CISSP Cert Guide
5th Edition
Published on 12. September 2024
944 pages
978-0-13-534390-6 (ISBN)
Description
In this comprehensive study guide, two leading experts help you master all the topics you need to know to succeed on the latest CISSP exam and advance your career in IT security. Their concise, focused approach explains every exam objective from a real-world perspective, helping you quickly identify weaknesses and retain everything you need to know.
Every feature of this book supports both efficient exam preparation and long-term mastery:
Opening Topics Lists identify the topics you need to learn in each chapter and list (ISC) (2)'s official exam objectives
Key Topic figures, tables, and lists call attention to the information that's most crucial for exam success
Exam Preparation Tasks enable you to review key topics, complete memory tables, define key terms, work through scenarios, and answer review questions...going beyond mere facts to master the concepts that are crucial to passing the exam and enhancing your career
Key Terms are listed in each chapter and defined in a complete glossary, explaining all the field's essential terminology
This study guide helps you master all the topics on the latest CISSP exam, deepening your knowledge of:
Security and Risk Management
Asset Security
Security Architecture and Engineering
Communication and Network Security
Identity and Access Management (IAM)
Security Assessment and Testing
Security Operations
Software Development Security
Every feature of this book supports both efficient exam preparation and long-term mastery:
Opening Topics Lists identify the topics you need to learn in each chapter and list (ISC) (2)'s official exam objectives
Key Topic figures, tables, and lists call attention to the information that's most crucial for exam success
Exam Preparation Tasks enable you to review key topics, complete memory tables, define key terms, work through scenarios, and answer review questions...going beyond mere facts to master the concepts that are crucial to passing the exam and enhancing your career
Key Terms are listed in each chapter and defined in a complete glossary, explaining all the field's essential terminology
This study guide helps you master all the topics on the latest CISSP exam, deepening your knowledge of:
Security and Risk Management
Asset Security
Security Architecture and Engineering
Communication and Network Security
Identity and Access Management (IAM)
Security Assessment and Testing
Security Operations
Software Development Security
More details
Series
Edition
5th edition
Language
English
Place of publication
Upper Saddle River
United States
Publishing group
Pearson Education (US)
Target group
Professional and scholarly
File size
57,86 MB
ISBN-13
978-0-13-534390-6 (9780135343906)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Classification
Other editions
Additional editions
Robin Abernathy | Darren Hayes
CISSP Cert Guide
Book
02/2025
5th Edition
Pearson It Certification
€74.50
Shipment within 15-20 days
Persons
Robin M. Abernathy has been working in the IT certification preparation industry for more than 20 years. She has written and edited certification preparation materials for many (ISC)2, Microsoft, CompTIA, PMI, ITIL, ISACA, and GIAC certifications and holds multiple IT certifications from these vendors. Robin provides training on computer hardware and software, networking, security, and project management. Over the past decade, she has ventured into the traditional publishing industry by technically editing several publications and co-authoring Pearson's CISSP Cert Guide and CASP+ Cert Guide and authoring Pearson's Project+ Cert Guide. She presents at technical conferences and hosts webinars on IT certification topics.
Dr. Darren R. Hayes has close to 20 years of academic and professional experience in computer security and digital forensics. He has authored numerous publications in these fields, including A Practical Guide to Digital Forensics Investigations, which is published by Pearson. He is Associate Professor at Pace University, where he is the founder and director of the Seidenberg Digital Forensics Research Lab. He holds numerous IT certifications in security and digital forensics and holds a PhD from Sapienza University in Italy and a doctorate from Pace University. Darren is also a professional digital forensics examiner and has supported both criminal and civil investigations over the past decade and a half. He has also been declared an expert witness in federal court.
Dr. Darren R. Hayes has close to 20 years of academic and professional experience in computer security and digital forensics. He has authored numerous publications in these fields, including A Practical Guide to Digital Forensics Investigations, which is published by Pearson. He is Associate Professor at Pace University, where he is the founder and director of the Seidenberg Digital Forensics Research Lab. He holds numerous IT certifications in security and digital forensics and holds a PhD from Sapienza University in Italy and a doctorate from Pace University. Darren is also a professional digital forensics examiner and has supported both criminal and civil investigations over the past decade and a half. He has also been declared an expert witness in federal court.
Content
Introduction xlix
Chapter 1 Security and Risk Management 5
Foundation Topics 6
Security Terms 6
Security Governance Principles 11
Compliance 40
Legal and Regulatory Issues 42
Investigation Types 65
Professional Ethics 70
Security Documentation 72
Business Continuity 76
Personnel Security Policies and Procedures 89
Risk Management Concepts 95
Geographical Threats 133
Threat Modeling 142
Security Risks in the Supply Chain 148
Security Education, Training, and Awareness 153
Exam Preparation Tasks 155
Review All Key Topics 155
Complete the Tables and Lists from Memory 157
Define Key Terms 157
Answer Review Questions 158
Answers and Explanations 164
Chapter 2 Asset Security 171
Foundation Topics 172
Asset Security Concepts 172
Identify and Classify Information and Assets 175
Information and Asset Handling Requirements 183
Provision Resources Securely 185
Data Life Cycle 186
Asset Retention 201
Data Security Controls 203
Exam Preparation Tasks 211
Review All Key Topics 211
Define Key Terms 211
Answer Review Questions 212
Answers and Explanations 213
Chapter 3 Security Architecture and Engineering 219
Foundation Topics 220
Information Systems Life Cycle 220
Engineering Processes Using Secure Design Principles 223
Security Model Concepts 231
System Security Evaluation Models 255
Certification and Accreditation 267
Control Selection Based on Systems Security Requirements 268
Security Capabilities of Information Systems 269
Security Architecture Maintenance 272
Vulnerabilities of Security Architectures, Designs, and Solution Elements 273
Vulnerabilities in Web-Based Systems 296
Vulnerabilities in Mobile Systems 299
Vulnerabilities in Embedded Systems 304
Cryptographic Solutions 305
Cryptographic Types 317
Symmetric Algorithms 325
Asymmetric Algorithms 332
Public Key Infrastructure and Digital Certificates 335
Key Management Practices 343
Message Integrity 347
Digital Signatures and Non-repudiation 354
Applied Cryptography 354
Cryptanalytic Attacks 355
Digital Rights Management 360
Site and Facility Design 362
Site and Facility Security Controls 368
Exam Preparation Tasks 379
Review All Key Topics 379
Complete the Tables and Lists from Memory 381
Define Key Terms 381
Answer Review Questions 382
Answers and Explanations 387
Chapter 4 Communication and Network Security 391
Foundation Topics 392
Secure Network Design Principles 392
IP Networking 403
Protocols and Services 435
Converged Protocols 443
Wireless Networks 448
Communications Cryptography 468
Secure Network Components 473
Secure Communication Channels 520
Network Attacks 535
Exam Preparation Tasks 547
Review All Key Topics 547
Define Key Terms 548
Answer Review Questions 550
Answers and Explanations 555
Chapter 5 Identity and Access Management (IAM) 561
Foundation Topics 562
Access Control Process 562
Physical and Logical Access to Assets 563
Identification and Authentication Concepts 568
Identification and Authentication Implementation 588
Identity as a Service (IDaaS) Implementation 602
Third-Party Identity Services Integration 602
Authorization Mechanisms 603
Provisioning Life Cycle 612
Access Control Threats 618
Prevent or Mitigate Access Control Threats 625
Exam Preparation Tasks 625
Review All Key Topics 625
Define Key Terms 626
Answer Review Questions 627
Answers and Explanations 630
Chapter 6 Security Assessment and Testing 635
Foundation Topics 636
Design and Validate Assessment and Testing Strategies 636
Conduct Security Control Testing 639
Collect Security Process Data 655
Analyze Test Outputs and Generate a Report 659
Conduct or Facilitate Security Audits 659
Exam Preparation Tasks 661
Review All Key Topics 661
Define Key Terms 662
Answer Review Questions 662
Answers and Explanations 665
Chapter 7 Security Operations 673
Foundation Topics 674
Investigations 674
Logging and Monitoring Activities 690
Configuration and Change Management 697
Security Operations Concepts 702
Resource Protection 707
Incident Management 719
Detective and Preventive Measures 724
Patch and Vulnerability Management 729
Recovery Strategies 729
Disaster Recovery 747
Testing Disaster Recovery Plans 751
Business Continuity Planning and Exercises 753
Physical Security 754
Personnel Safety and Security 760
Exam Preparation Tasks 763
Review All Key Topics 763
Define Key Terms 764
Answer Review Questions 764
Answers and Explanations 768
Chapter 8 Software Development Security 773
Foundation Topics 774
Software Development Concepts 774
Security in the System and Software Development Life Cycle 783
Security Controls in Development 806
Assess Software Security Effectiveness 815
Security Impact of Acquired Software 817
Exam Preparation Tasks 825
Review All Key Topics 825
Define Key Terms 825
Answer Review Questions 826
Answers and Explanations 830
Chapter 9 Final Preparation 835
Tools for Final Preparation 835
Suggested Plan for Final Review/Study 839
Summary 840
Online Elements
Appendix A Memory Tables
Appendix B Memory Tables Answer Key
Glossary
9780135343999, TOC, 7/24/24
Chapter 1 Security and Risk Management 5
Foundation Topics 6
Security Terms 6
Security Governance Principles 11
Compliance 40
Legal and Regulatory Issues 42
Investigation Types 65
Professional Ethics 70
Security Documentation 72
Business Continuity 76
Personnel Security Policies and Procedures 89
Risk Management Concepts 95
Geographical Threats 133
Threat Modeling 142
Security Risks in the Supply Chain 148
Security Education, Training, and Awareness 153
Exam Preparation Tasks 155
Review All Key Topics 155
Complete the Tables and Lists from Memory 157
Define Key Terms 157
Answer Review Questions 158
Answers and Explanations 164
Chapter 2 Asset Security 171
Foundation Topics 172
Asset Security Concepts 172
Identify and Classify Information and Assets 175
Information and Asset Handling Requirements 183
Provision Resources Securely 185
Data Life Cycle 186
Asset Retention 201
Data Security Controls 203
Exam Preparation Tasks 211
Review All Key Topics 211
Define Key Terms 211
Answer Review Questions 212
Answers and Explanations 213
Chapter 3 Security Architecture and Engineering 219
Foundation Topics 220
Information Systems Life Cycle 220
Engineering Processes Using Secure Design Principles 223
Security Model Concepts 231
System Security Evaluation Models 255
Certification and Accreditation 267
Control Selection Based on Systems Security Requirements 268
Security Capabilities of Information Systems 269
Security Architecture Maintenance 272
Vulnerabilities of Security Architectures, Designs, and Solution Elements 273
Vulnerabilities in Web-Based Systems 296
Vulnerabilities in Mobile Systems 299
Vulnerabilities in Embedded Systems 304
Cryptographic Solutions 305
Cryptographic Types 317
Symmetric Algorithms 325
Asymmetric Algorithms 332
Public Key Infrastructure and Digital Certificates 335
Key Management Practices 343
Message Integrity 347
Digital Signatures and Non-repudiation 354
Applied Cryptography 354
Cryptanalytic Attacks 355
Digital Rights Management 360
Site and Facility Design 362
Site and Facility Security Controls 368
Exam Preparation Tasks 379
Review All Key Topics 379
Complete the Tables and Lists from Memory 381
Define Key Terms 381
Answer Review Questions 382
Answers and Explanations 387
Chapter 4 Communication and Network Security 391
Foundation Topics 392
Secure Network Design Principles 392
IP Networking 403
Protocols and Services 435
Converged Protocols 443
Wireless Networks 448
Communications Cryptography 468
Secure Network Components 473
Secure Communication Channels 520
Network Attacks 535
Exam Preparation Tasks 547
Review All Key Topics 547
Define Key Terms 548
Answer Review Questions 550
Answers and Explanations 555
Chapter 5 Identity and Access Management (IAM) 561
Foundation Topics 562
Access Control Process 562
Physical and Logical Access to Assets 563
Identification and Authentication Concepts 568
Identification and Authentication Implementation 588
Identity as a Service (IDaaS) Implementation 602
Third-Party Identity Services Integration 602
Authorization Mechanisms 603
Provisioning Life Cycle 612
Access Control Threats 618
Prevent or Mitigate Access Control Threats 625
Exam Preparation Tasks 625
Review All Key Topics 625
Define Key Terms 626
Answer Review Questions 627
Answers and Explanations 630
Chapter 6 Security Assessment and Testing 635
Foundation Topics 636
Design and Validate Assessment and Testing Strategies 636
Conduct Security Control Testing 639
Collect Security Process Data 655
Analyze Test Outputs and Generate a Report 659
Conduct or Facilitate Security Audits 659
Exam Preparation Tasks 661
Review All Key Topics 661
Define Key Terms 662
Answer Review Questions 662
Answers and Explanations 665
Chapter 7 Security Operations 673
Foundation Topics 674
Investigations 674
Logging and Monitoring Activities 690
Configuration and Change Management 697
Security Operations Concepts 702
Resource Protection 707
Incident Management 719
Detective and Preventive Measures 724
Patch and Vulnerability Management 729
Recovery Strategies 729
Disaster Recovery 747
Testing Disaster Recovery Plans 751
Business Continuity Planning and Exercises 753
Physical Security 754
Personnel Safety and Security 760
Exam Preparation Tasks 763
Review All Key Topics 763
Define Key Terms 764
Answer Review Questions 764
Answers and Explanations 768
Chapter 8 Software Development Security 773
Foundation Topics 774
Software Development Concepts 774
Security in the System and Software Development Life Cycle 783
Security Controls in Development 806
Assess Software Security Effectiveness 815
Security Impact of Acquired Software 817
Exam Preparation Tasks 825
Review All Key Topics 825
Define Key Terms 825
Answer Review Questions 826
Answers and Explanations 830
Chapter 9 Final Preparation 835
Tools for Final Preparation 835
Suggested Plan for Final Review/Study 839
Summary 840
Online Elements
Appendix A Memory Tables
Appendix B Memory Tables Answer Key
Glossary
9780135343999, TOC, 7/24/24
