Index

A

  1. absolute addressing, 178
  2. abstraction, 181, 465
  3. abuse/misuse case testing, 368–369
  4. acceptability, 339
  5. acceptable use policies (AUPs), 149
  6. acceptance testing, 446–447, 465
  7. access aggregation, 355
  8. access control, 159–162, 180, 229, 349–353
  9. access control attacks, 353–355
  10. access control list (ACL), 352, 465
  11. access management, 438
  12. Access Matrix model, 161, 465
  13. Access Points (APs), 272–273
  14. access provisioning lifecycle, 355–356
  15. access rights/permissions, 352
  16. accessibility, as a consideration for choosing locations, 226
  17. accidents, in disaster recovery (DR) plan, 416
  18. account management, 371–372
  19. accountability
    1. about, 343
    2. as a basic control requirement, 164–165
    3. defined, 465
  20. accreditation, 167–169, 465
  21. acquisitions, 46, 136–138, 465
  22. active hubs, 278
  23. active IDS, 289
  24. active-active, 465
  25. active-passive, 465
  26. ActiveX, 466
  27. activities, logging and monitoring, 391–394
  28. ad hoc, 273
  29. Adaptive Chosen Ciphertext Attack (ACCA), 223
  30. Adaptive Chosen Plaintext Attack (ACPA), 223
  31. adaptive exam, 17
  32. address bus, 176
  33. Address Resolution Protocol (ARP), 264, 466
  34. address space, 466
  35. addressing personnel safety and security concerns, 428
  36. Adleman, Len (Dr), 211, 214
  37. administrative controls, 126, 466
  38. administrative laws, 55, 56, 466
  39. administrative management and control
    1. about, 111–112
    2. compliance, 115–116
    3. consultant controls, 115
    4. contractor controls, 115
    5. employment agreements and policies, 114
    6. employment candidate screening, 112–114
    7. employment termination processes, 115
    8. privacy, 116
    9. vendor controls, 115
  40. Advanced Encryption Standard (AES), 211, 466
  41. advisory policies, 86
  42. adware, 466
  43. African Network Information Centre (AFRINIC), 258
  44. age, as a criteria for commercial data classification, 144
  45. agent, 466
  46. agent of change, 32
  47. aggregation, 187, 397, 466
  48. Agile, 434–436, 466
  49. Agile Maturity Model (AMM), 437, 466
  50. Agile Project Management For Dummies (Layton), 436
  51. American Accounting Association (AAA), 48
  52. American Bar Association (ABA), 391
  53. American Council on Education's College Credit Recommendation Service (ACE CREDIT), 14
  54. American Institute of Certified Public Accountants (AICPA), 48
  55. American National Standards Institute (ANSI), 10, 207
  56. American Registry for Internet Numbers (ARIN), 257–258
  1. American Society for Industrial Security (ASIS), 25, 30, 35
  2. American Standard Code for Information Interchange (ASCII), 248
  3. analog signaling, 277
  4. analysis, 376, 386
  5. analytic attack, 221
  6. Annualized Loss Expectancy (ALE), 120, 466
  7. Annualized Rate of Occurrence (ARO), 120, 466
  8. anomaly-based endpoint protection, 293
  9. anomaly-based IDS, 392
  10. anti-malware, 411
  11. antivirus software, 466
  12. Anton Piller order, 385
  13. applet, 466
  14. application firewall, 467
  15. Application Layer (Layer 7) (OSI Reference Model), 245–247, 467
  16. Application Layer (TCP/IP Model), 279, 467
  17. application penetration test, 363, 467
  18. application programming interfaces (APIs), 317, 450, 467
  19. application scan, 467
  20. application software, 467
  21. application state, 174
  22. application virtualization, 309
  23. application whitelisting, 293, 467
  24. application-level gateway, 284–285
  25. applications, 395
  26. apprenticeship program, 140
  27. archive, 220, 467
  28. ARCnet, 264
  29. area identifiers, 254
  30. Arithmetic Logic Unit (ALU), 173
  31. artificial intelligence (AI), 467
  32. Asia-Pacific Network Information Centre (APNIC), 257
  33. aspirating devices, 236
  34. asset check-in/check-out log, 230
  35. asset inventory, 394, 467
  36. Asset Security domain
    1. about, 143
    2. classifying information, 143–146
    3. determining data security controls, 151–153
    4. determining ownership, 146–147
    5. establishing handling requirements, 154
    6. maintaining ownership, 146–147
    7. protecting privacy, 148–149
    8. retention, 150
    9. supporting assets, 143–146
  37. assets
    1. about, 117
    2. controlling physical and logical access to, 316–318
    3. defined, 467
    4. supporting, 143–146
    5. valuation of, 117–118, 129–130, 355, 467
  38. Associate of (ISC)2 certification, 33
  39. assurance, 164, 166
  40. asymmetric algorithm, 467
  41. asymmetric algorithm cryptography. See asymmetric key cryptography
  42. Asymmetric Digital Subscriber Line (ADSL), 267
  43. asymmetric key cryptography
    1. about, 212–214
    2. Diffie-Hellman key exchange, 215, 476
    3. El Gamal, 215
    4. Elliptic Curve (EC), 216
    5. Merkle-Hellman (Trapdoor) Knapsack, 215–216
    6. RSA algorithm, 214–215
  44. asymmetric key system, 467
  45. asynchronous communication, 271
  46. Asynchronous Transfer Mode (ATM), 268, 467
  47. attack tree, 134
  48. attacks, 221–222. See also specific attacks
  49. attenuation, 275, 278
  50. attestation, as a function of TPM, 181
  51. attribute-based access control (ABAC), 352–353, 467
  52. audit trail, 468
  53. audits/auditing, 165, 377, 438, 444–445, 467
  54. augmented reality (AR), 468
  55. authenticated scans, 360, 468
  56. authentication
    1. cryptography and, 196
    2. defined, 328, 468
    1. improper, 449
    2. single factor, 330–335
  57. Authentication Header (AH), 307, 468
  58. authorization
    1. as a data integrity measure, 158
    2. defined, 468
    3. implementing and managing mechanisms for, 348–353
  59. automatic controls, 126, 468
  60. autonomous system (AS), 255
  61. availability, 52, 159, 414, 468
  62. awareness, 138–139, 375, 423

B

  1. backdoor, 468
  2. background check, 468
  3. backup media encryption, 413
  4. backup verification data, 374–375, 406
  5. backups, 92–94, 154, 413
  6. bare metal hypervisors, 309
  7. base addressing, 178
  8. baseband signaling, 274
  9. baselines, 87, 152, 468
  10. Basic Input-Output System (BIOS), 178
  11. bastion host, 286
  12. beam devices, 236
  13. Beaver, Kevin (author)
    1. Hacking For Dummies, 364
    2. Hacking Wireless Networks For Dummies, 282
  14. behavior-based endpoint protection, 293
  15. Bell-LaPadula model, 160–161, 468
  16. best evidence, 380, 468
  17. best evidence rule, 381, 468
  18. Best Practices in Internal Investigations, 391
  19. Biba integrity model, 161, 468
  20. binding, as a function of TPM, 181
  21. biometrics, 337–343, 468
  22. Birthday Attack, 222, 468
  23. birthright access, 345
  24. bit error ratio (BER), 275
  25. Bitcoin, 299
  26. black-box testing, 469
  27. blacklisting, 410, 469
  28. blackout, 469
  29. block ciphers, 202–203, 469
  30. Blowfish Algorithm, 211
  31. bluejacking, 310–311
  32. bluesnarfing, 310–311
  33. Bluetooth, 469
  34. bollards, 230, 318, 469
  35. “boot camps,” 15
  36. bootkit, 469
  37. Border Gateway Protocol (BGP), 255
  38. bot, 469
  39. botnet, 469
  40. bounce site, 311
  41. breach, 469
  42. bridge, 271, 469
  43. bridge mode, 273
  44. bring your own device (BYOD), 469
  45. broadband signaling, 274
  46. broadcast, 265, 469
  47. broadcast storm, 271
  48. brownout, 469
  49. brute-force attack, 221, 353, 469
  50. buffer overflow, 301, 353–354, 449, 469
  51. Building Security in Maturity Model (BSIMM), 157, 437, 469
  52. buildings, in disaster recovery (DR) plan, 416
  53. burden of proof, 54
  54. bus, 469, 470
  55. Bus Interface Unit (BIU), 173
  56. Bus topology, 274
  57. Business Continuity Plan (BCP)
    1. about, 89, 90, 375–376
    2. developing, 106–110
    3. implementing, 110–111
    4. participating in, 427
    5. requirements for, 87–111
  58. Business Impact Analysis (BIA)
    1. about, 88, 90, 98–99
    2. Criticality Assessment, 100–101
    3. defined, 470
    4. determining Maximum Tolerable Outage (MTO), 102
    1. establishing Maximum Tolerable Downtime (MTD), 101–102
    2. establishing recovery targets, 102–105
    3. identifying key players, 101
    4. Resource Requirements portion, 106
    5. Vulnerability Assessment, 99–100
  59. business records exception, 382
  60. business strategy, aligning security function to, 44–45

C

  1. CAE-CD programs, 12
  2. California Security Breach Information Act (SB-1386), 81
  3. Callback feature, 304
  4. Caller ID, 303, 470
  5. caller ID spoofing, 470
  6. campus area network (CAN), 243
  7. The Candy-from-a-Baby Fallacy, 82
  8. Capability Maturity Model Integration (CMMI), 437, 470
  9. carbon dioxide (CO2), 237
  10. Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA), 263
  11. Carrier Sense Multiple Access with Collision Detection (CSMA/CD), 263
  12. case law, 53
  13. cash reserves, 420
  14. ceilings, as a building design consideration, 227
  15. Center for Cyber Safety and Education, 27
  16. Center for Internet Security (CIS) (website), 170, 434
  17. Central Processing Unit (CPU), 173–176, 470
  18. Certificate Authority (CA), 220, 470
  19. certificate programs, 140
  20. Certification and Accreditation Professional (CAP), 33, 433
  21. certifications. See also CISSP certification
    1. Check Point Security Administration, 36
    2. choosing, 37–38
    3. defined, 470
    4. earning, 32–38
    5. networking, 456
    6. non-(ISC)2, 34–37
    7. non-technical/non-vendor, 34–36
    8. technical/vendor, 36–37
    9. writing exam questions, 26
  22. Certified Business Continuity Planner (CBCP), 35
  23. Certified Chief Information Security Officer (C|CISO), 35
  24. Certified Cloud Security Professional (CCSP), 33
  25. Certified Ethical Hacker (C|EH), 36
  26. Certified in Risk and Information Systems Control (CRISC), 34
  27. Certified in the Governance of Enterprise IT (CGEIT), 34
  28. Certified Information Privacy Professional (CIPP), 35
  29. Certified Information Privacy Professional/Europe (CIPP/E), 35
  30. Certified Information Security Manager (CISM), 34
  31. Certified Information Systems Auditor (CISA), 34
  32. Certified Information Systems Security Professional (CISSP). See CISSP
  33. Certified Protection Professional (CPP), 35
  34. Certified Secure Software Lifecycle Professional (CSSLP), 33, 440
  35. chain of custody, 383–386, 470
  36. chain of evidence, 382, 383–386, 470
  37. Challenge Handshake Authentication Protocol (CHAP), 304, 325, 470
  38. change management, 395, 412, 439, 442–443, 470
  39. character conversion, 247
  40. Cheat Sheet (website), 4
  41. Check Point Security Administration certifications, 36
  42. checklist test, of disaster recovery (DR) plan, 424
  43. Children's Online Privacy Protection Act (COPPA) (1998), 77
  44. choose your own device (CYOD), 470
  45. Chosen Ciphertext Attack (CCA), 223
  46. Chosen Plaintext Attack (CPA), 223, 470
  47. Chosen Text Attack (CTA), 223
  48. CIA Triad, 51–52, 157–159, 470
  49. Cipher Block Chaining (CBC), 208–209, 470–471
  50. Cipher Block Chaining Message Authentication Code Protocol (CCMP), 282
  51. Cipher Feedback (CFB) mode, 209, 471
  1. ciphers, 199, 210–205, 470
  2. ciphertext, 199, 471
  3. Ciphertext Only Attack (COA), 222–223
  4. circuit-level gateway, 284
  5. circuit-switched networks, 267–268, 471
  6. circumstantial evidence, 381, 471
  7. Cisco certifications, 11
  8. CISSP certification
    1. about, 1–2, 9–10
    2. concentrations in, 33–34
    3. domains of, 10
    4. exam overview, 17–20
    5. exam preparation, 12–16
    6. exam registration, 16–17
    7. post-exam, 20–21
    8. promoting, 30–31
    9. renewing, 20–21
    10. requirements for, 10–12
    11. uses for, 23–39
    12. using as an agent of change, 32
  9. CISSP Certification Exam Outline, 12, 13
  10. CISSP training, 14
  11. civil disturbances, in disaster recovery (DR) plan, 416
  12. Civil Law systems, 54–55, 57, 471
  13. civil requirements, for investigations, 391
  14. cladding, 276
  15. Clark-Wilson integrity model, 161–162, 471
  16. classifications, 54, 143–146, 471
  17. classroom training, 139
  18. clearance level, 146
  19. client-based systems, assessing and mitigating vulnerabilities in, 185–186
  20. climatology, as a consideration for choosing locations, 226
  21. Clipper Chip, 221
  22. closed systems, 182, 471
  23. closed-head system, 236
  24. cloud, 471
  25. cloud access security broker (CASB) systems, 291–292, 395, 471
  26. cloud assets, 395
  27. cloud backup, 93
  28. cloud communications, 296
  29. Cloud Security Alliance (CSA), 192
  30. cloud-based access controls, 327–328
  31. cloud-based malware detection, 410
  32. cloud-based spam filtering, 410
  33. cloud-based systems, assessing and mitigating vulnerabilities in, 190–192
  34. cluster(ing), 471
  35. coaxial cable, 274–275, 471
  36. COBIT, 48, 153, 472
  37. code coverage analysis, 370
  38. code of ethics, 472
  39. code repositories, 443–444
  40. code review and testing, 368, 472
  41. coding, secure practices for, 448–452
  42. coercion, 382
  43. cold site, 97, 98, 413, 472
  44. collecting security process data, 371–376
  45. collision, 218
  46. collision domain, 471
  47. commercial data classification, 144–145
  48. commercial software, 448
  49. Committed Access Rate (CAR), 312
  50. Committee of Sponsoring Organizations of the Treadway Commission (COSO), 48–49
  51. Common Body of Knowledge (CBK), 10, 26
  52. Common Criteria for Information Technology Security Evaluation, 167, 472
  53. common law, 53, 472
  54. common vulnerability scoring system (CVSS), 362, 472
  55. common-mode noise, 232
  56. Communication and Network Security domain
    1. about, 239
    2. designing secure communication channels, 295–310
    3. implementing design principles in network architectures, 239–279
    4. Open Systems Interconnection (OSI) Reference Model, 241–278
    5. preventing/mitigating network attacks, 310–313
    6. secure network components, 280–295
    7. TCP/IP Model, 241–243
  57. communication channels
    1. data communications, 308
    2. email, 296–300
    3. facsimile, 302
    4. multimedia collaboration, 302–303
    5. remote access, 303–308
    6. virtualization, 309–310
    7. virtualized networks, 309
    8. voice, 295–296
    9. Web, 300–302
  58. communications, 228, 417, 421–422
  59. communications management, 179, 416
  60. community cloud computing, 191, 472
  61. compensating controls, 126, 472
  62. compensatory damage, 54, 272
  63. Complex-Instruction-Set Computing (CISC), 175, 472
  64. compliance
    1. about, 53
    2. administrative management and control, 115–116
    3. defined, 472
    4. legislative and regulatory, 53–57
    5. privacy requirements, 57–58
    6. rewarding, 47
  65. Component Object Model (COM), 472
  66. CompTIA Security, 11, 36–37, 456
  67. computer architecture
    1. about, 173
    2. firmware, 178
    3. hardware, 173–176
    4. main memory, 176–178
    5. software, 179–180
  68. computer crimes, 58–63
  69. Computer Emergency Response Team (CERT), 472
  70. Computer Ethics Institute (CEI), 84–85
  71. Computer Incident Response Team (CIRT), 472
  72. Computer Technology Investigators Network (CTIN) (website), 30
  73. computer-adaptive testing, 15, 20
  74. computer-generated records, 381
  75. computer-stored records, 381
  76. The Computer Game Fallacy, 82
  77. The Computer Misuse Act (1990) (U.K.), 70
  78. concealment cipher, 473
  79. concentrator. See hub
  80. concept development, in engineering process, 156
  81. conclusive evidence, 381, 473
  82. conduit, 281
  83. Confidential government data classification, 146
  84. confidentiality, 51–52, 158, 196, 473
  85. confidentiality agreement, 473
  86. configuration management, 164, 395, 412, 439, 442–443, 473
  87. connection establishment, 248
  88. connection release, 249
  89. connection-oriented protocol, 250
  90. consensual surrender, of evidence, 385
  91. console login, 317
  92. constrained data item (CDI), 162
  93. consultant controls, 115
  94. container, 310, 472
  95. container-based endpoint protection, 293
  96. containerization, 180, 472
  97. content-distribution networks (CDNs), 294, 473
  98. contention-based networks, 263
  99. context-based access control (CBAC), 284
  100. continual improvement, 473
  101. continuing education requirements, 140
  102. continuing professional education (CPE), 473
  103. Continuity of Operations Planning (COOP), 89, 473
  104. continuous improvement, in risk management, 130–131
  105. continuous monitoring, 393, 473
  106. contractor controls, 115
  107. contributing, to ISC2 publications, 27
  108. contribution to revenue, as an asset value element, 118
  109. control assessment, 127–129
  110. control bus, 176
  111. control frameworks, 48–50, 473
  112. Control Unit, 173
  113. Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act) (2003), 69
  114. controls, 125–126, 162–172, 473
  1. converged protocols, 260
  2. cooperation, importance of, 89
  3. copyright, 74, 473
  4. Copyright Act (1976), 74
  5. corrective controls, 126, 473
  6. corroborative evidence, 380, 473
  7. corroborative inquiry, as a control assessment technique, 128
  8. cost-effectiveness, risk management and, 123–124
  9. The Council of Europe's Convention on Cybercrime (2001), 70
  10. counter reset, 333
  11. counter threshold, 333
  12. countermeasure selection, 123–124
  13. countermeasures, 473
  14. covert channels, 164, 184, 473
  15. covert storage channel, 164
  16. covert timing channel, 164
  17. crash gates, 230, 318
  18. Creation stage, of ILM, 151
  19. credential management systems, 346–347
  20. crime, in disaster recovery (DR) plan, 416
  21. Crime Prevention Through Environmental Design (CPTED), 224–225
  22. criminal law, 53–54, 474
  23. criminal requirements, for investigations, 391
  24. critical support areas, 100
  25. Criticality Assessment, 100–101, 474
  26. cross-frame scripting (XFS). See frame injection
  27. Crossover Error Rate (CER), 338, 474
  28. Cross-site request forgery (CSRF), 301, 474
  29. Cross-site scripting (XSS), 301, 474
  30. crosstalk, 275
  31. cryptanalysis, 198, 474
  32. cryptocurrency, 299, 474
  33. cryptographic algorithm, 201
  34. cryptographic systems, assessing and mitigating vulnerabilities in, 189
  35. cryptography
    1. about, 153, 196–198
    2. alternatives to, 205–206
    3. ciphertext, 199
    4. decryption, 199–205
    5. defined, 474
    6. encryption, 199–205
    7. lifecycle of, 198
    8. maintaining communication security using, 279
    9. plaintext, 199
  36. cryptology, 198, 474
  37. cryptosystem, 201–202, 474
  38. cryptovariable, 201, 203–204, 474
  39. culpable negiligence, 50
  40. culpable negligence, 474
  41. custodian, 147, 474
  42. customary law systems, 57
  43. cutover, of disaster recovery (DR) plan, 426–427
  44. cyber attacks, in disaster recovery (DR) plan, 416
  45. cyber warfare, in disaster recovery (DR) plan, 416
  46. Cybercrime Act (2001) (Australia), 70
  47. CyberSecurity Forensic Analyst (CSFA), 36

D

  1. Daemen, Joan (Dr), 211
  2. daily standup, 436
  3. damage assessment, 91–92
  4. data, 75, 187
  5. data access controls, 316, 349
  6. data breaches, 80–81
  7. data bus, 176
  8. Data Carrier Equipment (DCE), 272, 475
  9. data classification, 474
  10. data communications, 308
  11. Data Communications Equipment (DCE), 277
  12. data compression, 247
  13. data controller, 80, 474
  14. data destruction, 474
  15. data dictionary, 475
  16. data encapsulation, 475
  17. data encryption, 247
  18. data encryption key (DEK), 475
  19. Data Encryption Standard (DES), 204, 207–209, 475
  20. data hiding, 182
  21. data import/export, 351
  22. data integrity, 158–159, 375
  1. Data Link Layer (Layer 2) (OSI Reference Model), 261–273, 475
  2. data loss prevention (DLP), 291, 394, 475
  3. Data Over Cable Service Interface Specification (DOCSIS), 267, 475
  4. data ownership, 351–352
  5. data processing continuity planning, 97–98
  6. data processor, 80, 475
  7. Data Protection Act (DPA), 75
  8. data protection officer (DPO), 80, 475
  9. data recovery, 374–375
  10. data remanence, 149, 163, 475
  11. data replication, 171, 413
  12. data representation, 247
  13. data retention, 475
  14. data security controls, 151–153
  15. data storage requirements, 339
  16. Data Terminal Equipment (DTE), 272, 277, 475
  17. data transfer, 249
  18. data warehouse, 475
  19. database administrator, 11
  20. database management system (DBMS), 475
  21. database systems, assessing and mitigating vulnerabilities in, 187
  22. database table permissions, 316
  23. datagram, 251
  24. Davis, Peter T. (author)
    1. Hacking Wireless Networks For Dummies, 282
    2. Wireless Networks For Dummies, 266
  25. DCID 6/3, 169
  26. DDos mitigation, 410
  27. decentralized access control systems, 328
  28. deciphering. See decryption
  29. Decode Unit, 173
  30. decommissioning, in engineering process, 157
  31. decryption, 199–205, 475
  32. dedicated security mode, 183
  33. deep packet inspection (DPI), 475
  34. defense in depth, 170, 476
  35. Defense Information Technology Security Certification and Accreditation Process (DITSCAP), 168–169, 476
  36. deluge system, 237
  37. demilitarized zone (DMZ), 287
  38. demonstrative evidence, 380, 476
  39. Denial of Service (DoS), 289, 296, 301, 333, 476
  40. Department of Commerce, 69
  41. Department of Homeland Security (DHS), 12, 68
  42. design documentation, 165
  43. design specification and verification, 164
  44. desktop virtualization, 309
  45. Destination IP address, 307
  46. destruction, 154, 406
  47. destructware, 476
  48. detective controls, 125, 476
  49. deterrence, under criminal law, 53
  50. deterrent controls, 125, 476
  51. development, 106–110, 156
  52. device drivers, 179
  53. devices, controlling access to, 316–317
  54. DevOps, 439–440, 476
  55. DevSecOps, 476
  56. Diameter protocol, 305, 326, 476
  57. dictionary attack, 353, 476
  58. Diffie-Hellman key exchange, 215, 476
  59. digital certificates, 337, 476
  60. digital forensics, 389–390
  61. digital signaling, 277
  62. Digital Signature Standard (DSS), 216–217, 476
  63. digital signatures, 343
  64. Digital Subscriber Line (DSL), 267, 476
  65. digital watermarking, 206
  66. direct addressing, 178
  67. direct evidence, 380, 476
  68. Directive 95/46/EC on the protection of personal data (1995, EU), 69
  69. directory harvest attack (DHA), 476
  70. directory level permissions, 316
  71. disaster recovery (DR), 88, 89, 374–376, 415–427
  72. Disaster Recovery Certified Expert (DRCE), 35
  73. Disaster Recovery Institute International (DRII) (website), 30, 35
  74. discovery sampling, 128
  75. discretionary access control (DAC), 163, 351–352, 476
  76. discretionary security property, 160
  1. disk mirroring, 477
  2. disk striping, 477
  3. disk striping with parity, 477
  4. disposable ciphers, 203
  5. Disposition stage, of ILM, 152
  6. distance-vector protocol, 253
  7. distributed application, 477
  8. distributed denial of service (DDoS), 477
  9. Distributed Network Protocol (DNP3), 260, 477
  10. distributed systems, assessing and mitigating vulnerabilities in, 188–189
  11. Distribution stage, of ILM, 151
  12. divestitures, 46
  13. DNS cache poisoning, 477
  14. DNS hijacking, 477
  15. DNS Server attacks, 311
  16. documentary evidence, 380, 477
  17. documentation, 96–97, 165, 386–387
  18. domain homograph attack, 477
  19. domain name system (DNS), 477
  20. domain name system security extensions (DNSEEC), 477
  21. domains, 10, 477
  22. doors, as a building design consideration, 227
  23. dormant VMs, 310
  24. drag and drop questions, 18
  25. DREAD technique, 133–134
  26. drive-by-download, 477
  27. drug screen, 477
  28. dry-pipe system, 237
  29. dual-homed gateways, 286
  30. due care, 50, 55, 477
  31. due diligence, 50, 477
  32. Dummies (website), 4
  33. dumpster diving, 478
  34. dwell time, 478
  35. dynamic application scanning tool (DAST), 478
  36. dynamic link library (DLL), 478
  37. dynamic packet-filtering firewall, 284
  38. dynamic password, 335, 478
  39. Dynamic RAM (DRAM), 176
  40. dynamic routing protocol, 253

E

  1. earning certifications, 32–38
  2. eavesdropping, 296, 313, 362, 478
  3. ECMAScript, 478
  4. edge computing, 478
  5. education, 138–141
  6. egress monitoring, 394
  7. EIA/TIA-232-F standard, 277
  8. El Gamal, 215
  9. electrical anomalies, 232
  10. electrical hazards, 232–233
  11. electrical noise, 232
  12. Electrically Erasable Programmable Read-Only Memory (EEPROM), 177
  13. electricity, 228, 231–232
  14. Electromagnetic Interference (EMI), 232, 478
  15. Electronic Code Book (ECB), 208, 478
  16. electronic discovery, 478
  17. electronic health records (EHRs), 78
  18. electronic protected health information (ePHI), 148, 478
  19. electronic signatures, 343
  20. electrostatic discharge (ESD), 232, 478
  21. Elliptic Curve (EC), 216
  22. email communication, 296–300
  23. emanations, 185
  24. embedded devices, assessing and mitigating vulnerabilities in, 195–196
  25. Emergency Power Off (EPO) switch, 231, 234
  26. emergency response, 91
  27. emergency supplies, 421
  28. employment agreements and policies, 114, 478
  29. employment candidate screening, 112–114, 478
  30. employment termination processes, 115, 478
  31. Encapsulating Security Payload (ESP), 307, 479
  32. encapsulation, 479
  33. enciphering. See encryption
  34. encryption, 199–205, 449, 479
  35. endpoint security, 292–294, 479
  36. end-to-end encryption, 199, 479
  37. end-user, 47–48
  38. Enigma Machine, 197
  1. Enterprise Risk Management - Integrated Framework, 132
  2. enticement, 382, 479
  3. entitlement, 397, 479
  4. entrapment, 382
  5. equipment, 228, 416
  6. Erasable Programmable Read-Only Memory (EPROM), 177
  7. error checking/recovery, 250
  8. escorts, 318
  9. Escrowed Encryption Standard (EES), 221, 479
  10. espionage, 479
  11. essential practices, 112
  12. Ethernet, 264, 276, 479
  13. ethics. See professional ethics
  14. European Information Technology Security Evaluation Criteria (ITSEC), 166–167, 479
  15. European Union (EU), 72, 402
  16. European Union General Data Protection Regulation (GDPR), 57–58, 80
  17. evacuation plans, 416, 421
  18. evaluation assurance levels (EALs), 167
  19. evaluation criteria, for selecting controls, 163–165
  20. e-vaulting, 93
  21. event management, 438
  22. events, speaking at, 26–27
  23. evidence collection/handling
    1. about, 379–380
    2. admissibility of evidence, 382–383
    3. defined, 479
    4. rules of evidence, 381–382
    5. types of evidence, 380–381
  24. evidence lifecycle, 479
  25. evidence storage, 229–230
  26. exams
    1. after the, 20–21
    2. fee for, 16
    3. overview of, 17–20
    4. planning tips for, 455–459
    5. practice, 15
    6. preparing for, 12–16
    7. question types, 18–19
    8. registering for, 16–17
    9. re-scheduling, 16
    10. tips for test-day, 461–464
    11. weighting of questions, 19
  27. Exclusive Or (XOR) function, 209, 479
  28. Execute (X) access, 352
  29. executive oversight, 45–46
  30. exhaustion attack, 221
  31. exigent circumstances, 385, 480
  32. expectation of privacy, 149
  33. expert system, 480
  34. exploit, 480
  35. Exposure Factor (EF), 120, 480
  36. Extended Binary-Coded Decimal Interchange Code (EBCDIC), 248
  37. Extensible Authentication Protocol (EAP), 304, 325, 480
  38. Extensible Markup Language (XML), 508
  39. Exterior Gateway Protocol (EGP), 255
  40. exterior walls, as a building design consideration, 227
  41. External Affairs, 95
  42. external assessment, 127
  43. external audit, 378
  44. external communications, 94
  45. external value, as an asset value element, 118
  46. extradition, 57
  47. Extranet, 241, 480

F

  1. facial recognition systems, 340
  2. facilities
    1. applying security principles to design of, 224–229
    2. controlling access to, 317–318
    3. designing, 226–229
    4. implementing security controls for, 229–238
  3. facsimile communication, 302
  4. Factor Analysis of Information Risk (FAIR), 131
  5. Fagan inspection, 368, 480
  6. fail closed, 480
  7. fail open, 480
  8. failover systems, 184, 480
  1. fail-safe systems, 184, 480
  2. fail-soft systems, 184, 480
  3. fallacies, computer use and, 82
  4. False Accept Rate (FAR), 338, 480
  5. False Reject Rate (FRR), 338, 480
  6. fault tolerance, 415, 480
  7. fault-tolerant systems, 184, 480
  8. Fed. R. Evid., 56
  9. Fed. Reg., 56
  10. Federal Information Processing Standard (FIPS), 207, 216, 481
  11. federal interest, 64
  12. federal interest computer, 64
  13. Federal Risk and Authorization Management Program (FedRAMP), 169, 481
  14. Federal statutes, 56
  15. Federal Trade Commission (FTC), 69
  16. federated identity management (FIM), 346, 481
  17. fees, 16, 21
  18. felony, 54
  19. fences, 318
  20. Fiber Distributed Data Interface (FDDI), 264, 273, 481
  21. fiber-optic cable, 276, 277, 481
  22. Fibre Channel over Ethernet (FCoE), 481
  23. field permissions, 316
  24. 50-year flood plain, 415
  25. file level permissions, 316
  26. file management, as an operating system function, 179
  27. file ownership, 351–352
  28. file transfer protocol (FTP), 246
  29. final disposition, of evidence, 386
  30. financial attacks, as a category of computer crime, 61
  31. Financial Executives International (FEI), 48
  32. financial readiness, in disaster recovery (DR) plan, 420–421
  33. finger scan systems, 340
  34. fingerprint recognition, 340
  35. fire prevention/detection/suppression, 234–238
  36. fire protection, 96
  37. fire suppression, 229
  38. fire triangle, 234–235
  39. firewalls, 283–288, 409, 481
  40. firmware, 481
  41. first aid, 421, 481
  42. fixed-temperature detectors, 236
  43. flame-sensing fire detection, 236
  44. Flash Memory, 177
  45. Floating-Point Unit (FPU), 173
  46. floors, as a building design consideration, 227
  47. flow control, 250
  48. forensics, 481
  49. formal education, 140
  50. formal training programs, 139–140
  51. Fraggle attack, 311
  52. frame injection, 481
  53. Frame Relay, 269, 481
  54. frameworks, in risk management, 131–132
  55. fraud, 481
  56. The Free Information Fallacy, 82
  57. frequency, in assessment, 127
  58. full interruption, of disaster recovery (DR) plan, 426–427
  59. full-duplex mode, 248, 250
  60. “fun” attacks, as a category of computer crime, 61
  61. functionality, 166
  62. fuzzing, 369, 481

G

  1. gaming, 449
  2. gas discharge systems, 237–238
  3. gates, 318
  4. gateways, 261, 481
  5. General Data Protection Regulation (GDPR), 402, 481
  6. generating reports, 376
  7. geolocation, 303
  8. German Enigma Machine, 197
  9. GI Bill, 17
  10. Global Information Assurance Certification (GIAC), 36
  11. global positioning system (GPS), 482
  12. goals, aligning security function to, 44–45, 482
  1. governance committees, 45–46, 482
  2. government data classification, 145
  3. Graphics Interchange Format (GIF), 248
  4. gray-box testing, 482
  5. Gregory, Peter H. (author)
    1. IT Disaster Recovery Planning For Dummies, 111, 416
  6. grudge attacks, 61–62
  7. guard dogs, 230, 318
  8. guards, 318
  9. guest operating systems, 180, 310, 482
  10. guidelines, developing and implementing, 85–87, 482

H

  1. The Hacker's Fallacy, 82
  2. Hacking For Dummies (Beaver), 364
  3. Hacking Wireless Networks For Dummies (Beaver and Davis), 282
  4. hacktivism, as a category of computer crime, 62, 482
  5. half-duplex mode, 248
  6. half-open connections, 312
  7. halon, 238
  8. hand geometry systems, 341
  9. handling, 154, 406
  10. hands-on experience, 13–14
  11. hard drive forensics, 389
  12. hardening standard, 87, 482
  13. hardware, 137, 173–176, 280, 482
  14. hardware address, 263
  15. hardware asset management, 407
  16. hardware segmentation, 482
  17. hash function, 482
  18. Hashed Message Authentication Code (HMAC), 219
  19. HealthCare Information Security and Privacy Practitioner (HCISSP), 33
  20. hearsay evidence, 381–382, 482
  21. heating, ventilation, and air conditioning (HVAC), 233–234
  22. heat-sensing fire detection system, 236
  23. heterogeneous environment, 171, 482
  24. heuristics-based endpoint protection, 293
  25. hidden code, 482
  26. High Technology Crime Investigation Association (HTCIA) (website), 30
  27. High-level Data Link Control (HDLC), 270–271
  28. High-rate Digital Subscriber Line (HDSL), 267
  29. High-Speed Serial Interface (HSSI), 278, 482
  30. holddown timers, 254
  31. home, 257
  32. homogeneous environment, 482
  33. honeynets, 411, 483
  34. honeypots, 411, 483
  35. hop count, 254
  36. host-based intrusion detection (HIDS), 289, 391, 483
  37. hosted hypervisors, 309
  38. hot site, 97, 413, 483
  39. hotspot questions, 18–19
  40. hub, 278, 483
  41. humidity, 232, 233–234
  42. hybrid cloud computing, 191, 483
  43. hybrid risk analysis, 122
  44. HyperText Markup Language (HTML), 300–302
  45. HyperText Transfer Protocol (HTTP), 246, 300–302, 483
  46. HyperText Transfer Protocol Secure (HTTPS), 246, 301, 483
  47. HyperText Transport Protocol Secure (HTTPS), 301
  48. hypervisors, 180, 309–310, 483

I

  1. ICMP flood attack, 311
  2. icons, explained, 4
  3. identification and authentication (I&A), 164, 328, 483
  4. identity and access management (IAM)
    1. about, 315–316, 319
    2. cloud-based access controls, 327–328
    3. controlling physical and logical access to assets, 316–318
    4. decentralized access controls, 328
    5. defined, 483
    6. implementing and managing authorization mechanisms, 348–353
    7. integrating identity-as-a-service, 347–348
    1. integrating third-party identity services, 348
    2. managing identification and authentication, 319–347
    3. managing identity, 355–356
    4. managing identity and access provisioning lifecycle, 355–356
    5. preventing and mitigating access control attacks, 353–355
    6. single sign-on (SSO), 319–327
  5. identity fraud, in voice communication, 296
  6. Identity-as-a-Service, 347–348, 483
  7. ideological attacks, as a category of computer crime, 62
  8. IETF, 258–259
  9. illegal search and seizure, 382
  10. implementation attack, 222
  11. import/export controls, 74–75
  12. inactivity timeouts, 344, 483
  13. incident management, conducting, 407–409
  14. indexed addressing, 178
  15. indicators of compromise (IOCs), 483
  16. indirect addressing, 178
  17. indoctrination, to raise security awareness, 139
  18. industrial control system (ICS), assessing and mitigating vulnerabilities in, 189–190, 317, 483
  19. industrial espionage, as a category of computer crime, 60–61
  20. inference, 484
  21. inference channel, 484
  22. inference engine, 484
  23. information, 143–146, 316, 402
  24. Information Assurance Support Environment (website), 170
  25. information custodian, 484
  26. Information Flow model, 162, 484
  27. Information Lifecycle Management (ILM), 151–152
  28. information owner, 484
  29. Information Security Journal, 27
  30. information security management system (ISMS), 484
  31. Information Security Scholarship Program, 27
  32. Information Systems Audit and Control Association (ISACA), 48, 437
  33. Information Systems Security Architecture Professional (ISSAP), 33
  34. Information Systems Security Engineering Professional (ISSEP), 34
  35. Information Systems Security Management Professional (ISSMP), 34
  36. Information Technology Act (2000) (India), 70
  37. Information Technology Infrastructure Library (ITIL), 49–50, 407, 485
  38. informative policies, 86
  39. InfraGard (website), 30
  40. Infrastructure as a Service (IaaS), 191, 483
  41. inherent vulnerability, 201
  42. initial cost, as an asset value element, 118
  43. initialization vector (IV), 209
  44. injection attacks, 449, 484
  45. injuries, in disaster recovery (DR) plan, 418
  46. input control, as a data integrity measure, 159
  47. inquiry, as a control assessment technique, 127
  48. inrush, 484
  49. INSIGHTS (online magazine), 27
  50. inspection, as a control assessment technique, 128
  51. instant messaging (IM), 303
  52. Institute of Electrical Engineers (IEEE), 484
  53. Institute of Internal Auditors (IIA), 48
  54. Institute of Management Accountants (IIMA), 48
  55. insurance, 420
  56. integrated product team, 439–440
  57. Integrated Services Digital Network (ISDN), 268, 484
  58. integrity, 52, 158–159, 196, 484
  59. *-integrity property (star integrity property), 161
  60. integrity verification procedures (IVP), 162
  61. intellectual property, 72–74, 484
  62. interface testing, 370–371
  63. interfaces, types of, 277–278
  64. interior walls, as a building design consideration, 227
  65. Intermediate System to Intermediate System (IS-IS), 255
  66. internal audit, 378
  67. internal value, as an asset value element, 118
  1. International Association of Privacy Professionals (IAPP) (website), 30, 35
  2. International Council of E-Commerce Consultants (EC-Council) (website), 36
  3. International Data Encryption Algorithm (IDEA) Cipher, 212
  4. International Electrotechnical Commission (IEC), 10, 484
  5. International Information System Security Certification Consortium (ISC)2, 9–10
  6. International law, 55–57
  7. International Organization for Standardization (ISO), 10, 484
  8. International Organization for Standardization/International Electrotechnical Commission (ISO/IEC 27002), 49
  9. International Systems Security Association (ISSA) (website), 29
  10. International Telecommunications Union (ITU), 484
  11. Internet, 485
  12. Internet Architecture Board (IAB), 84, 241
  13. Internet Assigned Numbers Authority (IANA), 255
  14. Internet Control Message Protocol (ICMP), 261, 485
  15. Internet Engineering Task Force (IETF), 485
  16. Internet Key Exchange (IKE), 307
  17. Internet Layer (TCP/IP Model), 279, 485
  18. Internet Message Access Protocol (IMAP), 246
  19. Internet of Things (IoT), 52, 192, 295, 485
  20. Internet Protocol (IP), 255, 485
  21. Internet Protocol Security (IPsec), 306–307, 485
  22. Internet Relay Chat (IRC), 485
  23. Internet Security Association and Key Management Protocol (ISAKMP), 307
  24. Internet Small Computer Systems Interface (iSCSI), 485
  25. Internetwork Packet Exchange (IPX), 255, 485
  26. internetworks, 252
  27. Intranet, 241, 485
  28. intrusion detection and prevention systems (IDPSs), 288–290, 391–392, 409
  29. intrusion detection systems (IDS), 288–290, 485
  30. intrusion prevention systems (IPSs), 288–290, 485
  31. investigations, 379–391
  32. I/O device management, as an operating system function, 179
  33. ionization devices, 236
  34. IP reputation services, 410
  35. IP spoofing, 312
  36. iris pattern, 341
  37. ISC2
    1. attending events, 25
    2. being an active member of, 25–26
    3. focus groups, 28
    4. helping at conferences, 27
    5. joining a chapter, 26
    6. online store (website), 31
    7. volunteer opportunities, 26–29
    8. voting in elections, 25
    9. website, 457
  38. ISC2 Congress, 25, 27
  39. ISC2 publications
    1. contributing to, 27
    2. reading, 27
  40. (ISC)2 Blog, 27
  41. (ISC)2 Code of Professional Ethics, 83
  42. (ISC)2 community, 28
  43. ISO/IEC 17024 standard, 10
  44. ISO/IEC 27002, Information Technology - Security Techniques - Code of Practice for Information Security Management, 86
  45. ISO/IEC 27005, 132
  46. IT Disaster Recovery Planning For Dummies (Gregory), 111, 416
  47. IT Governance Institute (ITGI), 48

J

  1. Japanese Government Information Security Professional (JGISP), 33
  2. Japanese Purple Machine, 197
  3. JavaScript, 485
  4. jitter, 251
  5. job description, 485
  6. job rotation, 400–402, 485
  7. joining local security chapters, 29–30
  8. Joint Photographic Experts Group (JPEG), 248
  1. joint tenants, as a consideration for choosing locations, 226
  2. JScript, 485
  3. judgmental sampling, 128
  4. juvenile laws, 59

K

  1. Kerberos, 320–324, 486
  2. kernel, 179
  3. key card access systems, 317
  4. key change, 221
  5. key clustering, 202, 471
  6. key control, 221
  7. key disposal, 221
  8. key distribution, 220
  9. key encryption key (KEK), 486
  10. key escrow, 221
  11. key generation, 220
  12. key installation, 220
  13. key logging, 486
  14. key management functions, 220–221
  15. key perfomance indicators (KPIs), 373–374, 486
  16. key recovery, 221
  17. key risk indicators (KRIs), 373–374, 486
  18. key storage, 220
  19. key transport, 214–215
  20. keyed invoices, 104, 201
  21. keystroke dynamics, 342
  22. knowledge-based IDS, 289–290
  23. Known Plaintext Attack (KPA), 223, 486
  24. KryptoKnight, 327, 486

L

  1. labels, 163
  2. large-scale parallel data systems, assessing and mitigating vulnerabilities in, 187–188
  3. latency, 201
  4. Latin America and Caribbean Network Information Centre (LACNIC), 257
  5. lattice model, 351, 486
  6. The Law-Abiding Citizen Fallacy, 82
  7. Layer 2 Forwarding Protocol (L2F), 266, 306, 486
  8. Layer 2 Tunneling Protocol (L2TP), 266, 306–307, 486
  9. Layton, Mark (author)
    1. Agile Project Management For Dummies, 436
    2. Scrum For Dummies, 436
  10. leading by example, 47
  11. learning style, knowing your, 455
  12. least privilege concept, 396–397, 486
  13. legal and regulatory issues
    1. about, 58
    2. computer crimes, 58–72
    3. data breaches, 80–81
    4. import/export controls, 74–75
    5. licensing and intellectual property, 72–74
    6. privacy, 75–80
    7. trans-border data flow, 75
  14. legal liability, risk management and, 124
  15. legislative and regulatory compliance, 53–57
  16. letters of agreement, 420
  17. Lewis, Barry (author)
    1. Wireless Networks For Dummies, 266
  18. liability, under civil law, 55
  19. licensing, 72–74
  20. life safety, controlling access to, 318
  21. lifecycle, cryptographic, 198
  22. lighting, as a building design consideration, 227
  23. lightning strikes, 228
  24. Lightweight Directory Access Protocol (LDAP), 324, 486
  25. limited access security mode, 183
  26. line of credit, 420
  27. link encryption, 200–201, 486
  28. Link (Network Access) Layer (TCP/IP Model), 279, 486
  29. link states, 254
  30. link-state protocol, 254
  31. live forensics, 390, 486
  32. local area networks (LANs), 240–241, 264–265
  33. local security chapters, joining, 29–30
  34. locations, choosing, 226
  35. log reviews, 365–366, 486
  36. logging, 391–394, 444–445
  37. logical access control, 337
  1. Logical Link Control (LLC), 262
  2. logistics, in disaster recovery, 95–96
  3. loopback network, 257
  4. loss of life, in disaster recovery (DR) plan, 418
  5. Lowe, Doug (author)
    1. Networking All-In-One For Dummies, 239

M

  1. machine learning (ML), 486
  2. magnetic fields, 228
  3. magnetic tape, 93
  4. main memory, 176–178
  5. main storage, 176–178
  6. maintenance and support
    1. detective and preventive measures, 409–411
    2. in engineering process, 157
    3. firewalls, 409
    4. intrusion detection and prevention systems (IDPSs), 409
    5. ownership, 146–147
    6. of software, 438–439
    7. third-party security services, 410
  7. maintenance cost, as an asset value element, 118
  8. maintenance fees, 21
  9. maintenance hooks, 172, 487
  10. Maintenance stage, of ILM, 151–152
  11. malicious input, 171
  12. malware, 487
  13. Man in the Browser (MITB), 301, 487
  14. Man in the Middle (MITM), 301, 311–312
  15. managed change, hardware operation and, 280
  16. managed security services (MSS), 410, 497
  17. management review, 372–373, 487
  18. mandatory access control (MAC), 163, 350–351
  19. mandatory vacations, 401
  20. Manifesto for Agile Software Development (website), 434
  21. Man-in-the-Middle Attack, 223, 301, 311–312, 354, 487
  22. man-made threats, 119
  23. mantraps, 318, 487
  24. manual controls, 126, 487
  25. marking, 154, 406
  26. maturity models, 437–438, 487
  27. Maximum Tolerable Downtime (MTD), 101–102, 103, 487
  28. Maximum Tolerable Outage (MTO), 102, 103, 487
  29. Maximum Tolerable Period of Disruption (MTPD), 101–102, 487
  30. Media Access Control (MAC), 262
  31. media management, 406–407
  32. media storage, 92–94
  33. media storage facilities, 229–230
  34. medical devices, 317
  35. Meet-in-the-Middle Attack, 223, 487
  36. memory addressing, 177, 487
  37. memory leaks, 449, 487
  38. memory management, as an operating system function, 179
  39. Memory Management Unit (MMU), 173
  40. memory space, 177, 178, 488
  41. mentors, 38
  42. mergers, integrating security risk considerations into, 136–138
  43. Merkle-Hellman (Trapdoor) Knapsack, 215–216
  44. mesh mode, 273
  45. Mesh topology, 274
  46. message authentication, 216–219
  47. Message Digest (MD), 218–219, 488
  48. message digests, 217–219
  49. metadata, 488
  50. metamorphism, 488
  51. metropolitan area network (MAN), 243, 488
  52. Microsoft certifications, 11
  53. military intelligence attacks, as a category of computer crime, 62
  54. MIME Object Security Services (MOSS), 300, 488, 489
  55. minimum security requirements, 137
  56. mischief, in disaster recovery (DR) plan, 416
  57. misdemeanor, 54
  58. mission, aligning security function to, 44–45
  59. mission statement, 44–45, 488
  60. misuse case testing, 368–369
  61. mixed law systems, 57
  1. mobile app, 488
  2. mobile device, 488
  3. mobile device management (MDMI), 488
  4. mobile systems, assessing and mitigating vulnerabilities in, 194
  5. modes of operation, 181–182, 208
  6. monoalphabetic substitution, 197, 488
  7. monoalphabetic substitution cipher, 204
  8. Moore's Law, 222
  9. Motion Picture Experts Group (MPEG), 248
  10. Motive, Opportunity, and Means (MOM), 389
  11. movement, 228
  12. multicast, 265, 485
  13. multi-factor authentication, 304, 335–343, 485
  14. multi-factor key card entry, 230
  15. multilevel security mode, 183
  16. multilevel system, 350, 485
  17. multimedia collaboration, 302–303
  18. multipayer protocols, 260
  19. multiple data centers, 97
  20. multiple processing sites, 413
  21. multiple-choice questions, 18
  22. multiplexing, 250
  23. multiprocessing functionality, of systems, 175, 485
  24. multiprogramming functionality, of systems, 175, 488
  25. Multi-Protocol Label Switching (MPLS), 269, 489
  26. multistate systems, 175
  27. multitasking functionality, of systems, 175, 489
  28. multiuser systems, 175

N

  1. Napoleonic code, 57
  2. National Computer Security Center (NCSC), 163, 489
  3. National Information Assurance Certification and Accreditation Process (NIA-CAP), 169, 489
  4. National Institute for Standards and Technology (NIST), 48, 65, 207, 216, 489
  5. National Security Agency (NSA), 12, 65, 207
  6. native hypervisors, 309
  7. natural access control, as a strategy of CPTED, 224–225
  8. natural disasters, as a consideration for choosing locations, 226
  9. natural surveillance, as a strategy of CPTED, 225
  10. natural threats, 119
  11. near-field communications (NFC), 489
  12. need-to-know concept, 146, 396–397, 489
  13. NetBIOS, 249
  14. network access control (NAC) devices
    1. about, 282
    2. cloud access security broker (CASB) systems, 291–292
    3. data loss prevention (DLP), 291
    4. firewalls, 283–288
    5. intrusion detection and prevention systems (IDSs/IPSs/IDPSs), 288–290
    6. Web content filters, 290–291
  15. Network Access (Link) Layer (TCP/IP Model), 279, 489
  16. Network Address Translation (NAT), 257, 489
  17. network administrator, 11
  18. network attacks, 310–313
  19. network components
    1. about, 280
    2. content distribution networks, 294
    3. endpoint security, 292–294
    4. hardware, 280
    5. network access control (NAC) devices, 282–292
    6. physical devices, 294–295
    7. transmission media, 280–282
  20. Network File System (NFS), 249
  21. network interface cards (NICs), 278, 489
  22. Network Layer (Layer 3) (OSI Reference Model), 252–261, 489
  23. network penetration test, 361–363, 489
  24. network sprawl, 261, 489
  25. network virtualization, 309
  26. network visibility, 310
  27. network-based IDS (NIDS), 289
  28. network-based intrusion detection (NIDS), 289, 391, 489
  29. Networking All-In-One For Dummies (Lowe), 239
  30. networking certification, 456
  31. networks, 24–25, 273–274, 309
  1. neural network, 489
  2. next-generation firewalls (NGFWs), 288, 490
  3. NIST Cyber Security Framework (CSF), 153
  4. NIST SP800-37, 132
  5. NIST SP800-53, 153
  6. NIST SP800-171 Revision 1, 153
  7. no write down (NWD), 160
  8. nonce, 327
  9. non-compete agreement, 490
  10. non-disclosure agreement (NDA), 490
  11. non-interference model, 162, 490
  12. non-(ISC)2 certifications, 34–37
  13. non-repudiation, 343, 490
  14. non-technical/non-vendor certifications, 34–36

O

  1. Oakley Key Exchange Protocol, 307
  2. object, 180, 490
  3. Object Linking and Embedding (OLE), 490
  4. object reuse, 149, 163, 490
  5. objectives, aligning security function to, 44–45, 490
  6. observation, as a control assessment technique, 127
  7. octets, 255–256
  8. odd-parity bit, 208
  9. omni-directional antennas, 272
  10. one-time pad, 203, 490
  11. one-time passwords, 335, 490
  12. one-way function, 214, 218, 490
  13. one-way hash function, 217
  14. one-way hashing algorithm, 218
  15. online business networking, 24
  16. online orders, RPOs and, 104
  17. online practice (website), 4, 12, 13
  18. on-premises, 490
  19. on-the-job training, 140
  20. open message format, 490
  21. open networkers, 24
  22. open relay, 490
  23. Open Shortest Path First (OSPF), 254
  24. open source software, 447, 490
  25. Open Study Group (website), 458
  26. Open System authentication, 282
  27. open systems, 182, 490
  28. Open Systems Interconnection (OSI) Reference Model, 241–278, 491
  29. Open Web Application Security Project (OWASP), 30, 369, 452, 491
  30. OpenFAIR, 131
  31. operating states, for CPUs, 174
  32. operating system (OS), 179, 448, 491
  33. operation, of software, 438–439
  34. operational assurance requirements, 164
  35. operational impact, risk management and, 124
  36. operational requirements,, for investigations, 391
  37. Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE), 131
  38. Orange Book, 163–165, 491
  39. organization, for exam, 457
  40. organizational awareness, promoting, 110
  41. organizational processes, 45–46
  42. organizational value, as an asset value element, 118
  43. orientation, to raise security awareness, 139
  44. output control, as a data integrity measure, 159
  45. Output Feedback (OFB) mode, 209, 491
  46. outsourcing, 491
  47. over-the-top (OTT) services, 296
  48. ownership, determining and maintaining, 146–147, 491

P

  1. packet sniffing, 354, 363, 491
  2. packet-filtering firewall, 283–284, 491
  3. packet-switched networks, 268–270, 491
  4. pair programming, 368
  5. pandemics, 418
  6. parabolic antennas, 272
  7. parallel test, of disaster recovery (DR) plan, 425–426
  8. parity bit, 208
  9. passive hubs, 278
  10. passive IDS, 289
  11. passphrases, 330–335, 491
  1. Password Authentication Protocol (PAP), 304, 325, 491
  2. password sniffing, 354
  3. passwords, 330–335, 491
  4. patches, managing, 411–412, 491
  5. Patent Cooperation Treaty (PCT), 73
  6. patents, 73, 492
  7. path-vector protocol, 255
  8. Payment Card Industry Data Security Standard (PCI DSS), 70–72, 75, 150, 492
  9. Payment Card Industry Internal Security Assessor (PCI-ISA), 35
  10. Payment Card Industry Qualified Security Assessor (PCI-QSA), 35
  11. Payment Card Industry Security Standards Council (website), 35
  12. payroll, during disasters, 101
  13. P-boxes, 205
  14. Pearson VUE (website), 16, 456
  15. peer programming, 368
  16. peer review, 368
  17. pen register, 67
  18. penalties, 53–54
  19. penetration testing, 361–365, 492
  20. pen/trap device, 67
  21. performance management, 438
  22. periodic reviews, for content relevancy, 141
  23. Permanent Virtual Circuits (PVCs), 269
  24. permutation ciphers, 204–205
  25. personal area network (PAN), 242
  26. personal health information (PHI), 51–52, 494
  27. personal identification numbers (PINs), 335, 492
  28. Personal Information Protection and Electronic Documents Act (PIPEDA), 492
  29. personally identifiable information (PII), 51–52, 148, 492
  30. personnel, in disaster recovery (DR) plan, 229, 416, 421
  31. personnel notification, 92
  32. personnel safety, 92
  33. personnel security policies. See administrative management and control
  34. pharming, 298, 365, 492
  35. phishing, 298, 364–365, 492
  36. phone taps, 382
  37. photoelectric devices, 236
  38. physical access control, 281, 337
  39. physical address, 263
  40. physical assets, 395
  41. physical controls, 492
  42. physical devices, 294–295
  43. physical evidence, 380, 492
  44. Physical Layer (Layer 1) (OSI Reference Model), 273–278, 493
  45. physical memory, 176–177
  46. physical penetration test, 363–364
  47. physical security, 427
  48. Physical Security Professional (PSP), 35
  49. pipes, 228
  50. Plain Old Telephone Systems (POTS), 295–296
  51. plaintext, 199, 493
  52. Platform as a Service (PaaS), 191, 491
  53. plenum, 228
  54. Pluralistic law systems, 57
  55. point-to-point links, 266–267
  56. Point-to-Point Protocol (PPP), 266, 492
  57. Point-to-Point Tunneling Protocol (PPTP), 266, 306, 492
  58. policies, 492
  59. Policy Decision Point (PDP), 353
  60. Policy Enforcement Point (PEP), 353
  61. political intelligence attacks, as a category of computer crime, 62
  62. polling, 263
  63. polyalphabetic substitution cipher, 204
  64. polyinstantiation, 492
  65. polymorphism, 493
  66. port hopping, 493
  67. port level access control, 316
  68. port scan, 359, 493
  69. Post Office Protocol Version 3 (POP3), 246
  70. PowerShell, 493
  71. practice exams, 15, 458
  72. preaction system, 237
  73. Pre-Fetch Unit, 173
  1. prepared statement, 493
  2. pre-purchased assets, 420
  3. Presentation Layer (Layer 6) (OSI Reference Model), 247–248, 493
  4. presentations, 139, 386
  5. preservation of evidence, 386
  6. Pretty Good Privacy (PGP), 300, 493
  7. preventive controls, 125, 493
  8. printed materials, to raise security awareness, 139
  9. privacy, 75–76. See also specific privacy acts
  10. Privacy and Electronic Communications Regulations of 2003 (U.K.), 70
  11. Privacy Enhanced Mail (PEM), 246, 300, 493
  12. privacy requirements compliance, 57–58
  13. Private Branch Exchange (PBX), 295–296
  14. private cloud computing, 191, 493
  15. private key cryptography. See symmetric key cryptography
  16. private network address, 493
  17. privilege creep, 397, 493
  18. privileged account management, 398–399
  19. Privileged Attribute Certificates (PACs), 326–327
  20. Privileged Attribute Server (PAS), 326–327
  21. privileges, escalation of, 449, 493
  22. problem state, 174
  23. procedures, 85–87, 280, 493
  24. Process for Attack Simulation & Threat Assessment (PASTA), 136
  25. process isolation, 493
  26. process management, as an operating system function, 179
  27. process table, 494
  28. product backlog, 435
  29. professional ethics, 82, 83–85, 479
  30. Programmable Read-Only Memory (PROM), 177
  31. Project Management Institute (website), 35
  32. Project Management Professional (PMP), 35
  33. project plan. developing and documenting, 90–98
  34. project scope, developing and documenting, 90–98
  35. project teams, membership in, 90
  36. promiscuous mode, 363, 494
  37. proofing of identity, 344–346
  38. *-property (star property), 160
  39. protected computer, 64
  40. Protected Extensible Authentication Protocol (PEAP), 494
  41. protection domain, 177, 406, 494
  42. protection of privacy, 345
  43. protection rings, 183, 494
  44. Protection Test Unit (PTU), 174
  45. Protocol Data Unit (PDU), 251, 494
  46. provisioning resources, 394–395
  47. proximate causation, 494
  48. proxy server, 284, 494
  49. prudent man rule, 494
  50. pseudo flaw, 494
  51. public cloud computing, 191, 494
  52. Public Company Accounting Oversight Board (PCAOB), 68
  53. Public Company Accounting Reform and Investor Protection Act, 371
  54. public key cryptography, 467, 494. See also asymmetric key cryptography
  55. Public Key Infrastructure (PKI), 219–220, 494
  56. Public Switched Telephone Network (PSTN), 266
  57. public value, as an asset value element, 118
  58. punishment, under criminal law, 53
  59. punitive damages, under civil law, 54, 494
  60. Purple Machine, 197
  61. pursuit of excellence, 38–39

Q

  1. qualification program, 140
  2. qualitative asset value, 117
  3. qualitative impact, of disasters, 98
  4. qualitative risk analysis, 120–121, 494
  5. quality of service, 415
  6. Quality of Service (QoS), 494
  7. quantitative asset value, 117
  8. quantitative impact, of disasters, 98
  9. quantitative risk analysis, 121–122, 495
  10. quarantine, 495
  11. question types, 18–19
  12. quizzes, to measure effectiveness of security training, 141

R

  1. race conditions, 184–185, 449, 495
  2. radiation monitoring, 362
  3. radio frequency (RF) emanations, 362, 495
  4. Rainbow table, 222, 353, 495
  5. Random Access Memory (RAM), 176
  6. ransomware, 495
  7. rate-of-rise detectors, 236
  8. Read (R) access, 352
  9. Read-Only Memory (ROM), 176
  10. read-through, of disaster recovery (DR) plan, 424
  11. real evidence, 380, 495
  12. real-time blackhole lists (RBLs), 297
  13. reciprocal site, 97
  14. records, in disaster recovery (DR) plan, 416
  15. recovery, in disaster recovery (DR) plan, 420
  16. recovery controls, 495
  17. Recovery Point Objective (RPO), 104–105, 495
  18. recovery procedures, 184
  19. recovery sites, strategies for, 413
  20. recovery strategies, implementing, 412–415
  21. recovery targets, establishing, 102–105
  22. Recovery Time Objective (RTO), 103–105, 495
  23. Reduced-Instruction-Set Computing (RISC), 175, 495
  24. reduction analysis, 135, 495
  25. redundant array of independent disks (RAID), 495
  26. redundant components, 172, 495
  27. reference monitor, 180, 182, 495
  28. referential integrity, 495
  29. registers, 174
  30. registration, for test, 456
  31. Registration Authority (RA), 220, 495
  32. registration processes, 344–346
  33. regulatory policies, 86
  34. regulatory requirements
    1. as a criteria for commercial data classification, 144
    2. for investigations, 391
  35. reliability, 339
  36. Religious law systems, 57
  37. remediating threats, 135
  38. Remember icon, 4
  39. remote access, 303–308
  40. Remote Access Service (RAS), 304, 325, 495
  41. remote access trojan (RAT), 496
  42. Remote Authentication Dial-In User Service (RADIUS), 304–305, 324–325, 496
  43. remote backup, 496
  44. remote console login, 317
  45. remote desktop protocol (RDP), 496
  46. Remote Procedure Call (RPC), 249
  47. renewing CISSP certification, 20–21
  48. repeater, 278, 496
  49. repeater mode, 273
  50. reperformance, as a control assessment technique, 128
  51. Replay Attack, 224
  52. replication, 93, 496
  53. reports, generating, 376
  54. Repository, 220, 496
  55. repudiation, 196
  56. reputation-based IDS, 392
  57. requirements, 10–12, 156
  58. re-scheduling exams, 16
  59. Réseaux IP Européens Network Coordination Centre (RIPE NCC), 257
  60. resilient systems, 184
  61. resource management, as an operating system function, 179
  62. resource protection, applying techniques for, 405–407
  63. Resource Requirements portion (BIA), 106
  64. resources, provisioning, 394–395
  65. response, to disasters, 419–421
  66. restoration, in disaster recovery (DR) plan, 423
  67. restricted address, 303
  68. restricted algorithm, 201
  69. restricted area security, 230
  70. retention, 150, 406
  71. retina patterns, 341
  72. return on investment (ROI), 89
  73. Reverse Address Resolution Protocol (RARP), 265, 496
  74. RG8, 275, 277
  1. RG11, 275, 277
  2. RG58, 275, 277
  3. Rijmen, Vincent (Dr), 211
  4. Rijndael Block Cipher, 211, 496
  5. Ring topology, 274, 496
  6. risk acceptance, 123, 496
  7. risk analysis, 119–122, 445–446, 496
  8. Risk and Insurance Management Society (RIMS) (website), 30
  9. risk assessment/analysis (treatment), 117–119, 131, 154, 496
  10. risk assignment, 123, 496
  11. risk avoidance, 123, 496
  12. risk framework, 132
  13. risk identification, 117
  14. risk management, 116–136, 138–141, 496
  15. Risk Management Framework (RMF), 132
  16. risk mitigation, 122–123, 445–446, 496
  17. risk reduction, 497
  18. risk tolerance, 497
  19. risk transference, 123, 496, 497
  20. risk treatment, 116, 122–123, 497
  21. risk-based authentication, 496
  22. Rivest, Ron (Dr), 211, 214, 497
  23. Rivest Ciphers, 211–212
  24. RJ-type connectors, 276
  25. role-based access control (RBAC), 349–350, 497
  26. roles and responsibilities, 46–48, 147, 397–398
  27. root mode, 273
  28. rootkits, 184, 497
  29. rotation of duties, 400–402, 497
  30. round, 208
  31. route poisoning, 254
  32. routed protocols, 252, 255–260
  33. routers, 261, 497
  34. Routing Information Protocol (RIP), 253–254
  35. routing loops, 253
  36. routing protocols, 252, 253–255, 497
  37. row permissions, 316
  38. RSA algorithm, 214–215
  39. “rubber hose” attack, 224
  40. rule-based access control, 350, 497
  41. run state, 174

S

  1. sabotage, 228
  2. sacrificial lamb, 286
  3. Safe and Secure Online program, 27
  4. Safe Harbor (1998), 69
  5. safeguard, 497
  6. sag, 497
  7. sally ports, 318, 497
  8. salvage, in disaster recovery (DR) plan, 419–420
  9. sampling, 378
  10. sampling techniques, 128
  11. sandboxing, 410, 497
  12. SANS GIAC certifications, 11
  13. SB-1386 (California Security Breach Information Act), 81
  14. S-boxes, 204
  15. scan, 497
  16. scareware, 497
  17. scope creep, 91
  18. scoping, 152–153
  19. screen savers, 344, 498
  20. screened-host gateways, 287
  21. screened-subnet, 287–288
  22. screening router, 283–284, 285–286, 498
  23. script injection, 301, 369, 498
  24. script kiddie, 498
  25. Scrum For Dummies (Layton), 436
  26. Scrum methodology, 436, 498
  27. sealing, as a function of TPM, 181
  28. search and seizure, 382
  29. search warrant, 385
  30. Searching and Seizing Computers and Obtaining Evidence in Criminal Investigations (3rd edition, 2009) publication, 384
  31. secondary evidence, 380, 498
  32. secondary memory, 177–178
  33. secondary storage, 177–178
  34. Secret government data classification, 146
  35. secret key cryptography. See symmetric key cryptography
  36. sectorized antennas, 272
  37. secure and signed message format, 213, 498
  1. secure design principles, implementing and managing engineering processes using, 155–157
  2. Secure Electronic Transaction (SET), 498
  3. Secure European System and Applications in a Multi-vendor Environment (SESAME), 326–327, 498
  4. Secure Hash Algorithm (SHA), 219
  5. Secure Hypertext Transfer Protocol (S-HTTP), 246, 498
  6. Secure Key Exchange Mechanism (SKEME), 307
  7. secure message format, 498
  8. secure modes of operation, 181–182
  9. Secure Multipurpose Internet Mail Extensions (S/MIME), 247, 300, 498
  10. secure offsite storage, 413
  11. Secure Remote Procedure Call (S-RPC), 249
  12. Secure Shell (SSH/SSH-2), 249, 498
  13. Secure Sockets Layer (SSL), 308, 498
  14. Secure Sockets Layer/Transport Layer Security (SSL/TLS), 252
  15. security analyst, 11
  16. Security and Risk Management domain
    1. about, 43
    2. applying concepts of confidentiality, integrity, and availability, 51–52
    3. applying risk management concepts, 116–132
    4. applying security governance principles, 44–50
    5. applying threat modeling, 132–136
    6. business continuity requirements, 87–111
    7. compliance, 53–58
    8. global legal and regulatory issues, 58–81
    9. integrating security risk considerations, 136–138
    10. managing information security education, training, and awareness, 138–141
    11. personnel security policies, 111–116
    12. policies, standards, procedures, and guidelines, 85–87
    13. professional ethics, 82–85
  17. security architect, 11
  18. Security Architecture and Engineering domain
    1. applying cryptography, 196–224
    2. applying security principles to site and facility design, 224–229
    3. fundamental concepts of security models, 157–162
    4. implementing site and facility security controls, 229–238
    5. secure design principles, 155–157
    6. security capabilities of information systems, 173–185
    7. selecting controls, 162–172
    8. vulnerabilities in embedded devices, 195–196
    9. vulnerabilities in mobile systems, 194
    10. vulnerabilities in Web-based systems, 193–194
    11. vulnerabilities of security architecture, designs, and solution elements, 185–192
  19. security architectures, 185–192
  20. Security Assertion Markup Language (SAML), 320, 499
  21. security assessment and testing
    1. about, 357
    2. analyzing test output, 376
    3. collecting security process data, 371–376
    4. conducting security audits, 376–378
    5. conducting security control testing, 359–371
    6. designing and validating strategies for, 357–358
    7. generating reports, 376
  22. security association (SA), 307
  23. security auditor, 11
  24. security audits, conducting, 376–378
  25. security awareness, 499
  26. security capabilities, of information systems, 173–185
  27. security consultant, 11
  28. security control assessment (SCA), 499
  29. security controls, 169–172, 359–371
  30. security countermeasures, 169–172
  31. security engineer, 11, 499
  32. security executive oversight, 45–46
  33. Security Features User's Guide (SFUG), 165
  34. security gates, 230
  35. security governance principles, 44–50
  36. security guards, 230
  37. security incident management. See incident management
  38. security information and event management (SIEM) systems, 366, 393, 410, 499
  1. security kernel, 181, 182, 499
  2. security lighting, 230
  3. security manager, 11
  4. security models, 157–162
  5. security modes, 183, 499
  6. security operation center (SOC), 499
  7. Security Operations domain
    1. about, 46, 379
    2. addressing personnel safety and security concerns, 428
    3. applying foundational security operations concepts, 396–405
    4. applying resource protection techniques, 405–407
    5. conducting incident management, 407–409
    6. conducting logging and monitoring activities, 391–394
    7. implementing disaster recovery (DR) processes, 415–423
    8. implementing patch and vulnerability management, 411–412
    9. implementing physical security, 427
    10. implementing recovery strategies, 412–415
    11. maintaining detective and preventive measures, 409–411
    12. participating in Business Continuity (BC) planning, 427
    13. participating in change management processes, 412
    14. provisioning resources, 394–395
    15. requirements for investigation types, 390–391
    16. supporting investigations, 379–390
    17. testing disaster recovery plans, 423–427
  8. Security Parameter Index (SPI), 307
  9. security perimeter, 180, 499
  10. security policies
    1. about, 46
    2. as a basic control requirement, 163
    3. developing and implementing, 85–87
  11. security posture, 46, 499
  12. security process data, 371–376
  13. security program metrics, to measure effectiveness of security training, 141
  14. Security Protocol ID, 307
  15. security scanners, 445
  16. security testing, 164
  17. security walls/fences, 230
  18. Security|5, 37
  19. segregation of duties and responsibilities, 397–398, 499
  20. self assessment, 127
  21. self-paced training, 140
  22. self-study, 12–13
  23. senior management, 89–90, 110
  24. senior management policies, 86
  25. Sensitive but Unclassified (SBU) government data classification, 145, 499
  26. sensitivity labels, 350–351, 499
  27. separation of duties and responsibilities, 397–398, 499
  28. Sequenced Packet Exchange (SPX), 252
  29. Serial Line IP (SLIP), 267, 499
  30. server rooms, 229–230
  31. server-based systems, assessing and mitigating vulnerabilities in, 186–187
  32. Service Set Identifier (SSID), 281, 499
  33. service-level agreements (SLAs), 137–138, 402–404, 499
  34. services, 137
  35. session hijacking, 312, 354, 500
  36. Session Initiation Protocol (SIP), 249
  37. session key, 323
  38. Session Layer (Layer 5) (OSI Reference Model), 248–249, 500
  39. session management, 344, 449
  40. session token interception, 312
  41. severe weather, 228
  42. Shamir, Adi (Dr), 211, 214
  43. Shared Key authentication, 282
  44. The Shatterproof Fallacy, 82
  45. shielded twisted-pair cable (STP), 275, 277
  46. shoulder surfing, 363, 500
  47. side-channel attacks, 211
  48. signature dynamics, 342
  49. signature-based IDS, 289–290, 392
  50. signature-based software, 292–293
  51. simple integrity property, 161, 500
  1. Simple Key Management for Internet Protocols (SKIP), 261, 500
  2. Simple Mail Transfer Protocol (SMTP), 247, 297, 500
  3. Simple Network Management Protocol (SNMP), 247
  4. simple security property (ss property), 160, 500
  5. simplex mode, 248
  6. simulation, of disaster recovery (DR) plan, 424–425
  7. single factor authentication, 330–335, 500
  8. single key cryptography. See symmetric key cryptography
  9. Single Loss Expectancy (SLE), 120, 500
  10. single sign-on (SSO), 319–327, 500
  11. Single-line Digital Subscriber Line (SDSL), 267
  12. single/multi-factor authentication, 328–343
  13. site accreditation, 169
  14. site design, applying security principles to, 224–229
  15. site security controls, implementing, 229–238
  16. The Site Security Handbook, 86
  17. 60-day study plan, 456–457
  18. S/Key protocol, 335
  19. smartphone passwords, 336, 500
  20. smishing, 365
  21. smoke-sensing fire detection, 236
  22. SMS passwords, 336
  23. SMTP over TLS, 299–300
  24. Smurf attack, 311, 500
  25. sniffing, 500
  26. social engineering, 354, 364–365, 500
  27. Society for Information Management (SIM) (website), 30
  28. Society of Information Risk Auditors (IIA) (website), 30
  29. socket, 251, 501
  30. soda acid, 237
  31. soft tokens, 336
  32. software
    1. about, 137, 179
    2. acquired, 447–448
    3. assessing effectiveness of security of, 444–447
    4. containerization, 180
    5. defined, 501
    6. environments for, 440–442
    7. operating systems, 179
    8. virtualization, 180
  33. Software as a Service (SaaS), 190, 501
  34. software asset management, 407
  35. Software Assuarnce Maturity Model (SAMM), 437, 501
  36. software developer, 11
  37. software development
    1. about, 429
    2. applying secure coding guidelines and standards, 448–452
    3. applying security controls in development environments, 440–444
    4. assessing effectiveness of software security, 444–447
    5. assessing security impact of acquired software, 447–448
    6. software development lifecycle (SDLC), 429–440
  38. software development lifecycle (SDLC)
    1. about, 429–430
    2. change management, 439
    3. defined, 501
    4. development methodologies, 430–436
    5. integrated product team, 439–440
    6. maturity models, 437–438
    7. operation and maintenance, 438–439
  39. software development methodology (SDMI). See software development lifecycle (SDLC)
  40. software escrow agreements, 94, 501
  41. software libraries, 448
  42. software-defined networks (SDNs), 260–261, 501
  43. solution elements, vulnerabilities of, 185–192
  44. source code review, 355, 501
  45. source code scanning tools, 446
  46. source-code, 448–450, 501
  47. speaking, at events, 26–27
  48. spear phishing, 298, 365, 501
  49. Special Publication 800-53: Security and Privacy Controls for Federal Information Systems and Organizations, 48
  50. speed, 338–339
  51. spike, 501
  1. SPIM, 501
  2. SPIT, 501
  3. split horizon, 254
  4. spoofing, 312, 501
  5. sprint planning, 435, 501
  6. sprint retrospective, 436
  7. sprint review, 436
  8. spyware, 502
  9. SQL injection, 502
  10. ss property (simple security property), 160
  11. SSL hiding, 502
  12. stack overflow, 353–354
  13. stack overflow attack, 469
  14. staging environments, 375
  15. stand-alone power system (SPS), 95, 502
  16. standard operating environments, 87
  17. Standard Operating Procedures (SOPs), 87
  18. Standard Practice for Computer Forensics, 391
  19. standards, 85–87, 153, 280, 448–452, 502
  20. standby assets, 421
  21. star integrity property (*-integrity property), 161, 502
  22. star property (*- property), 160, 502
  23. Star topology, 273, 502
  24. stare decisis, 53
  25. state attacks, 185, 502
  26. state machine, 161, 502
  27. stateful inspection firewall, 284, 502
  28. static application scanning tool (SAST), 502
  29. static password, 335, 502
  30. Static RAM (SRAM), 176
  31. static routing protocol, 253
  32. statistical attack, 222
  33. statistical sampling, 128
  34. statutory damages, under civil law, 54, 502
  35. steganography, 205, 502
  36. storage, 154, 386, 406
  37. storage area network (SAN), 242
  38. storage virtualization, 309
  39. stored procedure, 502
  40. stream ciphers, 203, 503
  41. Stream Control Transmission Protocol (SCTP), 252
  42. STRIDE technique, 133–134, 446
  43. strong authentication, 503
  44. Structured Query Language (SQL), 503
  45. structured walkthough, of disaster recovery (DR) plan, 424
  46. study groups, 13, 28, 458
  47. subject, 503
  48. subpoena, 385
  49. substitution ciphers, 203–204, 503
  50. Sun Network File System (NFS), 320
  51. Supervisory Control and Data Acquisition (SCADA), 503
  52. supervisory state, 175, 503
  53. supplies, in disaster recovery, 95–96
  54. supply chain management, integrating security risk considerations into, 136–138
  55. surge protectors, 233, 503
  56. surge suppressors, 233
  57. switch, 503
  58. Switched Multimegabit Data Service (SMDS), 269, 503
  59. Switched Virtual Circuits (SVCs), 269
  60. symmetric algorithm. See symmetric key cryptography
  61. symmetric key cryptography
    1. about, 206–207
    2. Advanced Encryption Standard (AES), 211
    3. Blowfish Algorithm, 211
    4. Data Encryption Standard (DES), 207–209
    5. defined, 503
    6. International Data Encryption Algorithm (IDEA) Cipher, 212
    7. Rivest Ciphers, 211–212
    8. Triple DES (3DES), 209–211
    9. Twofish Algorithm, 211
  62. SYN Defender, 312
  63. SYN flood attack, 312, 503
  64. synchronous communication, 271
  65. Synchronous Data Link Control (SDLC), 271
  66. Synchronous Digital Hierarchy (SDH), 269
  67. Synchronous Optical Network (SONET), 269, 503
  68. synthetic transactions, 367–368
  1. system access controls, 316, 503
  2. system accreditation, 169
  3. system architecture, 164
  4. system certification, 167–169
  5. system hardening, 170–171, 443
  6. system high mode, 182, 503
  7. system high security mode, 183
  8. system integrity, 164
  9. system isolation, 443
  10. system messages, 333–334
  11. system resilience, 171–172, 414
  12. system test, 503
  13. systems administrator, 11, 316–317
  14. systems development lifecycle. See software development lifecycle (SDLC)
  15. Systems Security Certified Professional (SSCP), 33

T

  1. tabletop walkthrough, of disaster recovery (DR) plan, 424
  2. tactics, techniques, and procedures (TTPs), 504
  3. tailgating, 365
  4. tailoring, 152–153
  5. Take-Grant systems, 161, 504
  6. TCP Intercept, 312
  7. teaching, about data security, 28–29
  8. Teardrop attack, 312, 504
  9. technical factors, risk management and, 124
  10. Technical Stuff icon, 4
  11. technical support, 5
  12. technical training, 140
  13. technical/vendor certifications, 36–37
  14. techniques, for control assessment, 127–128
  15. telephone calls, 365
  16. Telnet, 247, 504
  17. temperature, 233–234
  18. TEMPEST project, 172, 276
  19. Temporal Key Integrity Protocol (TKIP), 282
  20. temporary credentials, 345
  21. Terminal Access Controller Access Control System (TACACS), 305, 325–326, 504
  22. termination of employment, 401
  23. territorial reinforcement, as a strategy of CPTED, 225
  24. terrorism, 62, 228, 416, 417
  25. test coverage analysis, 370
  26. test documentation, 165
  27. testing
    1. analyzing output, 376
    2. Business Continuity Plan (BCP), 110–111
    3. disaster recovery (DR) plans, 423–427
    4. in engineering process, 156
  28. text messaging, 422
  29. theft, 228
  30. thicknet, 275, 277
  31. thinnet, 275, 277
  32. third-party, 504
  33. third-party assessment/monitoring, 137
  34. third-party audit, 378
  35. third-party identity services, 348
  36. third-party security services, 410
  37. Threat Agent Risk Assessment (TARA), 131
  38. threat analysis, 118–119
  39. threat modeling, 133–135, 354, 446, 504
  40. threats, identifying, 116–117, 133–134, 504
  41. 3DES (Triple DES), 465
  42. three-way handshake, 250, 504
  43. throughput, 338–339
  44. Tip icon, 4
  45. Token Ring, 264, 504
  46. token-passing networks, 263
  47. tokens, 336, 504
  48. toll fraud, 296
  49. tools, 179
  50. Top Secret government data classification, 146
  51. topologies, network, 273–274
  52. tort law, 471
  53. total cost of ownership (TCO), 123–124
  54. trade secrets, 74, 504
  55. Trademark Law Treaty Implementation Act, 73
  56. trademarks, 73, 504
  57. Trade-Related Aspects of Intellectual Property Rights (TRIPs), 72
  58. traffic analysis, 504
  1. training, 138–141, 280, 375, 423
  2. Training Seminar, 458
  3. transaction latency, 368
  4. trans-border data flow, 75, 505
  5. transformation procedures (TP), 162
  6. transitive trust, 397, 505
  7. Transmission Control Protocol (TCP), 250–251, 505
  8. Transmission Control Protocol/Internet Protocol (TCP/IP) Model, 278–279, 504
  9. transmission media, 280–282
  10. Transport Layer (Layer 4) (OSI Reference Model), 249–252, 505
  11. Transport Layer (TCP/IP Model), 279, 505
  12. Transport Layer Security (TLS), 505
  13. transport mode, 307
  14. transport via secure courier, 413
  15. transportation, 317, 386, 416, 418
  16. transposition ciphers, 204–205, 505
  17. trap and trace device, 67
  18. trap door, 505
  19. Trapdoor (Merkle-Hellman) Knapsack, 215–216
  20. traverse-mode noise, 232
  21. Triple Data Encryption Standard (3DES), 209
  22. Trivial File Transfer Protocol (TFTP), 247
  23. Trojan horse, 505
  24. trust model, 300
  25. trusted computer system, 505
  26. Trusted Computer System Evaluation Criteria (TCSEC), 163–165, 505
  27. Trusted Computing Base (TCB), 180–181, 505
  28. trusted distribution, 164
  29. trusted facility management, 164
  30. Trusted Facility Manual (TFM), 165
  31. Trusted Network Interpretation (TNI), 166, 505
  32. trusted path, 164, 505
  33. Trusted Platform Module (TPM), 181, 505
  34. trusted recovery, 164, 505
  35. trusted subject, 160
  36. tunnel mode, 307
  37. twinaxial cable, 275, 506
  38. twisted-pair cable, 275–276, 506
  39. two-factor authentication, 506
  40. Twofish Algorithm, 211
  41. Type 1 error, 338
  42. type accreditation, 169
  43. Type II error, 338
  44. typing dynamics, 342

U

  1. UDP flood attack, 313
  2. UDP small servers, 311
  3. U.K. Data Protection Act (DPA), 78–79
  4. unauthenticated scans, 360, 506
  5. Unclassified government data classification, 145
  6. unconstrained data item (UDI), 162
  7. unicast, 265, 506
  8. Unified Communications as a Service (UCaaS), 296
  9. unified threat management devices (UTMs), 288, 506
  10. Uninterruptible Power Supply (UPS), 95, 231–232, 506
  11. unit test, 506
  12. United Nations Commission on International Trade Law (UNCITRAL), 72
  13. unsecured protected health information (PHI), 78
  14. unshielded twisted-pair cable (UTP), 275, 277
  15. U.S. CAN-SPAM Act (2003), 69
  16. U.S. Child Pornography Prevention Act (CPPA) (1996), 66
  17. U.S. Computer Fraud and Abuse Act (1986), 63–65, 68
  18. U.S. Computer Security Act (1987), 65
  19. U.S. Defense Information Security Agency, 170
  20. U.S. Department of Defense (DoD), 145, 160–161, 163
  21. U.S. Economic Espionage Act (EEA) (1996), 64, 66
  22. U.S. Electronic Communications Privacy Act (ECPA) (1986), 65, 68
  23. U.S. Federal Emergency Management Agency (FEMA), 89
  24. U.S. Federal Information Systems Management Act (FISMA) (2002), 69
  25. U.S. Federal Privacy Act (1974), 75, 76
  26. U.S. Federal Sentencing Guidelines (1991), 55, 66
  27. U.S. Gramm-Leach-Bliley Financial Services Modernization Act (GLBA) (1999), 75, 77
  1. U.S. Health Information Technology for Economic and Clinical Health Act (HITECH) (2009), 75, 78
  2. U.S. Health Insurance Portability and Accountability Act (HIPAA) (1996), 52, 75–77, 482
  3. U.S. Homeland Security Act (2002), 68
  4. U.S. Identity Theft and Assumption Deterrence Act (2003), 69
  5. U.S. Intelligence Reform and Terrorism Prevention Act (2004), 69
  6. U.S. Patent and Trademark Office (PTO), 73
  7. U.S. Sarbanes-Oxley Act (SOX) (2002), 48, 68, 371, 378, 497
  8. USA PATRIOT Act (2001), 64, 66–68, 506
  9. use case testing, 368–369
  10. Use stage, of ILM, 151
  11. useful life, as a criteria for commercial data classification, 144
  12. user, 506
  13. user acceptance testing (UAT), 446–447, 506
  14. user and entity behavior analytics (UEBA), 506
  15. User Datagram Protocol (UDP), 251, 506
  16. user entitlement, 506
  17. user identity, 345
  18. user mode, 506
  19. user stories, 435
  20. users, as a security role and responsibility, 47–48
  21. utilities, 95, 226, 228, 231–233, 416, 417

V

  1. v. (versus), 56
  2. V.24 ITU-T standard, 277
  3. V.35 ITU-T standard, 277
  4. validating strategies for assessment and testing, 357–358
  5. value, as a criteria for commercial data classification, 144
  6. value-added network (VAN), 243
  7. vandalism, 228
  8. vendor controls, 115
  9. vendor training, 140
  10. Vernam cipher, 506
  11. version control, 375
  12. Very high Data-rate Digital Subscriber Line (VDSL), 267
  13. veterans, 17
  14. vibration, 228
  15. video surveillance, 229
  16. view, 506
  17. view permissions, 316
  18. violation analysis, 506
  19. virtual addressing, 178
  20. virtual assets, 395
  21. virtual circuit management, 250
  22. virtual desktop infrastructure (VDI), 507
  23. virtual local area network (VLAN), 242, 507
  24. virtual machine, 507
  25. virtual memory, 177, 178, 507
  26. Virtual Private Network (VPN), 305, 507
  27. virtual reality (VR), 507
  28. Virtual Tape Library (VTL), 93, 507
  29. virtualization, 180, 309–310, 414, 507
  30. virtualized networks, 309
  31. virus, 507
  32. visibility, as a consideration for choosing locations, 226
  33. visitor logs, 230, 318
  34. Visual Basic Script (VBScript), 507
  35. VM sprawl, 310, 507
  36. voice communication, 295–296
  37. Voice over Internet Protocol (VoIP), 295–296, 507
  38. Voice over Long-Term Evolution (VoLTE), 296
  39. Voice over Wi-Fi (VoWiFi), 296
  40. voice recognition, 342
  41. voluntary surrender, of evidence, 385
  42. volunteer opportunities, 26–29
  43. volunteering, reasons for, 29
  44. VOMIT, 507
  45. voting, in ISC2 elections, 25
  46. vulnerabilities, 116–117, 184–196, 355, 359–360, 411–412, 507
  47. Vulnerability Assessment, 99–100, 119, 507
  48. vulnerability management services, 410, 438, 507
  49. vulnerability scan, 359–360, 507
  50. vulnerability scanning tool, 507

W

  1. wait state, 175
  2. waivers, 11
  3. walkthrough, of disaster recovery (DR) plan, 424
  4. walls, 318
  5. war, 416
  6. war dialing, 361, 508
  7. war driving, 362, 508
  8. warm site, 97, 228, 413, 508
  9. Warning icon, 4
  10. water issues, 234
  11. water protection, 96
  12. water sprinkler systems, 236–237
  13. waterfall model, 430–434, 508
  14. watering hole attacks, 301, 508
  15. wearables, 317
  16. web application firewall (WAF), 285, 508
  17. web communication, 300–302
  18. web content filters, 290–291, 508
  19. Web filtering, 410
  20. web site security tools, 445
  21. Web-based systems, assessing and mitigating vulnerabilities in, 193–194
  22. websites. See specific websites
  23. weighting, of questions in exam, 19
  24. well-formed transaction, 162
  25. wet-pipe system, 236
  26. whaling, 298, 365
  27. white-box testing, 508
  28. whitelisting, 410, 508
  29. wide area networks (WANs), 240–241, 266–271
  30. Wi-Fi, 508
  31. Wi-Fi Calling, 296
  32. Wi-Fi networks, protecting, 281–282
  33. Wi-Fi Protected Access (WPA/WPA2), 282, 508
  34. Wired Equivalent Privacy (WEP), 281–282, 508
  35. wired networks, protecting, 281
  36. Wireless Access Points (APs), 272–273
  37. wireless campus area network (WCAN), 243
  38. wireless intrusion detection (WIDS), 392
  39. wireless local area network (WLAN), 243, 265–266
  40. wireless metropolitan area network (WMAN), 243
  41. wireless network interface cards, 272
  42. Wireless Networks For Dummies (Lewis and Davis), 266
  43. wireless personal area network (WPAN), 242
  44. Wireless Transport Layer Security (WTLS), 508
  45. wireless wide area network (WWAN), 243
  46. wiretaps, 382
  47. wiring, as a building design consideration, 227
  48. wiring closets, 229–230
  49. work area security, 230
  50. work factor, 222, 508
  51. World Customs Organization (WCO), 72
  52. World Intellectual Property Organization (WIPO), 72
  53. World Trade Organization (WTO), 72
  54. worm, 508
  55. Write (W) access, 352
  56. writing certification exam questions, 26

X

  1. X (Execute) access, 352
  2. X.21bis. ITU-T standard, 278
  3. X25, 270, 508

Y

  1. Yagi antennas, 272

Z

  1. Zigbee, 508
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.226.185.87