Index

A

ABAC (attribute-based access control), 510, 512

abstraction, 8, 661

acceptable use policy. See AUP

acceptance testing, 673, 696

access

administration, 477

aggregation, 522

asset security, 143-144

authentication, 480-507, 515-516

authorization, 508-514

control categories, 83-84

control processes, 475-476

denying, 702

IDaaS, 507

managing, 600

NAC devices, 435-436

Pearson Test Prep practice test engine, 714

physical/logical, 477-479

reviews, 516

third party, 72, 507

threats, 516-523

types, 84-87

access control, 645

matrices, 513

models, 508-510, 514

policies, 514

services, 196

access control lists. See ACLs

access points. See APs

accessibility, 310

accountability, 223, 505

accounting, 6

accounts

access reviews, 516

managing, 515-516, 551, 594

privileges, 595

revocation, 516

root, 488

accreditation, 217

Accreditation/Certification phase (SDLC), 674

ACID tests, 159

ACLs (access control lists), 346, 477-478, 514

acoustical detection systems, 643

Acquire/Develop stage (System Development Life Cycle), 669

acquired software, impact of, 696-697

acquisitions, 12, 121-123

active states, 290

active vulnerability scanners. See AVSs

ActiveX, 664-665

ACV (actual cost valuation), 631

Ad Hoc mode, 384

Address Resolution Protocol. See ARP

addresses

IP, 461

IPv4, 348

IPv6, 360, 363-372

logical, 347-353

MAC, 338, 352-353

physical, 347-353

Adleman, Leonard, 277

administration. See also managing

access, 477

passwords, 485-488

administrative controls, 85

administrative investigations, 581-582

administrative law, 39

Advanced Encryption Standard. See AES

advanced persistent threat. See APT

adware, 691

AES (Advanced Encryption Standard), 274

agent-based log reviews, 543-544

agentless log reviews, 543

agents, threats, 74, 138

aggregation, 158, 226, 362

Agile model, 679

AH (authentication header), 361

alarms, environmental, 320

ALE (annual loss expectancy), 79

algebraic attacks, 303

algorithms, 252

asymmetric, 268-269

MD2, 296

selecting, 262

SHA, 296

symmetric, 266-269, 275-276

3DES, 270-273

AES, 274

Blowfish, 275

DES, 270-273

Diffie-Hellman, 277

ECC, 278

El Gamal, 278

IDEA, 274

Knapsack, 279

RC4/RC5/RC6/RC7, 275

RSA, 277

Skipjack, 274

Twofish, 275

zero-knowledge proof, 279

alignment, security functions, 9-11

analog signaling, 353

analysis

evidence, 569

media, 577

risk management, 73-90, 93-106, 695-696

assets, 73-74

vulnerabilities, 74

security, 553

source code tools, 688

test coverage, 549, 562

analytic attacks, 304

annual loss expectancy. See ALE, 79

antenna placements, 391

antenna types, 392

anti-malware, 437, 614, 693

antivirus applications, 614, 693

anycast addresses, IPv6, 368

APs (access points), 384, 408

APIs (application programming interfaces), 700-701

APIPA (Automatic Private IP Addressing), 352

applets, Java, 664

Application layer (Layer 7), 336-337

application programming interfaces. See APIs

applications

owners, 17

provisioning, 591

security, 246, 665-668

applied cryptography, 300

APT (advanced persistent threat), 523

architecture, 192

COBRA, 663

cryptography, 250

features of, 256-257

history of, 253-255

life cycles, 261-262

mathematics, 258-261

NIST SP 800-175A and B, 257-258

types, 262-269

databases, 155-156

firewalls, 403-404

ISO/IEC 42010:2011, 193

maintenance, 223

SOA, 664

system, 196-205

vulnerabilities, 224-230, 233-242

archiving, privacy, 168

ARP (Address Resolution Protocol), 343, 372, 454

AS (authentication server), 500

assemblers, 660

assembly languages, 660

assertions, 481

assessments

controls, 89

disaster recovery, 636

effectiveness, 695-696

risk, 78. See also risk, management

security testing, 534-535

strategies, 533

vulnerabilities, 535-536

assets

accessing, 477-479

cloud computing, 591

costs, 78

information, 599

inventory, 590-591

managing, 599-603, 606-607

physical, 591

risk management, 73-74

security

baselines, 169

custodians, 161

data access/sharing, 167

data classification, 146-160

data custodians, 143

data documentation, 145

data ownership, 143

data policies, 141-143

data protection methods, 171-172

data quality, 144

data retention, 164-165

data security, 166-172

data states, 166-167

handling requirements, 172-173

ownership, 160-161

privacy, 161-163, 168

private sector classification, 151-152

roles/responsibilities, 143-144

scoping, 170

standards selection, 170

tailoring, 170

virtual, 591

assurance, 185

asymmetric algorithms, 251, 268-269, 276

Diffie-Hellman, 277

ECC, 278

El Gamal, 278

Knapsack, 279

RSA, 277

zero-knowledge proof, 279

asynchronous, 251

asynchronous tokens, 488

Asynchronous Transfer Mode. See ATM

asynchronous transmissions, 354

ATM (Asynchronous Transfer Mode), 433

atomicity, 159

attacks, 76

cryptography, 301-305

networks, 451, 454-462

cabling, 451-453

components, 453-462

threat modeling, 120

time-of-check/time-of-use, 243

Web-based, 243

OWASP, 244

SAML, 244

XML, 244

attenuation, 452

attribute-based access control. See ABAC

attributes, 155, 512, 660

auditing, 6, 505, 585-587, 695

classification, 160

committees, 15

logs, 505

security, 535, 554-556, 563

services, 196

types of, 587

auditors, 17

AUP (acceptable use policy), 567

authentication, 256, 480, 486-496, 515-516

factors for, 484-493

implementing, 496-507

Kerberos, 499-500

Open System Authentication, 387

periods, 487

Shared Key Authentication, 387

authentication header. See AH

authentication server. See AS

Authenticode technology, 665

authorization, 257, 508-514, 609

autoconfiguration, IPv6, 360

Automatic Private IP Addressing. See APIPA

availability, 61, 632

avalanche effect, 252

AVSs (active vulnerability scanners), 538

awareness, 124-126, 553, 647

B

backdoors, 522, 699

backups

data, 624, 627, 632

hardware, 621

software, 621

storage, 626

systems, 600

types of, 625

verification data, 553

barriers, 641

base relation, 155

baseband, 355

Basel II, 49

baselines, 58, 169

BCPs (business continuity plans), 60, 62-68, 639-640

behavior, 661

behavioral systems, 491

Bell-LaPadula model, 189

best evidence, 575

best practices, software development security, 686-687

BGP (Border Gateway Protocol), 415

BIA (business impact analysis), 61, 65-68, 618

Biba model, 190

big data, 145

biometric technologies, 492-493

biometrics, 315

BIOS, 203

birthday attacks, 303, 518

bits

clocking, 354

host/networks, 349

black-box testing, 547

blacklisting, 613

blackouts, 319

blind spoofing attacks, 453

blind tests, 540

block ciphers, 267

Blowfish, 275

Bluetooth, 386

Board Briefing on IT Governance, 9

board of directors, 14

bollards, 641

bombing, 115

Boolean systems, 258

BOOP (bootstrap protocol), 373

Border Gateway Protocol. See BGP

botnets, 691

bottom-up approach, 31

boundary control services, 196

bounds, 183

breaches, 76

data, 44

Brewer-Nash (Chinese Wall) model, 192

bridges, 399

British Ministry of Defence Architecture Framework. See MODAF

broadband, 355

broadcast transmissions, 355

brownouts, 319

brute-force attacks, 302, 517

BSI (Build Security In), 687

budgets, security, 11

buffers, overflow, 520, 697

Build and Fix approach, 675

Build Security In. See BSI

building security controls, 645

bus topologies, 420

business cases, 10

business continuity plans. See BCPs

business impact analysis. See BIA

business interruption insurance, 632

business/mission ownership, 161

business process recovery, 620

C

CA (certificate authority), 279

cable communication connections, 443

cabling, 415

attacks, 451-453

coaxial, 416

fiber optic, 418

twisted pair, 417-418

caching

DNS poisoning, 456

web, 404

Caesar cipher, 253

campus area networks. See CANs

CANs (campus area networks), 371

candidate keys, 156

capabilities, tables, 514

Capability Maturity Model Integration. See CMMI

capacitance detector, 643

CAPTCHA, 486

cardinality, 155

Carlisle Adams and Stafford Tavares. See CAST

Carrier Sense Multiple Access/Collision Avoidance. See CSMA/CA

Carrier Sense Multiple Access/Collision Detection. See CSMA/CD

CASE (common application service element), 337

CASE (Computer-Aided Software Engineering), 681

CAST (Carlisle Adams and Stafford Tavares), 275

categories, access control, 83-84

CBC-MAC (Cipher Block Chaining MAC), 298

CC (Common Criteria), 211-213

CCTA Risk Analysis and Management Method. See CRAMM

CCTV (closed-circuit television system), 643

CDMA (code division multiple access), 383

CDNs (content distribution networks), 438

CDP (Cisco Discovery Protocol), 413

cellular wireless, 383

Center for Internet Security. See CIS

central processing units. See CPUs

centralized access control, 478

certificate authority. See CA

certificate revocation list (CRL), 283

certificates, 280-281

certification, 217

chain of custody, 573

change management, 618, 674

channel service unit/data service unit. See CSU/DSU

characteristic factor authentication, 489-493

checklist tests, 638

chosen ciphertext attacks, 302

chosen plaintext attack, 302

CIA (confidentiality, integrity, and availability), 5-6, 61, 146, 182, 669

CIDR (Classless Inter-Domain Routing), 349

CIFS/SMB (Common Internet File System/Server Message Block), 377

CIP (critical infrastructure protection) plan, 64

Cipher-Based MAC (CMAC), 299

Cipher Block Chaining MAC (CBC-MAC), 298

ciphers, 263-269

ciphertext, 251

ciphertext-only attacks, 302

circuit-switching networks, 432

circumstantial evidence, 576

CIS (Center for Internet Security), 27

Cisco Discovery Protocol. See CDP

civil code law, 38

civil disobedience, 114

civil investigations, 582

civil law, 39

Clark-Wilson Integrity model, 190-191

classes, 349-350, 660

classification

asset security, 146-160

private sector, 151-152

Classless Inter-Domain Routing. See CIDR

Cleanroom model, 681

clearing, 163, 607

client-based system vulnerabilities, 224-225

clipping levels, 487, 614

clocking bits, 354

closed-circuit television system. See CCTV

closed systems, 182

cloud-based system vulnerabilities, 230, 233-237

cloud computing assets, 591

clustering, 633

CMaaS (Continuous Monitoring as a Service), 588

CMAC (Cipher-Based MAC), 299

CMMI (Capability Maturity Model Integration), 31, 682

coaxial cabling, 416

COBIT (Control Objectives for Information and Related Technology), 23

COBRA (Common Object Request Broker Architecture), 663

code

guidelines/standards, 697-700

mobile, 664, 700

repository security, 688

reviews, 546-549

secure coding practices, 701-702

source code analysis tools, 688

code division multiple access (CDMA), 383

cognitive passwords, 486

cohesion, 662

cold sites, 629

collecting

evidence, 568-569, 574

privacy, 163

security process data, 550

backing up, 553

disaster recovery, 553

KRIs, 552

management review, 551-552

managing accounts, 551

NIST SP 800-137, 550-551

training, 553

collisions, 252, 427

collusion, 113

COM (Component Object Model), 663

combination passwords, 485

commercial software, 43

Committee of Sponsoring Organizations. See COSO

committees

audit, 15

governance, 14

common application service element. See CASE

Common Criteria. See CC

common law, 38

Common Object Request Broker Architecture. See COBRA

Common Security Framework. See CSF

common TCP/UDP ports, 346

communications

channels, 438, 441-443

multimedia collaboration, 439

remote access, 440-451

virtualized networks, 450-451

voice, 439

disaster recovery, 636

networks, 353-357

threats, 110-111

Communications Assistance for Law Enforcement Act (CALEA) of 1994, 49

comparing

asynchronous/synchronous transmissions, 354

broadband/baseband, 355

wired/wireless transmissions, 356-357

compartmented security mode, 184

compensative controls, 83

compilers, 660, 701

complex passwords, 485

complexity of passwords, 487

compliance

personnel, 72

security, 33-34

laws/regulations, 34

privacy, 35

Component-Based Development method, 682, 710

Component Object Model. See COM

components, 196-205

attacks, 454-456

networks, 396, 403, 415, 424, 432

attacks, 453-462

hardware, 397-438

compromised states, 291

Computer-Aided Software Engineering. See CASE

computer crimes, 36-37, 44

Computer Ethics Institute, 52-53

Computer Fraud and Abuse Act (CFAA), 48

computer rooms, 311

Computer Security Act of 1987, 49

Computer Security Technology Planning Study, 694

computing platforms, 193-195

concealment ciphers, 263

conclusive evidence, 576

confidentiality, 148, 257

confidentiality, integrity, and availability. See CIA

configuration management, 592-593, 674

configuring

applications, 246

architecture, 196-205, 223

assets. See assets, security

auditing, 535

baselines, 169

business continuity, 58-68

capabilities, 219

encryption/decryption, 223

fault tolerance, 221

interfaces, 221

memory protection, 219-220

policy mechanisms, 222

TPM, 220-221

virtualization, 220

compliance, 33-34

laws/regulations, 34

privacy, 35

controls, 535-550, 562

cryptography, 267

data breaches, 44

device, 245

documentation, 54

baselines, 58

guidelines, 58

policies, 55-57

procedures, 57

processes, 57

standards, 57

domains, 502

DRM, 305-307

education, 126

email, 300

endpoint, 437

engineering

closed/open systems, 182

design, 180-181

objects/subjects, 181

equipment, 321

evaluation models, 206-219

facility and site design, 307-323

geographical threats, 108-115

governance, 8-9, 94-95

control frameworks, 17-18, 21, 24-33

processes, 12-14

roles and responsibilities, 14-17

security function alignment, 9-11

import/export controls, 45, 49

Internet, 300

kernels, 694

keys, 285-293

laws/regulations, 35-43

life cycles, 31

logs, 545

message integrity, 293-296

models, 182, 188

Bell-LaPadula model, 189

Biba model, 190

bounds, 183

Brewer-Nash (Chinese Wall) model, 192

CIA, 182

Clark-Wilson Integrity model, 190-191

computing platforms, 193-195

confinement, 183

defense in depth, 185

Goguen-Meseguer model, 192

Graham-Denning model, 192

Harrison-Ruzzo-Ullman model, 192

ISO/IEC 42010:2011, 193

isolation, 183

Lipner model, 191

modes, 183-185

services, 196

Sutherland model, 192

types, 185-187

networks, 335, 382, 386, 403, 415, 424, 432, 441-443, 451, 454-462

attacks, 451-462

communication channels, 438-451

components, 396-438

converged protocols, 379-381

cryptography, 392-394

Internet security, 394-396

IP networking, 345-353

IPv6, 357-369

multilayer protocols, 378-379

network transmission, 353-357

OSI models, 335-338

protocols, 372-378

services, 376-377

TCP/IP models, 340-345

types, 370-372

wireless, 381-392

operations, 571-576, 579, 589-592, 595, 602, 605, 608, 611, 614, 617-619, 637

asset management, 599-603, 606-607

authorization, 609

BCP, 639-640

change management, 618

concepts, 593

configuration management, 592-593

continuous monitoring, 588

detections, 612-617

disaster recovery, 633-636

eDiscovery, 585

egress monitoring, 588-589

forensic tools, 579-581

IDSs, 587

incident management, 608-612

industry standards, 582-584

information life cycles, 596-597

investigations, 566-579

job rotation, 595

logging/monitoring, 585-587

managing accounts, 594

managing privileges, 595

need to know/least privilege, 593

patches, 617

personal security, 645-647

physical security, 640-644

record retention, 596

recovery strategies, 618-633

resource protection, 597-599

resource provisioning, 589-591

sensitive information procedures, 596

separation of duties, 594

SIEM, 588

SLAs, 597

testing disaster recovery plans, 637-639

two-person controls, 596

types of investigations, 581-582

perimeters, 694

personnel, 68

compliance, 72

employee onboarding/offboarding, 71-72

employment agreements/policies, 70

hiring, 69-70

job rotation, 73

privacy, 72

separation of duties, 73

third party access, 72

PKI, 279-285

policies, 693, 701

privacy, 45-52

process data, collecting, 550-551

backing up, 553

disaster recovery, 553

KRIs, 552

management review, 551-552

managing accounts, 551

training, 553

professional ethics, 52-53

requirements, 123

risk management, 73-90, 93-106

assets, 73-74

vulnerabilities, 74

risks in acquisitions, 121-123

software development, 659-668, 700

API security, 700-701

coding guidelines, 697-700

impact of acquired software, 696-697

life cycles, 668-673

methods, 674-683

operation/maintenance, 684-686

secure coding, 701-702

security controls, 686-696

symmetric algorithms, 275

system architecture, 192

terms, 5

abstraction, 8

accounting, 6

auditing, 6

CIA, 5-6

data hiding, 8

default security posture, 7

defense-in-depth strategy, 7

encryption, 8

non-repudiation, 7

testing, 534-535, 553-556, 563

threat modeling, 115-121

training, 124-125, 647

trans-border data flow, 45

vulnerabilities, 224-230, 233-237

WLANs, 387-392

confinement, 183

confusion, 252

consistency, 159

constrained data item (CDI), 191

contamination, 226

content-dependent access control, 158, 513

content distribution networks. See CDNs

contention methods, 426

context-dependent access control, 159, 513

contingency plans, 61

continuity of operations (COOP) plan, 63

continuous improvement, 89

continuous monitoring, 588

Continuous Monitoring as a Service. See CMaaS

control frameworks, NIST SP, 94-95

Control Objectives for Information and Related Technology. See COBIT

controls, 217

access, 83-87, 475-476, 645

assessments, 89

asset security, 166-173

compensative, 83

corrective, 83

detective, 84, 586

deterrent, 84

directive, 84

import/export, 45, 49

input/output, 616

logical, 86

physical, 87

preventive, 84

security, 17-18, 21, 24-33, 562, 686, 700

best practices, 686-687

code repository security, 688

environments, 687

software effectiveness assessments, 695-696

source code analysis tools, 688

testing, 535-550

threats, 688-694

selecting, 218-219

site and facility, 312-323

converged protocols, 379

FCoE, 379

iSCSI, 381

MOPLS, 380

MPLS, 381

VoIP, 381

cookies, 396

COOP (continuity of operations), 63

copyrights, 42

corporate procedures, 321

corrective controls, 83

corroborative evidence, 576

COSO (Committee of Sponsoring Organizations), 28

costs, assets, 78

countermeasures, 75, 81, 138, 217

coupling, 662

covert channels, 694, 699

CPS (cyber-physical systems), 240

CPTED (Crime Prevention Through Environmental Design), 307

CPUs (central processing units), 197

crackers, 37

CRAMM (CCTA Risk Analysis and Management Method), 31

CRC (cyclic redundancy check), 354

credentials, 504

Crime Prevention Through Environmental Design (CPTED), 307

crime scenes, 572. See also investigations

criminal investigations, 582

criminal laws, 39

crisis communications plan, 63

critical infrastructure protection (CIP) plan, 64

critical processes, 66

criticality (data classification), 147

CRLs (certificate revocation lists), 283

cross-certification, 285

crosstalk, 452

cryptographic system vulnerabilities, 227

cryptography, 171, 250, 392

3DES, 270-273

applied, 300

attacks, 301-305

email encryption, 393-394

end-to-end encryption, 393

features of, 256-257

history of, 253-255

Internet security, 394-396

life cycles, 261-262

link encryption, 392

mathematics, 258-261

NIST SP 800-175A and B, 257-258

quantum, 394

services, 196

symmetric algorithms, 267

types, 262-269

cryptology, 252

cryptoperiods, 287

cryptosystem, 251

CSF (Common Security Framework), 26

CSMA/CA (Carrier Sense Multiple Access/Collision Avoidance), 426, 429

CSMA/CD (Carrier Sense Multiple Access/Collision Detection), 426, 428

CSU/DSU (channel service unit/data service unit), 432

custodians, asset security, 143, 161

customary law, 39

customizing exams, 715-716

cyber crimes, 44

cyber incident response plan, 64

cyber-physical systems. See CPS

Cybersecurity Framework (NIST), 552

cybersquatting, 458

cyclic redundancy check. See CRC

D

DAC (discretionary access control), 509

damage assessment teams, 635

DAP (Directory Access Protocol), 498

data

access, 167-168

audits, classification, 160

backups, 624, 627, 632

breaches, 44

classification, asset security, 146-160

collection, privacy, 163

custodians, 16, 143

databases

architecture, 155-156

classification, 155-159

interface languages, 157

locks, 159

maintenance, 158

threats, 158

views, 159

vulnerabilities, 226

documentation, asset security, 145

flow control, 225

haven laws, 51

hiding, 8, 661

leakage, 589

mining, 157

owners, 16

ownership, 143, 161

policies, 141-143

processors, 162

protection methods, 171-172

quality, 144

recovery, 623

remanence, 162-163

at rest, 166

retention, 164-165

security, 166-172

states, 166-167

storage, 168

structures, 662

in transit, 167

in use, 167

warehousing, 157, 226

Data Link Layer (2), 338

DCOM (Distributed Component Object Model), 663

DDoS (distributed DoS) attacks, 457, 520

deactivated states, 291

decentralized access control, 478

decisions, evidence, 570

decoding, 252

decryption, 223, 251

dedicated security mode, 184

de-encapsulation, TCP/IP, 345

default security posture, 7

default to no access, 497

defense in depth, 7, 185, 702

degrees, 155

delaying intruders, 309

demilitarized zones (DMZs), 165

denial-of-service. See DoS attacks

denying access, 702

Department of Defense Architecture Framework. See DoDAF

deprovisioning, 516

DES (Digital Encryption Standard), 270-273

design. See also security

accreditation/certification, 217

applied cryptography, 300

cryptography, 267

digital signatures, 299

DRM, 305-307

engineering, 180-181

closed/open systems, 182

objects/subjects, 181

evaluation models, 206-219

geographical threats, 108-115

keys, 285-293

message integrity, 293-299

network

converged protocols, 379-381

multilayer protocols, 378-379

protocols, 375-378

services, 376-377

wireless, 381-392

networks, 335, 380-386, 403, 415, 424, 432, 441-462

attacks, 451-462

communication channels, 438-451

components, 396-438

cryptography, 392-394

Internet security, 394-396

IP networking, 345-353

IPv6, 357-369

network transmission, 353-357

OSI models, 335-338

protocols, 372-375

TCP/IP models, 340-345

types, 370-372

policies, 165

security capabilities, 219

encryption/decryption, 223

fault tolerance, 221

interfaces, 221

memory protection, 219-220

policy mechanisms, 222

TPM, 220-221

virtualization, 220

security models, 182, 188

Bell-LaPadula model, 189

Biba model, 190

bounds, 183

Brewer-Nash (Chinese Wall) model, 192

CIA, 182

Clark-Wilson Integrity model, 190-191

computing platforms, 193-195

confinement, 183

defense in depth, 185

Goguen-Meseguer model, 192

Graham-Denning model, 192

Harrison-Ruzzo-Ullman model, 192

ISO/IEC 42010:2011, 193

isolation, 183

Lipner model, 191

modes, 183-185

services, 196

Sutherland model, 192

types, 185-187

security policies, 701

symmetric algorithms, 275

system architecture, 192, 196-205

vulnerabilities, 224-230, 233-242

Design phase (SDLC), 672

destroyed phases, 291-292

destruction, 163, 173

detecting

fires, 317

incidents, 610-611

intruders, 309

detective administrative control, 586

detective controls, 84

deterrent controls, 84

deterring criminal activity, 308

Develop phase (SDLC), 672

development, software, 659-668, 700

API security, 700-701

coding guidelines, 697-700

impact of acquired software, 696-697

life cycles, 668-683

operation/maintenance, 684-686

secure coding, 701-702

security controls, 686-696

deviations from standards, 615

device firmware, 204

devices

access controls, 479

authentication, 495-496

firmware, 204

hardware, 397-438

NAC, 435-436

security, 245

tracking, 322

DHCP (Dynamic Host Configuration Protocol), 336, 373

dial-up connections, 441

dictionary attacks, 303, 517

differential cryptanalysis, 303

Diffie, Whitfield, 277

Diffie-Hellman algorithm, 277

diffusion, 252

digital certificates, 251, 280-281

Digital Encryption Standard. See DES

digital forensic tools, 579-581

digital identity guidelines (SP 800-63), 480

digital investigations, 566-579

Digital Rights Management. See DRM

digital signaling, 353

Digital Signature Standard. See DSS

digital signatures, 251, 299

Digital Subscriber Line. See DSL

direct evidence, 576

direct memory access. See DMA

direct sequence spread spectrum (DSSS), 382

directive controls, 84

Directory Access Protocol. See DAP

directory services, 498

disaster recovery, 58-59, 111, 553, 633-637

disaster recovery plan. See DRP

discovery, network scans, 536-537

discretionary access control. See DAC

disposal of media, 606

Dispose stage (SDLC), 670

disruptions, 59

distance vector, 413

distance vector protocols, 413

Distributed Component Object Model. See DCOM

distributed computing, 663

distributed DoS. See DDoS attacks

distributed platforms, 194

distribution facilities, 316

divestitures, 12

DMA (direct memory access), 201

DMCA (U.S. Digital Millennium Copyright Act) of 1998, 44

DMZs (demilitarized zones), 165

DNS (Domain Name System), 374

cache poisoning, 456

network attacks, 456-459

DNSSEC (Domain Name System Security Extensions), 457

documentation

asset security, 145

DRM, 306

evidence, 570

recovery, 623

reviews, 122

security, 54

baselines, 58

guidelines, 58

policies, 55-57

procedures, 57

processes, 57

standards, 57

DoDAF (Department of Defense Architecture Framework), 22

Domain Name System. See DNS

Domain Name System Security Extensions. See DNSSEC

domains, 156

collisions, 427

grabbing, 458

protection, 503

security, 502

doors, 312-313

DoS (denial-of-service) attacks, 457, 520, 611

double-blind tests, 540

double-encapsulated 802.1Q/nested VLAN attack, 454

downtime, 66

DRM (Digital Rights Management), 43, 305-307

DRP (disaster recovery plan), 60, 62-64, 619-620, 628, 632

DSL (Digital Subscriber Line), 355, 442

DSS (Digital Signature Standard), 300

DSSS (direct sequence spread spectrum), 382

DSV (dynamic signature verification), 492

due care, 32

due diligence, 32-33

dumpster diving, 519

durability, 159

duress, 646

duties, separation of, 496, 594

Dynamic Host Configuration Protocol. See DHCP

dynamic signature verification. See DSV

dynamic testing, 548

E

earthquakes, 109

eavesdropping, 452, 521

e-books, DRM, 307

ECC (Elliptic Curve Cryptosystem) algorithm, 278

Economic Espionage Act of 1996, 49

eDiscovery, 585

education, 124-126

effectiveness assessments, security, 11, 695-696

efficiency, transmission (IPv6), 362

egress monitoring, 588-589

eigenfaces, 491

EIGRP (Enhanced IGRP), 414

El Gamal algorithm, 278

electrical threats, 110

electromechanical systems, 642

electronic backup solutions, 625-626

Electronic Communications Privacy Act (ECPA) of 1986, 48

electronic protected health information (EPHI), 149

electronically stored information. See ESI

E-lines, 431

Elliptic Curve Cryptosystem. See ECC

email

attacks, 458

encryption, 393-394

security, 300

spoofing, 458

email-pass-around code review, 547

emanations, 522

embedded devices, investigations, 578

embedded IPv4 unicast, 369

embedded systems, 195, 250

embedding, 663

emergency management, 646-647

employee onboarding/offboarding, 71-72

employees, privacy, 50

employment agreements/policies, 70

encapsulating security payload. See ESP

encapsulation, 336, 345, 661-662

encoding, 252

encryption, 8, 223, 250, 321

email, 393-394

end-to-end, 171, 300, 393

link, 392, 300

links, 171

end-to-end encryption, 171, 300, 393

endpoint authentication, 495-496

endpoint security, 437

engineering

accreditation/certification, 217

applied cryptography, 300

asymmetric algorithms. See asymmetric algorithms

cryptography, 250, 257-258, 267

features of, 256-257

history of, 253-255

life cycles, 261-262

mathematics, 258-261

types, 262-269

design, 180-181

closed/open systems, 182

objects/subjects, 181

digital signatures, 299

DRM, 305-307

evaluation models, 206-219

geographical threats, 108-115

keys, 285-293

message integrity, 293-299

PKI, 279-285

security capabilities, 219

encryption/decryption, 223

fault tolerance, 221

interfaces, 221

memory protection, 219-220

policy mechanisms, 222

TPM, 220-221

virtualization, 220

security models, 182, 188

Bell-LaPadula model, 189

Biba model, 190

bounds, 183

Brewer-Nash (Chinese Wall) model, 192

CIA, 182

Clark-Wilson Integrity model, 190-191

computing platforms, 193-195

confinement, 183

defense in depth, 185

Goguen-Meseguer model, 192

Graham-Denning model, 192

Harrison-Ruzzo-Ullman model, 192

ISO/IEC 42010:2011, 193

isolation, 183

Lipner model, 191

modes, 183-185

services, 196

Sutherland model, 192

types, 185-187

symmetric algorithms. See symmetric algorithms

system architecture, 192, 196-205

Enhanced IGRP. See EIGRP

Enigma machine, 255

enrollment, 282, 481

biometrics, 492

certificates, 282

Enterprise Risk Management. See ERM

Enterprise versions, 388

environmental alarms, 320

environmental security, 317-318

environments, software development security, 687

EPHI (electronic protected health information), 149

equipment rooms, 311

equipment security, 321

ERM (Enterprise Risk Management), 107

escalation, 551, 699

ESI (electronically stored information), 585

ESP (encapsulating security payload), 361

Ethernet 802.3 standard, 423

ethics, 52-53

EU (European Union) laws, 50-51

evacuation drills, 639

evaluation models

CC, 211-213

controls, selecting, 218-219

controls/countermeasures, 217

ITSEC, 209-211

security implementation standards, 213-215

TCSEC, 206-209

events

managing, 608

unusual, 615

evidence

analyzing, 569

best, 575

chain of custody, 573

circumstantial, 576

collecting, 568-569

collection, 574

conclusive, 576

corroborative, 576

decisions, 570

direct, 576

examining, 569

hearsay, 576

identifying, 568

opinion, 576

presenting findings, 569

preserving, 568-569

reporting, 570

secondary, 575

types of, 575

examining evidence, 569

exams

customizing, 715-716

memory tables, 717

Pearson Test Prep practice test engine, 713-715

review tools, 717

study plans, 717-718

updating, 716

exploits, 75

Exploratory Model, 681

explosions, 112

export controls, 45

exposure, 75

extended address spaces (IPv6), 360

Extensible Markup Language. See XML

extension headers, IPv6, 360

external security assessments, 535

external threats, 108-109

extranets, 370

F

facilities

access controls, 479

controls, 312-323

design, 307-311

recovery, 628-629

redundancy, 631

security, 598

selection, 309

factoring attacks, 304

failover, 632

failsoft, 632

fault tolerance, 68, 221, 600, 607, 631

faults, 319

FCoE (Fibre Channel over Ethernet), 379

FDDI (Fiber Distributed Data Interface), 425

FDM (frequency division multiplexing), 355

FDMA (frequency division multiple access), 383

Federal Information Processing Standard. See FIPS

Federal Information Security Management Act (FISMA) of 2002, 49

Federal Intelligence Surveillance Act (FISA) of 1978, 48

Federal Privacy Act of 1974, 48

federated identity management, 502

federation (SP 800-63C), 481

fences, 640-642

FHSS (frequency hopping spread spectrum), 382

fiber cabling specifications, 419

Fiber Distributed Data Interface. See FDDI

fiber optic cabling, 418

Fibre Channel over Ethernet. See FCoE

File Transfer Protocol. See FTP

filters, MAC, 391

fingerprinting operating systems, 537

FIPS (Federal Information Processing Standard), 90-92

FIPS Publication 201-2, 504

fire, 112, 317-318

fire detection and suppression systems, 632

firewalls, 401, 436-438, 613

architecture, 403-404

rules, 346

types, 401-403

firmware, 203-204

flooding, 110, 320

flow control, 343

foreign keys, 156

forensic investigations, 566-579

forensic procedures, 570

forensic processes, 584

forensic tools, 579-581

fraggle attacks, 455

Frame Relay, 432

Framework Core, 552

frameworks

risk, 90, 93-106

security controls, 17-18, 21, 24-33

fraud, 113

freeware, 43

frequency analysis, 303

frequency division multiple access. See FDMA

frequency division multiplexing. See FDM

frequency hopping spread spectrum. See FHSS

FTP (File Transfer Protocol), 374

FTPS (FTP Secure), 374

full-interruption tests, 639

full-knowledge tests, 540

functionality drills, 639

fuzz testing, 548

G

gates, 640-642

gateways, 401

Gather Requirements phase (SDLC), 671

GDPR (General Data Protection Regulation), 51-52

geographical threats, 108-115

glass entries, 315

global scope (IPv6), 369

global system for mobile communications (GSM), 383

goals, organizational, 10

Goguen-Meseguer model, 192

going dark, 44

governance

control frameworks, 94-95

security, 8-9

control frameworks, 17-18, 21, 24-33

processes, 12-14

roles and responsibilities, 14-17

security function alignment, 9-11

third-party, 122-123

government, data classification, 152-153

Graham-Denning model, 192

Gramm-Leach-Bliley Act (GLBA) of 1999, 47

graphical passwords, 486

gray-box testing, 547

graylisting, 613

Green Book, 209

grid computing vulnerabilities, 237

groups, managing, 594

GSM (global system for mobile communications), 383

guaranteed delivery, 343

guest operating systems, 451

guidelines

coding, 697-700

documentation, 58

H

hackers, 37

handling

asset security, 172-173

evidence, 574

risk, 82. See also risk, management

hardening systems, 616

hardware, 397-438

backups, 621

investigations, 578-579

redundancy, 607

risks, 121

security, 598

Harrison-Ruzzo-Ullman model, 192

hash, 251

hash MAC (HMAC), 298

hashing, 294

HAVAL, 297

headers

IPv6, 360

TCP, 341

UDP, 341

Health Care and Education Reconciliation Act of 2010, 50

Health Insurance Portability and Accountability Act. See HIPAA

hearsay evidence, 576

heat, 320

Hellman, Martin, 277

hiding data, 661

hierarchical models, 156

hierarchical storage management. See HSM

high availability, 632

high cohesion, 662

high-level languages, 660

High-Speed Serial Interface. See HSSI

higher-level recovery strategies, 619

hijacking, session, 461

HIPAA (Health Insurance Portability and Accountability Act), 149

hiring, 69-70

history

media, 606

passwords, 486

HITRUST, 26

HMAC (hash MAC), 298

honeynets, 614

honeypots, 405, 614

hosts, bits, 349

hot sites, 628-629

HSM (hierarchical storage management), 605

HSSI (High-Speed Serial Interface), 434

HTTP (Hypertext Transfer Protocol), 336, 375

HTTPS (Hypertext Transfer Protocol Secure), 375

hubs, 398

human-caused disasters, 60

human-caused threats, 111-113

human resources, 622

humidity, 320

hurricanes, 109

HVAC, 320

hybrid ciphers, 269

hybrid protocols, 413

hybrid routing, 413

hybrid topologies, 422

Hypertext Transfer Protocol. See HTTP

Hypertext Transfer Protocol Secure. See HTTPS

I

IAB (Internet Architecture Board), 52, 54

IAM (identity and access management)

access control processes, 475-476

authentication, 480-507, 515-516

authorization, 508-514

IDaaS, 507

physical/logical access, 477-479

third-party identity services, 507

threats, 516-523

ICCs (integrated circuit cards), 489

ICMP (Internet Control Message Protocol), 343, 375

attacks, 454

redirects, 455

ICSs (industrial control systems) vulnerabilities, 227-230

IDaaS (Identity as a Service), 507

IDEA (International Data Encryption Algorithm), 274

IDEAL model, 683

identification, implementing, 496-507. See also authentication

identifying

evidence, 568

threats, 119-120

identities

managing, 515-516, 600

proofing, 481

theft, 519

identity governance and administration. See IGA

IDPS (intrusion detection and prevention system), 438

IDSs (intrusion detection systems), 405-407, 586-587, 612

IEC (International Electrotechnical Commission), 18, 170

IEEE (Institute of Electrical and Electronics Engineers) standards

802.11 standards, 382, 385

802.11 techniques, 382

802.11a standard, 385

802.11ac standard, 385

802.11b standard, 385

802.11g standard, 385

802.11n standard, 386

802.11X standard, 389

IGA (identity governance and administration), 507

IGMP (Internet Group Management Protocol), 343, 376

IGRP (Interior Gateway Routing Protocol), 414

IKE (Internet Key Exchange) protocol, 361

IMAP (Internet Message Access Protocol), 376

Implement stage (System Development Life Cycle), 669

implementing

authentication, 496-507

authorization, 508-514

data policies, 141-143

IDaaS, 507

risk management, 82

third-party identity services, 507

import controls, 45

import/export controls, 49

incidents

events, 608

investigations, 609

managing, 608, 611

response teams, 609

Incremental model, 678

industrial control systems. See ICSs

industry standards, 34, 582-584

inference, 158, 226

information

access controls, 478

assets, 599

information flow models, 187

information life cycles, 153-154, 596-597

information security continuous monitoring. See ISCM

information security management system. See ISMS

information system contingency plan (ISCP), 64

Information Systems Audit and Control Association. See ISACA

Information Technology Infrastructure Library. See ITIL

Information Technology Security Evaluation Criteria. See ITSEC

infrared, 386

Infrastructure mode, 384

initialization vectors. See IVs

Initiate phase (System Development Life Cycle), 668-669

input validation, 699, 701

input/output (I/O), 616

devices, 202

structures, 202-203

instant messaging applications, 440

Institute of Electrical and Electronics Engineers. See IEEE

insurance, 631-632

intangible asset protection, 597-599, 602, 606

integrated circuit cards. See ICCs

Integrated Product and Process Development. See IPPD

Integrated Services Digital Networks. See ISDNs

integration testing, 673

integrity, 190, 196, 257, 293-299

integrity verification procedure (IVP), 191

intellectual property law, 40

interface-local scope (IPv6), 369

interfaces, 221

APIs, 700-701

HSSI, 434

languages, 157

testing, 549-550, 562

Interior Gateway Routing Protocol. See IGRP

Intermediate System to Intermediate System. See IS-IS

internal audits, 554-556, 563

internal protection, 43

internal security assessments, 535

internal security controls, 645

internal threats, 108-109

International Data Encryption Algorithm. See IDEA

International Electrotechnical Commission. See IEC

International Information Systems Security Certification Consortium. See ISC

International Organization on Computer Evidence. See IOCE

International Organization for Standardization. See ISO

Internet Architecture Board. See IAB

Internet Control Message Protocol. See ICMP

Internet Group Management Protocol. See IGMP

Internet Key Exchange protocol. See IKE protocol

Internet layer, 343

Internet Message Access Protocol. See IMAP

Internet of Things. See IoT

Internet Protocol. See IP

Internet security, 300, 394-396

Internet Small Computer System Interface. See iSCSI

interpreters, 660

interviewing (investigations), 573

intranets, 370

intrusion detection and prevention system. See IDPS

intrusion detection systems. See IDSs

intrusion prevention systems. See IPSs

inventories, 322, 590-591

investigations, 566, 571-572, 579

digital/forensic, 566-579

evidence, 574-576

incidents, 609

techniques, 573

types of, 581-582

IOCE (International Organization on Computer Evidence), 571

I/O (input/output)

devices, 202

structures, 202-203

IoT (Internet of Things) vulnerabilities, 238-242

IP (Internet Protocol), 343

addresses, 461

networks, 345

addressing, 347-353, 363-369

common TCP/UDP ports, 346

IPv6, 357-363

network transmission, 353-357

types, 370-372

IPPD (Integrated Product and Process Development), 685

IPS (intrusion prevention system), 407, 612

IPsec (IP security), 361

IPv4 (IP version 4)

addresses, 348

threats, 362-363

IPv6 (IP version 6), 357

addressing, 363-369

major features of, 360-361

network types, 370-372

NIST Special Publication (SP) 800-119, 358-360

threats, 362-363

ISACA (Information Systems Audit and Control Association), 9

ISC (International Information Systems Security Certification Consortium), 52-53

ISCM (information security continuous monitoring), 550-551

ISCP (information system contingency plan), 64

iSCSI (Internet Small Computer System Interface), 381

ISDNs (Integrated Services Digital Networks), 441

IS-IS (Intermediate System to Intermediate System), 415

ISMS (information security management system), 19

ISO (International Organization for Standardization), 18, 335, 570

ISO 9001:2015, 682

ISO/IEC 15288:2015, 181

ISO/IEC 27000 series, 18, 687

ISO/IEC 27001:2013, 214

ISO/IEC 27002:2013, 215

ISO/IEC 27005:2011, 105

isolation, 159, 183

issue-specific security policies, 57

ITGI (IT Governance Institute), 9

ITIL (Information Technology Infrastructure Library), 9, 28

ITSEC (Information Technology Security Evaluation Criteria), 209-211

IVs (initialization vectors), 268

J

JAD (Joint Analysis Development) model, 681

Java applets, 664

Java Platform, Enterprise Edition (Java EE), 664

JDBC (Java Database Connectivity), 157

job rotation, 73, 595

Joint Analysis Development. See JAD model

K

KDC (Key Distribution Center), 500

Kerberos, 499-500

Kerckhoff’s Principle, 255

kernels, security, 694

key clustering, 251

Key Distribution Center. See KDC

key-encrypting keys, 286

key performance indicators, 552, 563

key risk indicators. See KRIs

keys, 251, 261-262, 285-293

keyspace, 252

Knapsack algorithm, 279

knowledge factor authentication, 485-489, 515

known plaintext attacks, 302

KRIs (key risk indicators), 552

L

Label Distribution Protocol. See LDP

labeling, 172, 606

LANs (local area networks), 351, 370

languages

assembly, 660

high-level, 660

machine, 659

very-high-level, 660

large-scale parallel data systems vulnerabilities, 236-237

laws, 34-35

computer crimes, 36-37

EU, 50-51

major legal systems, 38-43

privacy, 47-51

Layer 3 switches, 400

Layer 4 switches, 400

layered defense models, 307

layers

Data Link (2), 338

Network (3), 338

Physical (1), 339

Presentation (6), 337

Session (5), 337

TCP/IP, 341-345

Transport (4), 337

LDAP (Lightweight Directory Access Protocol), 376

LDP (Label Distribution Protocol), 376

least privilege principle, 497, 593, 702

legal teams, 635

legally permissible, 574

length of passwords, 487

licenses, 43

licensing law, 40

life cycles, 481

certificates, 281

cryptography, 261-262

information, 153-154, 596-597

passwords, 486

provisioning, 514-515

security, 31

software development, 668-673

lighting

security, 643

types of, 644

Lightweight Directory Access Protocol. See LDAP

limiting data collection, 163-164

linear cryptanalysis, 303

link encryption, 392-393, 300

Link layer, TCP/IP models, 345

link-local scope (IPv6), 369

link state, 413

link state protocols, 413

linking, 663

links, encryption, 171

Linux, password storage, 488

Lipner model, 191

LLC (logical link control), 338

load balancing, 633

local area networks. See LANs

location factor authentication, 494

locks, 313-315, 323

databases, 159

doors, 312

logging, 585, 695

audits/reviews, 585-587

continuous monitoring, 588

egress monitoring, 588-589

IDSs, 587

SIEM, 588

types of logs, 586

logic bombs, 691

logical access to assets, 477-479

logical addressing, 347-353

logical controls, 86

logical link control. See LLC

logical operations, 259-260

logs, 541

audit, 505

configuring, 545

NIST SP 800-92, 542-545, 556

low humidity, 320

Lucifer project, 256

M

MAC (mandatory access control), 509

MAC (media access control)

addresses, 338, 352-353

filters, 391

flooding attacks, 454

MAC (Message Authentication Code), 297

machine languages, 659

mainframe/thin client platforms, 194

maintenance

architecture, 223

databases, 158

hooks, 242

software development, 684-686

major legal systems, 38-43

malware, 521, 614, 689, 693

MAN (metropolitan area network), 370

man-in-the-middle (MITM) attacks, 454

managing

access, 475-523

accounts, 515-516, 551, 594

assets, 145, 590-591, 599-603, 606-607

change management, 618, 674

configuration management, 592-593

controls, 85

credentials, 504

data policies, 141-143

identities, 515-516

incidents, 608, 611

authorization, 609

events, 608

investigations, 609

mitigation, 611

recovery, 612

remediation, 612

reporting, 611

responses, 610-611

reviewing, 612

keys, 261-262, 285-293

lifecycles, 481

media, 601

memory, 205

networks, 607

passwords, 485-488

patch management, 617

privileges, 595

reviews, 551-552

risk, 73-90, 93-106

assets, 73-74

vulnerabilities, 74

responsibilities, 14

security

abstraction, 8

baselines, 58

business continuity, 58-68

compliance, 33-35, 72

control framework, 17-18, 21, 24-33

data breaches, 44

data hiding, 8

default security posture, 7

defense-in-depth strategy, 7

documentation, 54-57

employee onboarding/offboarding, 71-72

employment agreements/policies, 70

encryption, 8

governance, 8-11

guidelines, 58

import/export controls, 45

job rotation, 73

laws/regulations, 35-43

personnel, 68-70

privacy, 45-52, 72

procedures, 57

processes, 12-14, 57

professional ethics, 52-53

roles and responsibilities, 14-17

separation of duties, 73

standards, 57

terms, 5-7

third party access, 72

trans-border data flow, 45

sessions, 503

vulnerabilities, 616

mandatory access control. See MAC

mantraps, 313

marking, 172

masking passwords, 487

massive multiple input multiple output (MIMO), 383

mathematics, cryptography, 258-261

matrix-based models, 186

maturity methods, 674-683

MD2 message digest algorithms, 296

mean time between failure. See MTBF

mean time to repair. See MTTR

measurements, 89

media

analysis, 577

disposal, 606

history, 606

labeling/storage, 606

management, 601

sanitizing, 606

storage facilities, 317

media access control. See MAC, addresses

meet-in-the middle attacks, 304

memorized secrets, 481, 484

memory, 199-201

cards, 489

managing, 205

protection, 219-220

tables (exams), 717

memory cards, 489

mesh topologies, 421

Message Authentication Code. See MAC

message integrity, 293-299

methods, 156, 661

contention, 426

data protection, 171-172

maturity, 675

software development, 674-683

metrics, security, 11

metropolitan area networks. See MANs

MFA (multi-factor authentication), 481

middleware, 194

military, data classification, 152-153

MIME (Multipurpose Internet Mail Extension), 394

MIMO (massive multiple input multiple output), 383

MIPv6 (Mobile IPv6), 361

mirrored sites, 630

missions, organizational, 10

misuse case testing, 549

mitigation, 523, 611, 695

MITM (man-in-the-middle) attacks, 454

mixed law, 40

MLD (Multicast Listener Discovery), 359

mobile application security, 665-668

mobile code, 438, 520, 664, 700

mobile computing, 195

mobile devices, 408, 412

Mobile IPv6. See MIPv6

mobile system vulnerabilities, 244-248

application security, 246

device security, 245

NIST SP 800-164, 248-249

mobile wireless, 383

MODAF (British Ministry of Defence Architecture Framework), 22

models

access control, 508-510, 514

COM, 663

databases, 155-156

DCOM, 663

evaluation, 206-219

layered defense, 307

OSI, 335-338

security, 182, 188

Bell-LaPadula model, 189

Biba model, 190

bounds, 183

Brewer-Nash (Chinese Wall) model, 192

CIA, 182

Clark-Wilson Integrity model, 190-191

computing platforms, 193-195

confinement, 183

defense in depth, 185

Goguen-Meseguer model, 192

Graham-Denning model, 192

Harrison-Ruzzo-Ullman model, 192

ISO/IEC 42010:2011, 193

isolation, 183

Lipner model, 191

modes, 183-185

services, 196

Sutherland model, 192

types, 185-187

STRIDE, 117

TCP/IP, 340-345

threats, 115-121

VAST, 118

modes, 183-185, 715-716

Modified Prototype Model. See MPM

modifying, 283

applications, 246

architecture, 196-205, 223

assets. See assets, security

auditing, 535

baselines, 169

business continuity, 58-68

capabilities, 219

encryption/decryption, 223

fault tolerance, 221

interfaces, 221

memory protection, 219-220

policy mechanisms, 222

TPM, 220-221

virtualization, 220

compliance, 33-34

laws/regulations, 34

privacy, 35

controls, 535-550, 562

cryptography, 267

data breaches, 44

device, 245

documentation, 54

baselines, 58

guidelines, 58

policies, 55-57

procedures, 57

processes, 57

standards, 57

domains, 502

DRM, 305-307

education, 126

email, 300

endpoint, 437

engineering

closed/open systems, 182

design, 180-181

objects/subjects, 181

equipment, 321

evaluation models, 206-219

facility and site design, 307-323

geographical threats, 108-115

governance, 8-9, 94-95

control frameworks, 17-18, 21, 24-33

processes, 12-14

roles and responsibilities, 14-17

security function alignment, 9-11

import/export controls, 45, 49

Internet, 300

kernels, 694

keys, 285-293

laws/regulations, 35-43

life cycles, 31

message integrity, 293-296

models, 182, 188

Bell-LaPadula model, 189

Biba model, 190

bounds, 183

Brewer-Nash (Chinese Wall) model, 192

CIA, 182

Clark-Wilson Integrity model, 190-191

computing platforms, 193-195

confinement, 183

defense in depth, 185

Goguen-Meseguer model, 192

Graham-Denning model, 192

Harrison-Ruzzo-Ullman model, 192

ISO/IEC 42010:2011, 193

isolation, 183

Lipner model, 191

modes, 183-185

services, 196

Sutherland model, 192

types, 185-187

networks, 335, 382, 386, 403, 415, 424, 432, 441-443, 451, 454-462

attacks, 451-462

communication channels, 438-451

components, 396-438

converged protocols, 379-381

cryptography, 392-394

Internet security, 394-396

IP networking, 345-353

IPv6, 357-369

multilayer protocols, 378-379

network transmission, 353-357

OSI models, 335-338

protocols, 372-378

services, 376-377

TCP/IP models, 340-345

types, 370-372

wireless, 381-392

operations, 571-576, 579, 589-592, 595, 602, 605, 608, 611, 614, 617-619, 637

asset management, 599-603, 606-607

authorization, 609

BCP, 639-640

change management, 618

concepts, 593

configuration management, 592-593

continuous monitoring, 588

detections, 612-617

disaster recovery, 633-636

eDiscovery, 585

egress monitoring, 588-589

forensic tools, 579-581

IDSs, 587

incident management, 608-612

industry standards, 582-584

information life cycles, 596-597

investigations, 566-579

job rotation, 595

logging/monitoring, 585-587

managing accounts, 594

managing privileges, 595

need to know/least privilege, 593

patches, 617

personal security, 645-647

physical security, 640-644

record retention, 596

recovery strategies, 618-633

resource protection, 597-599

resource provisioning, 589-591

sensitive information procedures, 596

separation of duties, 594

SIEM, 588

SLAs, 597

testing disaster recovery plans, 637-639

two-person controls, 596

types of investigations, 581-582

perimeters, 694

personnel, 68

compliance, 72

employee onboarding/offboarding, 71-72

employment agreements/policies, 70

hiring, 69-70

job rotation, 73

privacy, 72

separation of duties, 73

third party access, 72

PKI, 279-285

policies, 693, 701

privacy, 45-52

process data, collecting, 550-551

backing up, 553

disaster recovery, 553

KRIs, 552

management review, 551-552

managing accounts, 551

training, 553

professional ethics, 52-53

requirements, 123

risk management, 73-90, 93-106

assets, 73-74

vulnerabilities, 74

risks in acquisitions, 121-123

software development, 659-668, 700

API security, 700-701

coding guidelines, 697-700

impact of acquired software, 696-697

life cycles, 668-673

methods, 674-683

operation/maintenance, 684-686

secure coding, 701-702

security controls, 686-696

symmetric algorithms, 275

system architecture, 192

terms, 5

abstraction, 8

accounting, 6

auditing, 6

CIA, 5-6

data hiding, 8

default security posture, 7

defense-in-depth strategy, 7

encryption, 8

non-repudiation, 7

testing, 534-535, 553-556, 563

threat modeling, 115-121

training, 124-125, 647

trans-border data flow, 45

vulnerabilities, 224-230, 233-237

WLANs, 387-392

modulo function, 260

MOM (motive, opportunity, and means), 572

monitoring, 89, 585

accountability, 505

audits/reviews, 585-587

continuous, 588

egress, 588-589

IDSs, 587

ISCM, 550

personnel, 646

services, 196

SIEM, 588

special privileges, 595

synthetic transactions, 546

motive, opportunity, and means. See MOM

movies, DRM, 306

MPLS (Multiprotocol Label Switching), 380

MPM (Modified Prototype Model), 678

MTBF (mean time between failure), 608

MTTR (mean time to repair), 608

multicast addresses, IPv6, 368

Multicast Listener Discovery. See MLD

multicast transmissions, 355

multi-factor authentication. See MFA

multilayer protocols, 378-379

multilevel lattice models, 186

multilevel security mode, 184

multimedia collaboration, 439

multiprocessing, 199

Multiprotocol Label Switching. See MPLS

Multipurpose Internet Mail Extension. See MIME

multi-state systems, 199

multitasking, 198

music, DRM, 306

N

NAC (network access control) devices, 435-436

NAS (network-attached storage), 605

NAT (network address translation), 351, 376

National Information Assurance Certification and Accreditation Process. See NIACAP

National Institute of Standards and Technology. See NIST

natural access control, 308

natural disasters, 60

natural territorials reinforcement, 308

natural threats, 109

near field communication. See NFC

need-to-know principle, 497, 593

Neighbor Discovery, 361

Nessus, 538

NetBIOS (Network Basic Input/Output System), 376

network access control devices. See NAC devices

network address translation. See NAT

network-attached storage. See NAS

Network Basic Input/Output System. See NetBIOS

network discovery scans, 536-537

Network File System. See NFS

Network Layer (3), 338

network models, 156

networks

design, 335, 380-382, 386, 403, 415, 424, 432, 441-443, 451, 454-462

attacks, 451-462

communication channels, 438-451

components, 396-438

converged protocols, 379-381

cryptography, 392-394

Internet security, 394-396

IP networking, 345-353

IPv6, 357-369

multilayer protocols, 378-379

network transmission, 353-357

OSI models, 335-338

protocols, 372-378

services, 376-377

TCP/IP models, 340-345

types, 370-372

wireless, 381-392

investigations, 578

managing, 607

routing, 412-413

technologies, 423-424, 432

testing, 536

vulnerability scans, 538

NFC (near field communication), 386

NFS (Network File System), 377

NIACAP (National Information Assurance Certification and Accreditation Process), 217

NIST Framework for Improving Critical Infrastructure Cybersecurity, 103-105

NIST Interagency Report (NISTIR) 7924, 281

NIST (National Institute of Standards and Technology), 9, 90, 147, 170, 570-571

SP (Special Publication), 94-95

SP 800-2, 504

SP 800-12 Rev. 1, 24

SP 800-16 Rev. 1, 24

SP 800-18 Rev. 1, 24

SP 800-30 Rev. 1, 24, 101

SP 800-34 Rev. 1, 24, 62-63, 618

SP 800-35, 24

SP 800-36, 24

SP 800-37, 90, 99-101

SP 800-37 Rev. 1, 24

SP 800-39, 24, 102

SP 800-50, 24

SP 800-53 Rev. 4, 24, 90, 149

SP 800-53A Rev. 4, 24, 90

SP 800-55 Rev. 1, 24

SP 800-57, 285

SP 800-60, 90, 93

SP 800-60 Vol. 1 Rev. 1, 24, 94

SP 800-61 Rev. 2, 25

SP 800-63, 481-482

authentication, 480

passwords, 482-484, 487

SP 800-66

Risk Management Framework (RMF), 151

Security Rule, 151

SP 800-82 Rev. 2, 25, 228

SP 800-84, 25

SP 800-86, 25, 583-584

SP 800-88 Rev. 1, 25

SP 800-92, 25, 542-556

SP 800-101 Rev. 1, 25

SP 800-115, 25

SP 800-119, 358-360

SP 800-122, 25, 147, 149

SP 800-123, 25

SP 800-124 Rev, 25, 408

SP 800-137, 25, 90, 550-551

SP 800-144, 25, 234

SP 800-145, 25, 231

SP 800-146, 25

benefits of IaaS deployments, 236

benefits of PaaS deployments, 236

benefits of SaaS deployments, 235

cloud computing, 235

concerns of SaaS deployments, 236

SP 800-150, 25

SP 800-153, 25

SP 800-154, 25, 118

SP 800-160, 25, 90, 96-98, 181

SP 800-161, 25

SP 800-162

ABAC, 511-512

subject attributes, 512

SP 800-163, 26, 665, 667-668

SP 800-164, 26

SP 800-167, 26

SP 800-175A and B, 26, 257-258

SP 800-181, 26

SP 800-183, 26

no access, defaults to, 497

noise, 452

non-blind spoofing attacks, 453

nonce, 260

non-interference models, 186

non-repudiation, 7, 257

no-operation instructions. See NOPs

NOPs (no-operation instructions), 697

normalization, 156-157

numeric passwords, 486

O

Object Linking and Embedding. See OLE

object-oriented models, 156

object-oriented programming. See OOP

object-relational models, 157

objectives, organizational, 10

objects, 181, 660, 700

occupant emergency plan (OEP), 64

OCSP (Online Certificate Status Protocol), 284

OCTAVE (Operationally Critical Threat, Asset and Vulnerability Evaluation), 28

ODBC (Open Database Connectivity), 157

OEP (occupant emergency plan), 64

OFDM (orthogonal frequency division multiplexing), 382

OFDMA (orthogonal frequency division multiple access), 383

offline, accessing Pearson Test Prep practice test engine, 714

OLE (Object Linking and Embedding), 663

OLE DB (Object Linking and Embedding Database), 157

OLTP (Online Transaction Processing), 159

one-time pads, 264

one-way function, 252, 260

one-way hash, 294

online, accessing Pearson Test Prep practice test engine, 714

Online Certificate Status Protocol. See OCSP

Online Transaction Processing. See OLTP

onsite assessments, 122

on-time passwords, 486

OOP (object-oriented programming), 660-661

Open Database Connectivity. See ODBC

Open Group Architecture Framework. See TOGAF

Open Group Security Forum, 498

Open Shortest Path First. See OSPF

Open Source Security Testing Methodology Manual. See OSSTMM

Open System Authentication, 387

open systems, 182

Open Systems Interconnection models. See OSI models

Open Web Application Security Project. See OWASP

Operate/Maintain stage (System Development Life Cycle), 669

operating systems, 204

fingerprinting, 537

guest, 451

operational phases, 292

Operationally Critical Threat, Asset and Vulnerability Evaluation. See OCTAVE

operations

concepts, 593-595

information life cycles, 596-597

job rotation, 595

managing accounts, 594

managing privileges, 595

need to know/least privilege, 593

record retention, 596

sensitive information procedures, 596

separation of duties, 594

SLAs, 597

two-person control, 596

disaster recovery, 633-637

eDiscovery, 585

industry standards, 582-584

investigations, 566, 571-576, 579

civil, 582

criminal, 582

digital/forensic, 566-579

forensic tools, 579-581

operations/administrative, 581-582

regulatory, 582

types of, 581-582

logging/monitoring, 585

audits/reviews, 585-587

continuous monitoring, 588

egress monitoring, 588-589

IDSs, 587

SIEM, 588

personal security, 645-647

physical security, 640-644

recovery

BCP, 639-640

strategies, 618-633

testing plans, 637-639

resource provisioning, 589-592

asset inventory, 590-591

configuration management, 592-593

resources, 602, 605, 608, 611, 614, 617

asset management, 599-603, 606-607

change management, 618

incident management, 608-612

patch management, 617

protection, 597-599

threat prevention, 612-617

software development, 684-686

operators, 259-260

opinion evidence, 576

optimizing, 89

Orange Book, 206, 615, 694

organizational code of ethics, 54

organizational security policies, 56

organizational strategies, 10

orthogonal frequency division multiple access (OFDMA), 383

orthogonal frequency division multiplexing (OFDM), 382

OSI (Open Systems Interconnection) models, 335-338

OSPF (Open Shortest Path First), 414

OSSTMM (Open Source Security Testing Methodology Manual), 106

outages, 66, 319

over-the-shoulder code review, 547

overflow buffers, 520, 697

OWASP (Open Web Application Security Project), 244, 687

ownership

asset security, 143, 160-161

factor authentication, 488-489

P

packet creation, 336

packet-switching networks, 432

pair programming code review, 547

PAN (personal area network), 372

parallel tests, 639

paraphrase passwords, 486

parity information, 602

partial-knowledge tests, 540

passing tokens, 430

passive infrared (PIR) systems, 642

passive vulnerability scanners. See PVSs

passwords

managing, 485-488

NIST Special Publication (SP) 800-63, 481-484, 487

threats, 517

PASTA methodology, 117

PAT (port address translation), 351, 377

patch management, 617

patch panels, 397

patent law, 40

Path Maximum Transmission Unit Discovery. See PMTUD

paths, trusted, 616

patrol force, 644

PBX (private branch exchange), 405, 434

PCI DSS Version 3.2, 216

Pearson Test Prep practice test engine, 713-715

customizing, 715

memory tables, 717

review tools, 717

study plans, 717-718

updating, 716

peer-to-peer computing vulnerabilities, 237

penetration testing, 539-545

perimeter intrusion detection, 642

perimeter security, 640, 694