CISSP1A.txt

Minimum and customary practic of responsible protection of assets

• Preventive
• Detective
• Corrective

• Confidentiality, Integrity and Availability
• vs.
• Disclosure, Alteration and Destruction

• FTP Port 21
• SSH Port 22
• Telnet Port 23
• HTTP Port 80
• HTTPS Prt 443
• SMTP Port 25

• 1. Security & Risk Management
• 2. Asset Security
• 3. Security Engineering
• 4. Communications & Network Security
• 5. Identity and Access Management
• 6. Security Assessment & Testing
• 7. Security Operations
• 8. Software Development Security

• ATA Secure Erase
• Physical destruction

• But not:
• Format drive
• sector by sector overwrite
• Delete all files
• Degaussing

Establishes, tests or reconciles a user's identity.

Deals with the rights and permissions granted to an individual or process that enable access to a computer

systems ability to determine the actions of a user. Shows that a particular individual performed an action thur audit trails and logs.

Threat x Vulnerabilty

A framework with a command shell and dynamic payloads.

Easier to prove with preventive controls

Hard to justify with basic TCO and ROI

defines the technical security requirements when connecting two organizations together. Supports a Memorandum of Understanding.

Operationally Critical Threat, Asset and Vulnerability Evaluation

Common Vulnerability Scoring System

• Base
• Temporal
• Environmental

Base includes: Access Vector, Access Complexity, Authentication, Confidentiality, Integrity and Availability impacts

Smash the stack

Exploits the gap between the time a security check is applied and the time the code is executed. Also called Time of check/time of use.

• Masquerading
• Replay attack
• Spoofing

Lying about who you are

CAM Flood (content addressable memory table)

requires a carrier to spread

Spreads independently; infects one system, then many

Appears benign (overtly) but has a covert malicious function

a collection of compromised hosts controlled by a bot herder

Service side attack; initial SYN sent by the attacker

Victim initiates the attack by downloading malicious content

EMI leaving a system; study of these Compromising Emanations is through TEMPEST

results in monetary penalties or prison

Beyond a reasonable doubt

Punitive or compensatory damages but no prison

Tort law

Preponderance of evidence

HIPAA etc.

• white collar/financial fraud
• corporate espionage
• hacking
• stalking
• child porn
• organized crime
• terroism
• identity theft
• social engineering
• insider theft

• United Nations
• The G8 nations
• Mutual Legal Assistance Treaties
• European Union Border Controls (Interpol)

20 year property right for the inventor; effective only in the US and territories

right to exclude others from making, using, offering for sale, selling or importing the invention

Form of expression (rather than the subject)

mark is also called a servicemark (for services) while a trademark is for goods

good indefinitely

IP that is not publicly available

covered by an NDA

must be proven to be protected to have any recourse

Software with limited functionality

requires govt to keep information on individuals private and protected

OECD (Organization for Economic Cooperation and Development) PLUS

European Union Data Protection Directive

• IAB (Internet Activities Board)
• Computer Ethics Institute
• Association for Computing Machinery (ACM)
• Institute of Electrical and Electronics Engineers (IEEE)
• Information Systems Audit and Control Association (ISACA)
• International Information Systems Security Certification Consortium (ISC)2

Directive controls

High level guidance

mandatory

change infrequently but may be added to

• speed limit signs
• more detailed than policies
• focused on how to achieve
• should change frequently

security configuration

• mandatory
• specific
• specifies a certain way of doing something

Baseline is a specific implementation of a standard

• suggestion
• assists users
• not compulsory

• Policy - tells a user what to do
• Training - provides the skill set
• Awareness - changes user behavior