Hot answers tagged

60

All other answers are fine. I'm going to offer you a classic security perspective. Starting a fire/flood is a textbook scenario for physical penetration/exfiltration. People under stress are less likely to challenge strangers. A fire can be used to destroy forensic evidence, in particular when there's insider involvement. An earthquake or, indeed, any ...


51

It comes down to the classic security triad; Integrity, Confidentiality and Availability. The last of which could certainly suffer from any type of natural disaster, which is why you must include it in your continuity plan.


48

CISSP is an information security certification not a computer security certification. Information security is about the protecting the confidentiality, integrity, availabity of information in general. Information is not only stored on computers. They are printed out and stored in filing cabinets, they are memorized and stored in your employee's brains. ...


22

You could check out www.cccure.org - it was always the one I recommended folks go to when I used to teach CISSP. I have just checked it out and it has even more material than it did 5 years ago. It requires free registration, but then you have access to documentation and practice tests. (and good luck!)


16

Even if you take a narrow view of computer security as being limited to dealing with intentional malicious attacks, any way in which your system is vulnerable to a natural disaster also represents a way in which a well-equipped (or clever) attacker could disrupt your service. For example, if a data center is vulnerable to flooding, someone who wants to take ...


14

The CISSP certification is intended to demonstrate two things: Knowledge of the material in the ISC2 CBK, and Significant real-world experience in the field To an employer, a CISSP on a resume is supposed to mean that the application knows what s/he is doing and has demonstrated it with years of experience. Note that an employer looking for a CISSP for ...


13

Disasters are as much a security issue as mitigating denial of service attacks. In the ISC2 (CISSP) docs, security is often represented by the CIA triad: Confidentiality, Integrity and Availability. Disaster recovery strategies and DDOS mitigation both pertain to establishing and maintaining availability.


9

The non-interference model is all about preventing covert channels through shared resources or inference attacks. An example can be the following: Suppose that two users of different security levels are working on the same system (remotely, using shells for example). The lower level user should not be know anything about the work done by the higher level ...


8

From the perspective of an employer I would say yes - in terms of giving instructions to recruitment agencies, having a CISSP tick box can help to narrow down the number of applicants significantly. Later on in your career it may not count for so much, but as an indicator that someone has a reasonable grasp of the basics, in some IT and some procedural ...


8

Sure. Here's an example. Suppose we want to have a system log manager, which collects logs from all processes. We'll run the log manager at system HIGH. We want every process to be able to send log records to it. With your proposed rule, processes running at LOW would not be able to send log entries to the log manager. In contrast, the ★-property ...


8

Much like recursion, to properly understand audits we must first understand the scope and usage of audits. Audits are used to determine compliance against a benchmark. Without said benchmark, then the auditor has nothing to measure against. In some cases your benchmark may be a deeply technical document describing programming practices or operating system ...


8

Though not practice exams, I found the mind maps offered @ mindcert.com to be a great set of notes to use in keeping things together. They have published maps of 7 domain areas for the CISSP and a few for the CEH. Additionally, you can always make your own. http://www.mindcert.com/resources/ Hope this helps, and good luck to you!


7

cccure is a great resource. I also paid for study questions when i was studying and the cccure were harder, and more accurate to the test. Actually a lot of the cccure questions were harder than the actual test questions. Testing youself against a test bank is a good practice but I didn't really find it super helpful. It is a good activity if you are tired ...


7

Information flow, state machines and non-interference are more like 'theoretical concepts'. You can say that the Bell LaPadula model is an implementation of an information flow concept and BIBA is a model build on a state machine concept. I don't know if this helps.


6

I'll toss in my 2c and mention something that others have not specifically mentioned: Business Continuity Plans BCP is an important function of a security analyst's job, and as such, the CISSP provides a broad overview of the issues that can impact disasters and outages. Knowing these high-level details helps the CISSP build a foundation for knowledge and ...


5

For CISSP, I highly suggests Shon Harris's book. It's the single best book to cover CISSP I've read.


5

Audits are typically used for detection: detecting problems. Controls typically provide prevention: preventing intrusions. However, you can use audits for more than just detecting intrusions. You can also use auditing to detect problems or shortcomings in your controls (e.g., compliance audits, network configuration audits), and/or to detect ...


4

This model makes very little sense in context of regular computer usage. It makes a lot more sense when you think of military style classifications, where it makes sense sometimes to write things to another level. For example, if you have a bunch of reports coming in to one analyzer, you want the singular report writers to just upload their stuff and never ...


4

The truth is that there isn't any good reason this would happen practicaly afaik, but on the other hand, it is not against the goal of the model. I will reverse the question: Why do you think it shouldn't happen? From a confidentiality point of view, it does not matter if a lower label subject can write to higher levels, since those on the higher level can ...


4

I found this to be good as well. CISSP Free 50 question Practice Test


4

I think both are important. It's becoming more common for employers to require an undergrad degree for many positions. Fundamentally, if you don't have an undergrad degree, your ability to apply to positions will be limited. For example, if you ever want to consider working for the Big 4, you'd have to be very much in demand to get past their screening ...


4

My apologies as I don't have enough reputation to comment yet, so I'm forced to create a new answer. jplyle said "Experience is experience, regardless of whether you get it before or after a degree." I would caution you that this isn't necessarily correct; as a techie, I would recognize any experience and evaluate how relevant it was. I delayed my college ...


4

It is difficult to determine what the authoritative source is for SESAME, which is an indication. The best link, which I'm sure you have seen, is from COSIC. The first paragraph states: SESAME (a Secure European System for Applications in a Multi-vendor Environment) is a European research and development project, ... All information and links for ...


3

If you don't like academia, then I certainly wouldn't recommend it for you. You do not need to have a degree to do well in this field. You just need to compensate a lack of degree somehow. Work experience and certifications will be more than enough to prove to employers that you know what you are doing. This is a very hands-on field, so I think you'll learn ...


3

You do always have the option of going back to study later on in your career, should you decide that it would be worthwhile. Experience is experience, regardless of whether you get it before or after a degree. I am involved in teaching MSc courses in software engineering to people with industrial experience. Most students already have a BSc in a related ...


3

There are some non-canonical (or non-"standard") access control models (besides the well-known MAC, DAC, RBAC...), that are simply not well defined. As in, anyone can define or redefine them as they want, as long as the model makes sense. E.g. this post was the first time I heard that model called "Task based access control", though I use/employ/review it ...


3

Not to say that SESAME was ever widely prevalent but it did have valid use and was extended/modified with the advent of RFC 1510. For instance, SESAME was part of secure CORBA implementation. I can't comment on a large ORB system that I know was in place even within the last 7 years but it did exist - presumably at the later stages only superficially... For ...


3

Yes, E is correct. A vulnerability is a weakness that could lead to harm (whether it be to confidentiality, integrity, or availability.) A threat is an agent that could expose the vulnerability. The question is about an "event", which is the threat.


2

I don't think it's important to know whether these are "models". (I know nothing about CISSP, but if that's the kind of thing CISSP wants you to memorize, CISSP is inane.) That said, yes I'd say that Bell-Lapadula and Biba might well be called theoretical security models. Non-interference is in the same territory. Information flow too. But the more ...


2

One one side, as a recent graduate, you've been passing a lot of tests. CISSP is just another test, so some might think you're just after scoring all the certs you can, and the certs is not representative of your actual knowledge. On the other hand, a lot of organizations require you to have a CISSP to hold any security-relevant position. So while this ...



Only top voted, non community-wiki answers of a minimum length are eligible