ISC2 CISSP Certified Information Systems Security Professional Official Study Guide

Mike Chapple, PhD, CISSP, CCSP, is a teaching professor of IT, analytics, and operations at the University of Notre Dame. He is a cybersecurity professional and educator with over 25 years experience including as chief information officer of Brand Institute and an information security researcher with the National Security Agency and the U.S. Air Force. Mike is the author of more than 200 books and video courses and provides cybersecurity certification resources at CertMike.com. James Michael Stewart, CISSP, has been writing and training for more than 25 years, with a focus on security. He has been teaching CISSP training courses since 2002, not to mention other courses on Internet security and ethical hacking/penetration testing. He is the author of and contributor to more than 80 books on security certification. Darril Gibson, CISSP, (1958–2022) was the CEO of YCDA, LLC and regularly wrote and consulted on a wide variety of technical and security topics and held numerous other security certifications. He authored or coauthored more than 30 books including multiple prior editions of the CISSP Study Guide.

• Introduction xxxvAssessment Test lxChapter 1 Security Governance Through Principles and Policies 1Security 101 3Understand and Apply Security Concepts 4Security Boundaries 13Evaluate and Apply Security Governance Principles 14Manage the Security Function 16Security Policy, Standards, Procedures, and Guidelines 27Threat Modeling 29Supply Chain Risk Management 35Summary 38Study Essentials 39Written Lab 41Review Questions 42Chapter 2 Personnel Security and Risk Management Concepts 49Personnel Security Policies and Procedures 51Understand and Apply Risk Management Concepts 60Social Engineering 90Establish and Maintain a Security Awareness, Education, and Training Program 106Summary 110Study Essentials 111Written Lab 114Review Questions 115Chapter 3 Business Continuity Planning 121Planning for Business Continuity 122Project Scope and Planning 123Business Impact Analysis 131Continuity Planning 137Plan Approval and Implementation 140Summary 145Study Essentials 145Written Lab 146Review Questions 147Chapter 4 Laws, Regulations, and Compliance 151Categories of Laws 152Laws 155State Privacy Laws 179Compliance 179Contracting and Procurement 181Summary 182Study Essentials 182Written Lab 184Review Questions 185Chapter 5 Protecting Security of Assets 189Identifying and Classifying Information and Assets 190Establishing Information and Asset Handling Requirements 198Data Protection Methods 208Understanding Data Roles 214Using Security Baselines 216Summary 219Study Essentials 220Written Lab 221Review Questions 222Chapter 6 Cryptography and Symmetric Key Algorithms 227Cryptographic Foundations 228Modern Cryptography 246Symmetric Cryptography 253Cryptographic Life Cycle 263Summary 264Study Essentials 264Written Lab 266Review Questions 267Chapter 7 PKI and Cryptographic Applications 271Asymmetric Cryptography 272Hash Functions 279Digital Signatures 283Public Key Infrastructure 286Asymmetric Key Management 292Hybrid Cryptography 293Applied Cryptography 294Cryptographic Attacks 306Summary 309Study Essentials 310Written Lab 311Review Questions 312Chapter 8 Principles of Security Models, Design, and Capabilities 317Secure Design Principles 319Techniques for Ensuring CIA 330Understand the Fundamental Concepts of Security Models 332Select Controls Based on Systems Security Requirements 345Understand Security Capabilities of Information Systems 349Summary 352Study Essentials 353Written Lab 354Review Questions 355Chapter 9 Security Vulnerabilities, Threats, and Countermeasures 359Shared Responsibility 360Data Localization and Data Sovereignty 362Assess and Mitigate the Vulnerabilities of Security Architectures, Designs, and Solution Elements 363Client‐Based Systems 378Server‐Based Systems 381Industrial Control Systems 384Distributed Systems 386High‐Performance Computing (HPC) Systems 387Real‐Time Operating Systems 388Internet of Things 389Edge and Fog Computing 390Embedded Devices and Cyber‐Physical Systems 391Microservices 396Infrastructure as Code 397Immutable Architecture 398Virtualized Systems 399Containerization 406Mobile Devices 407Essential Security Protection Mechanisms 424Common Security Architecture Flaws and Issues 427Summary 431Study Essentials 432Written Lab 436Review Questions 437Chapter 10 Physical Security Requirements 443Apply Security Principles to Site and Facility Design 444Implement Site and Facility Security Controls 449Implement and Manage Physical Security 473Summary 480Study Essentials 481Written Lab 484Review Questions 485Chapter 11 Secure Network Architecture and Components 491OSI Model 493TCP/IP Model 501Analyzing Network Traffic 502Common Application Layer Protocols 503Transport Layer Protocols 504Domain Name System 506Internet Protocol (IP) Networking 512ARP Concerns 516Secure Communication Protocols 517Implications of Multilayer Protocols 518Segmentation 523Edge Networks 526Wireless Networks 527Satellite Communications 543Cellular Networks 544Content Distribution Networks (CDNs) 544Secure Network Components 545Summary 572Study Essentials 573Written Lab 575Review Questions 576Chapter 12 Secure Communications and Network Attacks 581Protocol Security Mechanisms 582Secure Voice Communications 587Remote Access Security Management 591Multimedia Collaboration 595Monitoring and Management 597Load Balancing 597Manage Email Security 600Virtual Private Network 606Switching and Virtual LANs 613Network Address Translation 617Third‐Party Connectivity 622Switching Technologies 624WAN Technologies 626Fiber‐Optic Links 629Prevent or Mitigate Network Attacks 630Summary 631Study Essentials 632Written Lab 635Review Questions 636Chapter 13 Managing Identity and Authentication 641Controlling Access to Assets 643The AAA Model 645Implementing Identity Management 662Managing the Identity and Access Provisioning Life Cycle 668Summary 672Study Essentials 672Written Lab 675Review Questions 676Chapter 14 Controlling and Monitoring Access 681Comparing Access Control Models 682Implementing Authentication Systems 694Zero‐Trust Access Policy Enforcement 702Understanding Access Control Attacks 703Summary 719Study Essentials 720Written Lab 721Review Questions 722Chapter 15 Security Assessment and Testing 727Building a Security Assessment and Testing Program 729Performing Vulnerability Assessments 735Testing Your Software 750Training and Exercises 758Implementing Security Management Processes and Collecting Security Process Data 759Summary 762Exam Essentials 763Written Lab 764Review Questions 765Chapter 16 Managing Security Operations 769Apply Foundational Security Operations Concepts 771Address Personnel Safety and Security 778Provision Information and Assets Securely 780Managed Services in the Cloud 786Perform Configuration Management (CM) 790Manage Change 793Manage Patches and Reduce Vulnerabilities 797Summary 801Study Essentials 802Written Lab 804Review Questions 805Chapter 17 Preventing and Responding to Incidents 809Conducting Incident Management 811Implementing Detection and Preventive Measures 818Logging and Monitoring 842Automating Incident Response 854Summary 860Study Essentials 860Written Lab 863Review Questions 864Chapter 18 Disaster Recovery Planning 869The Nature of Disaster 871Understand System Resilience, High Availability, and Fault Tolerance 883Recovery Strategy 888Recovery Plan Development 898Training, Awareness, and Documentation 906Testing and Maintenance 907Summary 911Study Essentials 912Written Lab 913Review Questions 914Chapter 19 Investigations and Ethics 919Investigations 920Major Categories of Computer Crime 934Ethics 940Summary 944Study Essentials 945Written Lab 946Review Questions 947Chapter 20 Software Development Security 951Introducing Systems Development Controls 953Establishing Databases and Data Warehousing 984Storage Threats 994Understanding Knowledge‐ Based Systems 995Summary 998Study Essentials 998Written Lab 1000Review Questions 1001Chapter 21 Malicious Code and Application Attacks 1005Malware 1006Malware Prevention 1018Application Attacks 1021Injection Vulnerabilities 1024Exploiting Authorization Vulnerabilities 1030Exploiting Web Application Vulnerabilities 1033Application Security Controls 1038Secure Coding Practices 1044Summary 1048Study Essentials 1048Written Lab 1049Review Questions 1050Appendix A Answers to Review Questions 1055Chapter 1: Security Governance Through Principles and Policies 1056Chapter 2: Personnel Security and Risk Management Concepts 1059Chapter 3: Business Continuity Planning 1063Chapter 4: Laws, Regulations, and Compliance 1065Chapter 5: Protecting Security of Assets 1068Chapter 6: Cryptography and Symmetric Key Algorithms 1070Chapter 7: PKI and Cryptographic Applications 1072Chapter 8: Principles of Security Models, Design, and Capabilities 1074Chapter 9: Security Vulnerabilities, Threats, and Countermeasures 1077Chapter 10: Physical Security Requirements 1082Chapter 11: Secure Network Architecture and Components 1085Chapter 12: Secure Communications and Network Attacks 1089Chapter 13: Managing Identity and Authentication 1092Chapter 14: Controlling and Monitoring Access 1095Chapter 15: Security Assessment and Testing 1097Chapter 16: Managing Security Operations 1099Chapter 17: Preventing and Responding to Incidents 1102Chapter 18: Disaster Recovery Planning 1104Chapter 19: Investigations and Ethics 1106Chapter 20: Software Development Security 1108Chapter 21: Malicious Code and Application Attacks 1111Appendix B Answers to Written Labs 1115Chapter 1: Security Governance Through Principles and Policies 1116Chapter 2: Personnel Security and Risk Management Concepts 1116Chapter 3: Business Continuity Planning 1117Chapter 4: Laws, Regulations, and Compliance 1118Chapter 5: Protecting Security of Assets 1119Chapter 6: Cryptography and Symmetric Key Algorithms 1119Chapter 7: PKI and Cryptographic Applications 1120Chapter 8: Principles of Security Models, Design, and Capabilities 1121Chapter 9: Security Vulnerabilities, Threats, and Countermeasures 1121Chapter 10: Physical Security Requirements 1123Chapter 11: Secure Network Architecture and Components 1124Chapter 12: Secure Communications and Network Attacks 1125Chapter 13: Managing Identity and Authentication 1126Chapter 14: Controlling and Monitoring Access 1127Chapter 15: Security Assessment and Testing 1127Chapter 16: Managing Security Operations 1128Chapter 17: Preventing and Responding to Incidents 1129Chapter 18: Disaster Recovery Planning 1130Chapter 19: Investigations and Ethics 1131Chapter 20: Software Development Security 1131Chapter 21: Malicious Code and Application Attacks 1131Index 1133