CC Certified in Cybersecurity Study Guide

ABOUT THE AUTHOR Mike Chapple, PhD, CIPM, CIPP/US, CISSP, is a teaching professor in the IT, Analytics, and Operations Department at the University of Notre Dame’s Mendoza College of Business. He is the author of several bestselling information technology certification guides and has over two decades’ experience in higher education, the private sector, and government IT.

• Introduction xviiPart I Domain 1: Security Principles 1Chapter 1 Confidentiality, Integrity, Availability, and Non-repudiation 3The CIA Triad 4Non-repudiation 7Chapter 2 Authentication and Authorization 11Access Control Process 11Password Policies 13Authentication Factors 16Chapter 3 Privacy 23Privacy 23Privacy Management Framework 25Chapter 4 Risk Management 35Risk Types 35Risk Identification and Assessment 37Risk Treatment Strategies 39Risk Profile and Tolerance 40Chapter 5 Security Controls 45What Are Security Controls? 45Categorizing Security Controls 46Chapter 6 Ethics 51Corporate Ethics Codes 51ISC2 Code of Ethics 52Ethics Complaint Procedure 54Chapter 7 Security Governance Processes 59Security Policies and Procedures 59Laws and Regulations 61Chapple213832_ftoc.indd 13 22-11-2023 12:53:06Part II Domain 2: Business Continuity (bc), Disaster Recovery (dr) & Incident Response (ir) Concepts 65Chapter 8 Business Continuity 67Business Continuity Planning 67Business Continuity Controls 69High Availability and Fault Tolerance 71Chapter 9 Disaster Recovery 79Disaster Recovery Planning 79Backups 81Disaster Recovery Sites 83Testing Disaster Recovery Plans 85Chapter 10 Incident Response 89Creating an Incident Response Program 89Building an Incident Response Team 91Incident Communications Plan 92Incident Identification and Response 93Part III Domain 3: Access Controls Concepts 99Chapter 11 Physical Access Controls 101Physical Facilities 101Designing for Security 104Visitor Management 106Physical Security Personnel 106Chapter 12 Logical Access Controls 111Authorization 111Account Types 114Non- repudiation 115Part IV Domain 4: Network Security 119Chapter 13 Computer Networking 121Network Types 121TCP/IP Networking 122IP Addressing 124Network Ports and Applications 128Securing Wi- Fi Networks 129Chapter 14 Network Threats and Attacks 137Malware 137Eavesdropping Attacks 139Denial- of- Service Attacks 140Side- Channel Attacks 142Chapter 15 Threat Identification and Prevention 145Antivirus Software 145Intrusion Detection and Prevention 146Firewalls 148Vulnerability Scanning 149Chapter 16 Network Security Infrastructure 155Data Center Protection 156Network Security Zones 158Switches, WAPs, and Routers 159Network Segmentation 161Virtual Private Networks 162Network Access Control 163Internet of Things 165Chapter 17 Cloud Computing 169Cloud Computing 169Cloud Deployment Models 171Cloud Service Categories 172Security and the Shared Responsibility Model 174Automation and Orchestration 174Vendor Relationships 175Part V Domain 5: Security Operations 179Chapter 18 Encryption 181Cryptography 181Encryption Algorithms 183Uses of Encryption 186Hash Functions 187Chapter 19 Data Handling 193Data Life Cycle 193Data Classification 196Chapter 20 Logging and Monitoring 201Logging 201Log Monitoring 202Chapter 21 Configuration Management 207Configuration Management 207Configuration Vulnerabilities 208Chapter 22 Best Practice Security Policies 213Acceptable Use Policy 213Data Handling Policy 214Password Policy 214Bring Your Own Device Policy 214Privacy Policy 214Change Management Policy 215Chapter 23 Security Awareness Training 219Social Engineering 219Security Education 221Index 227