Table Of Content

OFFICIAL (ISC)2® GUIDE TO THE ISSAP® CBK® SECOND EDITION K16840_FM.indd 1 8/7/13 7:05 AM OTHER BOOKS IN THE (ISC)2® PRESS SERIES Official (ISC)2® Guide to the ISSAP® CBK®, Second Edition Adam Gordon, Editor ISBN: 978-1-4665-7900-2 Official (ISC)2® Guide to the CISSP® CBK®, Third Edition Harold F. Tipton, Editor ISBN: 978-1-4665-6976-8 Official (ISC)2® Guide to the CAP® CBK®, Second Edition Patrick D. Howard ISBN: 978-1-4398-2075-9 Official (ISC)2® Guide to the SSCP® CBK®, Second Edition Harold F. Tipton, Editor ISBN: 978-1-4398-0483-4 Official (ISC)2® Guide to the ISSAP® CBK® Harold F. Tipton, Editor ISBN: 978-1-4398-0093-5 Official (ISC)2® Guide to the ISSMP® CBK® Harold F. Tipton, Editor ISBN: 978-1-4200-9443-5 CISO Leadership: Essential Principles for Success Todd Fitzgerald and Micki Krause, Editors ISBN: 978-0-8493-7943-X Official (ISC)2® Guide to the CISSP®-ISSEP® CBK® Susan Hansche ISBN: 978-0-8493-2341-X OFFICIAL (ISC)2® GUIDE TO THE ISSAP® CBK® SECOND EDITION Edited by Adam Gordon - CISSP-ISSAP, ISSMP, SSCP K16840_FM.indd 3 8/7/13 7:05 AM CRC Press Taylor & Francis Group 6000 Broken Sound Parkway NW, Suite 300 Boca Raton, FL 33487-2742 © 2014 by Taylor & Francis Group, LLC CRC Press is an imprint of Taylor & Francis Group, an Informa business No claim to original U.S. Government works Version Date: 20130806 International Standard Book Number-13: 978-1-4665-7901-9 (eBook - PDF) This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the valid- ity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or uti- lized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopy- ing, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers. For permission to photocopy or use material electronically from this work, please access www.copyright.com (http:// www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged. Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe. Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com Contents Foreword ................................................................................................................................................xv Introduction ........................................................................................................................................xvii Editors ...................................................................................................................................................xxv Domain 1 - Access Control Systems & Methodology .....................1 Introduction ..........................................................................................................................................4 Access Control Concepts .............................................................................................................4 Discretionary Access Control.............................................................................................................11 DAC Implementation Strategies .......................................................................................................14 Nondiscretionary Access Control ......................................................................................................18 Mandatory Access Control (MAC) .....................................................................................................21 Least Privilege .....................................................................................................................................25 Separation of Duties ..........................................................................................................................28 Architectures .......................................................................................................................................37 Authentication, Authorization, and Accounting (AAA) ....................................40 Centralized Access Control ................................................................................................................40 Common Implementations ...............................................................................................................43 Design Considerations .......................................................................................................................45 Decentralized Access Control ............................................................................................................46 Design Considerations .......................................................................................................................47 Federated Access Control ..................................................................................................................50 Design Considerations .......................................................................................................................51 Directories and Access Control .........................................................................................................52 Design Considerations .......................................................................................................................54 Identity Management ........................................................................................................................54 Accounting ..........................................................................................................................................60 Access Control Administration and Management Concepts ........................65 Access Control Administration ..........................................................................................................65 Database Access .................................................................................................................................70 Inherent Rights ...................................................................................................................................77 v ISSAP_v2.indb 5 7/18/2013 10:28:15 AM Official (ISC)2 Guide to the ISSAP CBK: Second Edition Granted Rights ....................................................................................................................................78 Change of Privilege Levels .................................................................................................................79 Groups .................................................................................................................................................79 Role Based ...........................................................................................................................................81 Task Based ...........................................................................................................................................86 Dual Control ........................................................................................................................................88 Location ...............................................................................................................................................92 Topology ..............................................................................................................................................92 Subnet ..................................................................................................................................................92 Geographical Considerations ...........................................................................................................94 Device Type .........................................................................................................................................96 Authentication .................................................................................................................................100 Strengths and Weaknesses of Authentication Tools ...................................................................102 Token-Based Authentication Tools ................................................................................................102 Common Issues with Token Management ...................................................................................106 Biometric Authentication Tools .....................................................................................................107 Performance Characteristics ..........................................................................................................107 Implementation Considerations ...................................................................................................108 Fingerprints ......................................................................................................................................109 Hand Geometry ...............................................................................................................................109 Iris ......................................................................................................................................................110 Retina ................................................................................................................................................110 Facial Recognition ...........................................................................................................................110 Authentication Tool Considerations .............................................................................................111 Design Validation ............................................................................................................................112 Architecture Effectiveness Assurance ............................................................................................114 Testing Strategies ............................................................................................................................116 Testing Objectives ............................................................................................................................117 Testing Paradigms ...........................................................................................................................118 Repeatability ....................................................................................................................................119 Methodology ...................................................................................................................................119 Developing Test Procedures ...........................................................................................................120 Risk-Based Considerations .............................................................................................................121 Domain 2 - Communications & Network Security ........................131 Voice and Facsimile Communications .........................................................................134 Pulse Code Modulation (PCM) ......................................................................................................135 Circuit-Switched versus Packet-Switched Networks....................................................................136 VoIP Architecture Concerns ............................................................................................................139 End-to-End Delay ............................................................................................................................139 Jitter ..................................................................................................................................................140 Method of Voice Digitization Used ................................................................................................140 Packet Loss Rate ..............................................................................................................................140 vi ISSAP_v2.indb 6 7/18/2013 10:28:15 AM Contents Security .............................................................................................................................................141 Voice Security Policies and Procedures .........................................................................................141 Encryption ........................................................................................................................................141 Authentication .................................................................................................................................142 Administrative Change Control .....................................................................................................143 Integrity ............................................................................................................................................143 Availability .......................................................................................................................................143 Voice Protocols .................................................................................................................................144 Network Architecture .....................................................................................................................152 Redundancy and Availability .........................................................................................................152 Internet versus Intranet ...................................................................................................................152 Extranet ............................................................................................................................................153 Network Types .................................................................................................................................153 Perimeter Controls ...........................................................................................................................156 Security Modems ............................................................................................................................160 Communications and Network Polices .........................................................................................161 Overview of Firewalls .....................................................................................................................162 Firewalls vs. Routers ........................................................................................................................165 Demilitarized Zone’s Perimeter Controls ......................................................................................166 IDS/IPS ..............................................................................................................................................167 IDS Architecture ...............................................................................................................................167 Intrusion Prevention System ..........................................................................................................172 Security Information & Event Management Considerations (SIEM)..........................................173 Wireless Considerations ..................................................................................................................176 Architectures ....................................................................................................................................176 Security Issues ..................................................................................................................................179 WPA and WPA2 ................................................................................................................................179 IEEE 802.11i and 802.1X ..................................................................................................................180 802.1X ..............................................................................................................................................180 Zones of Control ..............................................................................................................................181 Network Security .............................................................................................................................182 Content Filtering ..............................................................................................................................182 Anti-malware ...................................................................................................................................182 Anti-spam .........................................................................................................................................183 Outbound Traffic Filtering ..............................................................................................................184 Mobile Code .....................................................................................................................................185 Policy Enforcement Design .............................................................................................................185 Application and Transport Layer Security ....................................................................................187 Social Media .....................................................................................................................................188 Secure E-Commerce Protocols .......................................................................................................191 SSL/TSL and the TCP/IP Protocol Stack .........................................................................................191 Encryption ........................................................................................................................................192 Authentication .................................................................................................................................193 Certificates and Certificate Authorities ........................................................................................193 vii ISSAP_v2.indb 7 7/18/2013 10:28:15 AM Official (ISC)2 Guide to the ISSAP CBK: Second Edition Data Integrity ...................................................................................................................................193 SSL/TLS Features ..............................................................................................................................194 Limitations of SSL/TLS.....................................................................................................................195 Other Security Protocols .................................................................................................................195 Secure Remote Procedure Calls......................................................................................................196 Network Layer Security and VPNs .................................................................................................196 Types of VPN Tunneling ..................................................................................................................198 VPN Tunneling Protocols ................................................................................................................199 Layer 2 Tunneling Protocol (L2TP) .................................................................................................201 IPSec .................................................................................................................................................204 Authentication Header (AH) ...........................................................................................................205 Encapsulating Security Payload (ESP) ..........................................................................................208 Cryptographic Algorithms..............................................................................................................209 L2TP/IPSec ........................................................................................................................................209 Authentication Using EAP ..............................................................................................................209 TCP Wrapper ...................................................................................................................................210 SOCKS ...............................................................................................................................................211 Comparing SOCKS and HTTP Proxies ............................................................................................211 VPN Selection ...................................................................................................................................212 Topology Supported .......................................................................................................................212 Authentication Supported .............................................................................................................212 Encryption Supported .....................................................................................................................212 Scalability .........................................................................................................................................212 Management ...................................................................................................................................213 VPN Client Software ........................................................................................................................213 Operating System and Browser Support ......................................................................................213 Performance ....................................................................................................................................213 Endpoint Security ............................................................................................................................213 Encryption ........................................................................................................................................214 Network Security Design Considerations .................................................................215 Interoperability and Associated Risks .......................................................................................215 Cross-Domain Risks and Solutions ................................................................................................215 Audits and Assessments ................................................................................................................217 Monitoring .......................................................................................................................................218 Operating Environment .................................................................................................................218 Remote Access .................................................................................................................................222 Monitoring .......................................................................................................................................222 Design Validation ............................................................................................................................222 Penetration Testing .........................................................................................................................222 Vulnerability Assessment ................................................................................................................223 Monitoring and Network Attacks ..................................................................................................223 Risk-Based Architecture ..................................................................................................................223 Secure Sourcing Strategy ..............................................................................................................224 viii ISSAP_v2.indb 8 7/18/2013 10:28:15 AM Contents Domain 3 - Cryptography ...........................................................................................237 Cryptographic Principles .......................................................................................................240 Applications of Cryptography .....................................................................................................240 Benefits .............................................................................................................................................240 Uses ...................................................................................................................................................241 Message Encryption ........................................................................................................................244 Secure IP Communication ..............................................................................................................245 Remote Access .................................................................................................................................246 Secure Wireless Communication ...................................................................................................247 Other Types of Secure Communication ........................................................................................249 Identification and Authentication .................................................................................................250 Storage Encryption ..........................................................................................................................252 Electronic Commerce (E-Commerce) ............................................................................................253 Software Code Signing ...................................................................................................................255 Interoperability ................................................................................................................................255 Methods of Cryptography ..............................................................................................................256 Symmetric Cryptosystems ..............................................................................................................256 Block Cipher Modes .........................................................................................................................259 Stream Ciphers ................................................................................................................................263 Asymmetric Cryptosystems ............................................................................................................264 Hash Functions and Message Authentication Codes ..................................................................267 Digital Signatures ............................................................................................................................271 Vet Proprietary Cryptography & Design Testable Cryptographic Systems .................272 Computational Overhead & Useful Life ...................................................................................274 Key Management ........................................................................................................................276 Purpose of the Keys and Key Types ................................................................................................276 Cryptographic Strength and Key Size ...........................................................................................278 Key Life Cycle ..................................................................................................................................283 Key Creation .....................................................................................................................................284 Key Distribution and Crypto Information in Transit ....................................................................287 Symmetric Keys Distribution ..........................................................................................................288 Public and Private Keys Distribution .............................................................................................288 Key Storage ......................................................................................................................................290 Key Update .......................................................................................................................................293 Key Revocation ................................................................................................................................294 Key Escrow ........................................................................................................................................295 Backup and Recovery ......................................................................................................................296 Backup ..............................................................................................................................................296 Key Recovery ....................................................................................................................................297 Public Key Infrastructure ...............................................................................................................297 Key Distribution ...............................................................................................................................298 Certificate and Key Storage ............................................................................................................299 PKI Registration ...............................................................................................................................300 ix ISSAP_v2.indb 9 7/18/2013 10:28:15 AM

ebook img

Official (ISC)2® Guide to the ISSAP® CBK, Second Edition PDF

586 Pages·2013·22.917 MB·English
by  ISC)² Corporate
#
Save to my drive
Quick download
Download

Download Official (ISC)2® Guide to the ISSAP® CBK, Second Edition PDF Free - Full Version

by ISC)² Corporate| 2013| 586 pages| 22.917| English

Download Official (ISC)2® Guide to the ISSAP® CBK, Second Edition by ISC)² Corporate in PDF format completely FREE. No registration required, no payment needed. Get instant access to this valuable resource on PDFdrive.to!

Free Download PDF

About Official (ISC)2® Guide to the ISSAP® CBK, Second Edition

No description available for this book.

Detailed Information

Author:ISC)² Corporate
Publication Year:2013
Pages:586
Language:English
File Size:22.917
Format:PDF
Price:FREE
Download Free PDF

Safe & Secure Download - No registration required

Why Choose PDFdrive for Your Free Official (ISC)2® Guide to the ISSAP® CBK, Second Edition Download?

  • 100% Free: No hidden fees or subscriptions required for one book every day.
  • No Registration: Immediate access is available without creating accounts for one book every day.
  • Safe and Secure: Clean downloads without malware or viruses
  • Multiple Formats: PDF, MOBI, Mpub,... optimized for all devices
  • Educational Resource: Supporting knowledge sharing and learning

Free Books Similar to Official (ISC)2® Guide to the ISSAP® CBK, Second Edition

Frequently Asked Questions

Is it really free to download Official (ISC)2® Guide to the ISSAP® CBK, Second Edition PDF?

Yes, on https://PDFdrive.to you can download Official (ISC)2® Guide to the ISSAP® CBK, Second Edition by ISC)² Corporate completely free. We don't require any payment, subscription, or registration to access this PDF file. For 3 books every day.

How can I read Official (ISC)2® Guide to the ISSAP® CBK, Second Edition on my mobile device?

After downloading Official (ISC)2® Guide to the ISSAP® CBK, Second Edition PDF, you can open it with any PDF reader app on your phone or tablet. We recommend using Adobe Acrobat Reader, Apple Books, or Google Play Books for the best reading experience.

Is this the full version of Official (ISC)2® Guide to the ISSAP® CBK, Second Edition?

Yes, this is the complete PDF version of Official (ISC)2® Guide to the ISSAP® CBK, Second Edition by ISC)² Corporate. You will be able to read the entire content as in the printed version without missing any pages.

Is it legal to download Official (ISC)2® Guide to the ISSAP® CBK, Second Edition PDF for free?

https://PDFdrive.to provides links to free educational resources available online. We do not store any files on our servers. Please be aware of copyright laws in your country before downloading.

The materials shared are intended for research, educational, and personal use in accordance with fair use principles.

We use cookies

We use cookies to ensure you get the best browsing experience on our website. By clicking "Accept Cookies", you agree that we can store cookies on your device in accordance with our Terms and Privacy.