- CISSP in 21 Days Second Edition
- CISSP in 21 Days Second Edition
- Credits
- About the Author
- About the Reviewer
- www.PacktPub.com
- Preface
- 1. Day 1 – Security and Risk Management - Security, Compliance, and Policies
- 2. Day 2 – Security and Risk Management - Risk Management, Business Continuity, and Security Education
- 3. Day 3 – Asset Security - Information and Asset Classification
- 4. Day 4 – Asset Security - Data Security Controls and Handling
- 5. Day 5 – Exam Cram and Practice Questions
- 6. Day 6 – Security Engineering - Security Design, Practices, Models, and Vulnerability Mitigation
- 7. Day 7 – Security Engineering - Cryptography
- 8. Day 8 – Communication and Network Security - Network Security
- An overview of communication and network security
- Network architecture, protocols, and technologies
- Open System Interconnect (OSI) model
- OSI layers and security
- Application layer protocols and security
- Presentation layer protocols and security
- Summary
- Sample questions
- 9. Day 9 – Communication and Network Security - Communication Security
- An overview of communication security
- Security in communication channels
- Attacks on communication networks
- Preventing or mitigating communication network attacks
- Summary
- Sample questions
- 10. Day 10 – Exam Cram and Practice Questions
- 11. Day 11 – Identity and Access Management - Identity Management
- 12. Day 12 – Identity and Access Management - Access Management, Provisioning, and Attacks
- 13. Day 13 – Security Assessment and Testing - Designing, Performing Security Assessment, and Tests
- An overview of security assessment and testing
- Security assessment and test strategies
- Security controls
- Summary
- Sample questions
- 14. Day 14 – Security Assessment and Testing - Controlling, Analyzing, Auditing, and Reporting
- 15. Day 15 – Exam Cram and Practice Questions
- 16. Day 16 – Security Operations - Foundational Concepts
- An overview of operations security
- The physical security design
- Physical and operations security controls
- Operations/facility security
- Protecting and securing equipment
- Computer investigations
- Summary
- Sample questions
- 17. Day 17 – Security Operations - Incident Management and Disaster Recovery
- 18. Day 18 – Software Development Security - Security in Software Development Life Cycle
- 19. Day 19 – Software Development Security - Assessing effectiveness of Software Security
- 20. Day 20 – Exam Cram and Practice Questions
- 21. Day 21 – Exam Cram and Mock Test
Ensuring the confidentiality, integrity, and availability of requirements during various states that any data will pass through requires the secure handling of such data. Appropriate policies and procedures should be established for handling sensitive data.
Sensitive data such as confidential files need special care. Some of the best practices to handle sensitive information include the following:
- Secure disposal of media: Media containing sensitive data has to be disposed off in a secure manner. Shredding in case of paper documents and pulverizing in case of digital media are some of the methods used in media disposal.
- Labelling: Appropriate labelling is important for sensitive data without disclosing the type of content.
- Access restrictions: The need to know principle is to be adopted while designing and implementing access restrictions to sensitive data.
- Formal records of authorized recipients of data: Recipients who are authorized to access the data should be documented and approved.
- Storage of media: Media storage should be as per manufacturers' specifications and industry best practices.
- Data distribution: Appropriate controls should be established to ensure that the data is distributed only to approved and authorized entities as per the authorized recipients list.
- Clear marking: Marking on sensitive data has to be clear and legible for appropriate identification and handling. Marking may use codes compare labelling that may only be used for identification purposes.
- Review of distribution lists: Periodic review of the distribution lists is necessary to ensure that the data is not shared with obsolete or unauthorized entities.
- Control of publicly available information: Suitable controls should be established to ensure that sensitive data is not disclosed or posted to publicly available repositories or websites.
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.