
ISC2 SSCP Systems Security Certified Practitioner Official Study Guide
Description
Alles über E-Books | Antworten auf Fragen rund um E-Books, Kopierschutz und Dateiformate finden Sie in unserem Info- & Hilfebereich.
The only SSCP study guide officially approved by (ISC)2
The (ISC)2 Systems Security Certified Practitioner (SSCP) certification is a well-known vendor-neutral global IT security certification. The SSCP is designed to show that holders have the technical skills to implement, monitor, and administer IT infrastructure using information security policies and procedures.
This comprehensive Official Study Guide-the only study guide officially approved by (ISC)2-covers all objectives of the seven SSCP domains.
- Security Operations and Administration
- Access Controls
- Risk Identification, Monitoring, and Analysis
- Incident Response and Recovery
- Cryptography
- Network and Communications Security
- Systems and Application Security
This updated Third Edition covers the SSCP exam objectives effective as of November 2021. Much of the new and more advanced knowledge expected of an SSCP is now covered in a new chapter "Cross-Domain Challenges." If you're an information security professional or student of cybersecurity looking to tackle one or more of the seven domains of the SSCP, this guide gets you prepared to pass the exam and enter the information security workforce with confidence.
More details
Other editions
Additional editions

Person
ABOUT THE AUTHOR
Michael S. Wills, SSCP, CISSP, CAMS, is Assistant Professor of Applied Information Technologies in the College of Business at the Embry-Riddle Aeronautical University's Worldwide Campus. He has many years of experience designing, building, and operating cutting-edge secure systems, and wrote (ISC)2's official training courses for both the SSCP and CISSP. He is also the creator of ERAU's Master of Science in Information Security and Assurance degree program.
Content
Introduction xxv
Assessment Test xlviii
Part I Getting Started as an SSCP 1
Chapter 1 The Business Case for Decision Assurance and Information Security 3
Information: The Lifeblood of Business 4
Policy, Procedure, and Process: How Business Gets Business Done 10
Who Runs the Business? 20
Summary 24
Exam Essentials 24
Review Questions 26
Chapter 2 Information Security Fundamentals 33
The Common Needs for Privacy, Confidentiality, Integrity, and Availability 34
Training and Educating Everybody 47
SSCPs and Professional Ethics 47
Summary 49
Exam Essentials 50
Review Questions 54
Part II Integrated Risk Management and Mitigation 61
Chapter 3 Integrated Information Risk Management 63
It's a Dangerous World 64
The Four Faces of Risk 75
Getting Integrated and Proactive with Information Defense 83
Risk Management: Concepts and Frameworks 89
Risk Assessment 95
Four Choices for Limiting or Containing Damage 107
Summary 114
Exam Essentials 114
Review Questions 120
Chapter 4 Operationalizing Risk Mitigation 127
From Tactical Planning to Information Security Operations 128
Operationalizing Risk Mitigation: Step by Step 134
The Ongoing Job of Keeping Your Baseline Secure 164
Ongoing, Continuous Monitoring 174
Reporting to and Engaging with Management 182
Summary 183
Exam Essentials 183
Review Questions 189
Part III The Technologies of Information Security 197
Chapter 5 Communications and Network Security 199
Trusting Our Communications in a Converged World 200
Internet Systems Concepts 206
Two Protocol Stacks, One Internet 218
Wireless Network Technologies 240
IP Addresses, DHCP, and Subnets 243
IPv4 vs. IPv6: Important Differences and Options 248
CIANA Layer by Layer 251
Securing Networks as Systems 262
Summary 273
Exam Essentials 273
Review Questions 280
Chapter 6 Identity and Access Control 285
Identity and Access: Two Sides of the Same CIANA+PS Coin 286
Identity Management Concepts 288
Access Control Concepts 295
Network Access Control 305
Implementing and Scaling IAM 310
User and Entity Behavior Analytics (UEBA) 329
Zero Trust Architectures 332
Summary 333
Exam Essentials 334
Review Questions 343
Chapter 7 Cryptography 349
Cryptography: What and Why 350
Building Blocks of Digital Cryptographic Systems 358
Keys and Key Management 367
"Why Isn't All of This Stuff Secret?" 373
Cryptography and CIANA+PS 375
Public Key Infrastructures 381
Applying Cryptography to Meet Different Needs 399
Managing Cryptographic Assets and Systems 405
Measures of Merit for Cryptographic Solutions 407
Attacks and Countermeasures 408
PKI and Trust: A Recap 418
On the Near Horizon 420
Summary 423
Exam Essentials 424
Review Questions 429
Chapter 8 Hardware and Systems Security 435
Infrastructure Security Is Baseline Management 437
Securing the Physical Context 442
Infrastructures 101 and Threat Modeling 444
Endpoint Security 457
Malware: Exploiting the Infrastructure's Vulnerabilities 462
Privacy and Secure Browsing 466
"The Sin of Aggregation" 469
Updating the Threat Model 469
Managing Your Systems' Security 470
Summary 471
Exam Essentials 472
Review Questions 478
Chapter 9 Applications, Data, and Cloud Security 483
It's a Data-Driven World...At the Endpoint 484
Software as Appliances 487
Applications Lifecycles and Security 490
CIANA+PS and Applications Software Requirements 498
Application Vulnerabilities 504
"Shadow IT:" The Dilemma of the User as Builder 507
Information Quality and Information Assurance 511
Protecting Data in Motion, in Use, and at Rest 514
Into the Clouds: Endpoint App and Data Security Considerations 522
Legal and Regulatory Issues 533
Countermeasures: Keeping Your Apps and Data Safe and Secure 535
Summary 536
Exam Essentials 537
Review Questions 548
Part IV People Power: What Makes or Breaks Information Security 555
Chapter 10 Incident Response and Recovery 557
Defeating the Kill Chain One Skirmish at a Time 558
Harsh Realities of Real Incidents 564
Incident Response Framework 566
Preparation 571
Detection and Analysis 578
Containment and Eradication 584
Recovery: Getting Back to Business 587
Post-Incident Activities 590
Summary 594
Exam Essentials 595
Review Questions 601
Chapter 11 Business Continuity via Information Security and People Power 607
What Is a Disaster? 608
Surviving to Operate: Plan for It! 609
Timelines for BC/DR Planning and Action 615
Options for Recovery 617
Cloud- Based "Do- Over" Buttons for Continuity, Security, and Resilience 623
People Power for BC/DR 626
Security Assessment: For BC/DR and Compliance 633
Converged Communications: Keeping Them Secure During BC/DR Actions 634
Summary 637
Exam Essentials 637
Review Questions 641
Chapter 12 Cross-Domain Challenges 647
Operationalizing Security Across the Immediate and Longer Term 648
Supply Chains, Security, and the SSCP 657
Other Dangers on the Web and Net 662
On Our Way to the Future 666
Enduring Lessons 672
Your Next Steps 677
At the Close 678
Exam Essentials 678
Review Questions 683
Appendix Answers to Review Questions 689
Chapter 1: The Business Case for Decision Assurance and Information Security 690
Chapter 2: Information Security Fundamentals 693
Chapter 3: Integrated Information Risk Management 695
Chapter 4: Operationalizing Risk Mitigation 698
Chapter 5: Communications and Network Security 701
Chapter 6: Identity and Access Control 704
Chapter 7: Cryptography 707
Chapter 8: Hardware and Systems Security 709
Chapter 9: Applications, Data, and Cloud Security 712
Chapter 10: Incident Response and Recovery 715
Chapter 11: Business Continuity via Information Security and People Power 718
Chapter 12: Cross- Domain Challenges 722 Index 727
Introduction
Congratulations on choosing to become a Systems Security Certified Practitioner (SSCP)! In making this choice, you're signing up to join the professionals who strive to keep our information-based modern world safe, secure, and reliable. SSCPs and other information security professionals help businesses and organizations keep private data private and help to ensure that published and public-facing information stays unchanged and unhacked. They help ensure the safe, secure, reliable, and trustworthy operation of our financial, energy, communications, transportation, and many other critical infrastructure systems we all rely upon.
Whether you are new to the fields of information security, information assurance, or cybersecurity, or you've been working with these concepts, tools, and ideas for some time now, this book is here to help you grow your knowledge, skills, and abilities as a systems security professional.
Let's see how!
About This Book
You're here because you want to learn what it takes to be an SSCP. You know this will demand that you build a solid understanding of many different concepts, not only as theories but also as practical tasks you can do to help make information systems more secure. You know you'll need to master a number of key definitions and be able to apply those definitions to real-world situations-you'll need to operationalize those definitions and concepts by turning them into the step-by-step operations that make security become real.
This book is your study guide. It guides you along your personal journey as you learn and master these ideas and technologies. It takes you on that journey concept by concept, starting with simple, fundamental ideas and growing them to the level of power and complexity you will need, on the job, as an SSCP. That is this book's focus, its purpose, and design.
(ISC)2 periodically updates the technical scope-the breadth and depth-of their various certifications to keep them more closely aligned with the needs of the security profession and to better focus them on the current tactics, techniques, and strategies that those professionals are using, day after day. This new edition of the Study Guide has also been updated to reflect and support readers like you as you work to strengthen your own knowledge of information systems security, and the proficiency of your skills with those concepts.
That means this book is also a valuable reference to have with you on the job, or as you continue to learn more about information security, information risk management, or any of a number of other related subject areas. You'll find it more than covers the topic domains that (ISC)2 requires you to demonstrate competency in, should you want to earn your Systems Security Certified Practitioner credential.
Go to https://www.wiley.com/go/sybextestprep to register and gain access to the Sybex interactive online learning environment and test bank with study tools.
What Makes This the "Official" Study Guide for the SSCP?
Good question! This book exists because (ISC)2 wanted a book that would teach as well as guide and explain as well as capture the common knowledge about information assurance-keeping information systems safe and secure by protecting their information assets that all SSCPs should have at their mental fingertips. As creators of the SSCP program, (ISC)2 defines that common body of knowledge, in continuous consultation with system security experts and practitioners from business, industry, government, and academia from around the world.
What Is an SSCP?
The SSCP is actually three things in one: a standard of excellence, a credential that attests to demonstrated excellence, and a person who has earned that credential. Perhaps instead of asking "what" is an SSCP, we should also ask why, who, and how:
- SSCP as standard of excellence. The International Information System Security Certification Consortium, or (ISC)2, created this standard to reflect the continually evolving needs for people who can help all sorts of organizations around the world keep their information systems safe, secure, confidential, private, reliable, and trustworthy. Working with businesses, nonprofits, academic researchers, and the thought leaders of the cybersecurity and information assurance communities of practice, they developed the list of subject areas, or domains, that are the SSCP as a standard. That standard is set as the starting point for your professional journey as an information security specialist. Its focus is on hands-on technical knowledge combined with procedural and administrative awareness. The knowledge, skills, and abilities that make up the SSCP domains become the foundation for other, more advanced certifications (and hence standards).
- SSCP as a credential. Earning an SSCP certification attests to the fact that you have solid working knowledge of the topic domains that are the SSCP. As a published standard of excellence, this certification or credential is portable-people in the information system business, or who know the needs of their own organizations for information security, recognize and respect this credential. People can easily consult (ISC)2's published standards for the SSCP and understand what it means. It is a portable, stackable credential, meaning that it can clearly pave the way for you to take on job responsibilities that need the knowledge and skills it attests to, and demonstrates you have the foundational knowledge to earn other credentials that can build on it.
- SSCP as a goal or objective. The SSCP as a standard answers the needs of hiring managers when they seek the right kind of people to help protect their organization's information, their information systems and processes, their IT infrastructure, and their ability to make informed decisions in reliable, timely ways. Training managers or functional department leaders in various organizations can design their own internal training and skills development programs around the SSCP, knowing that it is a reliable standard for information system security knowledge and experience. They can look at job descriptions or task designs and use the SSCP as a standard to identify whether the job and the SSCP are a good fit with each other or if other significant knowledge and skills will be needed by people filling that position.
- SSCP as a person. By choosing to earn an SSCP credential, you're declaring to yourself and to others that you're willing to hold yourself to a respected and recognized standard of excellence. You're willing to master what that standard asks of you, not only on the technical, physical, and administrative aspects of information security and assurance, but also on its legal and ethical requirements.
The Systems Security Certified Practitioner is thus a person who does the job of systems security to a level of competency that meets or exceeds that standard and who has earned a credential as testament to their knowledge and skills. It is a foundational certification, based on the knowledge and skills that people should already have when they first start out as an information security professional.
Let's operationalize that set of words by showing them in action:
- Systems-Generally, a system is a collection or set of elements that interconnect and interact with each other to fulfill or achieve a larger purpose or objective. In this context, we mean information systems. Information systems are the collected sets of hardware, software, databases, and data sets; the communications, networking, and other technologies that connect all of those elements together into a cohesive, working whole; and the people who use them and depend on them to achieve their goals and objectives.
- Security-Again, generally speaking, security is the set of plans, procedures, and actions that keep something safe from harm, damage, or loss, through accident, acts of nature, or deliberate actions taken by people. Applying that to information systems, we see that information systems security is everything we need to do during design, implementation, operational use, and maintenance to keep all aspects of an information system protected against accidental or deliberate damage; it includes keeping its information free from unauthorized changes or viewing; and it keeps those systems up and running so that the information is there when people need it to get their jobs done.
- Certified-The person holding this credential (or certification) has earned the right to do so by means of having demonstrated their mastery of the knowledge, skills, and attitudes that are defined to be the subject area or domain of the certification. Specifically, an SSCP has passed the certification exam and demonstrated the required work experience in the field of information security, as specified by the SSCP subject area domains.
- Practitioner-A person whose professional or workplace duties, responsibilities, and tasks has them using the knowledge, skills, and abilities required by the standard to have earned the certification. There's a degree of practice in the definition of practitioner, of course; as a practitioner, you are continually doing the stuff of your profession, and in doing so you continue to learn it better as well as refine, polish, and...
System requirements
File format: ePUB
Copy protection: Adobe-DRM (Digital Rights Management)
System requirements:
- Computer (Windows; MacOS X; Linux): Install the free reader Adobe Digital Editions prior to download (see eBook Help).
- Tablet/smartphone (Android; iOS): Install the free app Adobe Digital Editions or the app PocketBook before downloading (see eBook Help).
- E-reader: Bookeen, Kobo, Pocketbook, Sony, Tolino and many more (not Kindle).
The file format ePub works well for novels and non-fiction books – i.e., „flowing” text without complex layout. On an e-reader or smartphone, line and page breaks automatically adjust to fit the small displays.
This eBook uses Adobe-DRM, a „hard” copy protection. If the necessary requirements are not met, unfortunately you will not be able to open the eBook. You will therefore need to prepare your reading hardware before downloading.
Please note: We strongly recommend that you authorise using your personal Adobe ID after installation of any reading software.
For more information, see our ebook Help page.