Scribd Logo
Upload

Welcome to Scribd!

  • 125 views

    CISSP - Domain 1 Part 1

    Uploaded by

    ezechriss
    The document discusses the Certified Information Systems Security Professional (CISSP) certification. It covers the following key topics in 3 sentences or less: The CISSP certification covers professional ethics, CIA concepts (confidentiality, integrity, availability), security governance principles, security policies, standards, procedures and guidelines, risk management processes, and business continuity planning and impact assessments. Common security threats are discussed such as attacks on encryption, social engineering, and key loggers. Methods to address these threats are also outlined including using encryption for data at rest and in motion, access controls, strong passwords, and monitoring systems with intrusion detection and prevention.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    CISSP - Domain 1 Part 1

    Uploaded by

    ezechriss
    125 views21 pages
    The document discusses the Certified Information Systems Security Professional (CISSP) certification. It covers the following key topics in 3 sentences or less: The CISSP certification covers professional ethics, CIA concepts (confidentiality, integrity, availability), security governance principles, security policies, standards, procedures and guidelines, risk management processes, and business continuity planning and impact assessments. Common security threats are discussed such as attacks on encryption, social engineering, and key loggers. Methods to address these threats are also outlined including using encryption for data at rest and in motion, access controls, strong passwords, and monitoring systems with intrusion detection and prevention.

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses the Certified Information Systems Security Professional (CISSP) certification. It covers the following key topics in 3 sentences or less: The CISSP certification covers professional ethics, CIA concepts (confidentiality, integrity, availability), security governance principles, security policies, standards, procedures and guidelines, risk management processes, and business continuity planning and impact assessments. Common security threats are discussed such as attacks on encryption, social engineering, and key loggers. Methods to address these threats are also outlined including using encryption for data at rest and in motion, access controls, strong passwords, and monitoring systems with intrusion detection and prevention.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    125 views21 pages

    CISSP - Domain 1 Part 1

    Uploaded by

    ezechriss
    The document discusses the Certified Information Systems Security Professional (CISSP) certification. It covers the following key topics in 3 sentences or less: The CISSP certification covers professional ethics, CIA concepts (confidentiality, integrity, availability), security governance principles, security policies, standards, procedures and guidelines, risk management processes, and business continuity planning and impact assessments. Common security threats are discussed such as attacks on encryption, social engineering, and key loggers. Methods to address these threats are also outlined including using encryption for data at rest and in motion, access controls, strong passwords, and monitoring systems with intrusion detection and prevention.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    You are on page 1of 21

    Certified Information Systems Security Professional

    (CISSP)
     Professional Ethics
     CIA Concepts
     Security Governance Principle
     Security Policies, Standards, Procedures and Guidelines
     Risk Identification, Assessment, Response, Monitoring
    and Reporting
     BCP & BIA
    THREATS We Use
     Encryption for DATA AT REST (For instance
     Attacks on Encryption
    AES 256), Full disk Encryption
     Social Engineering
     Secure Transport protocol for DATA IN
     Key Loggers (Software/ Hardware)
    MOTION (SSL, TLS, IPSEC)
     IOT – They can be backdoor to other
     Best practices for DATA IN USE- Clean desk,
    system due to growing number
    No Shoulder Surfing, Screen view Angle
    protector, LOCK the PC
     Strong Passwords, MFA, Masking, Access
    control, Need to Know, Least Privilege
    THREATS We Use
     Cryptography
     Alteration of our data
     Check sums
     Code Injections
     Message Digest (MD5, SHA 1 or SHA2)
     Attacks on your encryption
     Digital Signatures – Non-Repudiation
    THREATS We Use
     IDS/ IPS
     Malicious Attacks (DDOS, Physical
     Patch management
    system compromise, Staffs)
     Redundancy of Hardware Power supplies/
     Application Failures (Errors in the code)
    UPS/ Generators, Disks (RAID), Traffic Paths
     Component Failure (Hardware)
    (Network Designs), HVAC, Staff, High
    Availability
     SLAs – How much uptime wanted (99.9%)
    Identification is claiming to be an identity when attempting to access a secured area or system.

    Authentication is proving that you are that claimed identity.


    TYPE 1 - Something you know (Password, Passphrase, PIN etc)
    TYPE 2 - Something you have (Authentication ID, Passport, Smartcard, Token, Cookie on PC
    TYPE 3 - Something you are (Biometrics, Fingerprint scan, Facial Geometry etc)

    Authorization is defining the permissions (i.e., allow/grant and/or deny) of a resource and object access for a specific
    identity or subject.

    Auditing is recording a log of the events and activities related to the system and subjects.

    Accounting is reviewing log files to check for compliance and violations in order to hold subjects accountable for their
    actions, especially violations of organizational security policy
    Least Privilege - The principle of least privilege ensures users are granted with the minimum amount
    of access necessary for them to complete their required work tasks or job responsibilities.

    Need to Know - This principle ensures that subjects are granted access only to what they need to
    know for their work tasks and job functions. Subjects may have clearance to access classified or
    restricted data but are not granted authorization to the data unless they actually need it to perform
    a job.

    Non-Repudiation - Nonrepudiation ensures that the subject of an activity or who caused an event
    cannot deny that the event occurred.

    Subjects & Objects - The subject is the active entity that makes a request to access a resource. A
    subject is commonly a user, but it can also be a process, program, computer, or organization. The
    object is the passive entity that the subject wants to access. An object is commonly a resource, such
    as a file or printer, but it can also be a user, process, program, computer, or organization.
    CEO – Chief Executive Officer

    CTO – Chief Technology officer

    CSO – Chief Security Officer

    CFO – Chief Financial Officer


    SECURITY GOVERNANCE
    • PCI-DSS - Payment Card Industry Data Security Standard
    - Standard to issue or handle credit /Debit cards

    • OCTAVE – Operationally Critical Threat Asset and Vulnerability Evaluation


    - Self directed Risk Assessment

    • COBIT – Control Objectives for Information and related Technologies


    - Goals for IT stake holder needs

    • COSO – Committee of Sponsoring Organizations


    - Goals for entire organization

    • ITIL – Information Technology Infrastructure Library


    - IT service management
    DEFENSE IN DEPTH
    • Implement Overlapping security controls to protect an asset

    • No Single Security control secure an asset

    • To access a server, you will have to go thru multiple locked doors, Security guards, Man
    traps etc

    • To access a data you will have to go thru multiple routers, Firewalls, switches, servers and
    application security
    POLICIES
    STANDARDS
    PROCEEDURE

    You might also like