CISSP Passport Bobby E.
Rogers
Visit to download the full and correct content document:
https://ebookmass.com/product/cissp-passport-bobby-e-rogers/
Mike Meyers’
A+
CISSP
CompTIA ® ®
CERTIFICATION
PASSPORT
PASSPORT SEVENTH
(Exams 220-1001 & 220-1002) EDITION
About the Author
Bobby Rogers (he/his/him) is a cybersecurity proessional with over 30 years in the inor-
mation technology and cybersecurity ields. He currently works with a major engineering
company in Huntsville, Alabama, helping to secure networks and manage cyber risk or its
customers. Bobby’s customers include the U.S. Army, NASA, the State o ennessee, and
private/commercial companies and organizations. His specialties are cybersecurity engineer-
ing, security compliance, and cyber risk management, but he has worked in almost every area
o cybersecurity, including network deense, computer orensics and incident response, and
penetration testing.
Bobby is a retired Master Sergeant rom the U.S. Air Force, having served or over 21 years.
He has built and secured networks in the United States, Chad, Uganda, South Arica, Germany,
Saudi Arabia, Pakistan, Aghanistan, and several other remote locations. His decorations
include two Meritorious Service medals, three Air Force Commendation medals, the National
Deense Service medal, and several Air Force Achievement medals. He retired rom active
duty in 2006.
Bobby has a master o science in inormation assurance and a bachelor o science in
computer inormation systems (with a dual concentration in Russian language), and two
associate o science degrees. His many certiications include CISSP-ISSEP, CRISC, CySA+,
CEH, and MCSE: Security.
Bobby has narrated and produced over 30 computer training videos or several training
companies and currently produces them or Pluralsight (https://www.pluralsight.com). He
is also the author o CompTIA Mobility+ All-in-One Exam Guide (Exam MB0-001), CRISC
Certiied in Risk and Inormation Systems Control All-in-One Exam Guide, and Mike Meyers’
CompTIA Security+ Certiication Guide (Exam SY0-401), and is the contributing author/
technical editor or the popular CISSP All-in-One Exam Guide, Ninth Edition, all o which are
published by McGraw Hill.
About the Technical Editor
Nichole O’Brien is a creative business leader with over 25 years o experience in cybersecurity
and I leadership, program management, and business development across commercial,
education, and ederal, state, and local business markets. Her ocus on innovative solutions is
demonstrated by the development o a commercial cybersecurity and I business group, which
she currently manages in a Fortune 500 corporation and has received the corporation’s annual
Outstanding Customer Service Award. She currently serves as Vice President o Outreach or
Cyber Huntsville, is on the Foundation Board or the National Cyber Summit, and supports
cyber education initiatives like the USSRC Cyber Camp. Nichole has bachelor’s and master’s
degrees in business administration and has a CISSP certiication.
Mike Meyers’
A+
CISSP
CompTIA ® ®
CERTIFICATION
PASSPORT
PASSPORT SEVENTH
(Exams 220-1001 & 220-1002) EDITION
Bobby E. Rogers
New York Chicago San Francisco Athens
London Madrid Mexico City Milan
New Delhi Singapore Sydney Toronto
McGraw Hill is an independent entity rom (ISC)²® and is not afliated with (ISC)² in any manner. Tis study/training guide and/or material is not
sponsored by, endorsed by, or afliated with (ISC)2 in any manner. Tis publication and accompanying media may be used in assisting students to
prepare or the CISSP exam. Neither (ISC)² nor McGraw Hill warrants that use o this publication and accompanying media will ensure passing any
exam. (ISC)²®, CISSP®, CAP®, ISSAP®, ISSEP®, ISSMP®, SSCP®, and CBK® are trademarks or registered trademarks o (ISC)² in the United States and
certain other countries. All other trademarks are trademarks o their respective owners.
Copyright © 2023 by McGraw Hill. All rights reserved. Except as permitted under the United States Copyright Act of 1976, no
part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system,
without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and
executed in a computer system, but they may not be reproduced for publication.
ISBN: 978-1-26-427798-8
MHID: 1-26-427798-9
The material in this eBook also appears in the print version of this title: ISBN: 978-1-26-427797-1,
MHID: 1-26-427797-0.
eBook conversion by codeMantra
Version 1.0
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trade-
marked name, we use names in an editorial fashion only, and to the benet of the trademark owner, with no intention of infringe-
ment of the trademark. Where such designations appear in this book, they have been printed with initial caps.
McGraw Hill eBooks are available at special quantity discounts to use as premiums and sales promotions or for use in corporate
training programs. To contact a representative, please visit the Contact Us page at www.mhprofessional.com.
Information has been obtained by McGraw Hill from sources believed to be reliable. However, because of the possibility of hu-
man or mechanical error by our sources, McGraw Hill, or others, McGraw Hill does not guarantee the accuracy, adequacy, or
completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such
information.
TERMS OF USE
This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights in and to the work. Use of this work
is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one copy of the
work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon, transmit,
distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill Education’s prior consent. You
may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to
use the work may be terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION AND ITS LICENSORS MAKE NO GUARANTEES
OR WARRANTIES AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED
FROM USING THE WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA
HYPERLINK OR OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUD-
ING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. McGraw-Hill Education and its licensors do not warrant or guarantee that the functions contained in the work will
meet your requirements or that its operation will be uninterrupted or error free. Neither McGraw-Hill Education nor its licensors
shall be liable to you or anyone else for any inaccuracy, error or omission, regardless of cause, in the work or for any damages
resulting therefrom. McGraw-Hill Education has no responsibility for the content of any information accessed through the work.
Under no circumstances shall McGraw-Hill Education and/or its licensors be liable for any indirect, incidental, special, punitive,
consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised of
the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or
cause arises in contract, tort or otherwise.
I’d like to dedicate this book to the cybersecurity proessionals who
tirelessly, and sometimes, thanklessly, protect our inormation and
systems rom all who would do them harm.
I also dedicate this book to the people who serve in uniorm as
military personnel, public saety proessionals, police, frefghters,
and medical proessionals, sacrifcing sometimes all that they are
and have so that we may all live in peace, security, and saety.
—Bobby Rogers
This page intentionally left blank
DOMAIN vii
Contents at a Glance
1.0 Security and Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2.0 Asset Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
3.0 Security Architecture and Engineering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
4.0 Communication and Network Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
5.0 Identity and Access Management (IAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
6.0 Security Assessment and esting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
7.0 Security Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
8.0 Sotware Development Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
A About the Online Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431
vii
This page intentionally left blank
DOMAIN ix
Contents
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxix
1.0 Security and Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Objective 1.1 Understand, adhere to,
and promote professional ethics . . . . . . . . . . . . . . . . . . . . . . . . . . 2
The (ISC)2 Code of Ethics 3
Code of Ethics Preamble 3
Code of Ethics Canons 3
Organizational Code of Ethics 4
Workplace Ethics Statements and Policies 4
Other Sources for Ethics Requirements 5
REVIEW 7
11 QUESTIONS 7
11 ANSWERS 8
Objective 1.2 Understand and apply security concepts . . . . . . . . . . . 9
Security Concepts 9
Data, Information, Systems, and Entities 9
Confidentiality 10
Integrity 11
Availability 11
Supporting Tenets of Information Security 11
Identification 11
Authentication 11
Authenticity 12
Authorization 12
Auditing and Accountability 12
Nonrepudiation 12
Supporting Security Concepts 13
ix
x CISSP Passport
REVIEW 14
12 QUESTIONS 14
12 ANSWERS 15
Objective 1.3 Evaluate and apply security governance principles . . . 16
Security Governance 16
External Governance 16
Internal Governance 16
Alignment of Security Functions to Business Requirements 17
Business Strategy and Security Strategy 17
Organizational Processes 18
Organizational Roles and Responsibilities 18
Security Control Frameworks 19
Due Care/Due Diligence 20
REVIEW 21
13 QUESTIONS 21
13 ANSWERS 22
Objective 1.4 Determine compliance and other requirements . . . . . . 23
Compliance 23
Legal and Regulatory Compliance 24
Contractual Compliance 25
Compliance with Industry Standards 25
Privacy Requirements 25
REVIEW 26
14 QUESTIONS 27
14 ANSWERS 28
Objective 1.5 Understand legal and regulatory issues that pertain to
information security in a holistic context. . . . . . . . . . . . . . . . . . . . 29
Legal and Regulatory Requirements 29
Cybercrimes 29
Licensing and Intellectual Property Requirements 30
Import/Export Controls 31
Transborder Data Flow 32
Privacy Issues 32
REVIEW 33
15 QUESTIONS 33
15 ANSWERS 34
Objective 1.6 Understand requirements for investigation types (i.e.,
administrative, criminal, civil, regulatory, industry standards) . . . 35
Investigations 35
Administrative Investigations 35
Civil Investigations 35
Contents xi
Criminal Investigations 36
Regulatory Investigations 36
Industry Standards for Investigations 37
REVIEW 37
16 QUESTIONS 38
16 ANSWERS 39
Objective 1.7 Develop, document, and implement security policy,
standards, procedures, and guidelines . . . . . . . . . . . . . . . . . . . . . 39
Internal Governance 40
Policy 40
Procedures 40
Standards 41
Guidelines 41
Baselines 42
REVIEW 42
17 QUESTIONS 43
17 ANSWERS 44
Objective 1.8 Identify, analyze, and prioritize Business Continuity (BC)
requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Business Continuity 45
Business Impact Analysis 46
Developing the BIA 46
REVIEW 47
18 QUESTIONS 47
18 ANSWERS 48
Objective 1.9 Contribute to and enforce personnel security policies
and procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Personnel Security 49
Candidate Screening and Hiring 49
Employment Agreements and Policies 50
Onboarding, Transfers, and Termination Processes 50
Vendor, Consultant, and Contractor Agreements and Controls 52
Compliance Policy Requirements 53
Privacy Policy Requirements 53
REVIEW 54
19 QUESTIONS 55
19 ANSWERS 56
Objective 1.10 Understand and apply risk management concepts . . . 57
Risk Management 57
Elements of Risk 57
Identify Threats and Vulnerabilities 59
xii CISSP Passport
Risk Assessment/Analysis 60
Risk Response 63
Risk Frameworks 64
Countermeasure Selection and Implementation 64
Applicable Types of Controls 65
Control Assessments (Security and Privacy) 66
Monitoring and Measurement 67
Reporting 67
Continuous Improvement 68
REVIEW 68
110 QUESTIONS 69
110 ANSWERS 69
Objective 1.11 Understand and apply threat modeling concepts and
methodologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Threat Modeling 70
Threat Components 70
Threat Modeling Methodologies 72
REVIEW 73
111 QUESTIONS 73
111 ANSWERS 73
Objective 1.12 Apply Supply Chain Risk Management
(SCRM) concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Supply Chain Risk Management 74
Risks Associated with Hardware, Software, and Services 74
Third-Party Assessment and Monitoring 76
Minimum Security Requirements 77
Service Level Requirements 77
REVIEW 77
112 QUESTIONS 78
112 ANSWERS 79
Objective 1.13 Establish and maintain a security awareness, education,
and training program. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Security Awareness, Education, and Training Program 80
Methods and Techniques to Present Awareness and Training 80
Periodic Content Reviews 82
Program Effectiveness Evaluation 82
REVIEW 82
113 QUESTIONS 83
113 ANSWERS 84
Contents xiii
2.0 Asset Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Objective 2.1 Identify and classify information and assets. . . . . . . . . 86
Asset Classification 86
Data Classification 87
REVIEW
89
21 QUESTIONS 89
21 ANSWERS 90
Objective 2.2 Establish information and asset handling
requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Information and Asset Handling 90
Handling Requirements 91
Information Classification and Handling Systems 93
REVIEW 94
22 QUESTIONS 95
22 ANSWERS 95
Objective 2.3 Provision resources securely . . . . . . . . . . . . . . . . . . . . . 96
Securing Resources 96
Asset Ownership 96
Asset Inventory 96
Asset Management 97
REVIEW 98
23 QUESTIONS 99
23 ANSWERS 99
Objective 2.4 Manage data lifecycle . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Managing the Data Life Cycle 100
Data Roles 100
Data Collection 102
Data Location 102
Data Maintenance 102
Data Retention 103
Data Remanence 103
Data Destruction 103
REVIEW 104
24 QUESTIONS 104
24 ANSWERS 105
Objective 2.5 Ensure appropriate asset retention
(e.g., End-of-Life (EOL), End-of-Support (EOS)). . . . . . . . . . . . . . . 105
Asset Retention 105
Asset Life Cycle 106
End-of-Life and End-of-Support 106
xiv CISSP Passport
REVIEW 108
25 QUESTIONS 108
25 ANSWERS 108
Objective 2.6 Determine data security controls and compliance
requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Data Security and Compliance 109
Data States 109
Control Standards Selection 110
Scoping and Tailoring Data Security Controls 111
Data Protection Methods 111
REVIEW 113
26 QUESTIONS 113
26 ANSWERS 114
3.0 Security Architecture and Engineering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Objective 3.1 Research, implement, and manage engineering
processes using secure design principles . . . . . . . . . . . . . . . . . . . 116
Threat Modeling 116
Least Privilege 116
Defense in Depth 117
Secure Defaults 117
Fail Securely 117
Separation of Duties 118
Keep It Simple 119
Zero Trust 119
Privacy by Design 119
Trust But Verify 119
Shared Responsibility 120
REVIEW 120
31 QUESTIONS 121
31 ANSWERS 122
Objective 3.2 Understand the fundamental concepts of security
models (e.g., Biba, Star Model, Bell-LaPadula) . . . . . . . . . . . . . . . 122
Security Models 122
Terms and Concepts 123
System States and Processing Modes 124
Confidentiality Models 126
Integrity Models 127
Other Access Control Models 128
REVIEW 128
32 QUESTIONS 129
32 ANSWERS 130
Contents xv
Objective 3.3 Select controls based upon systems security
requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Selecting Security Controls 130
Performance and Functional Requirements 131
Data Protection Requirements 131
Governance Requirements 132
Interface Requirements 132
Risk Response Requirements 133
REVIEW 133
33 QUESTIONS 134
33 ANSWERS 134
Objective 3.4 Understand security capabilities of Information Systems
(IS) (e.g., memory protection, Trusted Platform Module (TPM),
encryption/decryption) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Information System Security Capabilities 135
Hardware and Firmware System Security 135
Secure Processing 137
REVIEW 138
34 QUESTIONS 139
34 ANSWERS 139
Objective 3.5 Assess and mitigate the vulnerabilities of security
architectures, designs, and solution elements . . . . . . . . . . . . . . . 139
Vulnerabilities of Security Architectures, Designs, and Solutions 140
Client-Based Systems 140
Server-Based Systems 140
Distributed Systems 141
Database Systems 141
Cryptographic Systems 142
Industrial Control Systems 142
Internet of Things 143
Embedded Systems 143
Cloud-Based Systems 144
Virtualized Systems 145
Containerization 146
Microservices 146
Serverless 146
High-Performance Computing Systems 146
Edge Computing Systems 146
REVIEW 147
35 QUESTIONS 148
35 ANSWERS 148
xvi CISSP Passport
Objective 3.6 Select and determine cryptographic solutions . . . . . . . 148
Cryptography 149
Cryptographic Life Cycle 149
Cryptographic Methods 151
Integrity 154
Hybrid Cryptography 155
Digital Certificates 156
Public Key Infrastructure 156
Nonrepudiation and Digital Signatures 158
Key Management Practices 158
REVIEW 159
36 QUESTIONS 160
36 ANSWERS 161
Objective 3.7 Understand methods of cryptanalytic attacks. . . . . . . . 161
Cryptanalytic Attacks 161
Brute Force 162
Ciphertext Only 162
Known Plaintext 162
Chosen Ciphertext and Chosen Plaintext 163
Frequency Analysis 163
Implementation 163
Side Channel 163
Fault Injection 164
Timing 164
Man-in-the-Middle (On-Path) 164
Pass the Hash 165
Kerberos Exploitation 165
Ransomware 165
REVIEW 166
37 QUESTIONS 166
37 ANSWERS 167
Objective 3.8 Apply security principles to site and facility design . . . 167
Site and Facility Design 167
Site Planning 167
Secure Design Principles 168
REVIEW 172
38 QUESTIONS 172
38 ANSWERS 173
Objective 3.9 Design site and facility security controls . . . . . . . . . . . . 173
Designing Facility Security Controls 173
Crime Prevention Through Environmental Design 174
Key Facility Areas of Concern 174
Contents xvii
REVIEW 181
39 QUESTIONS 181
39 ANSWERS 182
4.0 Communication and Network Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Objective 4.1 Assess and implement secure design principles
in network architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Fundamental Networking Concepts 184
Open Systems Interconnection and Transmission Control Protocol/Internet
Protocol Models 185
Internet Protocol Networking 187
Secure Protocols 189
Application of Secure Networking Concepts 193
Implications of Multilayer Protocols 193
Converged Protocols 194
Micro-segmentation 195
Wireless Technologies 197
Wireless Theory and Signaling 197
Wi-Fi 199
Bluetooth 202
Zigbee 202
Satellite 203
Li-Fi 203
Cellular Networks 204
Content Distribution Networks 205
REVIEW 206
41 QUESTIONS 206
41 ANSWERS 207
Objective 4.2 Secure network components . . . . . . . . . . . . . . . . . . . . . 207
Network Security Design and Components 208
Operation of Hardware 208
Transmission Media 212
Endpoint Security 213
REVIEW 214
42 QUESTIONS 214
42 ANSWERS 214
Objective 4.3 Implement secure communication channels
according to design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Securing Communications Channels 215
Voice 215
Multimedia Collaboration 218
xviii CISSP Passport
Remote Access 219
Data Communications 220
Virtualized Networks 222
Third-Party Connectivity 222
REVIEW 223
43 QUESTIONS 223
43 ANSWERS 224
5.0 Identity and Access Management (IAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
Objective 5.1 Control physical and logical access to assets . . . . . . . . 226
Controlling Logical and Physical Access 226
Logical Access 227
Physical Access 228
REVIEW 228
51 QUESTIONS 228
51 ANSWERS 229
Objective 5.2 Manage identification and authentication of people,
devices, and services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Identification and Authentication 229
Identity Management Implementation 230
Single/Multifactor Authentication 230
Accountability 231
Session Management 232
Registration, Proofing, and Establishment of Identity 232
Federated Identity Management 233
Credential Management Systems 233
Single Sign-On 234
Just-in-Time 234
REVIEW 235
52 QUESTIONS 236
52 ANSWERS 236
Objective 5.3 Federated identity with a third-party service . . . . . . . . 237
Third-Party Identity Services 237
On-Premise 237
Cloud 238
Hybrid 238
REVIEW 238
53 QUESTIONS 239
53 ANSWERS 239
Contents xix
Objective 5.4 Implement and manage authorization mechanisms. . . 239
Authorization Mechanisms and Models 240
Discretionary Access Control 241
Mandatory Access Control 241
Role-Based Access Control 242
Rule-Based Access Control 242
Attribute-Based Access Control 243
Risk-Based Access Control 243
REVIEW 243
54 QUESTIONS 244
54 ANSWERS 244
Objective 5.5 Manage the identity and access provisioning
lifecycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Identity and Access Provisioning Life Cycle 245
Provisioning and Deprovisioning 245
Role Definition 247
Privilege Escalation 248
Account Access Review 249
REVIEW 251
55 QUESTIONS 251
55 ANSWERS 252
Objective 5.6 Implement authentication systems . . . . . . . . . . . . . . . . 252
Authentication Systems 252
Open Authorization 253
OpenID Connect 253
Security Assertion Markup Language 253
Kerberos 254
Remote Access Authentication and Authorization 256
REVIEW 257
56 QUESTIONS 257
56 ANSWERS 258
6.0 Security Assessment and esting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
Objective 6.1 Design and validate assessment,
test, and audit strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Defining Assessments, Tests, and Audits 260
Designing and Validating Evaluations 261
Goals and Strategies 261
Use of Internal, External, and Third-Party Assessors 262
REVIEW 263
61 QUESTIONS 263
61 ANSWERS 264
xx CISSP Passport
Objective 6.2 Conduct security control testing . . . . . . . . . . . . . . . . . . 264
Security Control Testing 264
Vulnerability Assessment 265
Penetration Testing 265
Log Reviews 267
Synthetic Transactions 268
Code Review and Testing 268
Misuse Case Testing 269
Test Coverage Analysis 269
Interface Testing 269
Breach Attack Simulations 270
Compliance Checks 270
REVIEW 271
62 QUESTIONS 271
62 ANSWERS 272
Objective 6.3 Collect security process data (e.g., technical and
administrative) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Security Data 272
Security Process Data 273
REVIEW 275
63 QUESTIONS 276
63 ANSWERS 276
Objective 6.4 Analyze test output and generate report . . . . . . . . . . . . 277
Test Results and Reporting 277
Analyzing the Test Results 277
Reporting 278
Remediation, Exception Handling, and Ethical Disclosure 278
REVIEW 280
64 QUESTIONS 280
64 ANSWERS 280
Objective 6.5 Conduct or facilitate security audits . . . . . . . . . . . . . . . 281
Conducting Security Audits 281
Internal Security Auditors 282
External Security Auditors 282
Third-Party Security Auditors 283
REVIEW 284
65 QUESTIONS 284
65 ANSWERS 284
Contents xxi
7.0 Security Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Objective 7.1 Understand and comply with investigations . . . . . . . . 286
Investigations
286
Forensic Investigations 287
Evidence Collection and Handling 287
Digital Forensics Tools, Tactics, and Procedures 290
Investigative Techniques 291
Reporting and Documentation 292
REVIEW
293
71 QUESTIONS 294
71 ANSWERS 294
Objective 7.2 Conduct logging and monitoring activities. . . . . . . . . . 295
Logging and Monitoring 295
Continuous Monitoring 296
Intrusion Detection and Prevention 296
Security Information and Event Management 297
Egress Monitoring 297
Log Management 298
Threat Intelligence 298
User and Entity Behavior Analytics 301
REVIEW
302
72 QUESTIONS 303
72 ANSWERS 304
Objective 7.3 Perform Configuration Management (CM)
(e.g., provisioning, baselining, automation) . . . . . . . . . . . . . . . . . 304
Configuration Management Activities 304
Provisioning 305
Baselining 305
Automating the Configuration Management Process 306
REVIEW 306
73 QUESTIONS 307
73 ANSWERS 307
Objective 7.4 Apply foundational security operations concepts . . . . 308
Security Operations 308
Need-to-Know/Least Privilege 308
Separation of Duties and Responsibilities 309
Privileged Account Management 310
Job Rotation 311
Service Level Agreements 312
REVIEW 313
74 QUESTIONS 314
74 ANSWERS 314
xxii CISSP Passport
Objective 7.5 Apply resource protection . . . . . . . . . . . . . . . . . . . . . . . 314
Media Management and Protection 315
Media Management 315
Media Protection Techniques 315
REVIEW 317
75 QUESTIONS 317
75 ANSWERS 318
Objective 7.6 Conduct incident management . . . . . . . . . . . . . . . . . . . 318
Security Incident Management 318
Incident Management Life Cycle 319
REVIEW 324
76 QUESTIONS 325
76 ANSWERS 326
Objective 7.7 Operate and maintain detective and preventative
measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Detective and Preventive Controls 326
Allow-Listing and Deny-Listing 327
Firewalls 328
Intrusion Detection Systems and Intrusion Prevention Systems 331
Third-Party Provided Security Services 332
Honeypots and Honeynets 333
Anti-malware 334
Sandboxing 335
Machine Learning and Artificial Intelligence 336
REVIEW 336
77 QUESTIONS 338
77 ANSWERS 338
Objective 7.8 Implement and support patch and vulnerability
management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338
Patch and Vulnerability Management 339
Managing Vulnerabilities 339
Managing Patches and Updates 340
REVIEW 342
78 QUESTIONS 342
78 ANSWERS 343
Objective 7.9 Understand and participate in change management
processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344
Change Management 344
Change Management Processes 344
REVIEW 347
79 QUESTIONS 347
79 ANSWERS 348
Contents xxiii
Objective 7.10 Implement recovery strategies . . . . . . . . . . . . . . . . . . . 348
Recovery Strategies 348
Backup Storage Strategies 348
Recovery Site Strategies 351
Multiple Processing Sites 352
Resiliency 355
High Availability 355
Quality of Service 356
Fault Tolerance 356
REVIEW 357
710 QUESTIONS 358
710 ANSWERS 359
Objective 7.11 Implement Disaster Recovery (DR) processes. . . . . . . 359
Disaster Recovery 359
Saving Lives and Preventing Harm to People 360
The Disaster Recovery Plan 360
Response 361
Personnel 361
Communications 361
Assessment 363
Restoration 363
Training and Awareness 364
Lessons Learned 364
REVIEW 365
711 QUESTIONS 366
711 ANSWERS 367
Objective 7.12 Test Disaster Recovery Plans (DRP). . . . . . . . . . . . . . . . 367
Testing the Disaster Recovery Plan 367
Read-Through/Tabletop 368
Walk-Through 369
Simulation 369
Parallel Testing 370
Full Interruption 370
REVIEW 371
712 QUESTIONS 371
712 ANSWERS 372
Objective 7.13 Participate in Business Continuity (BC) planning
and exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372
Business Continuity 372
Business Continuity Planning 373
Business Continuity Exercises 375
xxiv CISSP Passport
REVIEW 376
713 QUESTIONS 376
713 ANSWERS 377
Objective 7.14 Implement and manage physical security . . . . . . . . . . 377
Physical Security 377
Perimeter Security Controls 378
Internal Security Controls 382
REVIEW 386
714 QUESTIONS 387
714 ANSWERS 387
Objective 7.15 Address personnel safety and security concerns . . . . 388
Personnel Safety and Security 388
Travel 388
Security Training and Awareness 389
Emergency Management 389
Duress 390
REVIEW 391
715 QUESTIONS 391
715 ANSWERS 392
8.0 Sotware Development Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
Objective 8.1 Understand and integrate security in the Software
Development Life Cycle (SDLC) . . . . . . . . . . . . . . . . . . . . . . . . . . . 394
Software Development Life Cycle 394
Development Methodologies 395
Maturity Models 398
Operation and Maintenance 400
Change Management 401
Integrated Product Team 401
REVIEW 401
81 QUESTIONS 402
81 ANSWERS 403
Objective 8.2 Identify and apply security controls in software
development ecosystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403
Security Controls in Software Development 403
Programming Languages 404
Libraries 405
Tool Sets 406
Integrated Development Environment 406
Runtime 406
Continuous Integration and Continuous Delivery 407
Security Orchestration, Automation, and Response 407
Software Configuration Management 408
Contents xxv
Code Repositories 408
Application Security Testing 408
REVIEW 411
82 QUESTIONS 411
82 ANSWERS 412
Objective 8.3 Assess the effectiveness of software security. . . . . . . . 412
Software Security Effectiveness 412
Auditing and Logging Changes 413
Risk Analysis and Mitigation 413
REVIEW 415
83 QUESTIONS 415
83 ANSWERS 415
Objective 8.4 Assess security impact of acquired software . . . . . . . . 416
Security Impact of Acquired Software 416
Commercial-off-the-Shelf Software 416
Open-Source Software 417
Third-Party Software 417
Managed Services 418
REVIEW 419
84 QUESTIONS 419
84 ANSWERS 420
Objective 8.5 Define and apply secure coding guidelines
and standards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420
Secure Coding Guidelines and Standards 420
Security Weaknesses and Vulnerabilities at the Source-Code Level 420
Security of Application Programming Interfaces 421
Secure Coding Practices 422
Software-Defined Security 424
REVIEW 424
85 QUESTIONS 425
85 ANSWERS 425
A About the Online Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
System Requirements 427
Your Total Seminars Training Hub Account 427
Privacy Notice 427
Single User License Terms and Conditions 427
TotalTester Online 429
Technical Support 429
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431
This page intentionally left blank
DOMAIN xxvii
Acknowledgments
A book isn’t simply written by one person; so many people had key roles in the production o
this study guide, so I’d like to take this opportunity to acknowledge and thank them. First and
oremost, I would like to thank the olks at McGraw Hill, Wendy Rinaldi, Caitlin Cromley-
Linn, and Janet Walden. All three worked hard to keep me on track and made sure that this
book met the highest standards o quality. hey are awesome people to work with, and I’m
grateul once again to work with them!
I would also like to sincerely thank Nitesh Sharma, Senior Project Manager, Knowledge-
Works Global Ltd, who worked on the post-production or the book, and Bill McManus, who
did the copyediting work or the book. hey are also great olks to work with. Nitesh was so
patient and proessional with me at various times when I did not exactly meet a deadline and
I’m so grateul or that. I’ve worked with Bill a ew times on dierent book projects, and I must
admit I’m always in awe o him (and a bit intimidated by him, but really glad in the end to
have him help on my projects), since he is an awesome copyeditor who catches every single
one o the plentiul mistakes I make during the writing process. I have also gained a signiicant
respect or Bill’s knowledge o cybersecurity, as he’s always been able to key in on small nuances
o wonky explanations that even I didn’t catch and suggest better ways to write them. He’s the
perect person to make sure this book lows well, is understandable to a reader, and is a higher-
quality resource. hank you, Bill!
here are many other people on the production side who contributed signiicantly to the
publication o this book, including Rachel Fogelberg, ed Laux, homas Somers, and Je
Weeks, as well as others. My sincere thanks to them all or their hard work.
I also want to thank my amily or their patience and understanding as I took time away
rom them to write this book. I owe them a great deal o time I can never pay back, and I am
very grateul or their love and support.
xxvii
xxviii CISSP Passport
And last, but certainly not least, I want to thank the technical editor, Nichole O’Brien.
I’ve worked with Nichole on tons o real-world cybersecurity projects o and on or at least
ten years now. I’ve lost count o how many proposals, risk assessment reports, customer meet-
ings, and cyber-related problems she has suered through with me, yet she didn’t hesitate
to jump in and become the technical editor or this book. Nichole is absolutely one o the
smartest businesspeople I know in cybersecurity, as well as simply a really good person, and
I have an ininite amount o proessional and personal respect or her. his book is so much
better or having her there to correct my mistakes, ask critical questions, make me do more
research, and add a dierent and unique perspective to the process. hanks, Nichole!
—Bobby Rogers
DOMAIN xxix
Introduction
Welcome to CISSP Passport! his book is ocused on helping you to pass the Certiied Inor-
mation Systems Security Proessional (CISSP) certiication examination rom the Interna-
tional Inormation System Security Certiication Consortium, or (ISC)². he idea behind
the Passport series is to give you a concise study guide or learning the key elements o the
certiication exam rom the perspective o the required objectives published by (ISC)², in their
CISSP Certiication Exam Outline. Cybersecurity proessionals can review the experience
requirements set orth by (ISC)² at https://www.isc2.org/Certiications/CISSP/experience-
requirements. he basic requirement is ive years o cumulative paid work experience in two
or more o the eight CISSP domains, or our years o such experience plus either a our-year
college degree or an additional credential rom the (ISC)² approved list. (ISC)² requires that
you document this experience beore you can be ully certiied as a CISSP. For those candidates
who do not yet meet the experience requirements, they may achieve Associate o (ISC)² status
by passing the examination. Associates o (ISC)² are then allowed up to six years to accumulate
the required ive years o experience to become ull CISSPs.
he eight domains and the approximate percentage o exam questions they represent are
as ollows:
• Security and Risk Management (15%)
• Asset Security (10%)
• Security Architecture and Engineering (13%)
• Communication and Network Security (13%)
• Identity and Access Management (IAM) (13%)
• Security Assessment and esting (12%)
• Security Operations (13%)
• Sotware Development Security (11%)
CISSP Passport assumes that you have already studied long and hard or the CISSP exam
and now just need a quick reresher beore you take the exam. his book is meant to be a
“no lu ” concise study guide with quick acts, deinitions, memory aids, charts, and brie
explanations. Because this guide gives you the key concepts and acts, and not the in-depth
xxix
xxx CISSP Passport
explanations surrounding those acts, you should not use this guide as your only study source
to prepare or the CISSP exam. here are numerous books you can use or your deep studying,
such as CISSP All-in-One Exam Guide, Ninth Edition, also rom McGraw Hill.
I recommend that you use this guide to reinorce your knowledge o key terms and con-
cepts and to review the broad scope o topics quickly in the inal ew days beore your CISSP
exam, ater you’ve done all o your “deep” studying. his guide will help you memorize ast
acts, as well as reresh your memory about topics you may not have studied or a while.
his guide is organized around the most recent CISSP exam domains and objectives
released by (ISC)², which is May 1, 2021 at the time o writing this book. Keep in mind that
(ISC)² reserves the right to change or update the exam objectives anytime at its sole discretion
and without any prior notice, so you should check the (ISC)² website or any recent changes
beore you begin reading this guide and again a week or so beore taking the exam to make sure
you are studying the most updated materials.
he structure o this study guide parallels the structure o the eight CISSP domains pub-
lished by (ISC)², presented in the same numerical order in the book, with individual domain
objectives also ordered by objective number in each domain. Each domain in this guide is
equivalent to a regular book chapter, so this guide has eight considerably large “chapters” with
individual sections devoted to the objective numbers. his organization is intended to help
you learn and master each objective in a logical way. Because some domain objectives overlap,
you will see a bit o redundancy in topics discussed throughout the book; where this is the case,
the topic is presented in its proper context within the current domain objective and you’ll see
a cross-reerence to the other objective(s) in which the same topic is discussed.
Each domain contains the ollowing useul items to call out points o interest.
EXAM TIP Indicates critical topics you’re likely to see on the actual exam
NOTE Points out ancillary but pertinent information, as well as areas for
further study
CAUTION Warns you of common pitfalls, misconceptions, and potentially
harmful or risky situations when working with the technology in the real world
Introduction xxxi
Cross-Reference
Directs you to other places in the book where concepts are covered, for your reference
ADDITIONAL RESOURCES Identifies where you can find books, websites,
and other media for further assistance
he end o each objective gives you two handy tools. he “Review” section provides a
synopsis o the objective—a great way to quickly review the critical inormation. hen the
“Questions” and “Answers” sections enable you to test your newly acquired knowledge. For
urther study, this book includes access to online practice exams that will help to prepare you
or taking the exam itsel. All the inormation you need or accessing the exam questions is
provided in the appendix. I recommend that you take the practice exams to identiy where
you have knowledge gaps and then go back and review the relevant material as needed.
I hope this book is helpul to you not only in studying or the CISSP exam but also as a quick
reerence guide you’ll use in your proessional lie. hanks or picking this book to help you
study, and good luck on the exam!
This page intentionally left blank
M A
O I
N
Security and 1.0
Risk Management
Domain Objectives
• 1.1 Understand, adhere to, and promote professional ethics.
• 1.2 Understand and apply security concepts.
• 1.3 Evaluate and apply security governance principles.
• 1.4 Determine compliance and other requirements.
• 1.5 Understand legal and regulatory issues that pertain to information security
in a holistic context.
• 1.6 Understand requirements for investigation types (i.e., administrative,
criminal, civil, regulatory, industry standards).
• 1.7 Develop, document, and implement security policy, standards, procedures,
and guidelines.
• 1.8 Identify, analyze, and prioritize Business Continuity (BC) requirements.
• 1.9 Contribute to and enforce personnel security policies and procedures.
• 1.10 Understand and apply risk management concepts.
• 1.11 Understand and apply threat modeling concepts and methodologies.
• 1.12 Apply Supply Chain Risk Management (SCRM) concepts.
• 1.13 Establish and maintain a security awareness, education, and training
program.
1
2 CISSP Passport
Domain 1, “Security and Risk Management,” is one of the key domains in understanding
critical security principles that you will encounter on the CISSP exam. The majority of the
topics in this domain include the administrative or managerial security measures put in
place to manage a security program. In this domain you will learn about professional ethics
and important fundamental security concepts. We will discuss governance and compliance,
investigations, security policies, and other critical management concepts. We will also
delve into business continuity, personnel security, and the all-important risk management
processes. We’ll also discuss threat modeling, explore supply chain risk management, and
finish the domain by examining the different aspects of security training and awareness
programs. These are all very important concepts that will help you to understand the subse-
quent domains, since they provide the foundations of knowledge you need to be successful
on the exam.
Objective 1.1 Understand, adhere to, and promote
professional ethics
T he fact that (ISC)2 places professional ethics as the first objective in the first domain of
the CISSP exam requirements speaks volumes about the importance of ethics and ethi-
cal behavior in our profession. The continuing increases in network breaches, data loss, and
ransomware demonstrate the criticality of ethical conduct in this expanding information secu-
rity landscape. Our information systems security workforce is expanding at a rapid pace, and
these new recruits need to understand the professional discipline required to succeed. Some
may enter the field because they expect to make a lot of money, but ultimately competence,
integrity, and trustworthiness are the qualities necessary for success. Most professions have
published standards for ethical behavior, such as healthcare, law enforcement, accounting, and
many other professions. In fact, you would be hard-pressed to find a profession that does not
have at least some type of minimal ethical requirements for professional conduct.
While exam objective 1.1 is the only objective that explicitly covers ethics and professional
conduct, it’s important to emphasize them, since you will be expected to know them on the
exam and, more importantly, you will be expected to uphold them to maintain your CISSP sta-
tus. The first part of this exam objective covers the core ethical requirements from (ISC)2 itself.
Absent any other ethical standards that you may also be required to uphold in your profession,
from your organization, your customers, and even any other certifications you hold, the (ISC)2
Code of Ethics should be sufficient to guide you in ethical behavior and professional conduct
while you are employed as an information systems security professional for as long as you hold
the CISSP certification. The second part of the objective reviews other sources of professional
ethics that guide your conduct, such as those from industry or professional organizations.
First, let’s look at the (ISC)2 Code of Ethics.
DOMAIN 1.0 Objective 1.1 3
The (ISC)2 Code of Ethics
The (ISC)2 Code of Ethics, located on the (ISC)2 website at https://www.isc2.org/Ethics#,
consists of a preamble and four mandatory canons. Additionally, the web page includes a
comprehensive set of ethics complaint procedures for filing ethics complaints against certified
members. The complaint procedures are designed to detail how someone might formally
accuse a certified member of violating one or more of the four canons.
NOTE (ISC)2 updates the Code of Ethics from time to time, so it is best to
occasionally go to the (ISC)2 website and review it for any changes. This allows you
to keep up with current requirements and serves to remind you of your ethical and
professional responsibilities.
Code of Ethics Preamble
The Code of Ethics Preamble simply states that people who are bound to the code must adhere
to the highest ethical standards of behavior, and that the code is a condition of certification.
Per the (ISC)2 site (https://www.isc2.org/Ethics#), the preamble states (at the time of writing):
“The safety and welfare of society and the common good, duty to our principals, and to
each other, requires that we adhere, and be seen to adhere, to the highest ethical stand-
ards of behavior. Therefore, strict adherence to this Code is a condition of certification.”
Code of Ethics Canons
The Code of Ethics Canons dictate the more specific requirements that certification holders
must obey. According to the ethics complaint procedures detailed by (ISC)2, violation of any of
these canons is grounds for the certificate holder have their certification revoked. The canons
are as follows:
I. Protect society, the common good, necessary public trust and confidence, and the
infrastructure.
II. Act honorably, honestly, justly, responsibly, and legally.
III. Provide diligent and competent service to principals.
IV. Advance and protect the profession.
Obviously, these canons are intentionally broad and, unfortunately, someone could con-
strue them to fit almost any type of act by a CISSP, accidental or malicious, into one these
categories. However, the ethics complaint procedures specify a burden of proof involved with
making a complaint against the certification holder for violation of these canons. The com-
plaint procedures, set forth in the “Standing of Complainant” section, specify that “complaints
4 CISSP Passport
will be accepted only from those who claim to be injured by the alleged behavior.” Anyone
with knowledge of a breach of Canons I or II may file a complaint against someone, but only
principals, which are employers or customers of the certificate holder, can lodge a complaint
about any violation of Canon III, and only other certified professionals may register com-
plaints about violations of Canon IV.
Also according to the ethics complaint procedures, the complaint goes before an ethics
committee, which hears complaints of breaches of the Code of Ethics Canons, and makes a
recommendation to the board. But the board ultimately makes decisions regarding the validity
of complaints, as well as levees the final disciplinary action against the member, if warranted.
A person who has had an ethics complaint lodged against them under these four canons has a
right to respond and comment on the allegations, as there are sound due process procedures
built into this process.
EXAM TIP You should be familiar with the preamble and the four canons of
the (ISC)2 Code of Ethics for the exam. It’s a good idea to go to the (ISC)2 website and
review the most current Code of Ethics shortly before you take the exam.
Organizational Code of Ethics
The second part of exam objective 1.1 encompasses organizational standards and codes of
ethics. Most organizations today have some minimal form of a code of ethics, professional
standards, or behavioral requirements that you must obey to be a member of that organization.
“Organization” in this context means professional organizations, your workplace, your cus-
tomer organization, or any other formal, organized body to which you belong or are employed
by. Whether you are a government employee or a private contractor, whether you work for a
volunteer agency or work in a commercial setting, you’re likely required to adhere to some type
of organizational code of ethics. Let’s examine some of the core requirements most organiza-
tional codes of ethics have in common.
Workplace Ethics Statements and Policies
Codes of ethics in the workplace may or may not be documented. Often there is no formalized,
explicit code of ethics document published by the organization, although that may not be the
case, especially in large or publicly traded corporations. More often than not, the requirements
for ethical or professional behavior are stated as a policy or group of policies that apply not
only to the security professionals in the organization but to every employee. For example, there
are usually policies that cover the topics of acceptable use of organizational IT assets, personal
behavior toward others, sexual harassment and bullying, bribery, gifts from external parties,
and so on. Combined, these policies cover the wide range of professional behavior expecta-
tions. These policies may be sponsored and monitored by the human resources department
and are likely found in the organization’s employee handbook. For the organizations that have
DOMAIN 1.0 Objective 1.1 5
explicit professional ethics documents, these usually describe general statements that are not
specific to IT or cybersecurity professionals and direct the employee to behave ethically and
professionally in all matters.
Other Sources for Ethics Requirements
Although not directly testable by the CISSP exam, it’s worth noting that there are other sources
for ethics requirements for technology professionals in general and cybersecurity professionals
in particular. All of these sources contain similar requirements to act in a professional, hon-
est manner while protecting the interests of customers, employers, and other stakeholders, as
well as maintain professional integrity and work toward the good of society. The following
subsections describe several sources of professional ethics standards to give you an idea of how
important ethics and professional behavior are across the wide spectrum of not only cyberse-
curity but technology in general.
The Computer Ethics Institute
The Computer Ethics Institute (CEI) is a nonprofit policy, education, and research group
founded to promote the study of technology ethics. Its membership includes several tech-
nology-related organizations and prominent technologists and it is positioned as a forum for
public discussion on a variety of topics affecting the integration of technology and society. The
most well-known of its efforts is the development of the Ten Commandments of Computer
Ethics, which has been used as the basis of several professional codes of ethics and behavior
documents, among them the (ISC)2 Code of Ethics.
The Ten Commandments of Computer Ethics, presented here from the CEI website, are
as follows:
1. Thou shalt not use a computer to harm other people.
2. Thou shalt not interfere with other people’s computer work.
3. Thou shalt not snoop around in other people’s computer files.
4. Thou shalt not use a computer to steal.
5. Thou shalt not use a computer to bear false witness.
6. Thou shalt not copy or use proprietary software for which you have not paid.
7. Thou shalt not use other people’s computer resources without authorization or proper
compensation.
8. Thou shalt not appropriate other people’s intellectual output.
9. Thou shalt think about the social consequences of the program you are writing or the
system you are designing.
10. Thou shalt always use a computer in ways that ensure consideration and respect for
your fellow humans.
6 CISSP Passport
Institute of Electrical and Electronics
Engineers – Computer Society
The Institute of Electrical and Electronics Engineers (IEEE) published a professional Code of
Ethics designed to promulgate ethical behaviors among technology professionals. Although
the IEEE Code of Ethics does not specifically target cybersecurity professionals, its principles
similarly promote the professional and ethical behaviors of other technology professionals and
is similar in requirements to the (ISC)2 Code of Ethics. The more important points of the IEEE
Code of Ethics are summarized as follows:
• Uphold high standards of integrity, responsible behavior, and ethical conduct in
professional activities
• Hold paramount the safety, health, and welfare of the public
• Avoid real or perceived conflicts of interest
• Avoid unlawful conduct
• Treat all persons fairly and with respect
• Ensure the code is upheld by colleagues and coworkers
As you can see, these points are directly aligned with the (ISC)2 Code of Ethics and, as with
many codes of conduct, offer no conflict with other codes that members may be subject to. In
fact, since codes of ethics and professional behavior are often similar, they support and serve
to strengthen the requirements levied on various individuals.
ADDITIONAL RESOURCES In addition to the example of the IEEE Code of
Ethics, numerous other professional organizations that are closely related to or aligned
with cybersecurity professionals also have comparable codes that are worth mentioning.
Another noteworthy example is the Project Management Institute (PMI) Code of Ethics
and Professional Conduct, available at https://www.pmi.org/about/ethics/code.
Governance Ethics Requirements
There also are standards that are imposed as part of regulatory requirements that cover how
technology professionals will comport themselves. Some of these standards don’t specifically
target cybersecurity professionals per se, but they do prescribe ethical behaviors with regard
to data protection, for example, and apply to organizations and personnel alike. Almost all
data protection regulations, such as the EU’s General Data Protection Regulation (GDPR), the
U.S. Health Insurance Portability and Accountability Act (HIPAA), the National Institute of
Standards and Technology (NIST) publications, the Code of Ethics requirements spelled out
in Section 406 of the Sarbanes-Oxley Act of 2002, and countless other laws and regulations,
describe the actions that users and personnel with privileged access to sensitive data must take
to protect that data from a legal and ethical perspective in order to comply with security, pri-
vacy, and other governance requirements.
DOMAIN 1.0 Objective 1.1 7
REVIEW
Objective 1.1: Understand, adhere to, and promote professional ethics In this objective
we focused on one of the more important objectives for the CISSP exam—one that’s often
overlooked in exam prep. We discussed codes of ethics, which are requirements intended
to guide our professional behavior. We specifically examined the (ISC)2 Code of Ethics,
as that is the most relevant to the exam. The Code of Ethics consists of a preamble and
four mandatory canons. (ISC)2 also has a comprehensive set of complaint procedures for
ethics complaints against certified members. The complaint procedures detail the process
for formally accusing a certified member of violating one or more of the four canons, while
ensuring a fair and impartial due process for the accused.
We also examined organizational ethics and discussed how some organizations may not
have a formalized code of ethics document, but their ethical or professional behavior expec-
tations may be contained in their policies. These are usually found in policies such as accept-
able use, acceptance of gifts, bribery, and other types of policies. Most of the policies that
affect professional behavior for employees are typically found in the employee handbook.
Finally, we discussed other sources of professional ethics, from professional organi-
zations and governance requirements that may define how to protect certain sensitive
data classifications. Absent any other core ethics document that prescribes professional
behavior, the (ISC)2 Code of Ethics is mandatory for CISSP certification holders and
should be used to guide their behavior.
1.1 QUESTIONS
1. You’re a CISSP who works for a small business. Your workplace has no formalized
code of professional ethics. Your manager recently asked you to fudge the results of
a vulnerability assessment on a group of production servers to make it appear as if
the security posture is improving. Absent a workplace code of ethics, which of the
following should guide your behavior regarding this request?
A. Your own professional conscience
B. (ISC)2 Code of Ethics
C. Workplace Acceptable Use Policy
D. The Computer Ethics Institute policies
2. Nichole is a security operations center (SOC) supervisor who has observed one of her
CISSP-certified subordinates in repeated violation of both the company’s requirements
for professional behavior and the (ISC)2 Code of Ethics. Which of the following
actions should she take?
A. Report the violation to the company’s HR department only
B. Report the violation to (ISC)2 and the HR department
C. Ignore a one-time violation and counsel the individual
D. Report the violation to (ISC)2 only
8 CISSP Passport
3. Which of the following is a legal, ethical, or professional requirement levied upon an
individual to protect data based upon the specific industry, data type, and sensitivity?
A. (ISC)2 Code of Ethics
B. IEEE Code of Ethics
C. The Sarbanes-Oxley Code of Ethics requirements
D. The Computer Ethics Institute’s Ten Commandments of Computer Ethics
4. Bobby has been accused of violating one of the four canons of the (ISC)2 Code of Ethics.
A fellow cybersecurity professional has made the complaint that Bobby intentionally
wrote a cybersecurity audit report to reflect favorably on a company in which he is also
applying for a job in order to gain favor with its managers. Which of the following four
canons has Bobby likely violated?
A. Provide diligent and competent service to principals
B. Act honorably, honestly, justly, responsibly, and legally
C. Advance and protect the profession
D. Protect society, the common good, necessary public trust and confidence, and
the infrastructure
1.1 ANSWERS
1. B Absent any other binding code of professional ethics from the workplace, the
(ISC)2 Code of Ethics binds certified professionals to a higher standard of behavior.
While using your own professional judgment is admirable, not everyone’s professional
standards are at the same level. Workplace policies do not always cover professional
conduct by cybersecurity personnel specifically. The Computer Ethics Institute policies
are not binding to cybersecurity professionals.
2. B Since the employee has violated both the company’s professional behavior
requirements and the (ISC)2 Code of Ethics, Nichole should report the actions to
both entities. Had the violation been only that of the (ISC)2 Code of Ethics, she would
not have necessarily needed to report it to the company. One-time violations may be
accidental and should be handled at the supervisor’s discretion; however, repeated
violations may warrant further action depending upon the nature of the violation
and the situation.
3. C The Sarbanes-Oxley (SOX) Code of Ethics requirements are part of the regulation
(Section 406 of the Act) enacted to prevent securities and financial fraud and require
organizations to enact codes of ethics to protect financial and personal data. The
other choices are not focused on data sensitivity or regulations, but rather apply to
technology and cybersecurity professionals.
4. A Although the argument can be made that falsifying an audit report could violate any
or all of the four (ISC)2 Code of Ethics Canons, the scenario specifically affects the canon
that requires professionals to perform diligent and competent service to principals.
DOMAIN 1.0 Objective 1.2 9
Objective 1.2 Understand and apply security concepts
I n this objective we will examine some of the more fundamental concepts of security.
Although fundamental, they are critical in understanding everything that follows, since
everything we will discuss in future objectives throughout all CISSP domains relates to the
goals of security and their supporting tenets.
Security Concepts
To become certified as a CISSP, you must have knowledge and experience that covers a
wide variety of topics. However, regardless of the experience you may have in the different
domains, such as networking, digital forensics, compliance, or penetration testing, you need
to comprehend some fundamental concepts that are the basis of all the other security knowl-
edge you will need in your career. This core knowledge includes the goals of security and its
supporting principles.
In this objective we’re going to discuss this core knowledge, which serves as a reminder for
the experience you likely already have before attempting the exam. We’ll cover the goals of
security as well as the supporting tenets, such as identification, authentication, authorization,
and nonrepudiation. We will also discuss key supporting concepts such as principles of least
privilege and separation of duties. You’ll find that no matter what expertise you have in the
CISSP domains, these core principles are the basis for all of them. As we discuss each of these
core subjects we’ll talk about how different topics within the CISSP domains articulate to these
areas. First, it’s useful to establish common ground with some terms you’ll likely see through-
out this book and your studies for the exam.
Data, Information, Systems, and Entities
There are terms that we commonly use in cybersecurity that can cause confusion if every-
one in the field does not have a mutual understanding of what the terms mean. Our field is
rich with acronyms, such as MAC, DAC, RBAC, IdM, and many more. Often the same acro-
nym can stand for different terms. For example, in information technology and cybersecurity
parlance, MAC can stand for media access control, message authentication code, mandatory
access control, and memory access controller, not to mention that it’s also a slang term for a
Macintosh computer. That’s an example of why it’s important to define a few terms up front
before we get into our discussion of security concepts. These terms include data, information,
system, and entity (and its related terms subject and object).
Two terms often used interchangeably by technology people in everyday conversation are
data and information. In nontechnical discussion, the difference really doesn’t matter, but
as cybersecurity professionals, we need to be more precise in our speech and differentiate
10 CISSP Passport
between the two. For purposes of this book, and studying for the exam, data are raw, singular
pieces of fact or knowledge that have no immediate context or meaning. An example might be
an IP address, or domain name, or even an audit log entry, which by itself may not have any
meaning. Information is data organized into context and given meaning. An example might be
several pieces of data that are correlated to show an event that occurred on host at a specific
time by a specific individual.
EXAM TIP The CISSP exam objectives do not distinguish the differences
between the terms “information” and “data,” as they are often used interchangeably
in the profession as well. For the purposes of this book, we also will sometimes not
distinguish the difference and use the term interchangeably, depending on the context
and the exam objectives presented.
A system consists of multiple components such as hardware, software, network protocols,
and even processes. A system could also consist of multiple smaller systems, sometimes called
a system of systems but most frequently just referred to as a system, regardless of the type or
quantity of subsystems.
An entity, for our purposes, is a general, abstract term that includes any combination of
organizations, persons, hardware, software, processes, and so on, that may interact with peo-
ple, systems, information, or data. Frequently we talk about users accessing data, but in real-
ity, software programs, hardware, and processes can also independently access data and other
resources on a network, regardless of user action. So it’s probably more correct to say that an
entity or entities access these resources. We can assign accounts and permissions to almost
any type of entity, not just humans. It’s also worth noting that entities are also referred to as
subjects, which perform actions (read, write, create, delete, etc.) on objects, which are resources
such as computers, systems, and information.
Now that we have those terms defined, let’s discuss the three goals of security—confidentiality,
integrity, and availability.
Confidentiality
Of the three primary goals of information security, confidentiality is likely the one that most
people associate with cybersecurity. Certainly, it’s important to make sure that systems and data
are kept confidential and only accessed by entities that have a valid reason, but the other goals
of security, which we will discuss shortly, are also of equal importance. Confidentiality is about
keeping information secret and, in some cases, private. It requires protecting information that
is not generally accessible to everyone, but rather only to a select few. Whether it’s personal
privacy or health data, proprietary company information, classified government data, or just
simply data of a sensitive nature, confidential information is meant to be kept secret. In later
objectives we will discuss different access controls, such as file permissions, encryption, authen-
tication schemes, and other measures, that are designed to keep data and systems confidential.
DOMAIN 1.0 Objective 1.2 11
Integrity
Integrity is the goal of security to ensure that data and systems are not modified or destroyed
without authorization. To maintain integrity, data should be altered only by an entity that has
the appropriate access and a valid reason to modify. Obviously, data may be altered purpose-
fully for malicious reasons, but accidental or unintentional changes may be caused by a well-
intentioned user or even by a bad network connection that degrades the integrity of a file or
data transmission. Integrity is assured through several means, including identification and
authentication mechanisms (discussed shortly), cryptographic methods (e.g., file hashing),
and checksums.
Availability
Availability means having information and the systems that process it readily accessible by
authorized users any time and in any manner they require. Systems and information do users
little good if they can’t get to and use those resources when needed, and simply preventing
their authorized use contradicts the availability goal. Availability can be denied accidentally
by a network or device outage, or intentionally by a malicious entity that destroys systems and
data or prevents use via denial-of-service attacks. Availability can be ensured through various
means including equipment redundancy, data backups, access control, and so on.
Supporting Tenets of Information Security
Security tenets are processes that support the three goals of security. The security tenets are
identification, authentication, authorization, auditing, accountability, and nonrepudiation.
Note that these may be listed differently or include other principles, depending on the source
of knowledge or the organization.
Identification
Identification is the act of presenting credentials that state (assert) the identity of an individ-
ual or entity. A credential is a piece of information (physical or electronic) that confirms the
identity of the credential holder and is issued by an authoritative source. Examples of creden-
tials used to identify an entity include a driver’s license, passport, username and password
combination, smart card, and so forth.
Authentication
Authentication occurs after identification and is the process of verifying that the credential
presented matches the actual identity of the entity presenting it. Authentication typically
occurs when an entity presents an identification and credential, and the system or network
verifies that credential against a database of known identities and characteristics. If the iden-
tity and credential asserted matches an entry in the database, the entity is authenticated.
12 CISSP Passport
Once this occurs, an entity is considered authenticated to the system, but that does not mean
that they have the ability to perform any actions with any resources. This is where the next
step, authorization, comes in.
Authenticity
Authenticity goes hand-in-hand with authentication, in that it is the validation of a user, an
action, a document, or other entity through verified means. User authenticity is established
with strong authentication mechanisms, for example; an action’s authenticity is established
through auditing and accountability mechanisms, and a document’s authenticity might be
established through integrity checks such as hashing.
Authorization
Authorization occurs only after an entity has been authenticated. Authorization determines
what actions the entity can take with a given resource, such as a computer, application, or
network. Note that it is possible for an entity to be authenticated but have no authorization
to take any action with a resource. Authorization is typically determined by considering an
individual’s job position, clearance level, and need-to-know status for a particular resource.
Authorization can be granted by a system administrator, a resource owner, or another entity
in authority. Authorization is often implemented in the form of permissions, rights, and privi-
leges used to interact with resources, such as systems and information.
EXAM TIP Remember that authorization consists of the actions an individual can
perform, and is based on their job duties, security clearance, and need-to-know,
Auditing and Accountability
Accountability is the ability to trace and hold an entity responsible for any actions that entity
has taken with a resource. Accountability is typically achieved through auditing. Auditing is
the process of reviewing all interactions between an entity and an object to evaluate the effec-
tiveness of security controls. An example is auditing access to a network folder and being able
to conclusively determine that user Gary deleted a particular document in that folder. Audit-
ing would rule out that another user performed this action on that resource. Most resources,
such as computers, data, and information, can be audited for a variety of actions, such as
access, creation, deletion, and so forth. The most frequent manifestation of auditing is through
audit trails or logs, which are generated by the system or object being audited and record all
actions that any user takes with that system or object.
Nonrepudiation
To hold entities, such as users, accountable for the actions they perform on objects, we must
be able to conclusively connect their identity to an event. Auditing is useful for recording
Another random document with
no related content on Scribd:
CHAPTER XLI.
DECISION OF THE UMPIRES.
A.H. XXXVII. A.D. 658.
The interval passed uneasily. Muâvia
ruled in Syria; Aly, over the rest of the The interregnum.
Moslem world. Neither, for the moment,
interfered with the other. The empire held itself in suspense.
Within the time appointed, Amru
appeared at Dûma, and, shortly after, Abu The Umpires meet.
Mûsa. Each was followed, according to Ramadhân, a.h. XXXVII.
Feb. a.d. 658.
agreement, by a retinue of four hundred
horsemen.[543] Thither also, to the neutral spot, flocked multitudes
from Irâc and from Syria, from Mecca and Medîna. With intense
interest they watched the strange proceeding, which (as they
expected) was about to decide the future of Islam. The leading chiefs
of the Coreish were also there; some, we are told, with the distant
hope that haply the choice might fall on one of themselves.[544]
The Umpires met in a pavilion pitched
for the occasion; and beneath it, a private And confer with each other.
conference was held between the two
alone. The account given by our authorities of what passed between
them, is very brief. The result we must accept, but the colloquy which
led to it is altogether of an uncertain kind. The gist of it is as follows.
Abu Mûsa, pressed by his astute colleague, admitted that the putting
of Othmân to death was a wicked and unjustifiable thing. ‘Then why,’
rejoined Amru, ‘wilt thou not take Muâvia, the avenger of blood, for
his successor?’ ‘If it were a mere question of blood-feud or
kinsmanship,’ Abu Mûsa answered, ‘there were Othmân’s sons with
a nearer claim. Succession to the throne, however, was a matter to
be determined, not by such considerations, but by the vote of the
chief Companions of the Prophet.’ Amru (so the story runs) then
proposed his own son: ‘A just and good man,’ replied Abu Mûsa, ‘but
one whom thou hast already made to take sides in the civil war; and,
Amru! we must above all things beware of kindling mutiny again
amongst the Arab tribes.’ A similar objection shut out Abdallah son of
Zobeir; and the son of Omar was put aside as not having qualities
fitting him for command. ‘Then,’ asked Amru, after all the possible
candidates had been named and negatived, ‘what may be the
judgment that thou wouldest give?’ ‘My judgment,’ answered Abu
Mûsa, ‘would be to depose both Aly and Muâvia, and then leave the
people free to choose whom they will.’ ‘Thy judgment is also mine,’
said Amru promptly; ‘let us go forth.’
The people, in breathless expectation
of the impending announcement, crowded The judgment.
round the pavilion as the Umpires issued
from it. ‘Let them know,’ said Amru to his fellow, ‘that we are agreed.’
Abu Mûsa advanced, and with voice loud and clear,[545] said: ‘We
are agreed upon a decision such as, we trust, will reconcile the
people, and reunite the empire.’ ‘He speaketh true,’ said Amru: ‘step
forth, O Abu Mûsa, and pronounce thy judgment.’[546] Then spoke
Abu Mûsa: ‘Ye people! we have considered the matter well. We see
no other course so likely to restore peace and concord amongst the
people, as to depose Aly and Muâvia, both the one and the other.
After that, ye shall choose a fit man in their room. This is my
judgment.’ He stepped aside, and Amru
advancing said: ‘Ye have heard the Deposing Aly.
sentence of Abu Mûsa. He hath deposed
his fellow; and so do I too depose him. But as for my Chief, Muâvia,
him do I confirm. He is the heir of Othmân, and as avenger of his
blood, the best entitled to succeed.’
The assembly was thunderstruck. Even
the Syrians had never dreamed of Muâvia The people thunderstruck.
achieving such a triumph; nor had it
entered the minds of those on Aly’s side, that their Umpire could be
overreached thus shamefully. ‘What could I do?’ cried Abu Mûsa,
assailed on every hand; ‘he agreed with me, then swerved aside.’
‘No fault of thine,’ said the son of Abbâs: ‘it was the fault of those
who put thee in the place.’ Overwhelmed with reproaches, Abu Mûsa
made his escape and fled to Mecca, where he thenceforward lived in
obscurity.[547] In the heat of his indignation,
the commander of the Kûfa body-guard Muâvia saluted Caliph by the
Syrians.
made an onset upon Amru, and was
roughly handling him, when the people interposed to set him free.
Amru returned forthwith to Damascus, where by acclamation Muâvia
was saluted Caliph by the Syrians.
How the startling intelligence affected
Aly, may be judged by the fact that to the The two Caliphs curse each
other in the daily service.
prescribed daily service he added a
petition cursing by their names, Muâvia, Amru, and several of their
chief adherents. Muâvia was nothing loth to follow his example. And
so the world was edified by the spectacle, in the cathedral temples of
Islam, of the rival Commanders of the Faithful uttering maledictions
in their daily prayers, the one against the other.[548]
CHAPTER XLII.
THE KHAREJITES, OR THEOCRATIC SEPARATISTS, DEFEATED
AT NEHRWAN.
A.H. XXXVII. A.D. 658.
Aly, as the reader will suppose, was not
content with heaping imprecations on his Aly’s designs against Syria.
antagonist. He resolved on the immediate
renewal of hostilities. But he had other work before him first in
dealing with the fanatics nearer home.
Ever since they had broken up their
camp at Harôra, these, instead of settling Hostile attitude of the
down in sentiments of loyalty and peace, theocractic faction.
Ramadhân, a.h. XXXVII.
had been gaining in aggressive force and Jan. a.d. 658.
stubbornness. There should (such was
their cry) be no oath of fealty but to the Lord alone, the Mighty and
the Glorious. To swear allegiance either to Aly or Muâvia was in
derogation of that great name. ‘Ye are both of you,’ they would say,
‘coursing along, neck and neck, in the race of apostasy: the Syrians
run after Muâvia whether the way be right or wrong, and ye swear for
Aly through black and white. It is nought but blasphemy.’ So they
formulated their creed into one short sentence: No judgment, but the
Lord’s alone; and this they insolently flung in Aly’s teeth.[549] In vain
the Caliph argued, as he had done before, that the Arbitration had
been forced upon him by themselves. ‘It is true,’ they would readily
reply; ‘but we have repented of that lapse; and thou must repent of it
likewise, or else we shall fight against thee; and if so be that we are
slain, we shall meet our Lord with joy.’ Aly
yet hoped to gain them over. He bore with Aly’s forbearance.
their seditious talk; and in a public address
in the Great Mosque at Kûfa, he declared his intention of treating
them with forbearance. ‘They should have free access to the
mosques for prayer. If they joined his army, they should share the
booty like the rest. So long as they refrained themselves from any
overt act of disloyalty, he would use no force of arms against them.’
Instead of softening the fanatics, this
moderation only tended to embolden them. The Khârejites march to
Nehrwân. Shawwâl, a.h.
When the Umpires’ judgment was XXXVII. March, a.d. 658.
announced, they were elated at a result
which in their eyes amply justified their secession at Siffîn. They held
frequent meetings in secret, and resolved on raising the Divine
standard. They looked for heavenly interposition; but even if they
perished, it would be in a righteous cause, sure to triumph in the
end; they would, at any rate, be protesting against a wicked world,
and become inheritors of a blessed futurity. In the month following
the Arbitration, they began accordingly, in concert with the brethren
who sympathised with them at Bussorah, to leave their homes by
stealth. The party from Bussorah, five hundred strong, was pursued
by the governor, Ibn Abbâs; but they effected their escape, and
joined the bands which in greater force had issued forth from Kûfa.
Secular power, and the dignity and pomp of this life, were abhorrent
from these Covenanters’ creed; and it was only after many had
declined the dangerous pre-eminence, and then simply as a
temporary expedient to meet the present necessity, that a chief was
prevailed on to accept the supreme command. The design was to
occupy the city of Medâin, upon the Tigris, and there, under a
Council of Representatives, establish theocratic rule as a model to
the ungodly cities around. But the governor had timely warning, and
repulsed the attempt. They passed on, and crossed the river farther
up in various bodies, and, appointing Nehrwân as their rendezvous,
assembled there to the number of 4,000.
Aly did not at first recognise the serious
character and bearing of the movement. Aly orders levy for Syrian
campaign.
The number of the fanatics was
comparatively insignificant; and he hoped that, when they saw their
former comrades in arms marching against the graceless Syrians,
they would not hesitate again to join his standard. So he mounted
the pulpit and harangued the men of Kûfa. He reprobated the
Umpires, because they had cast the Book of the Lord, equally with
the precedent of the Prophet, behind their backs. Both were
apostates, rejected of the Lord, of his Prophet, and of all good men.
‘Wherefore,’ he concluded, ‘we must begin to fight our battle again at
the point where, on the eve of victory, we were forced to leave it off.
Prepare then to march for Syria, and be ready in your camp without
the city, by the second day of the coming week.’ Then he indited a
despatch to the fanatics at Nehrwân. It was
couched in terms similar to his address, And summons the theocrats,
and ended thus: ‘Now, therefore, when ye who refuse to join him.
have read this, return forthwith and join the army. I am marching
against the common enemy, yours and ours alike; and we have
come back again to the state of things when aforetime at Siffîn ye
were fighting by my side.’ In reply Aly received an insulting message:
‘If he acknowledged his apostasy and repented thereof, then they
would see whether anything could be arranged between them;
otherwise they cast him off as an ungodly heretic.’ The stiff-necked
theocrats were thereupon, for the present, left to their own devices,
and the business of raising levies for Syria proceeded with. But little
enthusiasm was anywhere displayed in the
cause of Aly. Of the 60,000 fighting men Aly marches for Syria.
drawing stipendiary allowances in
Bussorah, 3,000 were with difficulty got together. At Kûfa, after vain
appeal to the loyalty of the city, a conscription was ordered through
the heads of clans; and thus at length an army of threescore and five
thousand men of every rank and class was brought into the field.[550]
With this imposing force, Aly had
already commenced his march on Syria, But is diverted by the
when tidings reached him that the fanatics excesses of the fanatic host.
were committing horrid and cold-blooded outrages in the country
round about their camp.[551] A messenger was sent to make inquiry;
but he too was put to death by the insurgents. The tidings of their
proceedings became more and more alarming, and the men of Kûfa
demanded to be led against them; ‘for how,’ said they, ‘can we leave
such outlaws unpunished and at large behind us, and our homes
exposed to their unlicensed cruelties?’ Aly himself, seeing that this
must be done, changed his course eastward, crossed the Tigris, and
marched against the fanatics. When now near to Nehrwân, he sent a
messenger forward, to demand that the murderers should be
delivered up. ‘Surrender these to justice,’ he said, ‘and ye shall be
left alone, until the Lord grant us victory in Syria, and then haply He
shall have turned your hearts again toward us.’ They replied that
‘they were all equally responsible for what had passed, and that the
blood of the ungodly heretics they had slain was lawful to them.’ A
parley ensued, in which the Caliph through his captains expostulated
with the misguided fanatics, and offered quarter to all who should
come over to his army, or retire peaceably to their homes. Some
obeyed the call and came over; 500 went
off to a neighbouring Persian town, and The fanatics at Nehrwân
many more dispersed in other directions to dispersed and slain.
their homes at Kûfa or elsewhere. Eighteen hundred remained upon
the field, martyrs to the theocratic creed. With the wild battle cry, On
to Paradise! they rushed upon the Kûfa lances, and were slain to a
man. Aly’s loss was trifling.[552]
It would have been better for the peace
of Islam if none of the four thousand had The Khârejites again appear
escaped. The snake was scotched, not in the field. a.h. XXXVII. a.d.
658.
killed. The fanatic spirit was strangely
catching; and the theocratic cause continued to be canvassed
vigorously and unceasingly, but in secret, at Bussorah and at Kûfa.
However hopeless the attainment of their object might appear, the
fanatics were nerved, if not by the expectation of Divine aid, at the
least by the sure hope of a Martyr’s crown. In the following year
armed bodies once and again appeared unexpectedly in the field,
denouncing Aly, and proclaiming that the Kingdom of the Lord was at
hand. One after another these bands of insurgent fanatics were cut
to pieces, or put to flight with ease. But the effect was unsettling; and
it could not but endamage the name and power of Aly, who now
reaped the fruit of his weak compromise with the enemies of
Othmân, and his neglect to bring them to justice. Fanatical in their
extravagant doctrine, they were too sincere
to combine with any of the political sects, They become a thorn in the
and hence they never came near to Moslem empire.
leaving any permanent mark of their theocratic creed behind them.
But both at this period and in succeeding reigns, we find them at
intervals gathering up their strength to assail the empire, and as
often beaten back. Ever and anon, for years, and even for ages,
these Khârejites still ‘went forth’[553] on their desperate errand, a
thorn in the side of the Caliphate, and a terror to the well-disposed.
CHAPTER XLIII.
REVOLT OF EGYPT.
A.H. XXXVIII. A.D. 658.
Having thus disposed of the fanatics at
Nehrwân, and recrossed the Tigris, Aly, at Aly abandons the war
the head of his army, turned his face again against Syria. End of XXXVII.
April, a.d. 658.
towards Syria. But the soldiers urged that,
before setting out upon so long a campaign, their armour needed
refitting. ‘Let us return for a little to our homes,’ they said, ‘to furbish
up our swords and lances, and to replenish our quivers.’ Aly
consenting, they marched back and pitched their camp at Nokheila.
This being close to Kûfa, the soldiers dropped off in small parties
thither; and so it came to pass that, in a short time, excepting
commanding officers, the camp was left almost empty. Aly, finding
that no man returned, became impatient, and himself re-entering
Kûfa, again harangued the people on the obligation to go forth with
him and make war on Syria. But exhortation and reproach fell
equally on listless ears. There was no response. Aly lost heart. The
Syrian expedition fell through; and no attempt was made to resume it
further.
Thus closed the thirty-seventh year of
the Hegira. The situation was unchanged. Position of Aly and Muâvia.
Muâvia, with now a colourable title to the
Caliphate, remained undisturbed in his position virtual monarch of
Syria, strong in the loyalty and affections of the province; while Aly,
mortified by an indifferent and partly alienated people, was now to
experience a severer trial.
We turn to Egypt. Before the Syrian war, as already stated, there
was a powerful faction in that dependency of Aly’s Caliphate,
especially at Kharanba, siding with those who demanded satisfaction
for the blood of Othmân; and Cays, having been recalled for leaving
these dissentients alone, Mohammed son of Abu Bekr had been
appointed in his room. Casting aside the
waiting policy of his wiser predecessor, Egypt revolts. a.h. XXXVIII.
Mohammed at once summoned the a.d. 658.
recusants, either to submit themselves to him, or to be gone from
Egypt. They refused, but masking for the present their hostile
designs, watched the issue of the struggle at Siffîn. When the armies
separated from that battle-field, leaving Muâvia still master of Syria,
they gained heart and began to assume the offensive. A party sent
against them was defeated, and the leader slain; and a second
attempt at retrieving the loss met with a like fate. The slumbering
elements of revolt were everywhere aroused.
Aly saw now the mistake which he had
made, but too late. He would have Ashtar, appointed governor,
is poisoned.
reappointed Cays; but Cays declined again
to take the post. The only other fitted for the emergency was Ashtar
the regicide, whom he summoned from his command at Nisibîn, and
sent off in haste to Egypt. But on the way he met with an untimely
death, having been poisoned, at the instigation (it is said) of Muâvia,
by a chief on the Egyptian border with whom he rested.[554] There
was joy at the death of the arch-regicide throughout the land of
Syria, where he had been greatly feared. Aly was equally cast down
by the untoward event. His only resource was now to bid
Mohammed son of Abu Bekr hold on, and do what he could to
retrieve his position. But the faction which
favoured Muâvia gained ground daily; and Mohammed killed and Egypt
when, shortly after, Amru, at the head of a conquered by Amru for
Muâvia. Safar, a.h. XXXVIII.
few thousand men, crossed the border, he July, a.d. 658.
was joined by an overwhelming body of
insurgents. Mohammed, after a vain attempt to meet his enemy in
the field, was easily put to flight. In the struggle he was killed, and his
body ignominiously burned in an ass’s skin.[555] Thus Egypt was lost
to Aly; and Amru, as the lieutenant of the rival Caliph, again became
its governor.
The loss of Egypt was the harder for
Aly to bear, as undoubtedly it might have Mortification of Aly at the
loss, and at the
been averted but for his removal of Cays; lukewarmness of Kûfa.
and even now it might have been retrieved
if the men of Kûfa had not been heartless in his cause. Over and
again he implored them to hasten to the defence of Egypt. With
difficulty two thousand men were got together; but after so long a
delay that they had hardly marched before news of the defeat made
it necessary to recall them. Aly thereupon ascended the pulpit, and
upbraided the people for their spiritless and disloyal attitude. For fifty
days, he had been urging them to go forth, to avenge their fallen
brethren, and to help those who were still struggling for him in the
field. Like a restive wayward camel, that refused its burden, they had
held back. ‘And now,’ he said, in grief and bitterness of spirit, ‘the
son of Abu Bekr is fallen a martyr, and Egypt hath departed from us.’
CHAPTER XLIV.
THE REMAINDER OF ALY’S REIGN.
A.H. XXXVIII.–XL. A.D. 658–660.
No gleam of fortune lighted up the
remaining days of Aly’s reign. What with Remainder of Aly’s reign.
the rising of fanatics at home, and the
threats of the rival Caliphate abroad, his life was one continual
struggle. And, moreover, the daily exhibition of indifference and
disloyalty in Kûfa, the city of his choice, was a burden and
mortification hard to bear.
The loss of Egypt, and the cruel death
of Mohammed son of Abu Bekr, preyed Insurrection at Bussorah
upon his mind. He withdrew into the suppressed.a.d. 658.
a.h. XXXVIII.
strictest privacy. Ibn Abbâs, fearful lest his
cousin should resign the Caliphate, or do some other rash and
unadvised thing, set out from Bussorah to visit and comfort him. This
becoming known to Muâvia, he took the opportunity, during the
absence of Ibn Abbâs, to send an emissary with the view of stirring
up the disaffected elements at Bussorah. Among certain of the clans,
he was sure of finding many who, equally with himself, sought to
avenge the blood of Othmân; few were zealously attached to the
cause of Aly; the remainder were mostly Khârejites, of the theocratic
faction, now as hostile to Aly as to Muâvia himself. Abdallah, the
Syrian agent, carrying a letter to the citizens of Bussorah, was so
well received, that Ziâd, who held temporary charge of the city, was
forced to retire with the treasures and the gubernatorial pulpit into
the stronghold of a loyal clan, from whence he wrote for help to Kûfa.
Aly at once despatched a chief of influence among the Beni Rabia,
the leading tribe at Bussorah, who were by his persuasion induced to
rally round Ziâd. After severe and bloody fighting in the city, attended
by various success, the rebels were at last defeated, and driven for
refuge to a neighbouring castle. There they were surrounded, and
the castle having been set on fire, Abdallah, with seventy of his
followers, perished in the flames. The victory was decisive for the
time; but the insurrection had brought to light the alarming spread of
disaffection, and showed how precarious was Aly’s grasp upon the
Bedouin races of this factious city.
The spirit of disturbance and unrest
was not confined to Egypt and to Khârejite émeutes.
Bussorah. During the year, we read of five
or six occasions on which considerable bands of Khârejites were
impelled by their theocratic creed to go forth and raise the standard
of rebellion. One after another they met the common fate of
slaughter and dispersion. But though crushed, the frequent repetition
of such desperate enterprises, the fruit of a wild and reckless
fanaticism, had a disturbing effect on the capital and the empire at
large. The most serious of these risings
was that led by Khirrît; and it is the more Rebellion of Khirrît in
remarkable, because this chief had with his Southern Persia,
XXXXVIII. a.d. 658.
a.h.
tribe, the Beni Nâjia, fought bravely by the
side of Aly in the battles both of the Camel and Siffîn. He was now
driven, like many others, by his strong convictions to rebel. Boldly
approaching the throne, he told Aly that since he, as Caliph, had
referred a Divine issue to the arbitration of man, he could obey him
no more, neither stand up behind him in the Mosque at prayer; but
henceforth was sworn to be his enemy. Aly, with his usual patience,
said that he would argue out the matter with him, and arranged a
meeting for the purpose. But the night before the appointed day,
Khirrît stole away from the city with all his following. ‘Gone,’ said Aly,
‘to the devil; lost, like the doomed Thâmudites!’ They were pursued,
but by so small a party that they held it at bay, and in the end
effected their escape to Ahwâz and Râm Hormuz. There they raised
the Persians, Kurds, and Christian mountaineers, by the specious
and inflammatory cry that the payment of taxes to an ungodly Caliph
must be renounced. With a band of apostate Arabs, they kindled
revolt throughout the province of Fars, and put the governor to flight.
A force from Bussorah drove them to the
shores of the Indian Ocean. But luring the suppressed, and Khirrît slain.
people by delusive arguments and
promises, they still gained head; and it was not till after a bloody
battle, in which Khirrît lost his life, that the supremacy of the
Caliphate was re-established in Southern Persia. The Mussulman
prisoners in this campaign were set at
liberty on their taking afresh the oath of Christian captives.
allegiance; but the Christians, five hundred
in number, were all marched away to be sold into captivity. The
women and children, as they were torn from their protectors, wailed
with loud and bitter cries. The hearts of many were softened.
Mascala, Governor of Ardshîr, touched by the scene, took upon
himself the cost of ransoming these Christian captives, and set them
free. Aly, hearing of it, demanded from him immediate payment at a
thousand pieces for each captive; and Mascala, unable to pay down
so great a sum, fled and joined Muâvia.[556]
The defeat of the Khârejites did not at
once restore peace to Persia; for Fars and Ziâd suppresses rebellion in
Kermân threw off their allegiance, and Persia, a.h. XXXIX. a.d. 659,
expelled their governors. To quell the spreading insurrection, Aly was
happy in the selection of Ziâd, the Chancellor of Bussorah, a man,
as we have seen, of conspicuous administrative ability. He carried
with him a great court and retinue; but it was mainly by his ready tact
in setting one rebellious prince against another, and by well-
appointed promises and favours, that he succeeded in restoring
peace. Aly recognised his service by
conferring on him the government of Fars; and is appointed Governor of
and his administration there became so Fars.
famous as to recall to Persian memories the happy age of
Nushirwân. He fixed his court at Istakhr (Persepolis), and built a
castle there, in connection with which his name was remembered for
many ages following.
Though successful thus in Persia, Aly
was still subject to trouble and molestation Expeditions from Syria
against Irâc. a.h. XXXVIII-IX.
nearer home. Muâvia, relieved now from a.d. 658–9.
apprehension on the side of Egypt, began
to annoy his rival by frequent raids on Arabia and the cities beyond
the Syrian desert. The object was various—now to ravage a province
or surprise a citadel, now to exact the tithe from the Bedouin tribes,
or, again, to force upon them allegiance to the Syrian Caliphate.
Such inroads, though not always successful, inspired a sense of
insecurity; and, what was worse than that, they betrayed more
clearly than ever the lukewarmness of the people in the cause of Aly.
These would stir neither hand nor foot to repel the Syrians invading
cities so close to them even as Ain Tamr, Anbâr, and Hît. To show his
displeasure at their listlessness and
disobedience, Aly went forth himself into Safar, a.h. XXXIX. June, a.d.
the field almost unattended. On this, the 659.
men of Kûfa, partly through shame, partly lured by the promise of
increased stipends, marched to the defence of their frontier. During
the year there were eight or ten inroads of this kind from Syria.
Though eventually repelled, it was not always without loss in
prisoners, plunder, and prestige. On one occasion, however, Aly’s
commander, with a flying column, pursued the raiders back into the
heart of Syria as far as Baalbek; and thence, turning northward,
escaped by Ricca again into Irâc. On the
other hand, Muâvia, to show his contempt Muâvia visits Mosul.
for the power of Aly, made an incursion
right across the plain of Upper Mesopotamia. For some days he
remained encamped on the banks of the Tigris; and, after leisurely
inspecting Mosul, which he had never seen before, made his way
back again to Damascus unmolested.
The fortieth year of the Hegira opened
with a new grief for Aly. At the close of the Raid of Bosor on Medîna,
year preceding, as the annual pilgrimage Mecca, and Yemen. a.h. XL.
a.d. 660.
drew near, Muâvia sent Bosor, a brave but
cruel captain of his host, with three thousand men into Arabia, to
secure for him the allegiance of the sacred cities. As he drew nigh to
Medîna, Abu Ayûb, the governor, fled to Kûfa, and Bosor entered
unopposed. Proceeding to the Great Mosque, he mounted the
sacred steps of the Prophet’s pulpit, and, recalling Othmân to mind,
thus addressed the people: ‘O citizens of Medîna! The Aged Man!
Where is the aged, grey-haired man whom, but as yesterday, and in
this very place, I swore allegiance to? Verily, but for my promise to
Muâvia, who bade me stay the sword, I had not left here a soul
alive!’ Then he threatened the leading citizens with death if they
refused to acknowledge Muâvia as their Caliph; and so, fearing for
their lives, all took the oath of allegiance to the Omeyyad ruler.
Passing on to Mecca, the same scene was enacted by the imperious
envoy there, and with the same result.[557] Then he marched south
to Yemen, where he committed great atrocities upon the adherents
of Aly. The governor, Obeidallah son of
Abbâs, escaped to his cousin at Kûfa. But He slays the infant children of
two of his little children, falling into the Aly’s cousin.
tyrant’s hands, were put to death in cold blood, as well as their
Bedouin attendant, who ventured to protest against the cruel act. An
army of four thousand men was despatched in haste from Kûfa, but
too late to stop these outrages; and Bosor made good his escape to
Syria. The wretched peninsula fared no better at the hands of the
relieving army. Many of the inhabitants of Najrân were put to death,
because they belonged to the party of Othmân. The men of Mecca
were forced to recall the oath they had just taken, and again do
homage to Aly. Similarly, the citizens of Medîna swore allegiance to
Hasan, son of Aly, at the point of the sword;[558] but no sooner were
the troops gone, than Abu Horeira, of the opposite faction, resumed
his functions as leader of the daily prayers. The cruel death of his
cousin’s infant children preyed on Aly more, perhaps, than all his
other troubles put together; and he cursed Bosor in the daily service
with a new and bitter imprecation. The disconsolate mother poured
forth her sorrow in plaintive verse, some touching couplets of which
still survive.[559]
Yet another grief was in store for Aly.
He had promoted his cousins, the sons of Abdallah son of Abbâs
Abbâs, to great dignity, giving the chief retires to Mecca.
command in Yemen to one, in Mecca to another, in Medîna to a third;
while Abdallah, the eldest, held the government of Bussorah, the
second city in his Caliphate. Complaints having reached the Court of
certain irregularities in the administration of Bussorah, Aly called
upon his cousin to render an account. Scorning to answer the
demand, Abdallah threw up his office, and, carrying his treasures
with him, retired to Mecca. Aly was much mortified at this unfriendly
act; and still more so by the desertion of his own brother, Ackîl, who
went over to Muâvia.[560]
These troubles, crowding rapidly one
upon another, entirely broke the spirit of Aly, broken in spirit,
Aly. He had no longer the heart to carry on concludes truce with Muâvia.
a.h. XL. a.d. 660.
hostilities with Syria. If he might secure the
Eastern provinces in peaceful subjection to himself, it was all that he
could hope for now. Accordingly, after lengthened correspondence,
an armistice was concluded between Aly and Muâvia, by which they
agreed to lay aside their arms, respect the territory of each other,
and maintain a friendly attitude.
It is possible that a double Caliphate
thus recognised, in two separate and The double Caliphate.
independent empires, by the Rulers of the
East and of the West, might have been prolonged indefinitely, or
even handed down in perpetuity, had not the tragical event occurred
which will be narrated in the following chapter.
You might also like
- CompTIA Network+ Certification Passport, 7th Edition Exam N10 008Document449 pagesCompTIA Network+ Certification Passport, 7th Edition Exam N10 008Dhanraj chavan100% (3)
- Hacking Any Files in FTP, Google and Rapid ShareDocument6 pagesHacking Any Files in FTP, Google and Rapid Shareapi-370661286% (7)
- CISSP PassportDocument481 pagesCISSP PassportTi Amero100% (2)
- 8085 Instruction SetDocument27 pages8085 Instruction Setbostanci100% (1)
- Storage and WarehousingDocument15 pagesStorage and WarehousingTonyo LinaNo ratings yet
- ProcessorsDocument44 pagesProcessorsRAHA TUDU100% (4)
- Ebook Cism Certified Information Security Manager All in One Exam Guide 2Nd Edition PDF Full Chapter PDFDocument67 pagesEbook Cism Certified Information Security Manager All in One Exam Guide 2Nd Edition PDF Full Chapter PDFgerald.loesch285100% (28)
- Isb 2223 Guide Book Group 3Document53 pagesIsb 2223 Guide Book Group 3meetup_chitraNo ratings yet
- مكتبة نور أم البراهين للإمام أبي عبد الله محمد بن يوسف السنوسي التلمساني 2 PDFDocument98 pagesمكتبة نور أم البراهين للإمام أبي عبد الله محمد بن يوسف السنوسي التلمساني 2 PDFAzam AlinaNo ratings yet
- Cissp Passport 1St Edition Bobby E Rogers Full ChapterDocument67 pagesCissp Passport 1St Edition Bobby E Rogers Full Chapterelaine.johnson720100% (6)
- A Concise Geologic Time Scale 1St Edition J G Ogg Full ChapterDocument67 pagesA Concise Geologic Time Scale 1St Edition J G Ogg Full Chapterlouis.cintron696100% (7)
- Cissp Practice Exams Fourth Edition Shon Harris Full ChapterDocument59 pagesCissp Practice Exams Fourth Edition Shon Harris Full Chapterelaine.johnson720100% (7)
- Tactical Air Power and The Vietnam War Explaining Effectiveness in Modern Air Warfare Phil M Haun Full ChapterDocument58 pagesTactical Air Power and The Vietnam War Explaining Effectiveness in Modern Air Warfare Phil M Haun Full Chaptermichelle.blair427100% (7)
- A Complete Resource Book in Physics For Jee Main 2019 Sanjeev Kumar Full ChapterDocument67 pagesA Complete Resource Book in Physics For Jee Main 2019 Sanjeev Kumar Full Chapterlouis.cintron696100% (7)
- Tactical Publishing Using Senses Software and Archives in The Twenty First Century Alessandro Ludovico Full ChapterDocument68 pagesTactical Publishing Using Senses Software and Archives in The Twenty First Century Alessandro Ludovico Full Chaptermichelle.blair427100% (8)
- Cities Responding To Climate Change Copenhagen Stockholm and Tokyo 1St Edition Stephen Jones Auth Full ChapterDocument55 pagesCities Responding To Climate Change Copenhagen Stockholm and Tokyo 1St Edition Stephen Jones Auth Full Chapterelaine.johnson720100% (8)
- A Comprehensive Guide To Sports Physiology and Injury Management An Interdisciplinary Approach Stuart Porter Full ChapterDocument68 pagesA Comprehensive Guide To Sports Physiology and Injury Management An Interdisciplinary Approach Stuart Porter Full Chapterlouis.cintron696100% (7)
- Labor and Aesthetics in European Contemporary Dance Dancing Precarity 1St Ed Edition Annelies Van Assche Full ChapterDocument68 pagesLabor and Aesthetics in European Contemporary Dance Dancing Precarity 1St Ed Edition Annelies Van Assche Full Chaptergregory.pederson600100% (7)
- Citizen Knowledge Markets Experts and The Infrastructure of Democracy Lisa Herzog Full ChapterDocument67 pagesCitizen Knowledge Markets Experts and The Infrastructure of Democracy Lisa Herzog Full Chapterelaine.johnson720100% (7)
- American Government and Politics Today Enhanced 18Th Edition Barbara A Bardes Full ChapterDocument67 pagesAmerican Government and Politics Today Enhanced 18Th Edition Barbara A Bardes Full Chapterkaryn.corman836100% (5)
- Tactical Medicine Essentials 2Nd Edition John E Campbell Full ChapterDocument67 pagesTactical Medicine Essentials 2Nd Edition John E Campbell Full Chaptermichelle.blair427100% (7)
- A Complete Guide To Devops With Aws Deploy Build and Scale Services With Aws Tools and Techniques Osama Mustafa Full ChapterDocument68 pagesA Complete Guide To Devops With Aws Deploy Build and Scale Services With Aws Tools and Techniques Osama Mustafa Full Chapterlouis.cintron696100% (6)
- Sexuality and Its Disorders Development Cases and Treatment 1St Edition Abrams Test Bank Full Chapter PDFDocument27 pagesSexuality and Its Disorders Development Cases and Treatment 1St Edition Abrams Test Bank Full Chapter PDFlynda.hoover522100% (12)
- Citizen Fetus The Changing Image of Motherhood Alessandra Piontelli Full ChapterDocument62 pagesCitizen Fetus The Changing Image of Motherhood Alessandra Piontelli Full Chapterelaine.johnson720100% (5)
- American Government in Black and White Diversity and Democracy Third Edition Mcclain Full ChapterDocument67 pagesAmerican Government in Black and White Diversity and Democracy Third Edition Mcclain Full Chapterkaryn.corman836100% (4)
- Download textbook Herzogs Ccu Book Eyal Herzog Md ebook all chapter pdfDocument53 pagesDownload textbook Herzogs Ccu Book Eyal Herzog Md ebook all chapter pdfjoe.murrell987100% (7)
- Vaughn Barb Han All ChapterDocument67 pagesVaughn Barb Han All Chapterkelly.lee738100% (4)
- International Relations Last Synthesis Decoupling Constructivist and Critical Approaches Barkin Full ChapterDocument67 pagesInternational Relations Last Synthesis Decoupling Constructivist and Critical Approaches Barkin Full Chapterrussell.amie326100% (5)
- Anatomy Physiology Elizabeth Mack Co Full ChapterDocument50 pagesAnatomy Physiology Elizabeth Mack Co Full Chapterjoann.meyer664100% (3)
- Goodman Gilmans The Pharmacological Basis of Therapeutics 13Th Edition Laurence L Brunton Full ChapterDocument67 pagesGoodman Gilmans The Pharmacological Basis of Therapeutics 13Th Edition Laurence L Brunton Full Chapterclara.yanez755100% (4)
- La Mamma Interrogating A National Stereotype 1St Ed 2018 Edition Penelope Morris Full ChapterDocument67 pagesLa Mamma Interrogating A National Stereotype 1St Ed 2018 Edition Penelope Morris Full Chaptergregory.pederson600100% (6)
- Citizen Support For Democratic and Autocratic Regimes Marlene Mauk Full ChapterDocument67 pagesCitizen Support For Democratic and Autocratic Regimes Marlene Mauk Full Chapterelaine.johnson720100% (6)
- Mapping South American Latina O Literature in The United States 1St Ed Edition Juanita Heredia Download PDF ChapterDocument51 pagesMapping South American Latina O Literature in The United States 1St Ed Edition Juanita Heredia Download PDF Chapternona.woods574100% (15)
- Anatomy Physiology The Unity of Form and Function 8Th Edition Edition Kenneth S Saladin Full ChapterDocument51 pagesAnatomy Physiology The Unity of Form and Function 8Th Edition Edition Kenneth S Saladin Full Chapterjoann.meyer664100% (4)
- VCP DCV For Vsphere 7 X Exam 2V0 21 20 Official Cert Guide Vmware Press Certification 4Th Edition Steve Baca All ChapterDocument68 pagesVCP DCV For Vsphere 7 X Exam 2V0 21 20 Official Cert Guide Vmware Press Certification 4Th Edition Steve Baca All Chapterkelly.lee738100% (4)
- Construction Safety Health Practices and Osha 1St Edition Islam Full ChapterDocument37 pagesConstruction Safety Health Practices and Osha 1St Edition Islam Full Chapterclyde.baumgardner731100% (15)
- The Facial Displays of Leaders Carl Senior Full ChapterDocument67 pagesThe Facial Displays of Leaders Carl Senior Full Chapterhope.staubin693100% (4)
- Solution Manual For Nutrition For Health and Healthcare 6Th Edition Debruyne Pinna 1305627962 9781305627963 Full Chapter PDFDocument35 pagesSolution Manual For Nutrition For Health and Healthcare 6Th Edition Debruyne Pinna 1305627962 9781305627963 Full Chapter PDFmary.cannon812100% (14)
- Anatomy Physiology The Unity of Form and Function 10Th International Student Edition Edition Kenneth S Saladin Full ChapterDocument52 pagesAnatomy Physiology The Unity of Form and Function 10Th International Student Edition Edition Kenneth S Saladin Full Chapterjoann.meyer664100% (4)
- Equity and Access To High Skills Through Higher Vocational Education Elizabeth Knight Full ChapterDocument51 pagesEquity and Access To High Skills Through Higher Vocational Education Elizabeth Knight Full Chaptercorey.dupas886100% (10)
- Tahriib Journeys Into The Unknown An Ethnography of Uncertainty in Migration Anja Simonsen Full ChapterDocument67 pagesTahriib Journeys Into The Unknown An Ethnography of Uncertainty in Migration Anja Simonsen Full Chaptermichelle.blair427100% (8)
- A Season in Hell With Rimbaud Dustin Pearson Full ChapterDocument51 pagesA Season in Hell With Rimbaud Dustin Pearson Full Chaptertony.thomas997100% (15)
- American Hegemony After The Great Recession A Transformation in World Order 1St Edition Brandon Tozzo Auth Full ChapterDocument68 pagesAmerican Hegemony After The Great Recession A Transformation in World Order 1St Edition Brandon Tozzo Auth Full Chapterkaryn.corman836100% (4)
- Download Marketing Communications In Emerging Economies Volume I Foundational And Contemporary Issues Palgrave Studies Of Marketing In Emerging Economies 1St Ed 2021 Edition Thomas Anning Dorson Editor full chapterDocument68 pagesDownload Marketing Communications In Emerging Economies Volume I Foundational And Contemporary Issues Palgrave Studies Of Marketing In Emerging Economies 1St Ed 2021 Edition Thomas Anning Dorson Editor full chapterbruce.bickers922100% (5)
- American Gun The True Story of The Ar 15 Cameron Mcwhirter Full ChapterDocument67 pagesAmerican Gun The True Story of The Ar 15 Cameron Mcwhirter Full Chapterkaryn.corman836100% (5)
- Ise Programmable Logic Controllers 6Th Edition Frank Petruzella Full ChapterDocument51 pagesIse Programmable Logic Controllers 6Th Edition Frank Petruzella Full Chapterthomas.miller562100% (5)
- Islam in The Anglosphere Perspectives of Young Muslims in Australia The Uk and The Usa Ihsan Yilmaz Full ChapterDocument67 pagesIslam in The Anglosphere Perspectives of Young Muslims in Australia The Uk and The Usa Ihsan Yilmaz Full Chaptermadeline.bryant891100% (2)
- American Government and Politics Today No Separate Policy Chapters Version 2016 2017 Edition Lynne E Ford Full ChapterDocument68 pagesAmerican Government and Politics Today No Separate Policy Chapters Version 2016 2017 Edition Lynne E Ford Full Chapterkaryn.corman836100% (4)
- Download Evoking Highly Focal Percepts In The Fingertips Through Targeted Stimulation Of Sulcal Regions Of The Brain For Sensory Restoration Santosh Chandrasekaran Stephan Bickel Jose L Herrero Joo Won full chapterDocument68 pagesDownload Evoking Highly Focal Percepts In The Fingertips Through Targeted Stimulation Of Sulcal Regions Of The Brain For Sensory Restoration Santosh Chandrasekaran Stephan Bickel Jose L Herrero Joo Won full chaptervivian.arriola772100% (3)
- Physical Chemistry For Jee Advanced Part 1 3Rd Edition K S Verma All ChapterDocument67 pagesPhysical Chemistry For Jee Advanced Part 1 3Rd Edition K S Verma All Chaptertamara.aguinaga853100% (7)
- Download textbook Enzymes In Food Technology Improvements And Innovations Mohammed Kuddus ebook all chapter pdfDocument63 pagesDownload textbook Enzymes In Food Technology Improvements And Innovations Mohammed Kuddus ebook all chapter pdfvelma.dixon403100% (8)
- Margaret Cavendish Essential Writings David Cunning Download PDF ChapterDocument51 pagesMargaret Cavendish Essential Writings David Cunning Download PDF Chapternona.woods574100% (14)
- Tactical Wireshark Kevin Cardwell Full ChapterDocument67 pagesTactical Wireshark Kevin Cardwell Full Chaptermichelle.blair427100% (6)
- Test Bank For Elementary and Intermediate Algebra 4Th Edition by Sullivan Struve and Mazzarella Isbn 0134556070 9780134556079 Full Chapter PDFDocument36 pagesTest Bank For Elementary and Intermediate Algebra 4Th Edition by Sullivan Struve and Mazzarella Isbn 0134556070 9780134556079 Full Chapter PDFpeter.winfield312100% (16)
- Download textbook Challenges For Technology Innovation An Agenda For The Future Proceedings Of The International Conference On Sustainable Smart Manufacturing S2M 2016 October 20 22 2016 Lisbon Portugal 1St E ebook all chapter pdfDocument54 pagesDownload textbook Challenges For Technology Innovation An Agenda For The Future Proceedings Of The International Conference On Sustainable Smart Manufacturing S2M 2016 October 20 22 2016 Lisbon Portugal 1St E ebook all chapter pdfjacqueline.schofield234100% (14)
- Evolving Tomorrow Genetic Engineering and The Evolutionary Future of The Anthropocene Prof Asher D Cutter Full ChapterDocument68 pagesEvolving Tomorrow Genetic Engineering and The Evolutionary Future of The Anthropocene Prof Asher D Cutter Full Chaptervivian.arriola772100% (3)
- Ebook Cardiology Secrets 6Th Edition PDF Full Chapter PDFDocument67 pagesEbook Cardiology Secrets 6Th Edition PDF Full Chapter PDFjohn.eastman290100% (22)
- Building Sustainable Communities Civil Society Response in South Asia 1St Ed Edition MD Nurul Momen Full ChapterDocument51 pagesBuilding Sustainable Communities Civil Society Response in South Asia 1St Ed Edition MD Nurul Momen Full Chapteramber.patrick965100% (10)
- Islamic Ethics and Female Volunteering Committing To Society Committing To God 1St Ed Edition Merve Reyhan Kayikci Full ChapterDocument68 pagesIslamic Ethics and Female Volunteering Committing To Society Committing To God 1St Ed Edition Merve Reyhan Kayikci Full Chaptermadeline.bryant891100% (1)
- Download textbook Clinical Virology 4Th Edition Douglas D Richman ebook all chapter pdfDocument53 pagesDownload textbook Clinical Virology 4Th Edition Douglas D Richman ebook all chapter pdfdana.lawson145100% (9)
- Introductory Statistics 10Th Edition Weiss Test Bank Full Chapter PDFDocument36 pagesIntroductory Statistics 10Th Edition Weiss Test Bank Full Chapter PDFcara.miltner626100% (12)
- Goodman Gilmans The Pharmacological Basis of Therapeutics 13Th Edition Laurence L Brunton 2 Full ChapterDocument49 pagesGoodman Gilmans The Pharmacological Basis of Therapeutics 13Th Edition Laurence L Brunton 2 Full Chapterclara.yanez755100% (3)
- Services Marketing Concepts Strategies and Cases 5Th Edition Hoffman Test Bank Full Chapter PDFDocument36 pagesServices Marketing Concepts Strategies and Cases 5Th Edition Hoffman Test Bank Full Chapter PDFlynda.hoover522100% (12)
- Business Government and Economic Institutions in China 1St Edition Xiaoke Zhang Full ChapterDocument67 pagesBusiness Government and Economic Institutions in China 1St Edition Xiaoke Zhang Full Chapterrobert.campbell485100% (5)
- Ebook Cissp Passport 2 Full Chapter PDFDocument67 pagesEbook Cissp Passport 2 Full Chapter PDFgerald.loesch285100% (27)
- Ebook Cissp Passport PDF Full Chapter PDFDocument67 pagesEbook Cissp Passport PDF Full Chapter PDFlana.willis186100% (26)
- Citizen Knowledge Markets Experts and The Infrastructure of Democracy Lisa Herzog Full ChapterDocument67 pagesCitizen Knowledge Markets Experts and The Infrastructure of Democracy Lisa Herzog Full Chapterelaine.johnson720100% (7)
- Cities Responding To Climate Change Copenhagen Stockholm and Tokyo 1St Edition Stephen Jones Auth Full ChapterDocument55 pagesCities Responding To Climate Change Copenhagen Stockholm and Tokyo 1St Edition Stephen Jones Auth Full Chapterelaine.johnson720100% (8)
- Citizens and Democracy in Europe Contexts Changes and Political Support 1St Ed Edition Sergio Martini Full ChapterDocument67 pagesCitizens and Democracy in Europe Contexts Changes and Political Support 1St Ed Edition Sergio Martini Full Chapterelaine.johnson720100% (7)
- Citizen Support For Democratic and Autocratic Regimes Marlene Mauk Full ChapterDocument67 pagesCitizen Support For Democratic and Autocratic Regimes Marlene Mauk Full Chapterelaine.johnson720100% (6)
- Citizen Fetus The Changing Image of Motherhood Alessandra Piontelli Full ChapterDocument62 pagesCitizen Fetus The Changing Image of Motherhood Alessandra Piontelli Full Chapterelaine.johnson720100% (5)
- Test Targets 10 - A Collaborative Effort Exploring The Use of ScieDocument86 pagesTest Targets 10 - A Collaborative Effort Exploring The Use of ScieVan PhamNo ratings yet
- Chapter 2Document20 pagesChapter 2Fahad AbdullahNo ratings yet
- Minecraft - Wikipedia, The Free EncyclopediaDocument26 pagesMinecraft - Wikipedia, The Free Encyclopediarrr20130% (1)
- Assignment - Photosynthetic PigmentsDocument2 pagesAssignment - Photosynthetic PigmentsTatiana StilloNo ratings yet
- Infineon MCESW RM UserManual v01 - 03 ENDocument194 pagesInfineon MCESW RM UserManual v01 - 03 ENBboy010193No ratings yet
- Surrogate-Assisted Symbiotic Organisms Search Algorithm For Parallel Batch Processor SchedulingDocument11 pagesSurrogate-Assisted Symbiotic Organisms Search Algorithm For Parallel Batch Processor SchedulingFJ77 ChannelNo ratings yet
- Toll Booth System Project ReportDocument25 pagesToll Booth System Project ReportAakash NigaleNo ratings yet
- From DS Univ Practical Question Bank: Khan S. Alam 1Document51 pagesFrom DS Univ Practical Question Bank: Khan S. Alam 1roxali8375No ratings yet
- CPCCBC5001B - Assessment Three - Skills Demonstration - QuestionnaireDocument8 pagesCPCCBC5001B - Assessment Three - Skills Demonstration - Questionnairesheraz karimNo ratings yet
- ZATCA Electronic Invoice Security Features Implementation StandardsDocument27 pagesZATCA Electronic Invoice Security Features Implementation StandardsRenil BabuNo ratings yet
- Wind Tunnel AEROLAB Open Circuit BrochureDocument6 pagesWind Tunnel AEROLAB Open Circuit Brochurejcpa1000No ratings yet
- AD5593RDocument29 pagesAD5593RPashaNo ratings yet
- Tendernotice 3Document121 pagesTendernotice 3ganeshkumarNo ratings yet
- Session Plan: 1. Set-Up User AccessDocument6 pagesSession Plan: 1. Set-Up User AccessFritchie LouNo ratings yet
- Contract de Instrainare-Dobandire A Unui Mijloc de TransportDocument1 pageContract de Instrainare-Dobandire A Unui Mijloc de TransportDiaconu FlorinNo ratings yet
- Subeen Resume SW June2k7Document3 pagesSubeen Resume SW June2k7dspiklu100% (1)
- Objective Type Questions: Exercise # 1Document5 pagesObjective Type Questions: Exercise # 1VICKY SONINo ratings yet
- Tool Chart CB US.08.19.WDocument1 pageTool Chart CB US.08.19.WNitesh SinghNo ratings yet
- IEC 60870-5-104 COMMUNICATION Protocol ManualDocument43 pagesIEC 60870-5-104 COMMUNICATION Protocol ManualHuy Truong GiaNo ratings yet
- Awesome Python1 PDFDocument1 pageAwesome Python1 PDFTaras KlimovNo ratings yet
- Am G10V: Installation and Operation ManualDocument26 pagesAm G10V: Installation and Operation Manualgadiel reyesNo ratings yet
- Course Outline CCNP and CCIE Enterprise Core ENCORE 350-401: Nexus It Training CenterDocument7 pagesCourse Outline CCNP and CCIE Enterprise Core ENCORE 350-401: Nexus It Training CenterChris BuenaventuraNo ratings yet
- Sciebooks A Web Based SelfDocument17 pagesSciebooks A Web Based SelfJell Vicor OpenaNo ratings yet
- 74HC HCT4051Document27 pages74HC HCT4051CurariuDanielNo ratings yet
