CISSP全一册：第5版考试指南

需积分: 0 162 浏览量更新于2024-07-29 收藏 33.74MB PDF 举报

"CISSP ALL IN ONE FIFTH Edition 是一本全面的CISSP（Certified Information Systems Security Professional）考试指南，涵盖了信息安全和风险管理、访问控制、安全架构与设计等多个核心领域。" 本书旨在帮助读者准备CISSP认证考试，内容丰富，包括12个章节，覆盖了信息安全行业的关键话题： 1. 第一章：成为CISSP - 解释为什么选择成为CISSP，探讨CISSP考试的背景及其历史发展。 - 描述成为CISSP的路径，以及本书将涵盖的内容。 - 提供CISSP考试的备考建议和如何有效利用本书。 2. 第二章：安全趋势 - 探讨安全问题的重要性是如何逐渐浮现的。 - 分析安全的不同领域，以及从无害到严重威胁的发展过程。 - 展示安全威胁的证据和现实案例。 3. 第三章：信息安全与风险管理 - 深入讨论信息安全管理策略，包括风险评估、风险管理和应对策略。 - 阐述如何实施有效的信息安全控制措施。 4. 第四章：访问控制 - 讨论访问控制机制，如身份验证、授权和审计，以及如何防止未授权访问。 - 探讨物理和逻辑访问控制的实践方法。 5. 第五章：安全架构与设计 - 介绍安全架构的设计原则，包括网络、系统和应用层面的安全设计。 - 讨论安全工程和生命周期管理的实践。 6. 第六章：物理和环境安全 - 解析物理安全措施，如数据中心保护和设备安全。 - 讨论环境控制和灾难防护。 7. 第七章：电信与网络安全 - 阐述网络拓扑、协议和安全机制，如防火墙和入侵检测系统。 8. 第八章：密码学 - 介绍加密技术的基本原理，包括对称和非对称加密、数字签名和证书等。 9. 第九章：业务连续性和灾难恢复 - 讨论业务连续性计划和灾难恢复策略，以确保组织在危机中的运营能力。 10. 第十章：法律、法规、合规与调查 - 解析与信息安全相关的法律法规，以及如何确保组织的合规性。 - 探讨法律调查和电子发现的过程。 11. 第十一章：应用安全 - 关注软件开发安全，包括安全编码、漏洞管理及应用安全测试。 12. 第十二章：运行安全 - 讨论操作层面的安全，如日志管理、事件响应和安全运营中心（SOC）的运作。此外，书后还附有Security Content Automation Protocol (SCAP) 概览、关于CD-ROM的详细信息、词汇表和索引，为读者提供全面的学习资源。这本书对于想要获取CISSP认证或增强信息安全知识的专业人士来说，是一本不可或缺的参考资料。

Chapter 1: Becoming a CISSP

All-in-1 / CISSP All-in-One Exam Guide, 5th Ed. / Harris / 160217-8

require you to be an expert in every subject. However, the questions do require you to

be familiar with many different security subjects.

The CISSP exam comprises 250 multiple-choice questions, and you have six hours

to complete it. The questions are pulled from a much larger question bank to ensure

the exam is as unique as possible for each entrant. In addition, the test bank constantly

changes and evolves to more accurately reflect the real world of security. The exam

questions are continually rotated and replaced in the bank as necessary. Each question

has four answer choices, only one of which is correct. Only 225 questions are graded,

while 25 are used for research purposes. The 25 research questions are integrated into

the exam, so you won’t know which go toward your final grade. To pass the exam, you

need a minimum raw score of 700 points out of 1,000. Questions are weighted based

on their difficulty; not all questions are worth the same number of points. The exam is

not product- or vendor-oriented, meaning no questions will be specific to certain prod-

ucts or vendors (for instance, Windows 2000, Unix, or Cisco). Instead, you will be

tested on the security models and methodologies used by these types of systems.

(ISC)

, which stands for International Information Systems Security Certification

Consortium, has also added scenario-based questions to the CISSP exam. These ques-

tions present a short scenario to the test taker rather than asking the test taker to iden-

tify terms and/or concepts. A scenario-based question would be worded something like

“John returned from lunch and found that the company’s IDS indicated that a critical

server has had continuous ICMP traffic sent to it for over 45 minutes, which is taking

up 85 percent of the server’s CPU resource. What does John need to do at this point?”

The goal of the scenario-based questions is to ensure that test takers not only know

and understand the concepts within the CBK, but also can apply this knowledge to real-

life situations. This is more practical because in the real world, you won’t be challenged

by having someone asking you “What is the definition of collusion?” You need to know

how to detect and prevent collusion from taking place, in addition to knowing the

definition of the term.

NOTE NOTE Hundreds of scenario-based questions have been added to the

CD-ROM in the back of this book to help you prepare for this exam.

The (ISC)

requires candidates for any of the (ISC)

credentials to obtain an en-

dorsement of their candidature exclusively from an (ISC)

-certified professional in

good standing. The professional endorsing the candidate can hold any (ISC)

certifica-

tion, such as the CISSP, SSCP (Systems Security Certified Professional), or CAP (Certi-

fication and Accreditation Professional). This sponsor will vouch for your years of

experience.

After passing the exam, you will be asked to supply documentation, supported by a

sponsor, proving that you indeed have this type of experience. The sponsor must sign a

document vouching for the security experience you are submitting. So, make sure you

ch01.indd 3ch01.indd 3 10/7/2009 11:01:49 AM10/7/2009 11:01:49 AM

CISSP All-in-One Exam Guide

All-in-1 / CISSP All-in-One Exam Guide, 5th Ed. / Harris / 160217-8

have this sponsor lined up prior to registering for the exam and providing payment.

You don’t want to pay for and pass the exam, only to find you can’t find a sponsor for

the final step needed to achieve your certification.

The reason behind the sponsorship requirement is to ensure that those who achieve

the certification have real-world experience to offer companies. Book knowledge is ex-

tremely important for understanding theory, concepts, standards, and regulations, but

it can never replace hands-on experience. Proving your practical experience supports

the relevance of the certification.

A small sample group of individuals selected at random will be audited after pass-

ing the exam. The audit consists mainly of individuals from (ISC)

calling on the can-

didates’ sponsors and contacts to verify the test taker’s related experience.

What makes this exam challenging is that most candidates, although they work

in the security field, are not necessarily familiar with all ten CBK domains. If a secu-

rity professional is considered an expert in vulnerability testing or application security,

for example, she may not be familiar with physical security, cryptography, or security

practices. Thus, studying for this exam will broaden your knowledge of the secu-

rity field.

The exam questions address the ten CBK security domains, which are described in

Table 1-1.

(ISC)

attempts to keep up with changes in technology and methodologies in the

security field by adding numerous new questions to the test question bank each year.

These questions are based on current technologies, practices, approaches, and stan-

dards. For example, the CISSP exam given in 1998 did not have questions pertaining to

wireless security, but present and future exams will.

Other examples of material not on past exams include security governance, instant

messaging, phishing, botnets, VoIP, and spam. Though these subjects weren’t issues in

the past, they are now.

The test is based on internationally accepted information security standards and

practices. If you look at the (ISC)

web site for test dates and locations, you may find,

for example, that the same test is offered this Tuesday in California and next Wednesday

in Saudi Arabia.

If you do not pass the exam, you have the option of retaking it as soon as you like.

(ISC)

used to subject individuals to a waiting period before they could retake the exam,

but this rule has been removed. (ISC)

keeps track of which exam version you were

given on your first attempt and ensures you receive a different version for any retakes.

(ISC)

also provides a report to a CISSP candidate who did not pass the exam, detailing

the areas where the candidate was weakest. Though you could retake the exam soon

afterward, it’s wise to devote additional time to these weak areas to improve your score

on the retest.

ch01.indd 4ch01.indd 4 10/7/2009 11:01:50 AM10/7/2009 11:01:50 AM

Chapter 1: Becoming a CISSP

All-in-1 / CISSP All-in-One Exam Guide, 5th Ed. / Harris / 160217-8

Domain Description

Access Control This domain examines mechanisms and methods used to enable

administrators and managers to control what subjects can

access, the extent of their capabilities after authorization and

authentication, and the auditing and monitoring of these activities.

Some of the topics covered include:

• Access control security models

• Identification and authentication technologies and techniques

• Access control administration

• Single sign-on technologies

• Attack methods

Telecommunications and

Network Security

This domain examines internal, external, public, and private

communication systems; networking structures; devices; protocols;

and remote access and administration. Some of the topics

covered include:

• OSI model and layers

• Local area network (LAN), metropolitan area network (MAN),

and wide area network (WAN) technologies

• Internet, intranet, and extranet issues

• Virtual private networks (VPNs), firewalls, routers, bridges, and

repeaters

• Network topologies and cabling

• Attack methods

Information Security and

Risk Management

This domain examines the identification of company assets,

the proper way to determine the necessary level of protection

required, and what type of budget to develop for security

implementations, with the goal of reducing threats and monetary

loss. Some of the topics covered include:

• Data classification

• Policies, procedures, standards, and guidelines

• Risk assessment and management

• Personnel security, training, and awareness

Application Security This domain examines the security components within operating

systems and applications and how to best develop and measure

their effectiveness. It looks at software life cycles, change control,

and application security. Some of the topics covered include:

• Data warehousing and data mining

• Various development practices and their risks

• Software components and vulnerabilities

• Malicious code

Table 1-1 Security Domains That Make Up the CISSP CBK

ch01.indd 5ch01.indd 5 10/7/2009 11:01:50 AM10/7/2009 11:01:50 AM

CISSP All-in-One Exam Guide

All-in-1 / CISSP All-in-One Exam Guide, 5th Ed. / Harris / 160217-8

Domain Description

Cryptography This domain examines methods and techniques for disguising data

for protection purposes. This involves cryptography techniques,

approaches, and technologies. Some of the topics covered include:

• Symmetric versus asymmetric algorithms and uses

• Public key infrastructure (PKI) and hashing functions

• Encryption protocols and implementation

• Attack methods

Security Architecture and

Design

This domain examines concepts, principles, and standards for

designing and implementing secure applications, operating systems,

and systems. This covers international security measurement

standards and their meaning for different types of platforms. Some

of the topics covered include:

• Operating states, kernel functions, and memory mapping

• Enterprise architecture

• Security models, architectures, and evaluations

• Evaluation criteria: Trusted Computer Security Evaluation

Criteria (TCSEC), Information Technology Security Evaluation

Criteria (ITSEC), and Common Criteria

• Common flaws in applications and systems

• Certification and accreditation

Operations Security This domain examines controls over personnel, hardware,

systems, and auditing and monitoring techniques. It also covers

possible abuse channels and how to recognize and address them.

Some of the topics covered include:

• Administrative responsibilities pertaining to personnel and job

functions

• Maintenance concepts of antivirus, training, auditing, and

resource protection activities

• Preventive, detective, corrective, and recovery controls

• Standards, compliance, and due care concepts

• Security and fault tolerance technologies

Business Continuity

Planning (BCP) and Disaster

Recovery Planning (DRP)

This domain examines the preservation of business activities

when faced with disruptions or disasters. It involves the

identification of real risks, proper risk assessment, and

countermeasure implementation. Some of the topics covered

include:

• Business resource identification and value assignment

• Business impact analysis and prediction of possible losses

• Unit priorities and crisis management

• Plan development, implementation, and maintenance

Table 1-1 Security Domains That Make Up the CISSP CBK (continued)

ch01.indd 6ch01.indd 6 10/7/2009 11:01:50 AM10/7/2009 11:01:50 AM

Chapter 1: Becoming a CISSP

All-in-1 / CISSP All-in-One Exam Guide, 5th Ed. / Harris / 160217-8

CISSP: A Brief History

Historically, the field of computer and information security has not been a structured

and disciplined profession; rather, the field has lacked many well-defined professional

objectives and thus has often been misperceived.

In the mid-1980s, members of the computer security profession recognized they

needed a certification program that would give their profession structure and provide

ways for computer security professionals to demonstrate competence and to present

evidence of their qualifications. Establishing such a program would help the credibility

of the computer and information security profession as a whole and the individuals

who make up the profession.

In November 1988, the Special Interest Group for Computer Security (SIG-CS) of

the Data Processing Management Association (DPMA) brought together several organi-

zations interested in forming a security certification program. They included the Infor-

mation Systems Security Association (ISSA), the Canadian Information Processing

Society (CIPS), the Computer Security Institute (CSI), Idaho State University, and sev-

eral U.S. and Canadian government agencies. As a voluntary joint effort, these organi-

zations developed the necessary components to offer a full-fledged security certification

for interested professionals. (ISC)

was formed in mid-1989 as a nonprofit corporation

to develop a security certification program for information systems security practitioners.

Domain Description

Legal Regulations,

Compliance, and

Investigation

This domain examines computer crimes, laws, and regulations. It

includes techniques for investigating a crime, gathering evidence,

and handling procedures. It also covers how to develop and

implement an incident-handling program. Some of the topics

covered include:

• Types of laws, regulations, and crimes

• Licensing and software piracy

• Export and import laws and issues

• Evidence types and admissibility into court

• Incident handling

Physical (Environmental)

Security

This domain examines threats, risks, and countermeasures to

protect facilities, hardware, data, media, and personnel. This involves

facility selection, authorized entry methods, and environmental and

safety procedures. Some of the topics covered include:

• Restricted areas, authorization methods, and controls

• Motion detectors, sensors, and alarms

• Intrusion detection

• Fire detection, prevention, and suppression

• Fencing, security guards, and security badge types

Table 1-1 Security Domains That Make Up the CISSP CBK (continued)

ch01.indd 7ch01.indd 7 10/7/2009 11:01:50 AM10/7/2009 11:01:50 AM

剩余1163页未读，继续阅读

zhangsong_112

粉丝: 0
资源: 1

CISSP全一册：第5版考试指南

CISSP全一册考试指南： Seventh Edition

CISSP全一册备考宝典PDF版

CISSP全攻略：信息安全管理与风险控制

cissp all in one

CISSP All in one

CISSP ALL IN ONE

cissp all in one 3rd

CISSP all in one, CISSP 安全指南

cissp all in one.2005

cissp all in one 3th edition

最新资源