CISSP Domain 3 v2 Complete

Certified
Information
Systems
Security
CISSP ® Professional
Domain 3
(©) Copyright ThorTeaches 2018 -
1
CISSP® - Certified Information Systems Security Professional
DOMAIN 3: Software Development Security.
Welcome to the third CBK Domain.
 In this chapter we focuses on how we protect our assets.

 Security Architecture and Design:
 Cryptography:
 Physical Security
 CBK 3 makes up 13% of the exam questions, being so broad it contains close to 25%
of the exam materials.

2
Security Models Fundamental Concepts:
https://www.cybrary.it/video/part-05-security-models-and-access-control-models/

3

Security models provide the rules for how we secure our data, while focusing on
different goals and what they provide.
 DAC - (Discretionary Access Control)
 MAC - (Mandatory Access Control)
 RBAC - (Role Based Access Control)
 ABAC - (Attribute Based Access Control)
Attributes could be:
 Subject (user)
 Object (resource)
 Environment
 RUBAC - (Rule Based Access Control)
Shon Harris 8th
(©) Copyright ThorTeaches 2018 - Ed. Page 315 4

 Bell-LaPadula: (Confidentiality) (Mandatory Access
Control):
 Simple Security Property “No Read UP”
 Security Property: "No Write DOWN”
 Strong Property: "No Read or Write UP and DOWN".

5

 BIBA: Integrity (Mandatory Access Control):
 Simple Integrity Axiom: "No Read DOWW”.
 Integrity Axiom : "No Write UP".
 Invocation Property: "No Read or Write UP".

6

 Lattice Based Access Control (LBAC) (MAC):
 A subject can have multiple access rights.
 A Subject with TopSecret" {crypto, chemical}

 A Subject with Secret" {crypto}
 A subject with "Top Secret" {chemical}
Shon Harris 8th


 Graham-Denning Model
 The 8 rules that a specific subject can execute on an object are:
1. Transfer Access.
2. Grant Access.
3. Delete Access.
4. Read Object.
5. Create Object.
6. Destroy Object.
7. Create Subject.
8. Destroy Subject.
Shon Harris 8
th

 HRU model (Harrison, Ruzzo, Ullman).
 Uses six primitive operations:

 Create object.
 Create subject.
 Destroy subject.
 Destroy object.
 Enter right into access matrix.
 Delete right from access matrix.
Shon Harris 8th
Security Models Fundamental

Concepts:
 Clark-Wilson – Integrity.
 Separation of duties.
 Well-formed transactions.
Shon Harris 8th

Concepts:
 Brewer-Nash (Chinese Wall or Information

Barriers)
 Non-Interference Model
Shon Harris 8th


Concepts:
 Take-Grant Protection Model:
 It has 4 rules:
 Take rule
 Grant rule
 Create rule
 Remove rule
Think of MS AD
(©) Copyright ThorTeaches 2018 - security! 12
 Access Control Matrix:

 One row per subject.
 One column per object.

13
Security Models
Fundamental
Concepts:
 Zachman Framework (for
Enterprise Architecture):
 Provides Six Frameworks
 Mapping those
frameworks to rules.
Shon Harris 8th


 Security Modes- can be MAC or DAC (Mandatory or
Discretionary Access Control):
 The mode is determined by:
Type of users, type of data, type of levels of users
 Dedicated security mode - All users must have …

15

 Security Modes:
 System high security mode – All users must have …
Shon Harris 8th Ed.

(©) Copyright ThorTeaches 2018 - Page 315 & 804
16
 Security Modes:
 Compartmented security mode - All users must have:
 Multi level security mode - (Controlled Security Mode)- All
users must have:

17
Evaluation Methods, Certification and

Accreditation:
 Choosing the security systems and products we
implement in our organization can be a daunting task.
 There are many evaluation models in use today.
 The earliest one, which most security models are based
on today is "The Orange Book" - The Trusted
Computer System Evaluation Criteria -(TCSEC).

18
Evaluation Methods, Certification and Accreditation:

 ITSEC (The European Information Technology Security Evaluation
Criteria)
 The International Common Criteria (ISO/IEC 15408).

 Target Of Evaluation (TOE)
 Protection Profile (PP)
 Security Target (ST)

19

Accreditation:
 The International Common Criteria (ISO/IEC 15408):
 Evaluation Assurance Level (EAL)
Shon Harris 8th Ed.

(©) Copyright ThorTeaches 2018 - Page 322
20

Accreditation:
 EAL Levels l-7:
 EAL1: Functionally Tested.
 EAL2: Structurally Tested.
 EAL3: Methodically Tested and Checked.
 EAL4: Methodically Designed, Tested and Reviewed
 EALS: Semi-formally Designed and Tested.
 EAL6: Semi-formally Verified Design and Tested.
 EAL7: Formally Verified Design and Tested.
Shon Harris 8th Ed.
21
Secure System Design Concepts:

 Layering: Separates hardware and software
functionality into layers.
 Abstraction: Hiding unnecessary details from the
user.

22
Secure System Design Concepts:

 Security Domains
 Kernel mode (Supervisor mode)
 User mode (Problem mode)
 Open and closed systems:

 Open systems
 Closed Systems

23
Secure System Design

Concepts:
 Security Domains:
 The Ring Model.
Shon Harris 8th Ed.

24
Secure Hardware
Architecture:
 System unit.
 Motherboard.
 Peripherals.
 Regular computer bus.

25
Secure Hardware Architecture:

 Northbridge and Southbridge
 This design is more common on newer
computers and replaces the regular
computer bus.

26
 CPU (Central Processing Unit).

 Arithmetic logic unit (ALU)
 Control unit (CU)

27
 Computer Architecture CPU video:
https://www.cybrary.it/video/part-03-computer-architecture-cpu/

28

 CPU (Central Processing Unit)
 Fetch .
 Decode.
 Execute
 Store
 Pipelining

29

 CPU (Central Processing Unit):
 Interrupt.
 Processes and Threads:

 Process.

30

 CPU (Central Processing Unit)
 Processes and Threads:
 Thread

31

 Multithreading, Processing, Tasking and Programming.
 Multithreading.
 Multiprocessing.
 Multitasking.
 Multiprogramming.

32

 Memory protection
 Process isolation
 Hardware segmentation
 Virtual Memory
 Swapping
 Paging

33
Question:
 In which order does the CPU process work?
A. Fetch, decode, store, execute.
B. Execute, fetch, decode, store.
C. Fetch, decode, execute, store.
D. Fetch, execute, decode, store.

Question:
 In which part of the computer are all the calculations
done?
A. ALU.
B. ROM.
C. CU.
D. CPU.

Question:
 When a computer uses more than one processor at a time
for a task, it is called what?
A. Multithreading.
B. Multiprocessing.
C. Multitasking.
D. Multiprogramming.

Secure Hardware
Architecture:
 BIOS- Basic Input Output System
(Low level OS)
 WORM Media (Write Once Read
Many)

33
Question:
 When we talk about WORM media, what are we referring to?
A. RAM.
B. R DVD’s
C. Hard disks.
D. EEPROM.

 TPM (Trusted Platform Module).

 Data Execution Prevention (DEP).
 Address Space Layout Randomization (ASLR).

34
Secure OS and Software Architecture:

 The Kernel
 A monolithic kernel
 Microkernels are modular kernels.
 The reference monitor is a core function of
the kernel.

35
Question:
 What handles all access between objects and subjects in
the computer kernel?
A. Supervisor mode.
B. Reference monitor.
C. Super user mode.
D. User mode.

Secure OS and Software

Architecture:
 Users and File Permissions
 Linux/UNIX
 Windows NTFS (New Technology File

System)

36
Virtualization and Distributed Computing:

 Virtualization poses a whole new set of standards, best
practices and security concerns.
 Virtualization holds a ton of benefits.
Shon Harris 8th Ed.

37
Virtualization and
Distributed Computing:
 Virtualization:
 Hypervisor

38
Virtualization and Distributed

Computing:
 Virtualization:
 Virtualization also poses new
vulnerabilities
 VM Escape (Virtualization escape)
 Hypervisor Security
 Resource Exhaustion
39

 Cloud Computing - (There is no 'Cloud' it is just another
computer somewhere else).
 Cloud Computing can be divided into 3 main types:

 Private Cloud Computing
 Public Cloud Computing
 Hybrid Cloud Computing
40
Virtualization and Distributed

Computing:
 Cloud Computing Public Cloud
Computing
 Platforms are normally offered as:
 IaaS - (Infrastructure as a Service).
 SaaS - (Software as a Service).
 PaaS - (Platform as a Service).

41
Question:
 We are using cloud computing and have chosen to use
IaaS. Who is responsible for the databases?
A. The security team.
B. The customer.
C. The network team.
D. The vendor.


 Grid Computing- can make use of resources not currently in
use from 100 or 100,000's of computers to perform very
complex tasks.
 Peer to Peer (P2P) -Any system can be a client and/or a

server.

42

 Thin Clients (Boot sequence- BIOS> POST> TCP/IP > BOOTP
or DHCP).
 Diskless Workstation (Diskless node).
 Thin Client Applications.

43

 The Internet of Things (IoT).
 It is really anything 'Smart": Smart TVs, Thermostats,
Lightbulbs, Cars, anything that connects to the internet
in some way (that didn't before).
Shon Harris 8th Ed.

44
System Vulnerabilities, Threats and

Countermeasures.
 Emanations - Often Electromagnetic Emanations.
 Covert Channels
 Covert Timing Channels: Operations that affect the "real
response time observed" by the receiver.
 Covert Storage Channels: Hidden information through the
modification of a stored object.
Shon Harris 8th Ed.
45

Countermeasures.
 Covert Channels.
 Steganography.
 Digital Watermarks.
Shon Harris 8th Ed.

46
System Vulnerabilities, Threats and Countermeasures.

 Malware (Malicious Code)
 Viruses
 Macro (document) viruses.
 Boot Sector viruses.
 Stealth Viruses.
 Polymorphic Viruses.
 Multipart (Multipartite) Viruses.
Shon Harris 8th Ed.

(©) Copyright ThorTeaches 2018 - Page 871-873
47
System Vulnerabilities, Threats and Countermeasures.

 Malware (Malicious Code):
 Worms.
 Trojans.
 Rootkits.
 Logic Bombs.
 Packers.
 Antivirus Software.
 Signature based.
 Heuristic (Behavioral) based.
48
Question:
 When would a logic bomb go off?
A. As soon as it is introduced to the system.
B. When it has infected the entire network.
C. A certain event happens or at a certain time.
D. When the system gets internet access.

Question:
 Which type of malware is embedded in another normal
program?
A. Trojans.
B. Worms.
C. Rootkits..
D. Logic bombs.


Countermeasures.
 Malware (Malicious Code):
 Server (Service) Side Attacks.
 Client Side Attacks.

49
Web Architecture and Attacks.

The internet is a very complex place. Security is often added on
as an afterthought and not designed in as it should be.
 Applets.
 Java applets.
 ActiveX.

50
Web Architecture and Attacks
 OWASP (Open Web Application Security Project).

 A1- A10.

51
Web Architecture and Attacks.
 XML (Extensible Markup Language).

 SOA (Service-Oriented Architecture).

52
Database Security
 Poly instantiation (Alternative Facts).
 Aggregation.
 Inference.
 Data mining.
 Data Analytics.
 Defense in Depth (again).

53
Question:
 You hear a colleague talk about polyinstantiation. What does that
mean?
A. Looking at a normal baseline and learning of new factors on the
network from higher traffic.
B. Two or more instances of the same data, depending on who
accesses it.
C. Collecting data to analyze it.
D. Deducing facts from data rather than specific statements.

Mobile Security:
 The more external devices we connect, the more complex
policies, procedures and standards we need.
 Mobile devices.
 Good security policies.
 Cell phones.
Shon Harris 8th Ed.

54
 Mobile Security:
 Laptops, Smartphones and
Tablets
 BYOD (Bring Your Own Device)
 On/off boarding
Shon Harris 8th Ed.

55
Industrial Control System

 ICS- (Industrial Control System).
 SCADA (Supervisory Control And Data Acquisition).
 DCS (Distributed Control Systems).
 PLC (Programmable Logic Controllers).
Shon Harris 8th Ed.

56
Industrial Control System

 ICS
 SCADA
 DNP3 (Distributed Network
Protocol).

57
Cryptography - the science of secure

communication.
 For the exam, what you need to know is that cryptography
helps with:
 Confidentiality
 Integrity
 Authentication
 Modular Math.
Shon Harris 8th Ed.
58

communication.
 Definitions:
 Cryptology.
 Cryptography.
 Cryptanalysis.
 Cipher.
59

communication.
 Definitions:
 Plaintext (Clear text).
 Ciphertext.
 Encryption.
 Decryption.
 Book Cipher.
 Running-Key Cipher.
60
Cryptography
 Mono and Polyalphabetic
Ciphers:
 Monoalphabetic Ciphers.
 Polyalphabetic Ciphers
 Frequency Analysis

61
Cryptography.
 Exclusive Or (XOR)
 Confusion.
 Diffusion.
 Substitution.
 Permutation (transposition).

62
 History of Cryptography video:

https://www.cybrary.it/video/part-08-history-of-crypto/

63
Cryptography
 The history of Cryptography
 Spartan Scytale (Stick).
 Caesar Cipher
(Substitution).

64
Cryptography
 The Vigenère cipher.
 The alphabet.

65
Cryptography.
 The history of Cryptography.
 Cipher Disk.
 Enigma - Rotary based.
 Purple (US name).

66
Cryptography
 The history of Cryptography:
 One-Time Pad.
 Vernam Cipher (The first known use
of a one-time pad).
 Project VENONA.

67
Cryptography.
 The History of Cryptography:
 The Jefferson Disk (Bazeries Cylinder)-
is a cipher system using a set of wheels
or disks, each with the 26 letters of the
alphabet arranged around the edge.

68
Cryptography
 SIGABA.

69
Cryptography
With the common use of Cryptography/ many governments
realized how important it was that cryptographic algorithms
were added to export restrictions in the same category as
munitions.
 COCOM (Coordinating Committee of Multilateral Export
Controls).
 Wassenaar Arrangement - 1996 -present.
70
 Symmetric vs Asymmetric Cryptography video:
https://www.cybrary.it/video/part-14-symmetric-vs-asymmetric-cryptography/

71
Cryptography
 Asymmetric vs Symmetric Encryption and Hybrid:
 Asymmetric:
Pros & Cons
 Symmetric:
Pros & Cons
 Hybrid Encryption.
Shon Harris 8th Ed.

72
Cryptography
Symmetric Encryption:
 DES - Data Encryption Standard (Single DES).
 ECB (Electronic Code Book).
 CBC (Cipher Block Chaining).

73
Cryptography
Symmetric Encryption
 DES (Continued):
 CFB (Cipher Feedback).
 OFB (Output Feedback).
 CTR (Counter).

74
Cryptography
 3 DES (Triple DES).
 IDEA (International Data Encryption Algorithm).

75
Question:
 When we are using frequency analysis, what are we looking
at?
A. How often messages are sent.
B. How often pairs of letters are used.
C. How many messages are sent.
D. How often certain letters are used.

Question:
 We are talking about implementing new encryption in our
organization. Which of these would be TRUE about IDEA?
A. It is a 64 bit block cipher, with 56 bit keys.
B. It is a 128 bit block cipher with 128, 192 or 256 bit keys.
C. It is a 64 bit block cipher with a 112 bit key.
D. It is a 64 bit block cipher with a 128 bit key.

Cryptography
 AES - Advanced Encryption Standard
(Rijndael).
 Initial Round:
 Add Round Key.

76
Cryptography
 AES
 Rounds:
 Sub Bytes
 Shift Rows
 Mix Columns
 Final Round (no Mix Columns).

77
Cryptography
 AES.

78
Cryptography
 Blowfish - publish domain.
 Two fish.
Shon Harris 8th Ed.

79
Cryptography
 Feistelcipher (Feistel network):
 Feistelor modified Feistel
Algorithms.
 Generalized Feistel Algorithms.

80
Cryptography
Symmetric Encryption
 RC4.
 RCS.
 RCG - AES3 Finalist.
Shon Harris 8th Ed.

81
Cryptography
 Asymmetric Encryption (Public Key Encryption)
 Asymmetric Encryption uses 2 keys: a Public Key and a
Private Key (Key Pair).
 Public Key.
 Private Key.

82
Question:
 We are looking at implementing a new type of symmetric encryption.

Which of these symmetric encryption types are no longer considered
secure, and should be something we should NOT consider?
A. Twofish.
B. 3DES K1.
C. RC4.
D. AES.

Question:
 We have 100 users all needing to communicate with each
other. If we are using asymmetric encryption how many
keys would we need?
A. 200
B. 100
C. 2000
D. 4950

Cryptography
Asymmetric Encryption
 Prime Number Factorization.
 Discrete logarithms.

83
Cryptography
Asymmetric Encryption.
 RSA cryptography.
 RSA-704.

84
Cryptography
Asymmetric Encryption:
 Diffie-Hellman (DH).
 Elliptic Curve Cryptography (ECC).

85
Cryptography
Asymmetric Encryption:
 EIGamal
 DSA (Digital Signature Algorithm).
 Knapsack (Merkle-Hellman knapsack cryptosystem) is one-
way.

86
 Cryptography
 Hash Functions (One-Way Hash Functions).
 Collisions.
 MDS (Message Digest 5).
 MD6 (Message Digest 6).

87
 Cryptography
 Hash Functions.
 Hash#1 is the original.
 Hash#2 is with 1comma
removed.

88
 Cryptography
 Hash Functions:
 SHA1(Secure Hash Algorithm 1).
 SHA2 (Secure Hash Algorithm 2).
 SHA3 (Secure Hash Algorithm 3).
 HAVAL(Hash of Variable Length).

89
Cryptography
 Hash Functions:
 RIPEMD.
 RIPEMD160.

90
Cryptography
 Hash Functions:
 Salt (Salting).
 Nonce: (arbitrary number that
may only be used once).

91
Question:
 Which of these countermeasures would be effective against
rainbow tables?
A. Key stretching.
B. Salting.
C. Limiting long attempts.
D. Keeping hashes in plaintext.

Cryptography
 Cryptographic Attacks:
 Steal the Key.
 Brute Force.
 Key stretching.
 Digraph attack.

92
Cryptography
 Man-in-the-Middle Attack (MITM).
 Session Hijacking (TCP Session
Hijacking).

93
Cryptography
 Social Engineering
FREE ICECREAM!
A very successful social engineering
attack was a Pen-Test company
driving up in front of a company
office with "Free Ice Cream”.

94
Cryptography
 Rainbow Tables.
 Known Plaintext.
 Chosen Plaintext.
 Adaptive Chosen Plaintext.
 Meet-in-the-Middle.

95
Cryptography
 Cryptographic Attacks
 Known Key.
 Differential Cryptanalysis.
 Linear Cryptanalysis.
 Differential Linear Cryptanalysis.

96
Cryptography
 Side Channel Attacks.
 Implementation Attacks.
 Key Clustering.

97
Cryptography
 Implementing Cryptography:
 PKI (Public Key Infrastructure).
 Key Escrow.

98
Cryptography
 Digital Signatures.

99
Question:
 When we have our private and public keys in key escrow, what does
that mean?
A. The public key available to everyone.
B. The private key I have on my system.
C. The server we keep our public and private keys on.
D. Someone keeping a copy of our keys. often law enforcement.

Cryptography
 Digital Signatures.
 CA (Certification Authority).
 ORA (Organizational Registration Authorities).

100
 Cryptography
 Digital Signatures:
 Digital certificates (continued):
 CRL (Certification Revocation List).
 OCSP (Online Certification Status Protocol).
 The Clipper chip.

101
Question:
 What can we use digital signatures to provide?
A. Confidentiality.
B. Availability.
C. Authentication.
D. Non-repudiation.

Question:
 A senior VP stops you in the cafeteria because you are one of those IT
people. She asks you questions about Public Key Infrastructure (PKI).
After you explain it at a high level, they ask for more detail. You could
tell them PKI uses which of these?
A. Asymmetric encryption.
B. Hashes.
C. Symmetric encryption.
D. All of these.

Question:
 The NSA wanted to embed the clipper chip on all
motherboards. Which encryption algorithm did the chip
use?
A. DSA,
B. RSA.
C. Skipjack.
D. 3DES.

Question:
 Jane is talking to a friend and is explaining what digital
signatures do. Which of these could be something that she tells
her friend is one of the MAIN reasons we use digital signatures?
A. Authentication.
B. Availability.
C. Integrity.
D. Confidentially.

 Cryptography
 MAC (Message Authentication Code).
 HMAC (Hashed Message Authentication Code).

102
Cryptography
 SSL and TLS
 SSL(Secure Socket layer)
 TLS (Transport layer
Security).

102
 IPSEC videos:
 Part 1: https://www.cybrary.it/video/part-19-ipsec-part-i/
 Part 2: https://www.cybrary.it/video/part-20-ipsec-part-ii/

104
Cryptography
 IPSEC (Internet Protocol Security).
 AH and ESP.
 AH (Authentication Header).
 ESP (Encapsulation Security Payload).

105
Cryptography
 IPSEC.
 SA (Security Association).
 ISAKMP (Internet Security And Key Management Protocol).
 Tunnel mode.
 Transport mode.

106
Cryptography
 Implementing Cryptography.
 IPSEC (continued).
 IKE (Internet Key Exchange).

107
Cryptography
 Pretty Good Privacy (PGP):
 MIME (Multipurpose Internet Mail Extensions).
 S/MIME (Secure/MIME).

108
Question:
 In which of these protocols, is IPSEC built into and NOT added on

later?
A. IPv4.
B. PGP.
C. IPv6.
D. HMAC.

Physical Security
 As part of physical security we also design "Design-in-Depth" into our
plan.
 Preventative Controls - Prevents action from happening
 Detective Controls - Controls that detect an attack
 Deterrent Controls - Controls that deter an attack
 Compensating Controls - if others too costly
 Administrative Controls - administrative framework
Shon Harris 8th Ed.
109
• Perimeter defense:
•Fences (Deterrence, Preventative).
•Gates (Deterrence, Preventative).
•ATSM Standard:
Class I - IV

110
Physical Security
 Perimeter defense:
 Bollards (Preventative).
 Lights (Detective and Deterrence).

111
Question:
 What could be a type of physical access control that we
would use, to prevent cars and vans from entering our
perimeter?
A. Motion sensors.
B. Cameras.
C. Bollards.
D. Lights.

Physical Security
 CCTV (Closed Circuit Television).
 Older cameras.
 Modern cameras.

112
Question:
 We are implementing passive monitoring in our data center. We have

chosen to use infrared motion detectors. What do they use to detect
movement?
A. Heat.
B. Sound.
C. Light.
D. Pulses.

Physical Security
 Locks (Preventative).
 Key locks.
 Key Bitting Code (How far the key is
bitten down for that section).
 Pin Tumbler lock (or Yale lock).

113
Physical Security
 Locks (Preventative).
 Key locks (continued).
 Lock Picking.
 Lock Bumping.

114
Physical Security
 Locks (Preventative):
 Key locks (continued).
 Master Keys.
 Core Key.

115
Physical Security
 Locks (Preventative):
 Combination locks.

116
Physical Security
 Perimeter Defense:
 Smart Cards (contact or contactless):
 Contact Cards.
 Contactless Cards.
 Magnetic Stripe Cards.

117
Physical Security
 Perimeter Defense (continued):
 Tailgating/Piggybacking.
 Mantrap.
Shon Harris 8th Ed.

118
Physical Security
 Turnstiles (Preventative, Deterrence).

119
Physical Security
 Contraband Checks (Preventative/ Detective/ Deterrent).

120
Physical Security
 Motion Detectors (Detective, Deterrence).
 Ultrasound, Microwave, Infrared or Laser.

121
Question:
 Which type of ASTM standard gate could you have at your
house?
A. Class I.
B. Class IV.
C. Class III.
D. Class IX.

Question:
 When we are installing motion sensors, we are
implementing which type of control?
A. Administrative and detective.
B. Detective and deterrence.
C. Preventative and detective.
D. Deterrence and preventative.

Physical Security
 Perimeter Alarms.
 Door/window sensors.

122
Physical Security
 Walls, Floors, and Ceilings.

123
Physical Security
 Guards
 Professional Guards.
 Amateur Guards.
 Pseudo Guard.

124
Physical Security
 Dogs (Deterrent, Detective,
Compensating).

125
Physical Security
 Restricted Work Areas and Escorts.

126
 Site Selection, Design and
Configuration:
 Site Selection:
 Greenfield.
 Typography.
 Utilities.
 Crime.
127
Physical Security
 Site Selection, Design and
Configuration:
 Site Design:
 Site Marking.

128
Physical Security
 Site Selection, Design and Configuration:
 Shared Tenancy and Neighbors.

129
Physical Security
 Wiring Closets.
 Demarc- Point of Demarcation (POD).
Shon Harris 8th Ed.

130
Physical Security
 Server Rooms and Data Centers.
 Data Center Build or Expansion.

131
Physical Security
 Server Rooms and Data Centers.
 Data Center Build or Expansion
(continued):
 Power.
 Fire Suppression.

132
Physical Security
 Media Storage and Locations.

133
Physical Security
 Asset Tracking.
 Hardware Hardening.
 Disabling the USB Ports.

134
Question:
 When, in telecommunications, we talk about the Demarc, what are we

referring to?
A. You ensure all of the other tenants have full access to your
network equipment.
B. The servers are places to ensure faster speeds.
C. You place all your routers and switches.
D. The ISP terminates their line and your network begins.

Environmental Controls
 Electricity
 Power Fluctuation Terms:
 Blackout
 Fault
 Brownout
 Sag
 Surge
 Spike

135
 Electricity:
 Surge Protectors UPSs .
 Surge Protectors.
 UPSs.
 Generator.
 PDU.
136
 Electricity:
 EMI (Electromagnetic Interference).
Shon Harris 8th Ed.

137
 HCAC
 Heat.
 Pressure.
 Humidity.
Shon Harris 8th Ed.

138
 HCAC (continued):
 Drains.

139
 Static Electricity.
Antistatic Shoes.
Not the prettiest
thing I ever saw,
but effective!
140
 Heat, Flame, and Particle/Smoke Detectors.
 Heat Detectors.
 Smoke Detectors: (Ionization or Photoelectric).
 Flame Detectors.

141
Personnel Safety, Training and Awareness

 Personnel safety is always most important.

142
Personnel Safety, Training and

Awareness
 Personnel Safety:
 Early Warning Systems (Duress Warning
Systems).

143
ABCD Fires and Suppression

 Fire suppression.
 Removing Oxygen.
 Removing Heat.
 Removing Fuel.
Shon Harris 8th Ed.

144
ABCD Fires and

Suppression
 Fire Classes.
Shon Harris 8th Ed.

145

 Automatic Fire Suppression
Systems:
 Water.
 Sprinkler Systems.

146

 Automatic Fire Suppression Systems:
 Water:
 Sprinkler Systems (continued):
 Wet Pipe.
 Dry Pipe
 Deluge.
 Pre-Action.
147

 Automatic Fire Suppression Systems:
 Gases
 C02.
 Halon 130.

148
 ABCD Fires and

Suppression.
 Automatic Fire Suppression
Systems:
 Gases (continued).
 Argon.
 FE-13 (Fluoroform).
 FM-200 (HFC-227ea).
 lnergen. Shon Harris 8th Ed.
149

 Fire Suppression:
 Fire Extinguishers:
 Use the PASS method to extinguish a
fire with a portable fire extinguisher:
 Pull.
 Aim.
 Squeeze.
 Sweep.
150

 Fire Suppression:
 Fire Extinguishers (continued):
 Soda-Acid Extinguishers.
 Dry Powder Extinguishers.
 Wet Chemical(potassium acetate, potassium carbonate,
potassium citrate).

151
What we covered in the third CBK Domain.

 In this chapter we talked about how we protect our assets.
 How the domain has 3 major knowledge areas (prior to the 2015 exam
update, each had their own domain).
 Security Architecture and Design.
 Cryptography.

152

CISSP Domain 3 v2 Complete

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CISSP Domain 3 v2 Complete

Uploaded by

Copyright:

Available Formats

Certified

Welcome to the third CBK Domain.

 In this chapter we focuses on how we protect our assets.

(©) Copyright ThorTeaches 2018 -

Security Models Fundamental Concepts:

(©) Copyright ThorTeaches 2018 -

Security Models Fundamental Concepts:

Security Models Fundamental Concepts:

 Simple Security Property “No Read UP”

 Security Property: "No Write DOWN”

 Strong Property: "No Read or Write UP and DOWN".

(©) Copyright ThorTeaches 2018 -

Security Models Fundamental Concepts:

 Simple Integrity Axiom: "No Read DOWW”.

 Integrity Axiom : "No Write UP".

 Invocation Property: "No Read or Write UP".

(©) Copyright ThorTeaches 2018 -

Security Models Fundamental Concepts:

 A Subject with TopSecret" {crypto, chemical}

Shon Harris 8th

Security Models Fundamental Concepts:

Security Models Fundamental Concepts:

 Uses six primitive operations:

Security Models Fundamental

Security Models Fundamental

 Brewer-Nash (Chinese Wall or Information

Shon Harris 8th

Security Models Fundamental

Security Models Fundamental Concepts:

 Access Control Matrix:

(©) Copyright ThorTeaches 2018 -

Shon Harris 8th

Security Models Fundamental Concepts:

 Dedicated security mode - All users must have …

(©) Copyright ThorTeaches 2018 -

Security Models Fundamental Concepts:

 System high security mode – All users must have …

Shon Harris 8th Ed.

Security Models Fundamental Concepts:

(©) Copyright ThorTeaches 2018 -

Evaluation Methods, Certification and

(©) Copyright ThorTeaches 2018 -

Evaluation Methods, Certification and Accreditation:

 The International Common Criteria (ISO/IEC 15408).

(©) Copyright ThorTeaches 2018 -

Evaluation Methods, Certification and

Shon Harris 8th Ed.

Evaluation Methods, Certification and

Secure System Design Concepts:

(©) Copyright ThorTeaches 2018 -

Secure System Design Concepts:

 Open and closed systems:

(©) Copyright ThorTeaches 2018 -

Secure System Design

Shon Harris 8th Ed.

(©) Copyright ThorTeaches 2018 -

Secure Hardware Architecture:

(©) Copyright ThorTeaches 2018 -

Secure Hardware Architecture:

 CPU (Central Processing Unit).

(©) Copyright ThorTeaches 2018 -

 Computer Architecture CPU video:

(©) Copyright ThorTeaches 2018 -