Foreword xxiii

Introduction xxv

Chapter 1: Security Operations and Administration 1

Comply with Codes of Ethics 2

Understand, Adhere to, and Promote Professional Ethics 3

(ISC)2 Code of Ethics 4

Organizational Code of Ethics 5

Understand Security Concepts 6

Conceptual Models for Information Security 7

Confidentiality 8

Integrity 15

Availability 17

Accountability 18

Privacy 18

Nonrepudiation 26

Authentication 27

Safety 28

Fundamental Security Control Principles 29

Access Control and Need-to-Know 34

Job Rotation and Privilege Creep 35

Document, Implement, and Maintain Functional Security Controls 37

Deterrent Controls 37

Preventative Controls 39

Detective Controls 39

Corrective Controls 40

Compensating Controls 41

The Lifecycle of a Control 42

Participate in Asset Management 43

Asset Inventory 44

Lifecycle (Hardware, Software, and Data) 47

Hardware Inventory 48

Software Inventory and Licensing 49

Data Storage 50

Implement Security Controls and Assess Compliance 56

Technical Controls 57

Physical Controls 58

Administrative Controls 61

Periodic Audit and Review 64

Participate in Change Management 66

Execute Change Management Process 68

Identify Security Impact 70

Testing/Implementing Patches, Fixes, and Updates 70

Participate in Security Awareness and Training 71

Security Awareness Overview 72

Competency as the Criterion 73

Build a Security Culture, One Awareness Step at a Time 73

Participate in Physical Security Operations 74

Physical Access Control 74

The Data Center 78

Service Level Agreements 79

Summary 82

Chapter 2: Access Controls 83

Access Control Concepts 85

Subjects and Objects 86

Privileges: What Subjects Can Do with Objects 88

Data Classification, Categorization, and Access Control 89

Access Control via Formal Security Models 91

Implement and Maintain Authentication Methods 94

Single-Factor/Multifactor Authentication 95

Accountability 114

Single Sign-On 116

Device Authentication 117

Federated Access 118

Support Internetwork Trust Architectures 120

Trust Relationships (One-Way, Two-Way, Transitive) 121

Extranet 122

Third-Party Connections 123

Zero Trust Architectures 124

Participate in the Identity Management Lifecycle 125

Authorization 126

Proofing 127

Provisioning/Deprovisioning 128

Identity and Access Maintenance 130

Entitlement 134

Identity and Access Management Systems 137

Implement Access Controls 140

Mandatory vs. Discretionary Access Control 141

Role-Based 142

Attribute-Based 143

Subject-Based 144

Object-Based 144

Summary 145

Chapter 3: Risk Identification, Monitoring, And Analysis 147

Defeating the Kill Chain One Skirmish at a Time 148

Kill Chains: Reviewing the Basics 151

Events vs. Incidents 155

Understand the Risk Management Process 156

Risk Visibility and Reporting 159

Risk Management Concepts 165

Risk Management Frameworks 185

Risk Treatment 195

Perform Security Assessment Activities 203

Security Assessment Workflow Management 204

Participate in Security Testing 206

Interpretation and Reporting of Scanning and Testing Results 215

Remediation Validation 216

Audit Finding Remediation 217

Manage the Architectures: Asset Management and Configuration Control 218

Operate and Maintain Monitoring Systems 220

Events of Interest 222

Logging 229

Source Systems 230

Legal and Regulatory Concerns 236

Analyze Monitoring Results 238

Security Baselines and Anomalies 240

Visualizations, Metrics, and Trends 243

Event Data Analysis 244

Document and Communicate Findings 245

Summary 246

Chapter 4: Incident Response and Recovery 247

Support the Incident Lifecycle 249

Think like a Responder 253

Physical, Logical, and Administrative Surfaces 254

Incident Response: Measures of Merit 254

The Lifecycle of a Security Incident 255

Preparation 257

Detection, Analysis, and Escalation 264

Containment 275

Eradication 277

Recovery 279

Lessons Learned; Implementation of New Countermeasures 283

Third-Party Considerations 284

Understand and Support Forensic Investigations 287

Legal and Ethical Principles 289

Logistics Support to Investigations 291

Evidence Handling 292

Evidence Collection 297

Understand and Support Business Continuity Plan and Disaster Recovery Plan Activities 306

Emergency Response Plans and Procedures 307

Interim or Alternate Processing Strategies 310

Restoration Planning 313

Backup and Redundancy Implementation 315

Data Recovery and Restoration 319

Training and Awareness 321

Testing and Drills 322

CIANA+PS at Layer 8 and Above 328

It Is a Dangerous World Out There 329

People Power and Business Continuity 333

Summary 333

Chapter 5: Cryptography 335

Understand Fundamental Concepts of Cryptography 336

Building Blocks of Digital Cryptographic Systems 339

Hashing 347

Salting 351

Symmetric Block and Stream Ciphers 353

Stream Ciphers 365

Eu Ecrypt 371

Asymmetric Encryption 371

Elliptical Curve Cryptography 380

Nonrepudiation 383

Digital Certificates 388

Encryption Algorithms 392

Key Strength 393

Cryptographic Attacks, Cryptanalysis, and Countermeasures 395

Cryptologic Hygiene as Countermeasures 396

Common Attack Patterns and Methods 401

Secure Cryptoprocessors, Hardware Security Modules, and Trusted Platform Modules 409

Understand the Reasons and Requirements for Cryptography 414

Confidentiality 414

Integrity and Authenticity 415

Data Sensitivity 417

Availability 418

Nonrepudiation 418

Authentication 420

Privacy 421

Safety 422

Regulatory and Compliance 423

Transparency and Auditability 423

Competitive Edge 424

Understand and Support Secure Protocols 424

Services and Protocols 425

Common Use Cases 437

Deploying Cryptography: Some Challenging Scenarios 442

Limitations and Vulnerabilities 444

Understand Public Key Infrastructure Systems 446

Fundamental Key Management Concepts 447

Hierarchies of Trust 459

Web of Trust 462

Summary 464

Chapter 6: Network and Communications Security 467

Understand and Apply Fundamental Concepts of Networking 468

Complementary, Not Competing, Frameworks 470

OSI and TCP/IP Models 471

OSI Reference Model 486

TCP/IP Reference Model 501

Converged Protocols 508

Software-Defined Networks 509

IPv4 Addresses, DHCP, and Subnets 510

IPv4 Address Classes 510

Subnetting in IPv4 512

Running Out of Addresses? 513

IPv4 vs. IPv6: Key Differences and Options 514

Network Topographies 516

Network Relationships 521

Transmission Media Types 525

Commonly Used Ports and Protocols 530

Understand Network Attacks and Countermeasures 536

CIANA+PS Layer by Layer 538

Common Network Attack Types 553

SCADA, IoT, and the Implications of Multilayer Protocols 562

Manage Network Access Controls 565

Network Access Control and Monitoring 568

Network Access Control Standards and Protocols 573

Remote Access Operation and Configuration 575

Manage Network Security 583

Logical and Physical Placement of Network Devices 586

Segmentation 587

Secure Device Management 591

Operate and Configure Network-Based Security Devices 593

Network Address Translation 594

Additional Security Device Considerations 596

Firewalls and Proxies 598

Network Intrusion Detection/Prevention Systems 605

Security Information and Event Management Systems 607

Routers and Switches 609

Network Security from Other Hardware Devices 610

Traffic-Shaping Devices 613

Operate and Configure Wireless Technologies 615

Wireless: Common Characteristics 616

Wi-Fi 624

Bluetooth 637

Near-Field Communications 638

Cellular/Mobile Phone Networks 639

Ad Hoc Wireless Networks 640

Transmission Security 642

Wireless Security Devices 645

Summary 646

Chapter 7: Systems and Application Security 649

Systems and Software Insecurity 650

Software Vulnerabilities Across the Lifecycle 654

Risks of Poorly Merged Systems 663

Hard to Design It Right, Easy to Fix It? 664

Hardware and Software Supply Chain Security 667

Positive and Negative Models for Software Security 668

Is Blocked Listing Dead? Or Dying? 669

Information Security = Information Quality + Information Integrity 670

Data Modeling 671

Preserving Data Across the Lifecycle 674

Identify and Analyze Malicious Code and Activity 678

Malware 679

Malicious Code Countermeasures 682

Malicious Activity 684

Malicious Activity Countermeasures 688

Implement and Operate Endpoint Device Security 689

HIDS 691

Host-Based Firewalls 692

Allowed Lists: Positive Control for App Execution 693

Endpoint Encryption 694

Trusted Platform Module 695

Mobile Device Management 696

Secure Browsing 697

IoT Endpoint Security 700

Endpoint Security: EDR, MDR, XDR, UEM, and Others 701

Operate and Configure Cloud Security 701

Deployment Models 702

Service Models 703

Virtualization 706

Legal and Regulatory Concerns 709

Data Storage and Transmission 716

Third-Party/Outsourcing Requirements 716

Lifecycles in the Cloud 717

Shared Responsibility Model 718

Layered Redundancy as a Survival Strategy 719

Operate and Secure Virtual Environments 720

Software-Defined Networking 723

Hypervisor 725

Virtual Appliances 726

Continuity and Resilience 727

Attacks and Countermeasures 727

Shared Storage 729

Summary 730

Appendix: Cross-Domain Challenges 731

Paradigm Shifts in Information Security? 732

Pivot 1: Turn the Attackers’ Playbooks Against Them 734

ATT&CK: Pivoting Threat Intelligence 734

Analysis: Real-Time and Retrospective 735

The SOC as a Fusion Center 737

All-Source, Proactive Intelligence: Part of the Fusion Center 738

Pivot 2: Cybersecurity Hygiene: Think Small, Act Small 739

CIS IG 1 for the SMB and SME 740

Hardening Individual Cybersecurity 740

Assume the Breach 742

Pivot 3: Flip the “Data-Driven Value Function” 743

Data-Centric Defense and Resiliency 744

Ransomware as a Service 745

Supply Chains, Security, and the SSCP 746

ICS, IoT, and SCADA: More Than SUNBURST 747

Extending Physical Security: More Than Just Badges and Locks 749

The IoRT: Robots Learning via the Net 750

Pivot 4: Operationalize Security Across the Immediate and Longer Term 751

Continuous Assessment and Continuous Compliance 752

SDNs and SDS 753

SOAR: Strategies for Focused Security Effort 755

A “DevSecOps” Culture: SOAR for Software Development 756

Pivot 5: Zero-Trust Architectures and Operations 757

FIDO and Passwordless Authentication 760

Threat Hunting, Indicators, and Signature Dependence 761

Other Dangers on the Web and Net 763

Surface, Deep, and Dark Webs 763

Deep and Dark: Risks and Countermeasures 764

DNS and Namespace Exploit Risks 765

Cloud Security: Edgier and Foggier 766

Curiosity as Countermeasure 766

Index 769

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.