掌握计算机安全十大领域的CISSP备考指南

需积分: 4 19 浏览量更新于2024-08-01 收藏 5.7MB PDF 举报

"The CISSP Prep Guide 是一本旨在帮助读者准备CISSP（Certified Information Systems Security Professional）认证考试的书籍。由Ronald L. Krutz和Russell Dean Vines合著，由Wiley Computer Publishing出版。这本书涵盖了计算机安全的十个关键领域，是备考CISSP的重要参考资料。" 《CISSP备考指南》全面解析了信息安全系统的十个核心领域，这些领域包括但不限于： 1. 安全与风险管理：讨论如何识别、评估和管理组织的安全风险，制定有效的安全策略和程序。 2. 安全工程：涉及系统开发生命周期，强调安全设计原则，以及如何在软件开发过程中融入安全性。 3. 通信和网络安全：涵盖网络协议、访问控制机制、加密技术以及网络安全威胁和防御措施。 4. 身份和访问管理：讲解用户身份验证、授权和审计，以及如何实施有效的身份和访问管理策略。 5. 安全评估和测试：介绍安全审计、漏洞评估、渗透测试等方法，以确保系统安全性和合规性。 6. 安全操作：讨论安全运营中心（SOC）、事件响应计划、灾难恢复和业务连续性管理。 7. 安全软件开发：关注软件开发生命周期中的安全实践，如静态代码分析、动态测试和安全编码。 8. 实体和信息保护：讨论物理安全措施，数据隐私保护以及存储介质的销毁和处置。 9. 法规、合规和调查：涵盖全球各地的法规遵从性要求，如PCI DSS、HIPAA等，并讨论电子发现和证据保全。 10. 业务持续性与灾难恢复：重点在于建立和维护业务连续性计划，以应对可能的中断事件。书中不仅提供了详尽的理论知识，还包含了大量的实例和习题，以帮助考生理解和应用所学概念。此外，作者提醒读者，虽然尽力考虑了商标权，但还是建议读者直接联系相关公司获取最新的商标和注册信息。《CISSP备考指南》是一本全面而深入的教材，旨在帮助读者掌握信息安全领域的专业知识，成功通过CISSP认证考试，提升在信息安全行业的专业能力。

§ Supports the tenets of confidentiality, integrity, and availability as it

pertains to data

§ Helps identify which protections apply to which information

§ May be required for regulatory, compliance, or legal reasons

Information Classification Concepts

The information produced or processed by an organization must be classified according

to the organization’s sensitivity to its loss or disclosure. These data owners are

responsible for defining the sensitivity level of the data. This approach enables the

security controls to be properly implemented according to its classification scheme.

Classification Terms

The following definitions describe several governmental data classification levels,

ranging from the lowest level of sensitivity, to the highest:

1. Unclassified. Information that is designated as neither sensitive nor

classified. The public release of this information does not violate

confidentiality.

2. Sensitive but Unclassified (SBU). Information that has been

designated as a minor secret, but may not create serious damage if

disclosed. Answers to tests are an example of this kind of information.

Health care information is another example of SBU data.

3. Confidential. Information that is designated to be of a confidential

nature. The unauthorized disclosure of this information could cause

some damage to the country’s national security. This level is used for

documents labeled between SBU and Secret in sensitivity.

4. Secret. Information that is designated of a secret nature. The

unauthorized disclosure of this information could cause serious

damage to the country’s national security.

5. Top Secret. The highest level of information classification (actually the

President of the United States has a level only for him). The

unauthorized disclosure of Top Secret information will cause

exceptionally grave damage to the country’s national security.

In all of these categories, in addition to having the appropriate clearance to access the

information, an individual or process must have a “need-to-know” the information. Thus,

an individual cleared for Secret or below is not authorized to access Secret material

that is not needed for him or her to perform their assigned job functions.

In addition, the following classification terms are also used in the private sector (see

Table 1.1):

1. Public. Information that is similar to unclassified information; all of a

company’s information that does not fit into any of the next categories

can be considered public. This information should probably not be

disclosed. However, if it is disclosed, it is not expected to seriously or

adversely impact the company.

2. Sensitive. Information that requires a higher level of classification than

normal data. This information is protected from a loss of

confidentiality, as well as from a loss of integrity due to an

unauthorized alteration.

3. Private. Information that is considered of a personal nature and is

intended for company use only. Its disclosure could adversely affect

the company or its employees. For example, salary levels and medical

information are considered private.

4. Confidential. Information that is considered very sensitive and is

intended for internal use only. This information is exempt from

disclosure under the Freedom of Information Act. Its unauthorized

disclosure could seriously and negatively impact a company. For

example, information about new product development, trade secrets,

and merger negotiations is considered confidential.

Table 1.1: A Simple Private/Commercial Sector Information Classification

Scheme

Definition Description

Public Use Information that is safe to disclose publicly

Internal Use Only Information that is safe to disclose internally, but

not externally

Company Confidential The most sensitive need-to-know information

Classification Criteria

Several criteria are used to determine the classification of an information object.

Value. Value is the number one commonly used criteria for classifying data in the

private sector. If the information is valuable to an organization or its competitors, it

needs to be classified.

Age. The classification of the information may be lowered if the information’s value

decreases over time. In the Department of Defense, some classified documents are

automatically declassified after a predetermined time period has passed.

Useful Life. If the information has been made obsolete due to new information,

substantial changes in the company, or other reasons, the information can often be

declassified.

Personal Association. If information is personally associated with specific individuals

or is addressed by a privacy law, it may need to be classified. For example,

investigative information that reveals informant names may need to remain classified.

Information Classification Procedures

There are several steps in establishing a classification system. The following primary

procedural steps are listed in priority order:

1. Identify the administrator/custodian.

2. Specify the criteria of how the information will be classified and

labeled.

3. Classify the data by its owner, who is subject to review by a

supervisor.

4. Specify and document any exceptions to the classification policy.

5. Specify the controls that will be applied to each classification level.

6. Specify the termination procedures for declassifying the information or

for transferring custody of the information to another entity.

7. Create an enterprise awareness program about the classification

controls.

Distribution of Classified Information

External distribution of classified information is often necessary, and the inherent

security vulnerabilities will need to be addressed. Some of the instances when this

distribution will be necessary are as follows:

§ Court order. Classified information may need to be disclosed to comply

with a court order.

§ Government contracts. Government contractors may need to disclose

classified information in accordance with (IAW) the procurement

agreements that are related to a government project.

§ Senior-level approval. A senior-level executive may authorize the

release of classified information to external entities or organizations.

This release may require the signing of a confidentiality agreement by

the external party.

Information Classification Roles

The roles and responsibilities of all participants in the information classification program

must be clearly defined. A key element of the classification scheme is the role the

users, owners, or custodians of the data play in regard to the data. The roles that

owner, custodian, and user play in information classification are described and are

important to remember.

Owner

An information owner may be an executive or manager of an organization. This person

is responsible for the asset of information that must be protected. An owner is different

from a custodian. The owner has the final corporate responsibility of data protection,

and under the concept of due care, the owner may be liable for negligence because of

the failure to protect this data. However, the actual day-to-day function of protecting the

data belongs to a custodian.

The responsibilities of an information owner could include the following:

§ Making the original determination to decide what level of classification

the information requires, which is based upon the business needs for

the protection of the data.

§ Reviewing the classification assignments periodically and making

alterations as the business needs change.

§ Delegating the responsibility of the data protection duties to the

custodian.

Custodian

An information custodian is delegated the responsibility of protecting the information by

its owner. This role is commonly executed by IT systems personnel. The duties of a

custodian may include the following:

§ Running regular backups and routinely testing the validity of the backup

data

§ Performing data restoration from the backups when necessary

§ Maintaining those retained records in accordance with (IAW) the

established information classification policy

In addition, the custodian may also have additional duties, such as being the

administrator of the classification scheme.

User

In the information classification scheme, an end user is considered to be anyone (such

as an operator, employee or external party) that routinely uses the information as part

of their job. They can also be considered a consumer of the data, who needs daily

access to the information to execute their tasks. The following are a few important

points to note about end users:

§ Users must follow the operating procedures that are defined in an

organization’s security policy, and they must adhere to the published

guidelines for its use.

§ Users must take “due care” to preserve the information’s security during

their work (as outlined in the corporate information use policies). They

must prevent “open view” from occurring (see sidebar).

§ Users must use company computing resources only for company

purposes, and not for personal use.

Open View

The term “open view” refers to the act of leaving classified documents in the open

where an unauthorized person can see them, thus violating the information’s

confidentiality. Procedures to prevent “open view” should specify that information is to

be stored in locked areas, or transported in properly sealed containers, for example.

Security Policy Implementation

Security Policies are the basis for a sound security implementation. Often organizations

will implement technical security solutions without first creating a foundation of policies,

standards, guidelines, and procedures, which results in unfocused and ineffective

security controls.

The following questions are discussed in this section:

§ What are polices, standards, guidelines, and procedures?

§ Why do we use polices, standards, guidelines, and procedures?

§ What are the common policy types?

Policies, Standards, Guidelines, and Procedures

Policies

A policy is one of those terms that can mean several things in InfoSec. For example,

there are security policies on firewalls, which refer to the access control and routing list

information. Standards, procedures, and guidelines are also referred to as policies in

the larger sense of a global Information Security Policy.

A good, well-written policy is more than an exercise that is created on white paper, it is

an essential and fundamental element of sound security practice. A policy, for example,

can literally be a life saver during a disaster, or it may be a requirement of a

governmental or regulatory function. A policy can also provide protection from liability

due to an employee’s actions, or can form a basis for the control of trade secrets.

Policy Types

剩余500页未读，继续阅读

BinXiao

粉丝: 24
资源: 10

掌握计算机安全十大领域的CISSP备考指南

11-The CISSP Prep Guide Mastering the Ten Domains of Computer Se

The CISSP Prep Guide.pdf

CISSP.Prep.Guide.Gold.Edition.rar_CISSP_The CISSP Prep Guide_gol

Wiley - Advanced CISSP Prep Guide 2009

the_cissp_Prep_Guide的学习笔记

cissp经典教程免费下载

cissp SC2.ActualTests.CISSP.v2013-02-27.by.james.999q

CISSP自学备考回顾（一次性通过）

CISSP_cccure_d3-Security Management Practices.pdf

CISSP_cccure_d4-Application and System Development Security.pdf

最新资源