CISSP

1. CBK

1.1. Information Security and Risk Management

1.1.1. Identify and Classify Assets

1.1.1.1. CIA

1.1.1.1.1. Definition

1.1.1.1.2. Well with

1.1.1.2. AAAA

1.1.1.2.1. Authenticate

1.1.1.2.2. Authorize

1.1.1.2.3. Accounting

1.1.1.2.4. Audit

1.1.2. Manage Risk

1.1.2.1. Management Concepts

1.1.2.2. Personnel Organization

1.1.2.2.1. Best Practices

1.1.2.2.2. Roles and Responsabilities

1.1.2.2.3. Role Review

1.1.2.2.4. Training

1.1.2.3. Legislative Drivers

1.1.2.3.1. FISMA

1.1.2.3.2. NIST CS

1.1.2.3.3. OECD Guidelines

1.1.2.4. Risk Management

1.1.2.4.1. Manage and Assess

1.1.2.4.2. Controls reduce the impact

1.1.2.4.3. Types of Risk

1.1.2.4.4. Probability of a Loss

1.1.2.4.5. Quantitative Analysis

1.1.2.4.6. Qualitative Analysis

1.1.2.4.7. Information Classification

1.1.2.4.8. Applying Controls

1.1.3. Develop Security Policies

1.1.3.1. Policies, Standards, Guidelines

1.1.3.1.1. Policies

1.1.3.1.2. Standards

1.1.3.1.3. Guidelines

1.1.3.1.4. Procedures

1.1.3.2. Provide the foundation for a secure infrastructure

1.1.3.3. Created by Senior Management

1.1.3.4. Some policies are required by Law

1.1.4. Enforce Security Policies

1.2. Access Control

1.2.1. Method control refers to your method of identifying who user is

1.2.2. Primary Controls

1.2.2.1. Administrative

1.2.2.1.1. Build Policies and procedures

1.2.2.2. Technical

1.2.2.2.1. Routers

1.2.2.2.2. Encryption

1.2.2.2.3. IDS

1.2.2.2.4. Antivirus

1.2.2.2.5. Firewalls

1.2.2.3. Physical

1.2.2.3.1. Network Segregation

1.2.2.3.2. Perimeter Security

1.2.2.3.3. Computer Controls

1.2.2.3.4. Work area separation

1.2.2.3.5. Data Backups

1.2.2.3.6. Locks on doors !

1.2.3. Operational Controls

1.2.3.1. Detective

1.2.3.2. Preventative

1.2.3.3. Deterrent

1.2.3.4. Corrective

1.2.3.5. Recovery

1.2.3.6. Compensatory

1.2.4. Access Control Models

1.2.4.1. Bell-LaPadula (Confidentiality)

1.2.4.1.1. Simple: Subject cannot read up

1.2.4.1.2. Star : Subject cannot write down

1.2.4.1.3. Strong: Subject with read and write cannot go up or down

1.2.4.2. Biba (Integrity)

1.2.4.2.1. Subject cannot read down

1.2.4.2.2. Subject cannot write up

1.2.4.3. Clark-Wilson (Integrity)

1.2.4.3.1. Subject can only access oject through authorized program

1.2.4.3.2. Enforces segregation of duties by authorized subjects

1.2.4.3.3. Requires auditing

1.2.4.4. Take

1.2.4.5. Brewer & Nash

1.2.5. Types of Access Rules

1.2.5.1. Mandatory (MAC)

1.2.5.2. Discretionary (DAC)

1.2.5.3. Non-Discretionary (NDAC)

1.2.5.4. Role-based (RBAC)

1.2.5.5. Content Dependent

1.2.6. Authentication / Passwords

1.2.6.1. Verification is done by testing

1.2.6.1.1. Who you are

1.2.6.1.2. What you know

1.2.6.1.3. What you have

1.2.6.1.4. What you do

1.2.7. SSO

1.2.7.1. Kerberos

1.2.7.2. SESAME

1.2.8. Biometrics

1.2.8.1. Types

1.2.8.1.1. Fingerprint/Palm/Face

1.2.8.1.2. Retina

1.2.8.1.3. Voice

1.2.8.2. Tools

1.2.8.2.1. Finger scanner

1.2.8.2.2. Palm scanner

1.2.8.2.3. Retina and iris scanner

1.2.8.3. Issues

1.2.8.3.1. Enrollment Time

1.2.8.3.2. Throughput Time

1.2.8.3.3. Acceptability Issues

1.2.8.3.4. False Rejection Rate (FRR) - Type I error

1.2.8.3.5. False Acceptance Rate (FAR) - Type II error

1.2.8.3.6. Crossover Error Rate (CER)

1.2.9. Authorization / Accountability

1.2.9.1. Authorization

1.2.9.1.1. granted privileges

1.2.9.2. Accountability

1.2.10. Managing Access Control

1.2.10.1. Scripting

1.2.10.2. Directory services

1.2.10.3. Centralized

1.2.10.3.1. Radius

1.2.10.3.2. TACACS

1.2.10.3.3. TACACS+

1.2.10.3.4. Diameter

1.2.10.4. CHAP

1.2.10.5. Decentralized

1.2.10.5.1. Database

1.2.11. Network Security Testing

1.2.11.1. NIST Publication 800-42

1.3. Telecommunications and Network Security

1.3.1. OSI / TCP Model

1.3.1.1. OSI OSI (Open Systems Interconnect)

1.3.1.1.1. Layer 7 : Application

1.3.1.1.2. Layer 6 : Presentation

1.3.1.1.3. Layer 5 : Session

1.3.1.1.4. Layer 4 : Transport

1.3.1.1.5. Layer 3 : Network

1.3.1.1.6. Layer 2 : Data

1.3.1.1.7. Layer 1 : Physical

1.3.1.2. TCP/IP

1.3.1.2.1. Application

1.3.1.2.2. Host-to-host (Transport)

1.3.1.2.3. Internet (Network)

1.3.1.2.4. Network Interface (data/physical)

1.3.2. Media / Topologies

1.3.2.1. Typical Media

1.3.2.1.1. 10Base2

1.3.2.1.2. 10Base5

1.3.2.1.3. Coax

1.3.2.1.4. UTP/STP

1.3.2.1.5. Fiber

1.3.2.1.6. Wireless

1.3.2.2. Topologies

1.3.2.2.1. Bus

1.3.2.2.2. Ring

1.3.2.2.3. Star

1.3.2.2.4. Tree

1.3.2.2.5. Mesh

1.3.3. Lan Protocols / Standards

1.3.3.1. ARP / RARP

1.3.3.2. 802.3 (CSMA/CD)

1.3.3.2.1. Ethernet

1.3.3.3. 802.5 (Token Ring)

1.3.3.4. 802.11 (Wireless)

1.3.3.5. 802.16 (WiMax)

1.3.3.6. 802.20 (Mobile WiMax)

1.3.4. WAN Technologies

1.3.4.1. Dedicated lines

1.3.4.2. Circuit Switched

1.3.4.2.1. SDH/SONET

1.3.4.2.2. DTM

1.3.4.3. Packet Switched

1.3.4.3.1. ATM

1.3.4.3.2. Gigabit Ethernet

1.3.4.3.3. x25

1.3.4.4. Token Ring

1.3.4.5. FDDI

1.3.5. The PBX

1.3.6. Remote Connectivity

1.3.6.1. PPP/SLIP

1.3.6.2. PPPOE

1.3.6.3. PAP/CHAP

1.3.6.4. Securing

1.3.6.4.1. IPSEC

1.3.6.4.2. VPNs

1.3.6.4.3. SSL

1.3.6.4.4. NAT

1.3.6.4.5. swIPe

1.3.7. Networking Cables

1.3.7.1. Coaxial Cable

1.3.7.2. Twisted Pair

1.3.7.3. Fiber-Optic Cable

1.3.7.3.1. Core

1.3.7.3.2. Cladding

1.3.7.3.3. Jacket

1.3.7.4. Cable Vulnerabilities

1.3.7.5. Cable failure Terms

1.3.7.5.1. Attenuation

1.3.7.5.2. Crosstalk

1.3.7.5.3. Noise

1.3.8. Networking Devices

1.3.8.1. Repeater

1.3.8.2. Bridge

1.3.8.3. Switch

1.3.8.4. Router

1.3.8.5. Proxies

1.3.8.6. Gateway

1.3.8.7. LAN Extender

1.3.8.8. Screened-Host Firewall

1.3.8.9. Dual-Homed Host Firewall

1.3.8.10. Screened-Subnet Firewall

1.3.8.11. SOCKS

1.3.9. Wireless

1.3.9.1. IEEE Standards

1.3.9.1.1. 802.11a -> 802.11n

1.3.9.1.2. 802.1x

1.3.9.1.3. 802.3af

1.3.9.1.4. 802.16 (WiMax)

1.3.9.1.5. 802.15 (Bluetooth)

1.3.9.2. Terminology

1.3.9.2.1. RADIUS

1.3.10. General Communications Vulnerabilities

1.3.10.1. Wireless exploits

1.3.10.1.1. Passive Attacks

1.3.10.1.2. Active Attacks

1.3.10.1.3. Man in the Middle Attacks

1.3.10.1.4. Jamming Attacks

1.3.10.2. Contremesures

1.3.10.2.1. IDS / IPS

1.3.10.2.2. Honeypots

1.3.10.2.3. Response Team

1.3.10.2.4. Layered Security

1.3.10.2.5. Firewalls

1.3.10.2.6. Securing Voice

1.4. Security Architecture and Design

1.4.1. Trusted Computer Base (TCB)

1.4.1.1. Trusted Computer

1.4.1.1.1. Does what you tell it to

1.4.1.1.2. Only what you tell it to do

1.4.1.1.3. You kown what it's doing

1.4.1.2. Trusted System

1.4.1.2.1. Rings of security

1.4.1.3. Reference Monitor

1.4.1.4. Security Kernel

1.4.1.4.1. Isolate processes

1.4.1.4.2. Be used on every access

1.4.1.4.3. Be small enough to be easily tested

1.4.1.5. Covert Channels

1.4.1.5.1. Covert Storage Channel

1.4.1.5.2. Covert Timing Channel

1.4.2. Computer Architecture

1.4.2.1. CPU

1.4.2.1.1. RISC

1.4.2.1.2. CISC

1.4.2.2. Memory

1.4.2.2.1. Cache

1.4.2.2.2. ROM

1.4.2.2.3. RAM

1.4.2.2.4. Flash

1.4.2.2.5. Memory Addressing

1.4.2.3. Buses

1.4.2.3.1. Serial

1.4.2.3.2. Paralelle

1.4.2.4. Firmware

1.4.2.4.1. BIOS

1.4.2.4.2. Cisco IOS

1.4.2.5. Software

1.4.2.5.1. OS

1.4.2.5.2. Applications

1.4.3. Data Classification Models

1.4.3.1. Models and IT classification Frameworks

1.4.3.2. Compartmented Security Modes

1.4.3.3. Multilevel Security Mode

1.4.4. Access Control Models

1.4.4.1. Access Control

1.4.4.1.1. Identification

1.4.4.1.2. Authentication

1.4.4.1.3. Authorization

1.4.4.1.4. Terms

1.4.4.2. Databases

1.4.4.3. Access Control Techniques

1.4.5. Certification / Accreditation and Evaluation

1.4.5.1. Certification

1.4.5.2. Accreditation

1.4.5.3. Evaluation

1.4.5.3.1. TCSEC

1.4.5.3.2. ITSEC

1.4.5.3.3. TNI

1.4.5.3.4. Common Criteria

1.4.6. Compliance

1.4.6.1. ISO 17799 / BS7799

1.4.6.1.1. ISO 17799

1.4.6.1.2. BS 7799

1.4.6.2. ISO 27000 Series

1.4.6.2.1. ISO 27000

1.4.6.2.2. ISO 27001

1.4.6.2.3. ISO 27002

1.4.6.2.4. ISO 27003

1.4.6.2.5. ISO 27004

1.4.6.3. Current drivers

1.4.6.3.1. Regulation and Legislation

1.4.6.3.2. Cyberliability Insurance

1.4.6.3.3. Incident Response

1.4.6.4. Future Drivers

1.4.6.4.1. Industry Adoption and Compliance

1.4.6.4.2. Cyberterrorism

1.4.6.4.3. Information Warface

1.4.6.4.4. Personal Privacy

1.5. Business Continuity and Disaster Recovery Planning

1.5.1. Business Continuity Planning (BCP)

1.5.1.1. Why ?

1.5.1.1.1. Business Need

1.5.1.1.2. Regulatory (SoX, BASEL2, FISMA, HIPAA, etc...)

1.5.1.2. Contingency Planning

1.5.1.3. Integration BCP/CP

1.5.1.3.1. Develop the contingency planning policy statement

1.5.1.3.2. Conduct the business impact analysis (BIA)

1.5.1.3.3. Identify preventive controls

1.5.1.3.4. Develop recovery strategies

1.5.1.3.5. Develop an IT contingency plan

1.5.1.3.6. Plan testing, training, and exercices

1.5.1.3.7. Plan Maintenance

1.5.1.4. NIST's 3 Phases of Actions

1.5.1.4.1. Notification/Activation

1.5.1.4.2. Recovery

1.5.1.4.3. Reconstitution

1.5.1.5. Elements of BCP

1.5.1.5.1. Scope and plan Initiation

1.5.1.5.2. Business Impact Analysis (BIA)

1.5.1.5.3. Business Continuity Planning and Development

1.5.1.5.4. Plan approval and implementation

1.5.2. Disaster Recovery Planning (DRP)

1.5.2.1. Objectives

1.5.2.1.1. Protect the compani form major computer services failure

1.5.2.1.2. Minimize the risk from delays in providing services

1.5.2.1.3. Guarantee reliability of standby systems through testing

1.5.2.1.4. Minimize decision making required by personnel during a disaster

1.5.2.2. DRP assumes BIA has been done, now focusing on steps needed to protect the business

1.5.3. Development

1.5.4. Emergency Implementation Planning

1.5.5. Types of DR Sites

1.5.5.1. Subscription Service

1.5.5.1.1. Hot Site

1.5.5.1.2. Warm Site

1.5.5.1.3. Cold Site

1.5.5.1.4. Others

1.5.5.2. Transaction Redundancy Implementation

1.5.5.2.1. Electronic Vaulting

1.5.5.2.2. Remote Journaling

1.5.5.2.3. Database Shadowing

1.5.6. Media / Methods

1.5.6.1. Backup Storage Media

1.5.6.1.1. Tape

1.5.6.1.2. Hard Disks

1.5.6.1.3. Optical Disks

1.5.6.1.4. Solid State

1.5.6.2. Backup Methods

1.5.6.2.1. Full

1.5.6.2.2. Incremental

1.5.6.2.3. Differential

1.5.6.3. RAID

1.5.6.3.1. disk stripping (raid 0)

1.5.6.3.2. disk mirroring (raid 1)

1.5.6.3.3. disk stripping with parity (raid5)

1.5.6.3.4. raid combiné (ex: raid 01 -> grappe raid 0 + raid global 1)

1.5.6.3.5. RAB Classification

1.5.7. Testing COOP / DRP

1.5.7.1. Checklist

1.5.7.2. Structured walk through

1.5.7.3. Simulation

1.5.7.4. Parallel

1.5.7.5. Full interruption

1.5.8. Standards

1.5.8.1. BS 25999

1.5.8.2. ISO 22399

1.5.8.3. ISO 24762

1.5.8.4. ISO 27001

1.5.9. Links

1.5.9.1. thebci

1.5.9.2. disasterrecoverytemplates

1.6. Application Security

1.6.1. Goals

1.6.1.1. Software should perform its intended tasks - nothing more, nothing less

1.6.1.2. Develop software and systems in budget and on schedule

1.6.2. Open Source vs. Proprietary Code

1.6.3. A TCB depends on Trusted Software

1.6.4. Overview of programming languages

1.6.4.1. 1st generation: Machine or Binary code

1.6.4.2. 2nd generation : ASM

1.6.4.3. 3rd generation : Spoken language

1.6.4.4. Compiled / Interpreted / Hybrid

1.6.5. Principles of Programming

1.6.5.1. Modularity

1.6.5.2. Top-down design

1.6.5.3. Limited control structures

1.6.5.4. Limited control structures

1.6.5.5. Limited scope of variables

1.6.6. Methodologies

1.6.6.1. Structured Programming

1.6.6.2. Object-Oriented Programming

1.6.6.3. Computer-Aided Software Engineering (CASE) tools

1.6.7. Good Coding Practices

1.6.7.1. Least privileges

1.6.7.2. Hiding secrets

1.6.7.3. Layered defense

1.6.7.4. Weakest link

1.6.8. Development Models

1.6.8.1. Software Engineering Models

1.6.8.1.1. Simplistic Model

1.6.8.1.2. Waterfall Model

1.6.8.1.3. Spiral Model

1.6.8.1.4. Cost Estimation Techniques

1.6.8.1.5. Rapid Application Development (RAD)

1.6.8.1.6. Cleanroom Model

1.6.8.1.7. Iterative Development Method

1.6.8.1.8. Prototyping Model

1.6.8.1.9. System Development Life Cycle (SDLC)

1.6.8.1.10. The Software Capability Maturity Model

1.6.8.1.11. IDEAL Model

1.6.9. Object Oriented Programming

1.6.9.1. Object Oriented Concepts

1.6.9.1.1. Class

1.6.9.1.2. Data Abstraction

1.6.9.1.3. Inheritance

1.6.9.1.4. Polymorphism

1.6.9.1.5. Polyinstantiation

1.6.9.2. Phases of Development for Object Oriented Orientation (OOO)

1.6.9.2.1. Object Oriented Requirements Analysis (OORA)

1.6.9.2.2. Object Oriented Analysis (OOA)

1.6.9.2.3. Domain Analysis (DA)

1.6.9.2.4. Object Oriented Design (OOD)

1.6.9.2.5. Object Oriented Programming( OOP)

1.6.10. Tools and Languages

1.6.10.1. JAVA

1.6.10.2. ActiveX

1.6.10.3. Dynamic Data Exchange (DDE)

1.6.10.4. Object Linking and Embedding (OLE)

1.6.10.5. Component Object Model (COM) & Distributed Component Object Model (DCOM)

1.6.10.6. Common Object Request Broker Architecture (CORBA)

1.6.10.7. Expert Systems

1.6.11. Databases

1.6.11.1. Types

1.6.11.1.1. File-based

1.6.11.1.2. Hierarchical

1.6.11.1.3. Network

1.6.11.1.4. Object-Oriented

1.6.11.1.5. Relational

1.6.11.2. Terms

1.6.11.2.1. Database Management System

1.6.11.2.2. Data Definition Language

1.6.11.2.3. Primary Key

1.6.11.2.4. Foreign Key

1.6.11.2.5. SELECT Command

1.6.11.2.6. Normalization

1.6.11.2.7. Bind variable

1.6.11.2.8. Data Warehouse

1.6.11.3. Database Security

1.6.11.3.1. Basics of Database Security

1.6.11.3.2. Discretionary vs Mandatory

1.6.11.3.3. Relational vs Object Oriented

1.6.12. Configuration & Management

1.6.13. Application Vulnérabilities

1.6.13.1. Malicious Mobile Code

1.6.13.2. DNS Hijacking

1.6.13.3. XSS

1.6.13.4. SQL Injection

1.6.13.5. DoS DDoS

1.6.13.6. Flooding

1.6.13.7. Virus

1.6.13.7.1. Trojan

1.6.13.7.2. Polymorphic

1.6.13.7.3. Stealth

1.6.13.7.4. Retro

1.6.13.7.5. Boot Sector

1.6.13.7.6. Macro

1.6.13.8. Worm

1.7. Cryptography

1.7.1. Classical Goals

1.7.1.1. Confidentiality

1.7.1.2. Integrity

1.7.1.3. Authentication

1.7.1.4. Nonrepudiation

1.7.2. History

1.7.3. Components

1.7.4. Symmetric-Key Cryptography

1.7.4.1. Symmetric Algorithms

1.7.4.1.1. DES

1.7.4.1.2. 3DES

1.7.4.1.3. AES

1.7.4.1.4. Serpent

1.7.4.1.5. Two Fish

1.7.4.1.6. RCG

1.7.4.1.7. IDEA

1.7.4.2. Modes of Operation DES

1.7.5. Asymmetric-Key Cryptography

1.7.5.1. Asymmetric Algorithms

1.7.5.1.1. RSA

1.7.5.1.2. DH

1.7.5.1.3. DSA

1.7.5.1.4. El Gamal

1.7.5.1.5. ECC

1.7.6. Hybrid Cryptography

1.7.7. Hashing

1.7.7.1. Hash Algorithms

1.7.7.1.1. MD5

1.7.7.1.2. SHA-1

1.7.8. Public Key Infrastructure

1.7.8.1. Certificate Authority or CA

1.7.8.2. Registration Authority or RA

1.7.8.3. Certificates holders

1.7.8.4. Clients that validate digital signatures

1.7.8.5. Repositories

1.7.9. Digital Signatures

1.7.9.1. Digital Signature Standard (DSS)

1.7.9.2. Types of CA Trust

1.7.9.2.1. Hierarchical

1.7.9.2.2. Cross Certification

1.7.10. Cryptography In Use

1.7.10.1. SSH

1.7.10.2. IPSEC

1.7.10.3. SSL

1.7.10.4. SET

1.7.11. Data Privacy Concerns

1.7.12. Attacks

1.8. Physical Security

1.8.1. Roles of Physical Security

1.9. Legal, Regulations, Compliance and Investigations

1.9.1. Ethics

1.9.1.1. ISC2 Code of Ethics

1.9.1.2. Internet Architecture Board (IAB)

1.9.2. Examples of Computer Crimes

1.9.2.1. Data Diddling

1.9.2.2. Salami Attacks

1.9.2.3. Social Engineering

1.9.2.4. Dumpster Diving

1.9.3. Law

1.9.3.1. The Legal Framework

1.9.3.1.1. Three sources of laws

1.9.3.2. Investigation

1.9.3.2.1. Steps

1.9.3.2.2. Terms

1.9.3.2.3. Best of Evidence

1.9.3.2.4. Forensics

1.9.3.2.5. Contracts

1.9.3.2.6. End-User Licence Adreements

1.9.3.2.7. Intellectual Property

1.9.3.2.8. Privacy

1.9.3.2.9. Accountability

1.9.3.2.10. International Laws

1.9.3.2.11. Computer Laws

1.10. Operations Security

1.10.1. Separation of Duties

1.10.1.1. Operator

1.10.1.2. Security Admin

1.10.1.3. System Admin

1.10.2. Critical Operations Controls

1.10.2.1. Ressources Protection

1.10.2.2. Hardware Controls

1.10.2.3. Software Controls

1.10.2.4. Privileged Entity Controls

1.10.2.5. Change Management Control

1.10.3. Media Protection

1.10.3.1. Records Retention

1.10.3.2. Data Remanence

1.10.3.3. Due care and due diligence

1.10.3.4. Documentation

1.10.4. Auditing

2. ISC2

2.1. Comment se certifier ?

2.2. Candidate Information Bulletins

2.3. Enregistrement

3. Examen

3.1. Jour

3.1.1. Samedi

3.2. Questions

3.2.1. 250 QCM

3.3. Cout

3.4. Tests

3.4.1. Cccure.org

3.4.2. FreePracticeTests