Questions tagged [cissp]
CISSP is an abreviation for Certified Information Systems Security Professional. It is a certification offered by the International Information Systems Security Certification Consortium, AKA: (ISC)^2.
44 questions
30
votes
5
answers
6k
views
How could a security control introduce a privacy issue?
I'm reading the CISSP official study guide and quote
In addition to verifying the reliability of security controls, an assessment should consider whether security controls affect privacy. Some ...
- 2,097
1
vote
0
answers
162
views
What would be the logical approach in breaking down the following scenario in regard to CISSP Domains?
I'm currently doing my Cyber Security Certification program, I along with my fellow classmates are in Beginner stages. Over the past few weeks we have been writing up variety of Discussions using ...
0
votes
2
answers
779
views
How Anomaly Analysis is differentiating from Heuristic analysis
Taking a look at the discription of both kinds, orientation seems the same. while it isn't the same I can't figure the difference. In a Heuristic scan it looks for suspicious or malicious behaviors in ...
- 3
2
votes
1
answer
11k
views
What is the difference between data owner, data custodian and system owner?
I just started studying up for the CISSP and am having trouble understanding few concepts:
Data owner
Data custodian
System owner
Somewhere I read:
The data owner (information owner) is usually a ...
- 159
1
vote
2
answers
1k
views
What is the difference between concealment and secrecy in context of confidentiality?
I just started studying up for the CISSP and am having trouble understanding few concepts.
This is regarding confidentiality, Below are some of the aspects of confidentiality
Sensitivity
Discretion
...
- 159
4
votes
3
answers
3k
views
How is a pepper used with salted passwords?
How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt?
From Sybex CISSP Official Study Guide, 8th Edition (2018):
Adding ...
- 143
0
votes
1
answer
127
views
security related certificate [closed]
I work in cyber security r&d for several years. Meanwhile, I have obtained a CEH (Certified Ethical Hacker) certificate and a CISSP certificate.
I wish to move to security industry instead of r&...
- 838
1
vote
1
answer
3k
views
Difference between ISO/IEC 27001 and CISSP CBK
Sorry to ask this, I am quite new to Security area. Recently I am trying to introduce some security standards.
After some searching I found this out in this doc
Among them, ISO is the best-known ...
- 121
1
vote
0
answers
443
views
What are the similarities and differences between CISSP CBK, ISO/IEC, and the NIST NICE Framework? [closed]
There are a ton of different information security/cyber security frameworks but I was wondering if someone can give a quick rundown of some major similarities and differences. It'll really help me ...
- 111
2
votes
2
answers
3k
views
What's the difference between "access aggregation" and "authorization creep"?
I'm studying for the CISSP and am getting hung up on some terminology. Specifically, I'm confused on the difference between access aggregation and authorization creep.
In both cases, it seems to me ...
- 3,498
1
vote
2
answers
4k
views
What's a practical example of a Trusted Computing Base?
I'm studying for the CISSP exam and trying to wrap my mind around the concept of a Trusted Computing Base. Can someone provide a practical example? The recurring definition I see is that it's a "...
- 3,498
4
votes
2
answers
3k
views
How exactly are registration authorities related to certificate authorities?
In preparing for the CISSP exam, the course material seems to emphasize a distinct role between a Certificate Authority and a Registration Authority. As per the study guide description:
...
- 3,498
0
votes
1
answer
541
views
Clarification on "data hiding" and how it applies to hardware?
I'm studying for the CISSP exam and one of the practice questions in my study guide has me a bit confused. The question is:
Which of the following is NOT considered an example of data hiding?
A. ...
- 3,498
1
vote
0
answers
390
views
What's a practical example of "declassification"?
I'm studying for the CISSP exam and trying to wrap my mind around the term "declassification". Can someone provide a practical example?
I get that declassification is necessary once "an asset no ...
- 3,498
0
votes
3
answers
208
views
What's the appropriate term for the digest output of various integrity hash and HMAC functions?
I've heard conflicting statements from various CISSP instructors, so I'd like some "real world" perspectives:
What is the appropriate terminology for the digest output of the following ...
- 3,498
3
votes
3
answers
23k
views
What's the difference between "Due Care" and "Due Diligence"?
Can someone please explain the difference between "due care" and "due diligence"? They seem very similar to one another and after researching more and more, I'm getting confused.
One tech book ...
- 3,498
-1
votes
2
answers
484
views
What is the ideal and realistic(affordable) career path to a Cyber Security expert? [closed]
I'm a graduating university student taking up BS Computer Science with a specialization in Network Engineering, so I'm currently immersed in CCNA and am about to take the cert exam this month.
I've ...
1
vote
1
answer
354
views
The benefits of CISSP Training for a Java developer [closed]
I am currently a Java developer and content with what I make. My company currently offers a 7 Day CISSP training and I am not sure, whether to take this training.
What benefits can I benefit by ...
- 115
3
votes
1
answer
317
views
Administrative recovery control mentions antivirus - error?
I am reading through Version 7 of the CISSP study guide and stumbled on a possible error. It mentions - in the administrative controls section - that Recovery is a subset/alternate version of ...
- 617
0
votes
1
answer
123
views
Why don't terminal IDs prevent unauthorized entery?
I'm studying for CISSP and had gotten this question wrong. I also found it and the correct answer online, but still don't understand the reasoning.
Source
Which of the following controls is not ...
- 10.2k
6
votes
5
answers
22k
views
difference between need to know, least privilege and confidential
I'm studying for CISSP. Is least privilege, need to know and confidentiality all the same thing?
In my book it says "confidentiality is sometimes referred to as the principle of least privilege" and ...
- 10.2k
8
votes
1
answer
5k
views
What is collusion and how does seperation of duties prevent it, or fail to prevent it?
I'm studying for CISSP and came across the term "collusion". I understand it means when people work together to steal something, but don't quite get it. For example, if two gunmen rob a bank would ...
- 10.2k
2
votes
3
answers
348
views
Confusing definitions of "parasitic virus" and "worm"
I was studying for CISSP certification when I came across the question "what type of virus attaches itself to an executable?" The answer was "parasitic". I find terms relating to viruses and malware ...
- 10.2k
55
votes
9
answers
8k
views
Why would security cover things like natural disasters?
I'm taking a course which is designed with the CISSP certification in mind. Though the class is categorized as software engineering, we talked a lot about physical security and, in particular, floods, ...
- 10.2k
2
votes
1
answer
847
views
CISSP Cert: can an IT sales pro pursue CISSP? [closed]
I am a sales and product professional who has a total of 9 years experience in IT; related to selling products indirectly or directly. I started my career working as a product manager for hardware ...
- 21
0
votes
1
answer
733
views
Is there a great cheap or free site for the CISSP exam? [closed]
CCCure is not free and many others that are recommended on the site are not free....any suggestions?
- 1
2
votes
2
answers
2k
views
Smart cards and firewalls are what type of access control?
Specifically for the CISSP, trying to figure out what type of access control these would be considered.
- 21
4
votes
3
answers
1k
views
Vulnerability or Threat?
I have a practice question here:
A business is going to determine the dangers to which it is exposed. What do we call a possible
event that can have a disruptive effect on the reliability of ...
- 51
0
votes
2
answers
1k
views
Is there a "classic" information security textbook? [closed]
Much in the same way compilers has the dragon book, algorithms has the Cormen, and graphics has Foley & van Dam I am wondering what the book on computer security is. Not the "best" book, or the ...
- 224
6
votes
3
answers
2k
views
Is SESAME really used in Europe?
I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
- 1,932
1
vote
0
answers
99
views
Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?
I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information.
My question is simple:
Does using of API ...
- 119
0
votes
2
answers
2k
views
Is CISSP suitable for a Java architect? [closed]
I am a tech lead developing web (Java/JEE) and mobile applications (Android) for the past 12 years (mobile in last year though). I am somehow interested in IT security.
Is it worth taking CISSP or ...
- 29
3
votes
0
answers
128
views
Suggested books to study for CISSP? [duplicate]
Possible Duplicate:
Good (preferably free) resource for CISSP practice questions
I intend to study to take the CISSP exam within the next few months. Could anyone who's taken the CISSP please ...
- 2,379
2
votes
1
answer
869
views
CISSP Certification [duplicate]
Possible Duplicate:
Good (preferably free) resource for CISSP practice questions
I am currently reviewing and aiming for a CISSP certification on the fourth quarter of this year. I've been ...
- 633
4
votes
6
answers
3k
views
Information Security Career tracks - Academically vs. IT certifications
I will try to be as straightforward as possible here.
I am currently working as a security integrator at an integration company.
I work with products of vendors like Check Point, Cisco, Juniper, HP, ...
- 1,560
2
votes
2
answers
710
views
Legal Risk to unpatched servers
Since one of the 10 domains on the CISSP is legal/governance, I figured this would be the best place to ask.
I recently did a security assessment for a non-profit. I found that their systems needed ...
- 686
1
vote
0
answers
364
views
Best way to get "into the security industry"? [duplicate]
Possible Duplicate:
What are the career paths in the computer security field?
I've been called a "jack of all trades" guy, who has been working in health care and finance for about seven years. ...
- 343
3
votes
3
answers
945
views
How do I clearly distinguish between groups of formal and informal models?
I'm currently studying for the CISSP exam and would like to ensure that I'm using proper terminology when referring to models. I'm a little confused because I'm coming across generic and specific ...
- 3,498
8
votes
1
answer
2k
views
What is a practical example of an action that violates the non-interference model?
I'm studying the non-interference model as part of CISSP prep and am having trouble thinking of a practical example where a violation would be involved (and the consequences of those violations).
I ...
- 3,498
5
votes
2
answers
269
views
Is it correct to consider audits as exclusively "detective" in nature?
I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...
- 3,498
6
votes
1
answer
3k
views
Is it correct to consider Task Based Access Control as a type of RBAC?
I'm studying for CISSP certification and one of the video lectures I viewed (CBT Nuggets) really confused me. Here are some excerpts from the lecture:
"Role Based Access Control doesn't
always ...
- 3,498
9
votes
3
answers
8k
views
Why does the ★-property rule of the Bell-LaPadula Model allow information to be stored in objects with HIGHER sensitivity labels?
I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-LaPadula Model. I understand the mechanics of it and that ...
- 3,498
19
votes
7
answers
23k
views
How useful is CISSP to a recent graduate?
I am a recent graduate and would like to move into the IT Security field. My degree was just straight CS with no particular security focus.
I have recently acquired a copy of a CISSP study guide and ...
- 345
24
votes
9
answers
27k
views
Good (preferably free) resource for CISSP practice questions
I'm looking to sit for my exam in a few weeks, and I want to have a good set of practice tests to bounce against and make sure that I'm up to par with the types of questions that will be asked.
- 38.6k