Introduction
This Rapid Review is designed to assist you with studying for the (ISC)2 CISSP exam. The Rapid Review series is designed for exam candidates who already have a good grasp of the exam objectives through a combination of experience, skills, and study and could use a concise review guide to help them assess their readiness for the exam.
The CISSP exam is aimed at an IT security professional who has a minimum of five years of direct full-time security work experience in two or more of the 10 domains of the (ISC)2 CISSP Common Body of Knowledge (CBK). One year can be waived for certain college degrees and technical certifications.
Candidates who take this exam should have the knowledge and skills required to do the following:
Identify risk and participate in risk mitigation activities
Provide infrastructure, application, operational, and information security
Apply security controls to maintain confidentiality, integrity, and availability
Identify appropriate technologies and products
Operate with an awareness of applicable policies, laws, and regulations
It is important to note that real-world experience with security is required prior to earning the CISSP certification and that having practical knowledge is a key component to achieving a passing score.
This book reviews every concept described in the following exam objective domains:
1.0 Access Control
2.0 Telecommunications and Network Security
3.0 Information Security Governance & Risk Management
4.0 Software Development Security
5.0 Cryptography
6.0 Security Architecture & Design
7.0 Operations Security
8.0 Business Continuity & Disaster Recovery Planning
9.0 Legal, Regulations, Investigations and Compliance
10.0 Physical (Environmental) Security
This is a Rapid Review and not a comprehensive guide such as the forthcoming CISSP Training Kit (Microsoft Press, 2013). The book covers every exam objective on the CISSP exam but will not necessarily cover every exam question. (ISC)2 regularly adds new questions to the exam, making it impossible for this (or any) book to provide every answer. Instead, this book is designed to supplement your existing independent study and real-world experience.
If you encounter a topic in this book with which you do not feel completely comfortable, you can visit the links described in the text in addition to researching the topic further by using other websites, as well as consulting support forums.
Note
The Rapid Review is designed to assess your readiness for the CISSP exam. It is not designed as a comprehensive exam preparation guide. If you need that level of training for any or all of the exam objectives covered in this book, we suggest the forthcoming CISSP Training Kit (ISBN: 9780735657823). The Training Kit will provide comprehensive coverage of each CISSP exam objective, along with exercises, review questions, and practice tests. The Training Kit will also include a discount voucher for the exam.
(ISC)2 professional certification program
(ISC)2 professional certifications cover the technical skills and knowledge needed to succeed in different IT careers. The CISSP certification is a vendor-neutral credential. An exam is an internationally recognized validation of skills and knowledge and is used by organizations and professionals around the globe. (ISC)2 CISSP certification is ISO 17024 Accredited (Personnel Certification Accreditation) and, as such, undergoes regular reviews and updates to the exam objectives. (ISC)2 exam objectives reflect the subject areas in an edition of an exam and result from subject matter expert workshops and industry-wide survey results regarding the skills and knowledge required of a professional with a number of years of experience.
Note
MORE INFO For a full list of (ISC)2 certifications, go to https://www.isc2.org/credentials/.
Acknowledgments
Books like this are never by just one or two people but instead are created with the combined efforts of a large group of people. Im grateful for the help and support I received from multiple individuals at OReilly and Microsoft Press. Im especially grateful for the outstanding technical input provided by Andrew Brice, the technical editor.
Support & feedback
The following sections provide information on errata, book support, feedback, and contact information.
Errata
Weve made every effort to ensure the accuracy of this book and its companion content. Any errors that have been reported since this book was published are listed on our Microsoft Press site: http://www.microsoftpressstore.com/title/9780735666788
If you find an error that is not already listed, you can report it to us through the same page.
If you need additional support, email Microsoft Press Book Support at .
Please note that product support for Microsoft software is not offered through the addresses above.
We want to hear from you
At Microsoft Press, your satisfaction is our top priority and your feedback our most valuable asset. Please tell us what you think of this book at http://www.microsoft.com/learning/booksurvey.
The survey is short, and we read every one of your comments and ideas. Thanks in advance for your input!
Stay in touch
Lets keep the conversation going! Were on Twitter: http://twitter.com/MicrosoftPress.
Preparing for the Exam
Certification exams are a great way to build your resume and let the world know about your level of expertise. Certification exams validate your on-the-job experience and product knowledge. Although there is no substitute for on-the-job experience, preparation through study and hands-on practice can help you prepare for the exam. We recommend that you augment your exam preparation plan by using a combination of available study materials and courses. For example, you might use the Rapid Review and another training kit for your at home preparation and take an (ISC)2 CISSP professional certification course for the classroom experience. Choose the combination that you think works best for you.
Chapter 1. Access Control
The Access Control domain covers a variety of different controls used to identify subjects, authenticate them, and control the access they are granted to different objects by controlling rights and permissions. Audit trails are an important element of accounting and logging and, combined with effective authentication, provide individual accountability. Access control attacks are common, and its important for security professionals to have a basic understanding of evaluating threats and analyzing vulnerabilities to determine overall risk. Ideally, access controls are implemented to fully support an organizations security policy, and a way to verify this is through access reviews and audits. These reviews and audits can also detect problems in the identity and access provisioning life cycle, such as inactive accounts that have not been disabled.
This chapter covers the following objectives:
Objective 1.1: Control access by applying the following concepts/methodologies/techniques