CISSP备考指南：计算机安全十大领域的精通

CISSP

需积分: 8 175 浏览量更新于2024-06-28 收藏 5.49MB PDF 举报

身份认证购VIP最低享 7 折!

30元优惠券

"11-The CISSP Prep Guide Mastering the Ten Domains of Computer Security" 是一本由 Ronald L. Krutz 和 Russell Dean Vines 合著的书籍，专注于帮助读者准备 CISSP（Certified Information Systems Security Professional）认证考试。该书的第一版出版于2001年，包含了501页的内容，旨在覆盖计算机安全的十个关键领域。 CISSP 是全球广泛认可的信息安全专业认证，旨在验证个人在设计、实施、管理和审核信息安全方案方面的专业知识。该书作为备考指南，深入解析了这些核心领域，帮助考生理解和掌握所需的知识点。书中涵盖的十个安全领域通常包括： 1. 安全和风险管理：涉及如何评估、管理和减轻组织面临的各种安全风险。 2. 资产安全：强调保护组织资产的重要性，包括数据、硬件、软件等。 3. 安全工程：讨论如何设计和构建安全的系统与网络架构。 4. 通信和网络安全：涵盖了网络协议、加密技术以及网络安全策略。 5. 身份和访问管理：关注用户身份验证、授权和审计过程。 6. 安全评估和测试：讲解如何进行安全审计、漏洞评估和渗透测试。 7. 安全操作：涉及安全事件响应、监控和日志管理。 8. 计算机取证：介绍如何收集、分析和保护电子证据。 9. 业务持续性：探讨灾难恢复计划和业务连续性管理。 10. 法规、合规性和道德：讲解相关法律法规，以及信息安全专业人员的道德责任。该书不仅介绍了理论知识，还可能包含实践案例、习题和模拟试题，帮助读者将理论应用于实际场景，并通过 CISSP 认证考试。作者 Ronald L. Krutz 和 Russell Dean Vines 在信息安全领域有深厚的专业背景，他们的著作为读者提供了权威且全面的学习资料。值得注意的是，尽管该书具有很高的价值，但读者应了解，随着技术和法规的不断变化，书中信息可能需要更新。因此，备考者在学习时还需要参考最新的行业标准和官方指南，确保知识是最新的。此外，由于版权法律的限制，未经许可，本书的内容不得非法复制或传播。

资源详情

资源推荐

§ Supports the tenets of confidentiality, integrity, and availability as it

pertains to data

§ Helps identify which protections apply to which information

§ May be required for regulatory, compliance, or legal reasons

Information Classification Concepts

The information produced or processed by an organization must be classified according

to the organization’s sensitivity to its loss or disclosure. These data owners are

responsible for defining the sensitivity level of the data. This approach enables the

security controls to be properly implemented according to its classification scheme.

Classification Terms

The following definitions describe several governmental data classification levels,

ranging from the lowest level of sensitivity, to the highest:

1. Unclassified. Information that is designated as neither sensitive nor

classified. The public release of this information does not violate

confidentiality.

2. Sensitive but Unclassified (SBU). Information that has been

designated as a minor secret, but may not create serious damage if

disclosed. Answers to tests are an example of this kind of information.

Health care information is another example of SBU data.

3. Confidential. Information that is designated to be of a confidential

nature. The unauthorized disclosure of this information could cause

some damage to the country’s national security. This level is used for

documents labeled between SBU and Secret in sensitivity.

4. Secret. Information that is designated of a secret nature. The

unauthorized disclosure of this information could cause serious

damage to the country’s national security.

5. Top Secret. The highest level of information classification (actually the

President of the United States has a level only for him). The

unauthorized disclosure of Top Secret information will cause

exceptionally grave damage to the country’s national security.

In all of these categories, in addition to having the appropriate clearance to access the

information, an individual or process must have a “need-to-know” the information. Thus,

an individual cleared for Secret or below is not authorized to access Secret material

that is not needed for him or her to perform their assigned job functions.

In addition, the following classification terms are also used in the private sector (see

Table 1.1):

1. Public. Information that is similar to unclassified information; all of a

company’s information that does not fit into any of the next categories

can be considered public. This information should probably not be

disclosed. However, if it is disclosed, it is not expected to seriously or

adversely impact the company.

2. Sensitive. Information that requires a higher level of classification than

normal data. This information is protected from a loss of

confidentiality, as well as from a loss of integrity due to an

unauthorized alteration.

3. Private. Information that is considered of a personal nature and is

intended for company use only. Its disclosure could adversely affect

the company or its employees. For example, salary levels and medical

information are considered private.

4. Confidential. Information that is considered very sensitive and is

intended for internal use only. This information is exempt from

disclosure under the Freedom of Information Act. Its unauthorized

disclosure could seriously and negatively impact a company. For

example, information about new product development, trade secrets,

and merger negotiations is considered confidential.

Table 1.1: A Simple Private/Commercial Sector Information Classification

Scheme

Definition Description

Public Use Information that is safe to disclose publicly

Internal Use Only Information that is safe to disclose internally, but

not externally

Company Confidential The most sensitive need-to-know information

Classification Criteria

Several criteria are used to determine the classification of an information object.

Value. Value is the number one commonly used criteria for classifying data in the

private sector. If the information is valuable to an organization or its competitors, it

needs to be classified.

Age. The classification of the information may be lowered if the information’s value

decreases over time. In the Department of Defense, some classified documents are

automatically declassified after a predetermined time period has passed.

Useful Life. If the information has been made obsolete due to new information,

substantial changes in the company, or other reasons, the information can often be

declassified.

Personal Association. If information is personally associated with specific individuals

or is addressed by a privacy law, it may need to be classified. For example,

investigative information that reveals informant names may need to remain classified.

Information Classification Procedures

There are several steps in establishing a classification system. The following primary

procedural steps are listed in priority order:

1. Identify the administrator/custodian.

2. Specify the criteria of how the information will be classified and

labeled.

3. Classify the data by its owner, who is subject to review by a

supervisor.

4. Specify and document any exceptions to the classification policy.

5. Specify the controls that will be applied to each classification level.

6. Specify the termination procedures for declassifying the information or

for transferring custody of the information to another entity.

7. Create an enterprise awareness program about the classification

controls.

Distribution of Classified Information

External distribution of classified information is often necessary, and the inherent

security vulnerabilities will need to be addressed. Some of the instances when this

distribution will be necessary are as follows:

§ Court order. Classified information may need to be disclosed to comply

with a court order.

§ Government contracts. Government contractors may need to disclose

classified information in accordance with (IAW) the procurement

agreements that are related to a government project.

§ Senior-level approval. A senior-level executive may authorize the

release of classified information to external entities or organizations.

This release may require the signing of a confidentiality agreement by

the external party.

Information Classification Roles

The roles and responsibilities of all participants in the information classification program

must be clearly defined. A key element of the classification scheme is the role the

users, owners, or custodians of the data play in regard to the data. The roles that

owner, custodian, and user play in information classification are described and are

important to remember.

Owner

An information owner may be an executive or manager of an organization. This person

is responsible for the asset of information that must be protected. An owner is different

from a custodian. The owner has the final corporate responsibility of data protection,

and under the concept of due care, the owner may be liable for negligence because of

the failure to protect this data. However, the actual day-to-day function of protecting the

data belongs to a custodian.

The responsibilities of an information owner could include the following:

§ Making the original determination to decide what level of classification

the information requires, which is based upon the business needs for

the protection of the data.

§ Reviewing the classification assignments periodically and making

alterations as the business needs change.

§ Delegating the responsibility of the data protection duties to the

custodian.

Custodian

An information custodian is delegated the responsibility of protecting the information by

its owner. This role is commonly executed by IT systems personnel. The duties of a

custodian may include the following:

§ Running regular backups and routinely testing the validity of the backup

data

§ Performing data restoration from the backups when necessary

§ Maintaining those retained records in accordance with (IAW) the

established information classification policy

In addition, the custodian may also have additional duties, such as being the

administrator of the classification scheme.

User

In the information classification scheme, an end user is considered to be anyone (such

as an operator, employee or external party) that routinely uses the information as part

of their job. They can also be considered a consumer of the data, who needs daily

access to the information to execute their tasks. The following are a few important

points to note about end users:

§ Users must follow the operating procedures that are defined in an

organization’s security policy, and they must adhere to the published

guidelines for its use.

§ Users must take “due care” to preserve the information’s security during

their work (as outlined in the corporate information use policies). They

must prevent “open view” from occurring (see sidebar).

§ Users must use company computing resources only for company

purposes, and not for personal use.

Open View

The term “open view” refers to the act of leaving classified documents in the open

where an unauthorized person can see them, thus violating the information’s

confidentiality. Procedures to prevent “open view” should specify that information is to

be stored in locked areas, or transported in properly sealed containers, for example.

Security Policy Implementation

Security Policies are the basis for a sound security implementation. Often organizations

will implement technical security solutions without first creating a foundation of policies,

standards, guidelines, and procedures, which results in unfocused and ineffective

security controls.

The following questions are discussed in this section:

§ What are polices, standards, guidelines, and procedures?

§ Why do we use polices, standards, guidelines, and procedures?

§ What are the common policy types?

Policies, Standards, Guidelines, and Procedures

Policies

A policy is one of those terms that can mean several things in InfoSec. For example,

there are security policies on firewalls, which refer to the access control and routing list

information. Standards, procedures, and guidelines are also referred to as policies in

the larger sense of a global Information Security Policy.

A good, well-written policy is more than an exercise that is created on white paper, it is

an essential and fundamental element of sound security practice. A policy, for example,

can literally be a life saver during a disaster, or it may be a requirement of a

governmental or regulatory function. A policy can also provide protection from liability

due to an employee’s actions, or can form a basis for the control of trade secrets.

Policy Types

剩余500页未读，继续阅读

yx106

粉丝: 0
资源: 15

CISSP备考指南：计算机安全十大领域的精通

CISSP官方教程最完备精华笔记.pdf

CISSP OSG 第九版 英文版

CISSP备考资料分享.rar

11小时cissp电子书

cissp官方学习文档pdf

cissp定量计算公式学些

osg 9 cissp

cissp东方瑞通讲义

ctf和cissp有什么区别

cissp 知识点 csdn

cissp all in one 第九版 pdf

cissp思维导图 xmind

cissp第9版pdf

cissp官方学习指南

怎样顺利通过CISSP考试

cissp备考中文详解

cissp 知识点 4000

cissp认证考试指南

cissp 工作证明怎么写

cissp官方教材最完备精华笔记

最新资源

CISSP OSG 第九版英文版