscalledauthentica-
tion:youauthenticatetheidentityclaim,usuallybysupplyingapieceofinformation
or anobject thatonly you posses, such as apasswordoryourpassport.
Authorization
Authorizationdescribestheactionsyoucanperformonasystemonceyouhaveiden-
tifiedandauthenticated.Actionsmayincludereading,writing,orexecutingfilesor
programs.
Accountability
Accountability holds users accountable for their actions. This is typically accom-
plished by logging and analyzing audit data. Enforcing accountability helps keep
“honestpeoplehonest.”Forsomeusers,knowingthatdataisloggedisnotenough
toprovideaccountability:theymustknowthatthedataisloggedandauditedandthat
sanctions may result from violation ofpolicy.
Nonrepudiation
Nonrepudiation means ausercannot deny(repudiate) havingperformedatransac-
tion.Itcombinesauthenticationandintegrity:nonrepudiationauthenticatestheiden-
tityofauserwhoperformsatransactionandensurestheintegrityofthattransaction.
Youmusthavebothauthenticationandintegritytohavenonrepudiation:provingyou
signedacontracttobuyacar(authenticating youridentityasthepurchaser)isnot
useful if the car dealer can change the price from $20,000 to $40,000 (violate the
integrity ofthe contract).
Least privilege and need to know
Least privilege means users should be granted the minimum amount of access
(authorization) required to do their jobs, but no more. Least privilege is applied to
groupsofobjects.Needtoknowismoregranularthanleastprivilege:theusermust
need toknow that specific piece ofinformationbeforeaccessing it.
Subjects and objects
A subject is an active entity on a data system. Most examples of subjects involve
people accessing data files. However, running computer programs are subjects
as well.
Anobjectisanypassivedatawithinthesystem.Objectscanrangefromdatabases
totextfiles.Theimportantthingtorememberaboutobjectsisthattheyarepassive
within the system. Theydo not manipulate otherobjects.
4 CHAPTER 1 Domain 1: Access Control
Defense-in-depth
Defense-in-depth (also called layered defenses) applies multiple safeguards (also
calledcontrols:measurestakentoreducerisk)toprotectanasset.Anysinglesecurity
control may fail; by deploying multiple controls, you improve the confidentiality,
integrity, and availabilityof yourdata.
ACCESS CONTROL MODELS
Nowthatwehavereviewedthecornerstoneaccesscontrolconcepts,wecandiscuss
the different access control models: the primary models are Discretionary Access
Control (DAC), Mandatory Access Control (MAC), and nondiscretionary access
control.
Discretionary access controls
DiscretionaryAccessControl(DAC)givessubjectsfullcontrolofobjectstheyhave
beengivenaccessto,includingsharingtheobjectswithothersubjects.Subjectsare
empoweredandcontroltheirdata.StandardUNIXandWindowsoperatingsystems
use DAC for file systems: subjects can grant other subjects access to their files,
change their attributes,alter them, or delete them.
Mandatory access controls
MandatoryAccessControl(MAC)issystem-enforcedaccesscontrolbasedonsub-
ject’s clearance and object’s labels. Subjects and objects have clearances and
labels, respectively, such as confidential, secret, and top secret. A subject may
access an object only if the subject’s clearance is equal to or greater than the
object’s label. Subjects cannot share objects with other subjects who lack the
proper clearance or “write down” objects to a lower classification level (such
as from top secret to secret). MAC systems are usually focused on preserving
the confidentiality of data.
Nondiscretionary access control
Role-BasedAccessControl(RBAC)defineshowinformationisaccessedonasystem
basedontheroleofthesubject.Arolecouldbeanurse,abackupadministrator,a
helpdesktechnician,etc.Subjectsaregroupedintorolesandeachdefinedrolehas
accesspermissions based upon the role, notthe individual.
RBAC is a type of nondiscretionary access control because users do not have
discretionregardingthegroupsofobjectstheyareallowedtoaccessandareunable
to transfer objects toothersubjects.
Task-based access control is another nondiscretionary access control model,
relatedtoRBAC.Task-basedaccesscontrolisbasedonthetaskseachsubjectmust
Access Control Models 5
perform,suchaswritingprescriptions,restoringdatafromabackuptape,oropening
ahelpdeskticket.ItattemptstosolvethesameproblemthatRBACsolves,focusing
on specific tasks, instead of roles.
Rule-based access controls
A rule-based access control system uses a series of defined rules, restrictions,
and filters for accessing objects within a system. The rules are in the form of
“if/then”statements.Anexampleofarule-basedaccesscontroldeviceisaproxy
firewallthatallowsuserstosurftheWebwithpredefinedapprovedcontentonly
(If the user is authorized to surf the Web and the site is on the approved list,
then allow access). Other sites are prohibited and this rule is enforced across
all authenticated users.
Centralized access control
Centralized access control concentrates access control in one logical point for a
system or organization. Instead of using local access control databases, systems
authenticate via third-party authentication servers. Centralized access control
can be used to provide Single Sign-On (SSO), where a subject may authenticate
once, and then access multiple systems. Centralized access control can centrally
provide the three “A’s” of access control: Authentication, Authorization, and
Accountability.
Access control lists
Access control lists (ACLs) are used throughout many IT security policies, proce-
dures,andtechnologies.Anaccesscontrollistisalistofobjects;eachentrydescribes
thesubjectsthatmayaccessthatobject.Anyaccessattemptbyasubjecttoanobject
that does not have a matching entry onthe ACLwillbe denied.
Access provisioning lifecycle
Oncetheproperaccesscontrolmodelhasbeenchosenanddeployed,theaccesspro-
visioninglifecyclemustbemaintainedandsecured.Whilemanyorganizationsfol-
low best practices for issuing access, many lack formal processes for ensuring the
entire lifetime of access is kept secure as employees and contractors move within
an organization.
IBM describesthe following identity lifecyclerules:
(cid:129) “Passwordpolicy compliance checking
(cid:129) Notifyingusersto change their passwords before they expire
(cid:129) Identifyinglifecyclechangessuchasaccountsthatareinactiveformorethan30
consecutive days
(cid:129) Identifyingnewaccountsthathavenotbeenusedformorethan10daysfollowing
their creation
