1. Domain 6 - Telecommunications and Network Security
1.1. Voice Communication
1.2. Network Architecture
1.3. Network Design Considerations
2. Domain 5 - BCP and DR
2.1. Risk Analysis
2.1.1. Natural
2.1.2. Industry
2.1.3. Neighbours
2.2. Business Impact Analysis
2.3. Data stored in electronic Form
2.4. Remote Replication and Off-site journaling
2.5. Backup Strategies
2.5.1. Selecting Recovery Strategy
2.6. Cost-Benefit Analysis
2.6.1. Implementing Recovery Strategy
2.6.2. Documenting the Plan
2.6.3. The Human Factor
2.6.4. Logistics
2.6.5. Plan Maintenance
3. Domain 4 - Requirements Analysis and Security Standards
3.1. Risk Analysis
3.1.1. Risk Theory
3.2. Attack Vectors
3.2.1. Attack by email
3.2.2. Attack by Deception
3.2.3. Hoaxes
3.2.4. Hackers
3.2.5. Web Page Attacks
3.2.6. Attack of the Worms
3.2.7. IRC and P2P
3.2.8. Viruses
3.2.9. Asset and Data Valuation
3.2.10. Context and Data Value
3.2.11. Corporate vs Departmental
3.2.12. Business Legal and Regulatory Requirements
3.2.13. Product Assurance Evaluation Criteria
3.2.13.1. TOE
3.2.13.2. EAL
3.2.13.3. CC Assurance
3.3. ISO 27000 series
3.4. Capability Maturity Model (SEI-CMM)
3.5. ISO 7498 series
3.5.1. Concept of Layered Architecture
3.5.2. PCI DSS
3.5.3. Architectural Solution
3.5.4. Architecture Frameworks
3.5.5. Department of Defence DoDAF
3.5.6. The Zachman Framework
3.5.7. System Security Engineering Methodology
3.5.8. Design Validation
3.5.9. Certification
3.5.10. Peer Reviews
3.5.11. Documentation
4. Domain 1 - Access Control Systems and Methodology
4.1. Access Control Concepts
4.1.1. Subject - WHO?
4.1.2. Object - WHAT?
4.1.3. Rights (Subject -> the right to create user) - HOW?
4.1.4. Permissions (Subject R/W/X) - HOW?
4.1.5. Access Control List - RWX
4.1.6. Access Control on OSI model
4.1.7. ACL List
4.1.8. ACL Repository
4.2. Access Control Mechanisms
4.2.1. Mandatory Access control (Labels)
4.2.2. Discretionary Access Control - DAC (Object Owner decides) | evaluates ACL
4.2.2.1. DAC Implementation Strategies
4.2.2.1.1. Limit access to essential objects
4.2.2.1.2. Label data
4.2.2.1.3. Filter information
4.2.2.1.4. Policy
4.2.2.1.5. Monitoring
4.2.2.2. CACLS tool (execute problem)
4.2.2.2.1. Configuration files
4.2.2.2.2. Windows registry
4.2.2.2.3. Services
4.2.2.2.4. Data
4.2.2.2.5. Solutions
4.2.3. Non-Discretionary Access Control (more DAC than MAC)
4.2.3.1. RBAC (roles)
4.2.3.2. ORCON (contest of the originator is required)
4.2.3.3. DRM (Digital - cryptographic)
4.2.3.4. UCON (usage controlled / frequency of access)
4.2.3.5. Rule-based (Firewalls / VPNs) | evaluates activity
4.2.4. Least Functionality
4.2.5. Least Privilege (no limitations)
4.2.6. Separation of Duties
4.3. Architecture
4.3.1. AAA
4.3.2. Single Sign-On
4.3.3. Centralized Access Control
4.3.3.1. Proxy Access Control
4.3.3.2. Gatekeeper
4.3.3.3. Access Control Server
4.3.3.4. Protocols
4.3.3.4.1. TACACS
4.3.3.4.2. RADIUS
4.3.3.4.3. EAP
4.3.3.4.4. KERBEROS
4.3.3.4.5. SESAME
4.3.3.5. Design Considerations
4.3.4. De-centralized Access Control
4.3.4.1. Distributed | Shared database | Robust | Scalable
4.3.4.2. Design Considerations
4.3.5. Trusted Computing Base
4.3.6. Federated Access Control
4.3.6.1. Design Considerations
4.3.7. Directories and Access Control
4.3.7.1. Design Considerations
4.3.8. Identity Management
4.3.9. Accounting
4.3.9.1. Who?What?Where?When?Effect?
4.4. Access Control Administration and Management Concepts
4.4.1. Access Control Administration
4.4.1.1. Authorized | Monitored | Validated
4.4.1.2. P2P
4.4.2. Database Access
4.4.2.1. Views | Triggers | Stored Procedures
4.5. Inherent Rights
4.6. Granted Rights
4.6.1. Change of Privilege Levels
4.6.2. Groups
4.6.2.1. Role based
4.6.2.2. Task based
4.6.3. Dual Control
4.6.4. Location
4.6.5. Topology
4.6.6. Subnet
4.6.7. Geo consideration
4.6.8. Device types
4.6.8.1. Physical and Logical
4.6.8.2. Network based
4.6.8.3. Third Party Software
4.6.9. Authentication
4.6.9.1. Strength and Weaknesses of Authentication Tools
4.6.9.2. Token based Authentication Tools
4.6.9.2.1. Badges
4.6.9.2.2. Magnetic Strips
4.6.9.2.3. Proximity Cards
4.6.9.2.4. Common Issues
4.6.9.3. Biometric Authentication
4.6.9.3.1. Performance
4.6.9.3.2. Implementation
4.6.9.3.3. Common Issues
4.6.9.4. Design Validation
4.6.9.5. Architecture Effectiveness Assurance
4.6.9.6. Testing Strategies
4.6.9.7. Testing Objectives
4.6.9.8. Testing Paradigms
4.6.9.9. Repeatability
4.6.9.10. Methodology
4.6.9.11. Developing Test Procedures
4.6.9.12. Risk-Based Considerations
5. Domain 2 - Cryptography
5.1. Principles
5.1.1. Applications of Cryptography
5.1.2. Message Encryption
5.1.3. Secure IP Communication (IPSEC)
5.1.4. Remote Access
5.1.5. Wireless Communication
5.1.6. Other types of Secure Communication
5.1.7. Identification and Authentication
5.1.8. Storage Encryption
5.1.9. Code Signing
5.1.10. Methods of Cryptography
5.1.10.1. Symmetric
5.1.10.2. Block Cipher
5.1.10.3. Stream Cipher
5.1.10.4. Asymmetric
5.1.10.5. Hash and MAC
5.1.10.6. Digital Signatures
5.2. Key Management
5.2.1. Key Types
5.2.2. Strength and Key Size
5.2.3. Key Life Cycle
5.2.4. Key Creation
5.2.5. Key Distribution
5.2.6. Key Storage
5.2.7. Key Update
5.2.8. Key Revocation
5.2.9. Key Escrow
5.2.10. Backup and Recovery
5.3. Public Key Infrastructure
5.3.1. Key Distribution
5.3.2. Certificates and Key Storage
5.3.3. PKI Registration
5.3.4. Certificate Issuance
5.3.5. Trust Models
5.3.6. Certificate Chains
5.3.7. Certificate Revocation
5.3.8. Cross Certification
5.4. Design Validation
5.4.1. Review of Cryptanalytic Attacks
5.5. Risk-Based Cryptographic Architecture
5.6. Cryptographic Compliance
5.6.1. Standards
5.6.1.1. NSA-FIPS-197
5.6.1.2. NSA-FIPS-140
5.6.1.3. NIST CAVP
5.6.1.4. NIST CMVP
5.6.2. Industry- specific Standards
5.6.2.1. PCI DSS
5.6.2.2. HIPAA
5.6.2.3. EU Data Protection Act
6. Domain 3 - Physical Security
6.1. Physical Security Risks
6.1.1. Unauthorized access
6.1.1.1. Traffic Monitoring
6.1.1.1.1. Roadway Design
6.1.1.1.2. Parking
6.1.1.1.3. Open Area Parking
6.1.1.1.4. Loading Docks
6.1.1.2. Surveillance Devices
6.1.1.2.1. Infrared Sensors
6.1.1.2.2. Microwave
6.1.1.2.3. Coaxial Strain-Sensitive Cable
6.1.1.2.4. Taut-Wire Systems
6.1.1.2.5. Time Domain Reflectometry Systems
6.1.1.2.6. CCTV
6.1.1.2.7. DVR
6.1.1.2.8. Video Content Analysis
6.1.1.2.9. Guard Force
6.1.1.3. Access Control Systems
6.1.1.3.1. Card Types
6.1.1.3.2. Badge Equipment
6.1.1.3.3. Biometrics
6.1.1.3.4. Access control Head-End
6.1.2. Facility Risk
6.1.2.1. Low Profile
6.1.2.2. Location Hazard
6.1.2.3. Threat Assessment
6.1.2.4. Site Planning
6.1.2.5. Restricted Work Areas
6.1.2.6. Entrances and Exits
6.1.2.7. Mobile Devices
6.2. Protection Plan
6.2.1. Evacuation Drills
6.2.2. Incident Response
6.3. Design Validation
6.3.1. Penetration Tests
6.3.2. Access Control Violation Monitoring