Foreword xxiii

Introduction xxv

Chapter 1: Security Operations and Administration 1

Comply with Codes of Ethics 2

Understand, Adhere to, and Promote Professional Ethics 3

(ISC)2 Code of Ethics 4

Organizational Code of Ethics 5

Understand Security Concepts 6

Conceptual Models for Information Security 7

Confidentiality 8

Integrity 15

Availability 17

Accountability 18

Privacy 18

Nonrepudiation 26

Authentication 27

Safety 28

Fundamental Security Control Principles 29

Access Control and Need-to-Know 34

Job Rotation and Privilege Creep 35

Document, Implement, and Maintain Functional Security Controls 37

Deterrent Controls 37

Preventative Controls 39

Detective Controls 39

Corrective Controls 40

Compensating Controls 41

The Lifecycle of a Control 42

Participate in Asset Management 43

Asset Inventory 44

Lifecycle (Hardware, Software, and Data) 47

Hardware Inventory 48

Software Inventory and Licensing 49

Data Storage 50

Implement Security Controls and Assess Compliance 56

Technical Controls 57

Physical Controls 58

Administrative Controls 61

Periodic Audit and Review 64

Participate in Change Management 66

Execute Change Management Process 68

Identify Security Impact 70

Testing/Implementing Patches, Fixes, and Updates 70

Participate in Security Awareness and Training 71

Security Awareness Overview 72

Competency as the Criterion 73

Build a Security Culture, One Awareness Step at a Time 73

Participate in Physical Security Operations 74

Physical Access Control 74

The Data Center 78

Service Level Agreements 79

Summary 82

Chapter 2: Access Controls 83

Access Control Concepts 85

Subjects and Objects 86

Privileges: What Subjects Can Do with Objects 88

Data Classification, Categorization, and Access Control 89

Access Control via Formal Security Models 91

Implement and Maintain Authentication Methods 94

Single-Factor/Multifactor Authentication 95

Accountability 114

Single Sign-On 116

Device Authentication 117

Federated Access 118

Support Internetwork Trust Architectures 120

Trust Relationships (One-Way, Two-Way, Transitive) 121

Extranet 122

Third-Party Connections 123

Zero Trust Architectures 124

Participate in the Identity Management Lifecycle 125

Authorization 126

Proofing 127

Provisioning/Deprovisioning 128

Identity and Access Maintenance 130

Entitlement 134

Identity and Access Management Systems 137

Implement Access Controls 140

Mandatory vs. Discretionary Access Control 141

Role-Based 142

Attribute-Based 143

Subject-Based 144

Object-Based 144

Summary 145

Chapter 3: Risk Identification, Monitoring, And Analysis 147

Defeating the Kill Chain One Skirmish at a Time 148

Kill Chains: Reviewing the Basics 151

Events vs. Incidents 155

Understand the Risk Management Process 156

Risk Visibility and Reporting 159

Risk Management Concepts 165

Risk Management Frameworks 185

Risk Treatment 195

Perform Security Assessment Activities 203

Security Assessment Workflow Management 204

Participate in Security Testing 206

Interpretation and Reporting of Scanning and Testing Results 215

Remediation Validation 216

Audit Finding Remediation 217

Manage the Architectures: Asset Management and Configuration Control 218

Operate and Maintain Monitoring Systems 220

Events of Interest 222

Logging 229

Source Systems 230

Legal and Regulatory Concerns 236

Analyze Monitoring Results 238

Security Baselines and Anomalies 240

Visualizations, Metrics, and Trends 243

Event Data Analysis 244

Document and Communicate Findings 245

Summary 246

Chapter 4: Incident Response and Recovery 247

Support the Incident Lifecycle 249

Think like a Responder 253

Physical, Logical, and Administrative Surfaces 254

Incident Response: Measures of Merit 254

The Lifecycle of a Security Incident 255

Preparation 257

Detection, Analysis, and Escalation 264

Containment 275

Eradication 277

Recovery 279

Lessons Learned; Implementation of New Countermeasures 283

Third-Party Considerations 284

Understand and Support Forensic Investigations 287

Legal and Ethical Principles 289

Logistics Support to Investigations 291

Evidence Handling 292

Evidence Collection 297

Understand and Support Business Continuity Plan and Disaster Recovery Plan Activities 306

Emergency Response Plans and Procedures 307

Interim or Alternate Processing Strategies 310

Restoration Planning 313

Backup and Redundancy Implementation 315

Data Recovery and Restoration 319

Training and Awareness 321

Testing and Drills 322

CIANA+PS at Layer 8 and Above 328

It Is a Dangerous World Out There 329

People Power and Business Continuity 333

Summary 333

Chapter 5: Cryptography 335

Understand Fundamental Concepts of Cryptography 336

Building Blocks of Digital Cryptographic Systems 339

Hashing 347

Salting 351

Symmetric Block and Stream Ciphers 353

Stream Ciphers 365

Eu Ecrypt 371

Asymmetric Encryption 371

Elliptical Curve Cryptography 380

Nonrepudiation 383

Digital Certificates 388

Encryption Algorithms 392

Key Strength 393

Cryptographic Attacks, Cryptanalysis, and Countermeasures 395

Cryptologic Hygiene as Countermeasures 396

Common Attack Patterns and Methods 401

Secure Cryptoprocessors, Hardware Security Modules, and Trusted Platform Modules 409

Understand the Reasons and Requirements for Cryptography 414

Confidentiality 414

Integrity and Authenticity 415

Data Sensitivity 417

Availability 418

Nonrepudiation 418

Authentication 420

Privacy 421

Safety 422

Regulatory and Compliance 423

Transparency and Auditability 423

Competitive Edge 424

Understand and Support Secure Protocols 424

Services and Protocols 425

Common Use Cases 437

Deploying Cryptography: Some Challenging Scenarios 442

Limitations and Vulnerabilities 444

Understand Public Key Infrastructure Systems 446

Fundamental Key Management Concepts 447

Hierarchies of Trust 459

Web of Trust 462

Summary 464

Chapter 6: Network and Communications Security 467

Understand and Apply Fundamental Concepts of Networking 468

Complementary, Not Competing, Frameworks 470

OSI and TCP/IP Models 471

OSI Reference Model 486

TCP/IP Reference Model 501

Converged Protocols 508

Software-Defined Networks 509

IPv4 Addresses, DHCP, and Subnets 510

IPv4 Address Classes 510

Subnetting in IPv4 512

Running Out of Addresses? 513

IPv4 vs. IPv6: Key Differences and Options 514

Network Topographies 516

Network Relationships 521

Transmission Media Types 525

Commonly Used Ports and Protocols 530

Understand Network Attacks and Countermeasures 536

CIANA+PS Layer by Layer 538

Common Network Attack Types 553

SCADA, IoT, and the Implications of Multilayer Protocols 562

Manage Network Access Controls 565

Network Access Control and Monitoring 568

Network Access Control Standards and Protocols 573

Remote Access Operation and Configuration 575

Manage Network Security 583

Logical and Physical Placement of Network Devices 586

Segmentation 587

Secure Device Management 591

Operate and Configure Network-Based Security Devices 593

Network Address Translation 594

Additional Security Device Considerations 596

Firewalls and Proxies 598

Network Intrusion Detection/Prevention Systems 605

Security Information and Event Management Systems 607

Routers and Switches 609

Network Security from Other Hardware Devices 610

Traffic-Shaping Devices 613

Operate and Configure Wireless Technologies 615

Wireless: Common Characteristics 616

Wi-Fi 624

Bluetooth 637

Near-Field Communications 638

Cellular/Mobile Phone Networks 639

Ad Hoc Wireless Networks 640

Transmission Security 642

Wireless Security Devices 645

Summary 646

Chapter 7: Systems and Application Security 649

Systems and Software Insecurity 650

Software Vulnerabilities Across the Lifecycle 654

Risks of Poorly Merged Systems 663

Hard to Design It Right, Easy to Fix It? 664

Hardware and Software Supply Chain Security 667

Positive and Negative Models for Software Security 668

Is Blocked Listing Dead? Or Dying? 669

Information Security = Information Quality + Information Integrity 670

Data Modeling 671

Preserving Data Across the Lifecycle 674

Identify and Analyze Malicious Code and Activity 678

Malware 679

Malicious Code Countermeasures 682

Malicious Activity 684

Malicious Activity Countermeasures 688

Implement and Operate Endpoint Device Security 689

HIDS 691

Host-Based Firewalls 692

Allowed Lists: Positive Control for App Execution 693