cissp笔记 chapter2.docx
- 文档编号:30132948
- 上传时间:2023-08-05
- 格式:DOCX
- 页数:25
- 大小:164.54KB
cissp笔记 chapter2.docx
《cissp笔记 chapter2.docx》由会员分享,可在线阅读,更多相关《cissp笔记 chapter2.docx(25页珍藏版)》请在冰豆网上搜索。
cissp笔记chapter2
FundamentalPrinciplesofSecurity
Availability
Availabilityprotectionensures reliability and timelyaccess todataandresourcesto
authorizedindividuals
Integrity
Integrityisupheldwhentheassuranceoftheaccuracyandreliabilityofinformation
andsystemsisprovidedandanyunauthorizedmodificationisprevented
Confidentiality
Confidentialityensuresthatthenecessarylevelofsecrecyisenforcedateachjunctionofdataprocessingandpreventsunauthorizeddisclosure
SecurityDefinitions
A vulnerability isalackofacountermeasureoraweaknessinacountermeasurethat
isinplace.Itcanbeasoftware,hardware,procedural,orhumanweaknessthatcanbeexploited。
A threat isanypotentialdangerthatisassociatedwiththeexploitationofavulnerability。
Theentitythattakesadvantageofavulnerabilityisreferredtoasathreatagent
A risk isthelikelihoodofathreatagentexploitingavulnerabilityandthecorrespondingbusinessimpact
An exposure isaninstanceofbeingexposedtolosses。
Acontrolorcountermeasure,isputintoplacetomitigate(reduce)thepotential
risk.
ControlTypes
Controlsareputintoplacetoreducetheriskanorganizationfaces,andtheycome
inthreemainflavors:
administrative,technical,andphysical
Administrativecontrols arecommonlyreferredtoas“softcontrols”becausetheyaremoremanagement-oriented.
Technicalcontrols(alsocalledlogicalcontrols)are
softwareorhardwarecomponents,asinfirewalls,IDS,encryption,identificationand
authenticationmechanisms.
physicalcontrols areitemsputintoplacetoprotect
facility,personnel,andresources.Examplesofphysicalcontrolsaresecurityguards,
locks,fencing,andlighting.
Thetypesofcontrolsthatareactuallyimplementedmustmaptothethreatsthe
companyfaces,andthenumbersoflayersthatareputintoplacemaptothesensitivity
oftheasset.
Thedifferentfunctionalitiesofsecuritycontrolsare preventive,detective,corrective,
deterrent,recovery,andcompensating.
Basically,youwanttostopanytroublebeforeitstarts,butyou
mustbeabletoquicklyreactandcombattroubleifitdoesfindyou.Itisnotfeasibleto
preventeverything;therefore,whatyoucannotprevent,youshouldbeabletoquickly
detect.That’swhypreventiveanddetectivecontrolsshouldalwaysbeimplemented
togetherandshouldcomplementeachother.Totakethisconceptfurther:
whatyou
can’tprevent,youshouldbeabletodetect,andifyoudetectsomething,itmeansyou
weren’tabletopreventit,andthereforeyoushouldtakecorrectiveactiontomakesure
itisindeedpreventedthenexttimearound.Therefore,allthreetypesworktogether:
preventive,detective,andcorrective.
SecurityFrameworks
Relianceonconfusiontoprovidesecurityisobviouslydangerous.
Insecurity,agoodpracticeisillustratedby
theoldsaying,“ThereareonlytwopeopleintheworldItrust:
youandme—andI’m
notsosureaboutyou.”Thisisabetterattitudetotake,becausesecurityreallycanbe
compromisedbyanyone,atanytime.
A securityprogram isaframeworkmadeupof manyentities:
logical,administrative,
andphysicalprotectionmechanisms,procedures,businessprocesses,andpeople
that allworktogethertoprovideaprotectionlevelforanenvironment. Eachhasan
importantplaceintheframework,andifoneismissingorincomplete,thewhole
frameworkmaybeaffected.
Theprogramshould workinlayers:
onelayerprovidessupportforthelayeraboveitandprotectionforthelayerbelowit
ISO/IEC27000Series
Thereasonthatthistypeofstandardwasevenneededwastotryandcentrally
managethevarioussecuritycontrolsdeployedthroughoutanorganization.
Withoutasecuritymanagementsystem,thecontrolsareimplementedandmanagedinanadhoc
manner
ThisgroupofstandardsisknownastheISO/IEC27000seriesandservesasindustry
bestpracticesforthemanagementofsecuritycontrolsinaholisticmannerwithinorganizationsaroundtheworld
EnterpriseArchitectureDevelopment
todefineanenterprisesecurityarchitecture,allow
ittobetheguidewhenimplementingsolutionstoensurebusinessneedsaremet,providestandardprotectionacrosstheenvironment,andreducetheamountofsecurity
surprisestheorganizationwillruninto
Noticethedifferencebetweenanarchitectureframeworkandanactualarchitecture.You usetheframeworkasaguideline onhowtobuildanarchitecturethatbestfits
yourcompany’sneeds.
Noticethedifferencebetweenan architectureframework andanactualarchitecture.
Youusetheframeworkasaguidelineonhowtobuildanarchitecturethatbestfits
yourcompany’sneeds
Whendevelopinganarchitecture,firstthe stakeholder sneedtobeidentified,which
iswhowillbelookingatandusingthearchitecture.Next,the views needtobedeveloped,whichishowtheinformation
thatismostimportanttothedifferentstakeholderswillbeillustratedinthemostusefulmanner.
ZachmanArchitectureFramework
Thegoalofthismodelistobeabletolookatthesameorganizationfromdifferent
views
TheOpenGroupArchitectureFramework
AnotherenterprisearchitectureframeworkisTheOpenGroupArchitectureFramework(TOGAF),whichhasitsoriginsintheU.S.DepartmentofDefense.Itprovidesan
approachtodesign,implement,andgovernanenterprise informationarchitecture.
thisarchitectureframeworkcanbeusedtocreateindividualarchitectures
throughtheuseofitsArchitectureDevelopmentMethod(ADM).Thismethodisaniterativeandcyclicprocessthatallowsrequirementstobecontinuouslyreviewedandthe
individualarchitecturesupdatedasneeded
Military-OrientedArchitectureFrameworks
TheBritishMinistryofDefenceArchitectureFramework(MODAF)isanotherrecognizedenterprisearchitectureframeworkbasedupontheDoDAF.Thecruxoftheframeworkistobeabletogetdataintherightformattotherightpeopleassoonaspossible
Thearchitectureneedstorepresentthecompanyinthe
mostusefulmannertothepeoplewhoneedtounderstanditthebest
EnterpriseSecurityArchitecture
Anenterprisesecurityarchitectureisasubsetofanenterprisearchitectureanddefines
theinformationsecuritystrategythatconsistsoflayersofsolutions,processes,andproceduresandthewaytheyarelinkedacrossanenterprisestrategically,tactically,and
operationally
Themainreasontodevelopanenterprisesecurityarchitecture
istoensurethatsecurityeffortsalignwithbusinesspracticesinastandardizedandcosteffectivemanner.
AgroupdevelopedtheSherwoodAppliedBusinessSecurityArchitecture(SABSA),as
showninTable2-3,whichissimilartotheZachmanframework
SABSAisaframeworkandmethodologyforenterprisesecurityarchitectureand
servicemanagement
Foranenterprise securityarchitecturetobesuccessful initsdevelopmentandimplementation,thefollowingitemsmustbeunderstoodandfollowed:
strategicalignment,processenhancement,businessenablement,andsecurityeffectiveness.
Strategicalignmentmeansthebusinessdriversandtheregulatoryandlegalrequirementsarebeingmetbythesecurityenterprisearchitecture
Securitycannotstandinthewayofbusinessprocesses,butshouldbeimplementedtobetter
enablethem.
Securityeffectivenessdealswithmetrics,meetingservicelevelagreement(SLA)requirements,achievingreturnoninvestment(ROI),meetingsetbaselines,andprovidingmanagementwithadashboardorbalancedscorecardsystem.
SecurityControlsDevelopment
Itdefinesgoalsforthe
controlsthatshouldbeusedtoproperlymanageITandtoensurethatITmapstobusinessneeds
CobiT isbrokendownintofourdomains:
PlanandOrganize,Acquireand
Implement,DeliverandSupport,andMonitorandEvaluate. Eachcategorydrillsdown
intosubcategories.
securityonlybeingonecomponent.CobiTisasetofpractices
thatcanbefollowedtocarryoutITgovernance,whichrequiresproper
securitypractices.
NIST800-53
ProcessManagementDevelopment
ITIL
SixSigma
SixSigmaisaprocessimprovementmethodology.Itsgoalis
toimproveprocessqualitybyusingstatisticalmethodsofmeasuringoperationefficiencyandreducingvariation,defects,andwaste
SixSigmaisbeingusedinthesecurityassuranceindustryinsomeinstancestomeasurethesuccessfactorsofdifferent
controlsandprocedures
CMMI
ThecruxofCMMIistodevelopstructuredstepsthatcanbefollowed
soanorganizationcanevolvefromoneleveltothenextandconstantlyimproveitsprocessesand
securityposture
Whilethecoresofthesevarioussecuritystandardsandframeworksaresimilar,itis
importanttounderstandthatasecurityprogramhasalifecyclethatisalwayscontinuing,becauseitshouldbeconstantlyevaluatedandimprovedupon.Thelifecycleofany
processcanbedescribedindifferentways.Wewillusethefollowingsteps
1.Planandorganize
2.Implement
3.Operateandmaintain
4.Monitorandevaluate
securitymanagementisanongoingand continuallyimprovingprocess
Blueprints areimportant tools toidentify,develop,anddesignsecurityrequirementsforspecific
businessneeds
Theseblueprintsmustbecustomizedtofulfilltheorganization’ssecurityrequirements,
whicharebasedonitsregulatoryobligations,businessdrivers,andlegalobligations
Sotheblueprintwilllayoutthesecuritysolutions,processes,andcomponentsthe
organizationusestomatchitssecurityandbusinessneeds.
Totiethesepiecestogether,youcanthinkoftheISO/IEC27000thatworksmainly
atthepolicylevelasadescriptionofthetypeofhouseyouwanttobuild(two-story,
ranch-style,fivebedroom,threebath).Thesecurityenterpriseframeworkisthear
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- cissp笔记 chapter2 cissp 笔记
![提示](https://static.bdocx.com/images/bang_tan.gif)