1. Identity & Access Management
1.1. Method control refers to your method of identifying who the user is
1.2. Primary Controls
1.2.1. Administrative
1.2.1.1. Build Policies and procedures
1.2.2. Technical
1.2.2.1. Routers
1.2.2.2. Encryption
1.2.2.3. IDS
1.2.2.4. Antivirus
1.2.2.5. Firewalls
1.2.3. Physical
1.2.3.1. Network Segregation
1.2.3.2. Perimeter Security
1.2.3.3. Computer Controls
1.2.3.4. Work area separation
1.2.3.5. Data Backups
1.2.3.6. Locks on doors !
1.3. Operational Controls
1.3.1. Detective
1.3.2. Preventative
1.3.3. Deterrent
1.3.4. Corrective
1.3.5. Recovery
1.3.6. Compensatory
1.4. Access Control Models
1.4.1. Bell-LaPadula (Confidentiality)
1.4.1.1. Simple: Subject cannot read up
1.4.1.2. Star : Subject cannot write down
1.4.1.3. Strong: Subject with read and write cannot go up or down
1.4.2. Biba (Integrity)
1.4.2.1. Subject cannot read down
1.4.2.2. Subject cannot write up
1.4.3. Clark-Wilson (Integrity)
1.4.3.1. Subject can only access oject through authorized program
1.4.3.2. Enforces segregation of duties by authorized subjects
1.4.3.3. Requires auditing
1.4.4. Take
1.4.5. Brewer & Nash
1.5. Types of Access Rules
1.5.1. Mandatory (MAC)
1.5.2. Discretionary (DAC)
1.5.3. Non-Discretionary (NDAC)
1.5.4. Role-based (RBAC)
1.5.5. Content Dependent
1.6. Authentication / Passwords
1.6.1. Verification is done by testing
1.6.1.1. Who you are
1.6.1.1.1. biometrics
1.6.1.2. What you know
1.6.1.2.1. passwords, polling and interrogation
1.6.1.3. What you have
1.6.1.3.1. id, badge, key, USB plug
1.6.1.4. What you do
1.7. SSO
1.7.1. Kerberos
1.7.2. SESAME
1.8. Biometrics
1.8.1. Types
1.8.1.1. Fingerprint/Palm/Face
1.8.1.1.1. Hand Geometry
1.8.1.1.2. Signature dynamics
1.8.1.1.3. Facial Scan
1.8.1.2. Retina
1.8.1.3. Voice
1.8.2. Tools
1.8.2.1. Finger scanner
1.8.2.2. Palm scanner
1.8.2.3. Retina and iris scanner
1.8.3. Issues
1.8.3.1. Enrollment Time
1.8.3.1.1. Acceptable rate is 2 minutes per person
1.8.3.2. Throughput Time
1.8.3.2.1. Acceptable rate is 10 people per minute
1.8.3.3. Acceptability Issues
1.8.3.3.1. Privacy, physical, psychological
1.8.3.4. False Rejection Rate (FRR) - Type I error
1.8.3.5. False Acceptance Rate (FAR) - Type II error
1.8.3.6. Crossover Error Rate (CER)
1.8.3.6.1. CER = % when FRR = FAR
1.9. Authorization / Accountability
1.9.1. Authorization
1.9.1.1. granted privileges
1.9.2. Accountability
1.10. Managing Access Control
1.10.1. Scripting
1.10.2. Directory services
1.10.3. Centralized
1.10.3.1. Radius
1.10.3.2. TACACS
1.10.3.3. TACACS+
1.10.3.4. Diameter
1.10.4. CHAP
1.10.5. Decentralized
1.10.5.1. Database
1.10.5.1.1. Relational Database
1.10.5.1.2. Databases 101
1.10.5.1.3. Security elements
1.11. Network Security Testing
1.11.1. NIST Publication 800-42
2. Security Operations
2.1. Separation of Duties
2.1.1. Operator
2.1.2. Security Admin
2.1.3. System Admin
2.2. Critical Operations Controls
2.2.1. Ressources Protection
2.2.2. Hardware Controls
2.2.3. Software Controls
2.2.4. Privileged Entity Controls
2.2.5. Change Management Control
2.3. Media Protection
2.3.1. Records Retention
2.3.2. Data Remanence
2.3.3. Transaction Redundancy Implementation
2.3.3.1. Electronic Vaulting
2.3.3.2. Remote Journaling
2.3.3.3. Database Shadowing
2.3.4. Due care and due diligence
2.3.5. Documentation
2.4. Disaster Recovery Planning (DRP)
2.4.1. Objectives
2.4.1.1. Protect the compani form major computer services failure
2.4.1.2. Minimize the risk from delays in providing services
2.4.1.3. Guarantee reliability of standby systems through testing
2.4.1.4. Minimize decision making required by personnel during a disaster
2.4.2. Subscription Service
2.4.2.1. Hot Site
2.4.2.2. Warm Site
2.4.2.3. Cold Site
2.4.2.4. Others
2.4.2.4.1. Mobile Site
2.4.3. DRP assumes BIA has been done, now focusing on steps needed to protect the business
2.5. Backup Methods
2.5.1. Full
2.5.1.1. To restore, requires only the previous day's Full backup
2.5.1.2. Requires the most time and media space
2.5.2. Incremental
2.5.2.1. Requires the least time and space
2.5.2.2. To restore, requires last Full backup plus all backups since the last Full backup
2.5.3. Differential
2.5.3.1. To restore, requires the last Full backup and the last Differential backup and the last differential
2.5.3.2. Intermediate in time and media space requierements between Full and Incremential backups
2.6. Business Continuity Planning (BCP)
2.6.1. Why ?
2.6.1.1. Business Need
2.6.1.2. Regulatory (SoX, BASEL2, FISMA, HIPAA, etc...)
2.6.2. Contingency Planning
2.6.3. Integration BCP/CP
2.6.3.1. Develop the contingency planning policy statement
2.6.3.2. Conduct the business impact analysis (BIA)
2.6.3.3. Identify preventive controls
2.6.3.4. Develop recovery strategies
2.6.3.5. Develop an IT contingency plan
2.6.3.6. Plan testing, training, and exercices
2.6.3.7. Plan Maintenance
2.6.4. NIST's 3 Phases of Actions
2.6.4.1. Notification/Activation
2.6.4.2. Recovery
2.6.4.3. Reconstitution
2.6.5. Elements of BCP
2.6.5.1. Scope and plan Initiation
2.6.5.1.1. Scope
2.6.5.1.2. Amount of work required
2.6.5.1.3. Ressources to be used
2.6.5.1.4. Management Practices
2.6.5.1.5. Roles and Responsibilities
2.6.5.2. Business Impact Analysis (BIA)
2.6.5.2.1. Gathering assessment materials
2.6.5.2.2. Perform the assessment
2.6.5.2.3. Analyze the compiled information
2.6.5.2.4. Document the results
2.6.5.3. Business Continuity Planning and Development
2.6.5.4. Plan approval and implementation
2.7. Auditing
2.8. Backup Storage Media
2.8.1. Tape
2.8.2. Hard Disks
2.8.3. Optical Disks
2.8.4. Solid State
2.9. RAID
2.9.1. disk stripping (raid 0)
2.9.2. disk mirroring (raid 1)
2.9.3. disk stripping with parity (raid5)
2.9.4. raid combiné (ex: raid 01 -> grappe raid 0 + raid global 1)
2.9.5. RAB Classification
2.9.5.1. Failure-resistant disk systems
2.9.5.2. Failure-tolerant disk systems
2.9.5.3. Disaster-tolerant disk systems
3. Software Development Security
3.1. Goals
3.1.1. Software should perform its intended tasks - nothing more, nothing less
3.1.2. Develop software and systems in budget and on schedule
3.2. Open Source vs. Proprietary Code
3.3. A TCB depends on Trusted Software
3.4. Overview of programming languages
3.4.1. 1st generation: Machine or Binary code
3.4.2. 2nd generation : ASM
3.4.3. 3rd generation : Spoken language
3.4.4. Compiled / Interpreted / Hybrid
3.5. Principles of Programming
3.5.1. Modularity
3.5.2. Top-down design
3.5.3. Limited control structures
3.5.4. Limited control structures
3.5.5. Limited scope of variables
3.6. Methodologies
3.6.1. Structured Programming
3.6.2. Object-Oriented Programming
3.6.3. Computer-Aided Software Engineering (CASE) tools
3.7. Good Coding Practices
3.7.1. Least privileges
3.7.2. Hiding secrets
3.7.3. Layered defense
3.7.4. Weakest link
3.8. Development Models
3.8.1. Software Engineering Models
3.8.1.1. Simplistic Model
3.8.1.1.1. Requierements Gathering
3.8.1.1.2. Analysis
3.8.1.1.3. Design
3.8.1.1.4. Coding
3.8.1.1.5. Testing
3.8.1.2. Waterfall Model
3.8.1.2.1. System requirements
3.8.1.2.2. Software Requirements
3.8.1.2.3. Analysis
3.8.1.2.4. Program Design
3.8.1.2.5. Coding
3.8.1.2.6. Testing
3.8.1.2.7. Operations and Maintenance
3.8.1.3. Spiral Model
3.8.1.3.1. Define objectives
3.8.1.3.2. Risk analysis, prototype
3.8.1.3.3. Engineering and Testing
3.8.1.3.4. Planning
3.8.1.4. Cost Estimation Techniques
3.8.1.4.1. Delphi Technique
3.8.1.4.2. Expert Judgment
3.8.1.4.3. Function Points
3.8.1.4.4. Industry Benchmarks
3.8.1.5. Rapid Application Development (RAD)
3.8.1.6. Cleanroom Model
3.8.1.7. Iterative Development Method
3.8.1.8. Prototyping Model
3.8.1.9. System Development Life Cycle (SDLC)
3.8.1.9.1. Project initiation
3.8.1.9.2. Analysis and planning
3.8.1.9.3. System design specifications
3.8.1.9.4. Software development
3.8.1.9.5. Installation and implementation
3.8.1.9.6. Operations and maintenance
3.8.1.9.7. Disposal
3.8.1.10. The Software Capability Maturity Model
3.8.1.11. IDEAL Model
3.9. Object Oriented Programming
3.9.1. Object Oriented Concepts
3.9.1.1. Class
3.9.1.2. Data Abstraction
3.9.1.3. Inheritance
3.9.1.3.1. Child (derived) class inherits from the Parent (base) class
3.9.1.4. Polymorphism
3.9.1.5. Polyinstantiation
3.9.2. Phases of Development for Object Oriented Orientation (OOO)
3.9.2.1. Object Oriented Requirements Analysis (OORA)
3.9.2.2. Object Oriented Analysis (OOA)
3.9.2.3. Domain Analysis (DA)
3.9.2.4. Object Oriented Design (OOD)
3.9.2.5. Object Oriented Programming( OOP)
3.10. Tools and Languages
3.10.1. JAVA
3.10.2. ActiveX
3.10.3. Dynamic Data Exchange (DDE)
3.10.4. Object Linking and Embedding (OLE)
3.10.5. Component Object Model (COM) & Distributed Component Object Model (DCOM)
3.10.6. Common Object Request Broker Architecture (CORBA)
3.10.7. Expert Systems
3.11. Databases
3.11.1. Types
3.11.1.1. File-based
3.11.1.2. Hierarchical
3.11.1.3. Network
3.11.1.4. Object-Oriented
3.11.1.5. Relational
3.11.2. Terms
3.11.2.1. Database Management System
3.11.2.2. Data Definition Language
3.11.2.3. Primary Key
3.11.2.4. Foreign Key
3.11.2.5. SELECT Command
3.11.2.6. Normalization
3.11.2.7. Bind variable
3.11.2.8. Data Warehouse
3.11.2.8.1. Data Mining
3.11.2.8.2. Data Dictionary
3.11.3. Database Security
3.11.3.1. Basics of Database Security
3.11.3.1.1. Release of information
3.11.3.1.2. Modification of information
3.11.3.1.3. Denial of service
3.11.3.2. Discretionary vs Mandatory
3.11.3.2.1. Specific authorization granted and denied
3.11.3.2.2. Authorization based on assigned classification
3.11.3.3. Relational vs Object Oriented
3.11.3.3.1. Relational
3.11.3.3.2. Object
3.12. Configuration & Management
3.13. Application Vulnérabilities
3.13.1. Malicious Mobile Code
3.13.2. DNS Hijacking
3.13.3. XSS
3.13.4. SQL Injection
3.13.5. DoS DDoS
3.13.6. Flooding
3.13.7. Virus
3.13.7.1. Trojan
3.13.7.2. Polymorphic
3.13.7.3. Stealth
3.13.7.4. Retro
3.13.7.5. Boot Sector
3.13.7.6. Macro
3.13.8. Worm
4. Security Assessment & Testing
4.1. Assessment and Test Strategies
4.1.1. Software Development
4.1.2. Log Review
4.1.3. Synthetic Transactions
4.1.4. Testing
4.1.4.1. Checklist
4.1.4.2. Structured walk through
4.1.4.3. Simulation
4.1.4.4. Parallel
4.1.4.5. Full interruption
4.2. Collect Security Process Data Internal & Third-Party Audits
4.2.1. SOC Reporting Options
5. Asset Security
5.1. Roles of Physical Security
5.2. Cryptography
5.2.1. Classical Goals
5.2.1.1. Confidentiality
5.2.1.2. Integrity
5.2.1.3. Authentication
5.2.1.4. Nonrepudiation
5.2.2. History
5.2.3. Components
5.2.4. Symmetric-Key Cryptography
5.2.4.1. Symmetric Algorithms
5.2.4.1.1. DES
5.2.4.1.2. 3DES
5.2.4.1.3. AES
5.2.4.1.4. Serpent
5.2.4.1.5. Two Fish
5.2.4.1.6. RCG
5.2.4.1.7. IDEA
5.2.4.2. Modes of Operation DES
5.2.5. Asymmetric-Key Cryptography
5.2.5.1. Asymmetric Algorithms
5.2.5.1.1. RSA
5.2.5.1.2. DH
5.2.5.1.3. DSA
5.2.5.1.4. El Gamal
5.2.5.1.5. ECC
5.2.6. Hybrid Cryptography
5.2.7. Hashing
5.2.7.1. Hash Algorithms
5.2.7.1.1. MD5
5.2.7.1.2. SHA-1
5.2.8. Public Key Infrastructure
5.2.8.1. Certificate Authority or CA
5.2.8.2. Registration Authority or RA
5.2.8.3. Certificates holders
5.2.8.4. Clients that validate digital signatures
5.2.8.5. Repositories
5.2.9. Digital Signatures
5.2.9.1. Digital Signature Standard (DSS)
5.2.9.2. Types of CA Trust
5.2.9.2.1. Hierarchical
5.2.9.2.2. Cross Certification
5.2.10. Cryptography In Use
5.2.10.1. SSH
5.2.10.2. IPSEC
5.2.10.3. SSL
5.2.10.4. SET
5.2.11. Data Privacy Concerns
5.2.12. Attacks
5.3. Information Classification
5.3.1. Criteria
5.3.1.1. Value
5.3.1.2. Age
5.3.1.3. Useful life
5.3.1.4. Personal Association
5.3.2. Government
5.3.2.1. Unclassified
5.3.2.2. Sensitive but Unclassified
5.3.2.3. Confidential
5.3.2.4. Secret
5.3.2.5. Top Secret
5.3.3. Private Sector
5.3.3.1. Public
5.3.3.2. Sensitive
5.3.3.3. Private
5.3.3.4. Confidential
6. Security and Risk Management
6.1. Identify and Classify Assets
6.1.1. CIA
6.1.1.1. Definition
6.1.1.1.1. Confidentiality
6.1.1.1.2. Integrity
6.1.1.1.3. Availability
6.1.1.2. Well with
6.1.1.2.1. Economically Viable
6.1.1.2.2. Authentication
6.1.1.2.3. Extensible
6.1.1.2.4. Auditable
6.1.1.2.5. Forensically sound
6.1.2. AAAA
6.1.2.1. Authenticate
6.1.2.2. Authorize
6.1.2.3. Accounting
6.1.2.4. Audit
6.2. Manage Risk
6.2.1. Management Concepts
6.2.2. Personnel Organization
6.2.2.1. Best Practices
6.2.2.1.1. Separation of Duties
6.2.2.1.2. Job Rotation
6.2.2.1.3. Job Description
6.2.2.1.4. Accountability
6.2.2.2. Roles and Responsabilities
6.2.2.2.1. Data Owner
6.2.2.2.2. Data Custodian
6.2.2.2.3. Users and Operators
6.2.2.2.4. Auditor
6.2.2.3. Role Review
6.2.2.3.1. Chief Information Officer
6.2.2.4. Training
6.2.2.4.1. Awareness Training
6.2.2.4.2. Technical Training
6.2.3. Legislative Drivers
6.2.3.1. FISMA
6.2.3.2. NIST CS
6.2.3.3. OECD Guidelines
6.2.4. Risk Management
6.2.4.1. Manage and Assess
6.2.4.1.1. Impact of the threat
6.2.4.1.2. Risk of the threat occuring
6.2.4.2. Controls reduce the impact
6.2.4.3. Types of Risk
6.2.4.3.1. Inherent risk
6.2.4.3.2. Control risk
6.2.4.3.3. Detection risk
6.2.4.3.4. Residual risk
6.2.4.3.5. Business risk
6.2.4.3.6. Overall risk
6.2.4.4. Probability of a Loss
6.2.4.5. Quantitative Analysis
6.2.4.5.1. Identify assets and determine value
6.2.4.5.2. Estimate potential losses
6.2.4.5.3. Analyze threats
6.2.4.5.4. Calculate overall loss potential
6.2.4.5.5. Accept, Mitigate, Assign the risk or Refuse
6.2.4.6. Qualitative Analysis
6.2.4.6.1. Techniques
6.2.4.6.2. Does not assign numeric value to risks
6.2.4.6.3. Based on experience ans intuition of the risk analysts
6.2.4.7. Applying Controls
6.2.4.7.1. Fundamental Control Set
6.3. Compliance
6.3.1. ISO 27000 Series
6.3.1.1. ISO 27000
6.3.1.2. ISO 27001
6.3.1.2.1. was BS 7799 Part 2
6.3.1.3. ISO 27002
6.3.1.3.1. aka 17799
6.3.1.4. ISO 27003
6.3.1.5. ISO 27004
6.3.2. Current drivers
6.3.2.1. Regulation and Legislation
6.3.2.2. Cyberliability Insurance
6.3.2.3. Incident Response
6.3.3. Future Drivers
6.3.3.1. Industry Adoption and Compliance
6.3.3.2. Cyberterrorism
6.3.3.3. Information Warface
6.3.3.4. Personal Privacy
6.4. Develop Security Policies
6.4.1. Policies, Standards, Guidelines
6.4.1.1. Policies
6.4.1.2. Standards
6.4.1.3. Guidelines
6.4.1.4. Procedures
6.4.2. Provide the foundation for a secure infrastructure
6.4.3. Created by Senior Management
6.4.4. Some policies are required by Law
6.5. Enforce Security Policies
6.6. Effective Security Program
6.7. Ethics
6.7.1. ISC2 Code of Ethics
6.7.2. Internet Architecture Board (IAB)
6.8. Law
6.8.1. The Legal Framework
6.8.1.1. Three sources of laws
6.8.1.1.1. Legislated
6.8.1.1.2. Regulated
6.8.1.1.3. Court precedence
6.8.2. Investigation
6.8.2.1. Steps
6.8.2.1.1. MOM
6.8.2.2. Terms
6.8.2.2.1. Enticement
6.8.2.2.2. Entrapment
6.8.2.3. Best of Evidence
6.8.2.3.1. Best
6.8.2.3.2. Corroborative
6.8.2.3.3. Secondary
6.8.2.3.4. Conclusive
6.8.2.3.5. Circumstantial
6.8.2.4. Forensics
6.8.2.5. Contracts
6.8.2.6. End-User Licence Adreements
6.8.2.7. Intellectual Property
6.8.2.8. Privacy
6.8.2.9. Accountability
6.8.2.10. International Laws
6.8.2.11. Computer Laws
6.8.3. Examples of Computer Crimes
6.8.3.1. Data Diddling
6.8.3.2. Salami Attacks
6.8.3.3. Social Engineering
6.8.3.4. Dumpster Diving
7. Communications and Network Security
7.1. OSI / TCP Model
7.1.1. OSI OSI (Open Systems Interconnect)
7.1.1.1. Layer 7 : Application
7.1.1.2. Layer 6 : Presentation
7.1.1.3. Layer 5 : Session
7.1.1.4. Layer 4 : Transport
7.1.1.5. Layer 3 : Network
7.1.1.6. Layer 2 : Data
7.1.1.7. Layer 1 : Physical
7.1.2. TCP/IP
7.1.2.1. Application
7.1.2.2. Host-to-host (Transport)
7.1.2.3. Internet (Network)
7.1.2.3.1. CIDR
7.1.2.4. Network Interface (data/physical)
7.2. Media / Topologies
7.2.1. Typical Media
7.2.1.1. 10Base2
7.2.1.2. 10Base5
7.2.1.3. Coax
7.2.1.4. UTP/STP
7.2.1.5. Fiber
7.2.1.6. Wireless
7.2.2. Topologies
7.2.2.1. Bus
7.2.2.2. Ring
7.2.2.3. Star
7.2.2.4. Tree
7.2.2.5. Mesh
7.2.2.5.1. Full
7.2.2.5.2. Partial
7.3. Lan Protocols / Standards
7.3.1. ARP / RARP
7.3.2. 802.3 (CSMA/CD)
7.3.2.1. Ethernet
7.3.3. 802.5 (Token Ring)
7.3.4. 802.11 (Wireless)
7.3.5. 802.16 (WiMax)
7.3.6. 802.20 (Mobile WiMax)
7.4. WAN Technologies
7.4.1. Dedicated lines
7.4.2. Circuit Switched
7.4.2.1. SDH/SONET
7.4.2.2. DTM
7.4.3. Packet Switched
7.4.3.1. ATM
7.4.3.2. Gigabit Ethernet
7.4.3.3. x25
7.4.4. Token Ring
7.4.5. FDDI
7.5. The PBX
7.6. Remote Connectivity
7.6.1. PPP/SLIP
7.6.2. PPPOE
7.6.3. PAP/CHAP
7.6.4. Securing
7.6.4.1. IPSEC
7.6.4.2. VPNs
7.6.4.2.1. SKIP
7.6.4.3. SSL
7.6.4.4. NAT
7.6.4.5. swIPe
7.7. Networking Cables
7.7.1. Coaxial Cable
7.7.2. Twisted Pair
7.7.3. Fiber-Optic Cable
7.7.3.1. Core
7.7.3.2. Cladding
7.7.3.3. Jacket
7.7.4. Cable Vulnerabilities
7.7.5. Cable failure Terms
7.7.5.1. Attenuation
7.7.5.2. Crosstalk
7.7.5.3. Noise
7.8. Networking Devices
7.8.1. Repeater
7.8.2. Bridge
7.8.3. Switch
7.8.4. Router
7.8.5. Proxies
7.8.6. Gateway
7.8.7. LAN Extender
7.8.8. Screened-Host Firewall
7.8.9. Dual-Homed Host Firewall
7.8.10. Screened-Subnet Firewall
7.8.11. SOCKS
7.9. Wireless
7.9.1. IEEE Standards
7.9.1.1. 802.11a -> 802.11n
7.9.1.2. 802.1x
7.9.1.3. 802.3af
7.9.1.4. 802.16 (WiMax)
7.9.1.5. 802.15 (Bluetooth)
7.9.2. Terminology
7.9.2.1. RADIUS
7.10. Network Attacks
7.10.1. Wireless exploits
7.10.1.1. Passive Attacks
7.10.1.2. Active Attacks
7.10.1.3. Man in the Middle Attacks
7.10.1.4. Jamming Attacks
7.10.2. Countermeasures
7.10.2.1. IDS / IPS
7.10.2.2. Honeypots
7.10.2.3. Response Team
7.10.2.4. Layered Security
7.10.2.5. Firewalls
7.10.2.6. Securing Voice
8. Security Engineering
8.1. Trusted Computer Base (TCB)
8.1.1. Trusted Computer
8.1.1.1. Does what you tell it to
8.1.1.2. Only what you tell it to do
8.1.1.3. You kown what it's doing
8.1.2. Trusted System
8.1.2.1. Rings of security
8.1.2.1.1. Ring 0 : trusted core OS kernel
8.1.2.1.2. Outer rings are less privileged
8.1.2.1.3. Sandbox isolates a process from CPU andd file system
8.1.2.1.4. Intel Architectural Model
8.1.3. Reference Monitor
8.1.4. Security Kernel
8.1.4.1. Isolate processes
8.1.4.2. Be used on every access
8.1.4.3. Be small enough to be easily tested
8.1.5. Covert Channels
8.1.5.1. Covert Storage Channel
8.1.5.2. Covert Timing Channel
8.2. Computer Architecture
8.2.1. CPU
8.2.1.1. RISC
8.2.1.2. CISC
8.2.2. Memory
8.2.2.1. Cache
8.2.2.2. ROM
8.2.2.3. RAM
8.2.2.4. Flash
8.2.2.5. Memory Addressing
8.2.3. Buses
8.2.3.1. Serial
8.2.3.2. Paralelle
8.2.4. Firmware
8.2.4.1. BIOS
8.2.4.2. Cisco IOS
8.2.5. Software
8.2.5.1. OS
8.2.5.2. Applications
8.2.5.2.1. Processes & Threads
8.3. Data Classification Models
8.3.1. Models and IT classification Frameworks
8.3.2. Compartmented Security Modes
8.3.3. Multilevel Security Mode
8.4. Access Control Models
8.4.1. Access Control
8.4.1.1. Identification
8.4.1.2. Authentication
8.4.1.3. Authorization
8.4.1.4. Terms
8.4.1.4.1. Subjects
8.4.1.4.2. Objects
8.4.1.4.3. Access
8.4.1.4.4. Access Control
8.4.2. Databases
8.4.3. Access Control Techniques
8.5. Certification / Accreditation and Evaluation
8.5.1. Certification
8.5.2. Accreditation
8.5.3. Evaluation
8.5.3.1. TCSEC
8.5.3.1.1. TCB Division
8.5.3.1.2. Orange Book
8.5.3.2. ITSEC
8.5.3.2.1. Used in Europe
8.5.3.2.2. Evaluate functionality and assurance separately
8.5.3.2.3. Rating
8.5.3.3. TNI
8.5.3.3.1. Red Book of Rainbow Series
8.5.3.4. Common Criteria
8.5.3.4.1. Eight Assurance Levels are defined (EAL0-EAL7)
9. ISC2
9.1. How to get Certified
9.2. Candidate Information Bulletins
9.3. Registration
9.4. Exam
9.4.1. Day
9.4.1.1. Saturday
9.4.2. Questions
9.4.2.1. 250 QCM
9.4.3. Tests
9.4.3.1. Cccure.org
9.4.3.2. FreePracticeTests