CISSP Notes Flashcards
Type of malware which can change or update a system’s kernel
Rootkit
Best practice when it comes to taking measures against a rootkit
Reinstall operating system
Type of self-sufficient malware
Worm
Malware which requires host-to-host transmission to work
Virus
Firewall rule placed at the top of the rulebase to drop direct connections to the firewall
Stealth rule
Attribute-based access control allows authorization through this type of condition
Environmental
Examples of environmental attributes in ABAC
Time of day, geolocation, network type
Subjects access _________
objects
Signing a document with your private key provides
Nonrepudiation
HMAC is associated with this high-level and fundamental security concept
Integrity
Users are allowed access to resources through a pre-determined template
Role-based access control
Firewall policies reflect this type of access control
Rule-based access control
Every object must have an owner
Discretionary Access Control
A more in-depth, granular, detailed, and fully tested evaluation provides ________
assurance
Determines the functionality of a product
Certification
Determining why to create the software and for what purpose
First phase of SDLC
Implementing proper disposal methods for software
Last phase of SDLC
A portion of software which is left unprotected and could provide a means for an attacker
Attack surface
How well the components of software work together per design specifications
Integration testing
Making sure the users verify the product operates as it should
User acceptance testing
Enter safe mode, recover files, validate operations
What to do after a system crash
Only allowing systems administrators to shut down critical systems
Reduce the possibility of denial of service
When processes should not be interrupted from receiving input to providing output
Atomic transactions
Type of codes which maintain the integrity of files
Message authentication code
Even if a report has no data, it should still say “no data to report”.
Input/output control
The default state of wiring closet doors.
Closed
When doors are opened during emergencies
Fail-safe
The estimated amount of time a device is meant to work reliably.
Mean time between failures
This should be implemented if the mean time to repair is too high on a device
Redundancy measures
The decision engine in this access control method is controlled by the operating system in highly classified computers
Mandatory Access Control
ACLs provide this type of RBAC, with no formal roles other than by the user themselves
Non-RBAC
An access control system fully defined by organizational roles, policies, and permissions for subjects to objects
Full RBAC
Attack from flaws in IP packet reassembly
Teardrop attack
10.1.2.0/23 and10.1.3.248/30
RFC 1918 Overlapping subnets
A product which provides IDS/IPS, DLP, firewall, antimalware, antispam services
Unified Threat Management
First thing to establish before any security control or project
The business need
Transferring workers to another organization’s workplace to use their infrastructure as a recovery agreement
Reciprocal agreement
Type of recovery site necessary for an MTD of 1 hour
Hot site
Type of recovery site necessary for an MTD of 12 hours
Warm site
Permissions and authorization rights are this type of control
Administrative
NIST 800-34
Contingency Guide Planning (good read for exam)
Who can declare an emergency?
Anyone
Who can declare a disaster?
BCP Coordinator
Read Shon Harris 7th Edition once, Sybex 3 times, Official CBK once
Study Tips
The best way to memorize something for the exam. It creates a visual placeholder in your brain.
Handwritten notes
Don’t let your dreams be dreams, achieve them with goals. Achieve them with three methods.
Discipline, dedication, consistency.
People taking the exam usually think they are going to fail. But they pass.
Just like you will.
A Cisco ASA firewall failing after 213 days of uptime
Example of mean time between failure
The more complex a device, program, or component
The less reliability
Data written across all drives increases write performance
Striping
Applying controls to better “suit” an environment beyond the recommended baseline
Tailoring
Eliminating unnecessary controls for an environment recommended by a baseline
Scoping
Applying minimum security controls as a reference point in an organization
Baseline
Pre-employment administrative detective control to gauge employee suitability
Background investigation
Most important action before applying updates or patches to a system in production
Backup
Type of knowledge that is a must for the CISSP exam
Inter-domain
The most stressful moments of the CISSP exam
First 10-15 minutes/questions
Port for SMTP
25
Practice CISSP questions most similar to the CISSP exam
CISSP Practice Questions, Fourth Edition, Shon Harris
A more secure way to remotely connect to servers instead of Telnet (Port 23)
SSH (Port 22)
Standards enforce a _________ environment
homogeneous
Form of API security to mitigate DOS
Rate-limiting
Those who direct the business and security efforts of an organization
Senior management
Structure to properly direct organizational business and security efforts
Security governance
Cost to support, repair, replace, manage, and administer an asset
Asset valuation
Framework which provides steps to match business goals with IT resources
COBIT
Access control method which uses classifications and utilized in government systems
Mandatory Access Control
Standard which rewards clean desk policies, proper documentation, security protocols and processes for information security management systems
ISO 27001
Security model which upholds integrity through the use of data items and well-formed transactions
Clark-Wilson
Access control method in which each object must absolutely have an owner
Discretionary Access Control
Inventors of the one of the first mathematical security models
David Elliot Bell and Leonard J. LaPadula
Risk mitigation should be considered at which stages of the system development life-cycle?
Every stage
Administrative control which aims to teach users about potential social engineering techniques and other types of risks
Security awareness training
Access control method which users a set with least upper bound and greatest lower bound
Lattice-based access control
A backup site to a backup site
Tertiary site
Renting a database program
Software as a Service
Renting an operating system
Platform as a Service
Renting a virtual firewall
Infrastructure as a Service
The use of shared resources among thousands of servers in thousands of data centers
Cloud computing
Document which outlines an appropriate level of service between a provider and a customer
Service Level Agreement (SLA)
Uptime, downtime, peak, average and failover times.
Common issues addressed in SLAs
Establishing a contract with a cloud service provider
Due care
Verifying controls are in place when forming a contract with a cloud service provider
Due diligence
Reports capable of verifying the controls used by vendors to ensure service delivery
Service Organization Control (SOC)
Virtualization spurned the invention of this technology
Cloud computing
Customer’s responsibility in Software as a Service
Data Security
Customer’s responsibility in Platform as a Service
Data classification
Customer’s responsibility in an Infrastructure as a Service
Access Control
Cloud service provider’s responsibility in a Software as a Service
Application Security
Cloud service provider’s responsibility in a Platform as a Service
Infrastructure Security
Cloud service provider’s responsibility in an Infrastructure as a Service
Physical Security
Companies or users who utilize the services offered by the cloud
Tenants
AWS and Microsoft Azure
Cloud service providers
Cloud service model which dedicates all services to one tenant
Private cloud
Type of cloud where multiple tenants use the same service
Community cloud
Type of cloud service which will allow you to throttle server CPU utilization if necessary
Infrastructure as a Service
Best way to secure data flowing from your organization and the cloud
Encryption
Sort of like policies
Directives
Takes over when primary controls have failed
Compensating controls
Controls which discourage those trying to subvert directives
Deterrent controls
Pours water out immediately after the suppression mechanism is triggered
Wet Pipe
Pipe system filled with compressed air
Dry pipe system
Bigger pipes, more water
Deluge system
Best type of water suppression system for computers and other electronics
Preaction system
Combination of a dry pipe/wet pipe system
Preaction system
Vulnerability which was the death of SSL
POODLE
Component of ABAC which makes it a unique type of access control method
Environmental attributes
Data state which can be secured by hard disk encryption
Data at rest
Data state which can be secured by TLS
Data in motion
Data state which can be secured by a proper a software development life cycle
Data in use
Used to assess the quality of software, but not the vendor which makes the software
Common Criteria
Used to assess the quality of a software vendor, but not the software the vendor makes
Capability Maturity Model Integration
A form of non-discretionary based access control
Mandatory Access Control
Can be used on top of role-based access control
Rule-based access control
Evaluation method which preceded the Common Criteria
TCSEC (Trusted Computer System Evaluation Criteria)
A set of categorized basic security requirements to evaluate a specific type of system
Protection Profile
Documentation and paperwork to prove the functionality and assurance of a system
Security Target
The product of a Common Criteria security evaluation
Target of Evaluation
Hiding an invention such as custom encryption and thinking attackers won’t ever break it
Security through obscurity
The theory that transistors on a microchip will grow exponentially making old encryption algorithms breakable
Moore’s Law
Encrypting data on a hard drive instead of deleting it
Crypto erase
Overwriting sectors on a hard drive
Overwriting
Media which cannot be degaussed
Solid state drives
Method of calculating the different ways a system can experiences faults and lower reliability and safety
Fault-tree analysis
Technology used to control physical components of industrial environments
Industrial control systems
Trusting your friend and your friend’s friend with data
Transitive trust
Trusting your friend and only your friend with data
Non-transitive trust
FTPS and SMTPS
Protocols which use Transport Layer Security
What to do the night before the exam
Get at least 8 hours of sleep
Bundle of functional and assurance requirements
Common Criteria EALs
Software, encryption algorithms, key management, applications, TPMs
A cryptosystem
Encryption cipher which uses the natural world and the elements within it for the key
Running key cipher
Less mathematical computations than public key cryptography
Symmetric encryption
Probably the only stream cipher you need to know for the CISSP exam
RC4
Random values used at the beginning of a keystream or algorithm
Initialization Vectors
Signing a document with a private key provides nonrepudiation and also this
Authentication
A symmetric key used one time to secure the communication channel for data
Session key
Supports 14 rounds of encryption if both the key and block sizes are 256 bits
Rijndael 256
Cryptographic keys should never be in cleartext outside the system’s trusted memory location
Key management principle
Unique private key within a TPM and a public key to authenticate the TPM
Endorsement Key
