Tag Info

Hot answers tagged

22

You could check out www.cccure.org - it was always the one I recommended folks go to when I used to teach CISSP. I have just checked it out and it has even more material than it did 5 years ago. It requires free registration, but then you have access to documentation and practice tests. (and good luck!)


13

The CISSP certification is intended to demonstrate two things: Knowledge of the material in the ISC2 CBK, and Significant real-world experience in the field To an employer, a CISSP on a resume is supposed to mean that the application knows what s/he is doing and has demonstrated it with years of experience. Note that an employer looking for a CISSP for ...


9

The non-interference model is all about preventing covert channels through shared resources or inference attacks. An example can be the following: Suppose that two users of different security levels are working on the same system (remotely, using shells for example). The lower level user should not be know anything about the work done by the higher level ...


8

From the perspective of an employer I would say yes - in terms of giving instructions to recruitment agencies, having a CISSP tick box can help to narrow down the number of applicants significantly. Later on in your career it may not count for so much, but as an indicator that someone has a reasonable grasp of the basics, in some IT and some procedural ...


8

Much like recursion, to properly understand audits we must first understand the scope and usage of audits. Audits are used to determine compliance against a benchmark. Without said benchmark, then the auditor has nothing to measure against. In some cases your benchmark may be a deeply technical document describing programming practices or operating system ...


8

Though not practice exams, I found the mind maps offered @ mindcert.com to be a great set of notes to use in keeping things together. They have published maps of 7 domain areas for the CISSP and a few for the CEH. Additionally, you can always make your own. http://www.mindcert.com/resources/ Hope this helps, and good luck to you!


7

cccure is a great resource. I also paid for study questions when i was studying and the cccure were harder, and more accurate to the test. Actually a lot of the cccure questions were harder than the actual test questions. Testing youself against a test bank is a good practice but I didn't really find it super helpful. It is a good activity if you are tired ...


7

Sure. Here's an example. Suppose we want to have a system log manager, which collects logs from all processes. We'll run the log manager at system HIGH. We want every process to be able to send log records to it. With your proposed rule, processes running at LOW would not be able to send log entries to the log manager. In contrast, the ★-property ...


7

Information flow, state machines and non-interference are more like 'theoretical concepts'. You can say that the Bell LaPadula model is an implementation of an information flow concept and BIBA is a model build on a state machine concept. I don't know if this helps.


5

For CISSP, I highly suggests Shon Harris's book. It's the single best book to cover CISSP I've read.


5

Audits are typically used for detection: detecting problems. Controls typically provide prevention: preventing intrusions. However, you can use audits for more than just detecting intrusions. You can also use auditing to detect problems or shortcomings in your controls (e.g., compliance audits, network configuration audits), and/or to detect ...


4

This model makes very little sense in context of regular computer usage. It makes a lot more sense when you think of military style classifications, where it makes sense sometimes to write things to another level. For example, if you have a bunch of reports coming in to one analyzer, you want the singular report writers to just upload their stuff and never ...


4

The truth is that there isn't any good reason this would happen practicaly afaik, but on the other hand, it is not against the goal of the model. I will reverse the question: Why do you think it shouldn't happen? From a confidentiality point of view, it does not matter if a lower label subject can write to higher levels, since those on the higher level can ...


4

I found this to be good as well. CISSP Free 50 question Practice Test


4

I think both are important. It's becoming more common for employers to require an undergrad degree for many positions. Fundamentally, if you don't have an undergrad degree, your ability to apply to positions will be limited. For example, if you ever want to consider working for the Big 4, you'd have to be very much in demand to get past their screening ...


4

My apologies as I don't have enough reputation to comment yet, so I'm forced to create a new answer. jplyle said "Experience is experience, regardless of whether you get it before or after a degree." I would caution you that this isn't necessarily correct; as a techie, I would recognize any experience and evaluate how relevant it was. I delayed my college ...


4

It is difficult to determine what the authoritative source is for SESAME, which is an indication. The best link, which I'm sure you have seen, is from COSIC. The first paragraph states: SESAME (a Secure European System for Applications in a Multi-vendor Environment) is a European research and development project, ... All information and links for ...


3

If you don't like academia, then I certainly wouldn't recommend it for you. You do not need to have a degree to do well in this field. You just need to compensate a lack of degree somehow. Work experience and certifications will be more than enough to prove to employers that you know what you are doing. This is a very hands-on field, so I think you'll learn ...


3

You do always have the option of going back to study later on in your career, should you decide that it would be worthwhile. Experience is experience, regardless of whether you get it before or after a degree. I am involved in teaching MSc courses in software engineering to people with industrial experience. Most students already have a BSc in a related ...


3

There are some non-canonical (or non-"standard") access control models (besides the well-known MAC, DAC, RBAC...), that are simply not well defined. As in, anyone can define or redefine them as they want, as long as the model makes sense. E.g. this post was the first time I heard that model called "Task based access control", though I use/employ/review it ...


3

Yes, E is correct. A vulnerability is a weakness that could lead to harm (whether it be to confidentiality, integrity, or availability.) A threat is an agent that could expose the vulnerability. The question is about an "event", which is the threat.


2

I don't think it's important to know whether these are "models". (I know nothing about CISSP, but if that's the kind of thing CISSP wants you to memorize, CISSP is inane.) That said, yes I'd say that Bell-Lapadula and Biba might well be called theoretical security models. Non-interference is in the same territory. Information flow too. But the more ...


2

Going from programming into security is more uncommon than going from networking into security, in my experience. This seems especially true for CISSP holders. Application security is increasingly important and there is a huge need for people with development experience in application security. Developers can communicate more effectively with developers ...


2

I feel that anyone interested in pursuing a security centric career should become CISSP early in the process. If you are interested in remaining focused on development and wish to demonstrate security expertise, there are several other certifications that would be more appropriate. I strongly recommend the SANS classes and corresponding GIAC certifications ...


2

The Shon Harris All in One book, as pointed out by Alex, is quite good. In my opinion, however, you can't just rely on one book. You may also want to look into the offical (ISC)2 study guide, from their web site. I would also supplement any 'study guide' with reading published specs (NIST 800 series and the 17799/27001 series IEEE/IEC at the very least). ...


2

One one side, as a recent graduate, you've been passing a lot of tests. CISSP is just another test, so some might think you're just after scoring all the certs you can, and the certs is not representative of your actual knowledge. On the other hand, a lot of organizations require you to have a CISSP to hold any security-relevant position. So while this ...


2

The CISSP does not really provide any practical knowledge, so if you are looking for something that is about half an inch deep than the CISSP is the right choice. From a recruiting perspective they may ignore you because of the lack of experience on your resume and they just assume that you cheated( talking purely from a recruiting standpoint I am not ...


2

Security is an extremely vast topic... Which part of it exactly do you want to study? Cryptography? Although it's a bit old, Bruce Schneier's Applied Cryptography gives an excellent introduction to the field. Forensics ? Real Digital Forensics did the trick for me, and I find it extremely practical. Malware analysis? Windows' security mechanisms? The ...


2

I would actually say that there is one, Ross Anderson's security engineering is it, and it's free: http://www.cl.cam.ac.uk/~rja14/book.html https://www.schneier.com/blog/archives/2013/03/ross_andersons_1.html I also agree with executifs's comment - the books he mentions are the books regarded as core to those disciplines. Ross Anderson's book has the ...


2

Not to say that SESAME was ever widely prevalent but it did have valid use and was extended/modified with the advent of RFC 1510. For instance, SESAME was part of secure CORBA implementation. I can't comment on a large ORB system that I know was in place even within the last 7 years but it did exist - presumably at the later stages only superficially... For ...



Only top voted, non community-wiki answers of a minimum length are eligible