CISSP Guide to Security Essentials Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. CISSP Guide to Security Essentials Second Edition Peter H. Gregory Australia Brazil Mexico Singapore UnitedKingdom UnitedStates Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. This is an electronic version of the print textbook. Due to electronic rights restrictions, some third party content may be suppressed. Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. The publisher reserves the right to remove content from this title at any time if subsequent rights restrictions require it. For valuable information on pricing, previous editions, changes to current editions, and alternate formats, please visit www.cengage.com/highered to search by ISBN#, author, title, or keyword for materials in your areas of interest. Important Notice: Media content referenced within the product description or the product text may not be available in the eBook version. Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. CISSPGuidetoSecurityEssentials, ©2015CengageLearning SecondEdition WCN:02-200-203 PeterH.Gregory ALLRIGHTSRESERVED.Nopartofthisworkcoveredbythecopyright SVP,GMSkills&GlobalProduct hereinmaybereproduced,transmitted,stored,orusedinanyformorby Management:DawnGerrain anymeansgraphic,electronic,ormechanical,includingbutnotlimitedto ProductDevelopmentManager: photocopying,recording,scanning,digitizing,taping,webdistribution, LeighHefferon informationnetworks,orinformationstorageandretrievalsystems,except aspermittedunderSection107or108ofthe1976UnitedStatesCopyright SeniorContentDeveloper: Act,withoutthepriorwrittenpermissionofthepublisher. JuliaLeroux-Lindsey ProductAssistant:ScottFinger Forproductinformationandtechnologyassistance,contactusat VicePresident,MarketingServices: CengageLearningCustomer&SalesSupport,1-800-354-9706 JenniferAnnBaker Forpermissiontousematerialfromthistextorproduct, submitallrequestsonlineatwww.cengage.com/permissions MarketingDirector:MicheleMcTighe Furtherpermissionsquestionscanbeemailedto MarketingManager:EricLaScola [email protected] MarketingCoordinator:WillGuiliani SeniorProductionDirector:WendyTroeger LibraryofCongressControlNumber:2014949536 ProductionManager:PattyStephan ISBN-13:978-1-285-06042-2 SeniorContentProjectManager:Brooke ISBN-10:1-285-06042-3 Greenhouse ArtDirector:GEXPublishingServices CengageLearning CoverPhoto:©iStockPhoto.com/Henrik5000 20ChannelCenterStreet Boston,MA02210 USA CengageLearningisaleadingproviderofcustomizedlearningsolutions withofficelocationsaroundtheglobe,includingSingapore,theUnited Kingdom,Australia,Mexico,Brazil,andJapan.Locateyourlocalofficeat: www.cengage.com/global CengageLearningproductsarerepresentedinCanadaby NelsonEducation,Ltd. TolearnmoreaboutCengageLearning,visitwww.cengage.com Purchaseanyofourproductsatyourlocalcollegestoreoratourpreferred onlinestorewww.cengagebrain.com NoticetotheReader Publisherdoesnotwarrantorguaranteeanyoftheproductsdescribedhereinorperformanyindependentanalysisinconnectionwithanyoftheproduct informationcontainedherein.Publisherdoesnotassume,andexpresslydisclaims,anyobligationtoobtainandincludeinformationotherthanthatprovided toitbythemanufacturer.Thereaderisexpresslywarnedtoconsiderandadoptallsafetyprecautionsthatmightbeindicatedbytheactivitiesdescribed hereinandtoavoidallpotentialhazards.Byfollowingtheinstructionscontainedherein,thereaderwillinglyassumesallrisksinconnectionwithsuch instructions.Thepublishermakesnorepresentationsorwarrantiesofanykind,includingbutnotlimitedto,thewarrantiesoffitnessforparticularpurposeor merchantability,norareanysuchrepresentationsimpliedwithrespecttothematerialsetforthherein,andthepublishertakesnoresponsibilitywithrespect tosuchmaterial.Thepublishershallnotbeliableforanyspecial,consequential,orexemplarydamagesresulting,inwholeorpart,fromthereaders’useof,or relianceupon,thismaterial. Printed in the United States of America Print Number: 01 Print Year: 2014 Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. To Rebekah and Shannon, and to the memory of my son and daughters. Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Brief Table of Contents INTRODUCTION ................................................................. xxvii LABREQUIREMENTS.............................................................. xxxv CHAPTER 1 InformationSecurityandRiskManagement ............................................ 1 CHAPTER 2 AccessControls ................................................................. 37 CHAPTER 3 SoftwareDevelopmentSecurity..................................................... 87 CHAPTER 4 BusinessContinuityandDisasterRecoveryPlanning .................................... 139 CHAPTER 5 Cryptography.................................................................. 175 CHAPTER 6 Legal,Regulations,Investigations,andCompliance..................................... 219 CHAPTER 7 SecurityOperations ............................................................. 255 CHAPTER 8 PhysicalandEnvironmentalSecurity ................................................ 293 CHAPTER 9 SecurityArchitectureandDesign................................................... 329 CHAPTER 10 TelecommunicationsandNetworkSecurity ........................................... 375 APPENDIX A TheTenDomainsofCISSPSecurity ................................................. 433 APPENDIX B The(ISC)2CodeofEthics ......................................................... 441 APPENDIX C EarningtheCISSPCertification..................................................... 445 GLOSSARY. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451 INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 vii Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. Copyright 2015 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.